v0.7.0

Fixed

• A cluster-wide gauge was double-counted, reporting 8 nodes online on a 4-node cluster. 29 metric names are exported by both /cluster and /node, including minio_cluster_nodes_online_total, and the two endpoints were concatenated — so every aggregate over an overlapping name doubled. The merge now skips a (name, labels) series it has already absorbed, which cannot drop real data because two genuinely different series never share both. Measured on a real 4-node distributed MinIO.
• Per-drive and per-node listings say they cover one server. heal drives on that same 4-node cluster listed 1 drive and reported returned: 1, indistinguishable from "this deployment has one drive". heal drives and heal nodes now carry scope: "node", and drives additionally reports clusterDrivesOnline with a note when the deployment has more drives than the queried server can see.
• Heal counters are ints. healObjectsScanned, healObjectsHealed, healBacklogObjects, healErrors and clusterHealthStatus rendered as floats (4.0 objects scanned) while drivesOffline in the same payload was an int.
• undo apply replays against the target the original write ran on. It dispatched the inverse against whatever target the caller named — in practice the config's first entry — while the write's own target sat unused in the undo record. On a multi-target config the inverse therefore ran against the wrong host; it only looks harmless because the resource usually is not there, but two hosts holding the same name and the inverse succeeds on the wrong one, silently. An explicitly named target still wins. Line-wide: all 24 copies had the identical defect. Caught live in container-host-aiops, where a stop recorded against a Podman target replayed against a Portainer one.

v0.6.0

Changed (BREAKING)

• Requires MCP SDK 2.0 (mcp[cli]>=2.0,<3.0). mcp.server.fastmcp no longer exists in 2.0; the server is now built with MCPServer and reports its package version in the stdio handshake.

Fixed

• undo apply works from the CLI. Every write tool is imported lazily inside its own CLI command, so a CLI-driven undo ran in a process where the inverse tool was never registered and failed with "inverse tool is not registered" — for every write tool. Only the MCP entry point, which imports the whole server, worked. Found while live-verifying against a real cluster.
• An undetermined outcome is audited unknown, not ok. The harness only classified a result as undetermined when the payload also carried an error key, so a write that looked successful but had not been confirmed was recorded as a success.
• as_int no longer round-trips integers through float64, which cannot represent values above 2**53 exactly. A line-wide sweep found only one of six vendored copies had actually been fixed after the original precision bug. A bool is treated as non-numeric (None, matching this tool's unknown-vs-zero contract) rather than being returned unchanged — bool subclasses int.

v0.5.0

Release notes — minio-aiops 0.5.0

Previous release: 0.4.0.

BREAKING — the authorization layer is removed

This tool no longer decides whether a write is permitted. Read-only mode
(<PREFIX>_READ_ONLY), the graduated-approval / approver gate, and the
rules.yaml deny engine are all gone. Whether an operation runs is the
agent's judgement, or the permission of the account you connect it with — point
it at a read-only credential and the write fails at the server, the place that
actually owns the permission.

What the tool guarantees instead is that nothing is silent: every operation,
over MCP and the CLI alike, lands a row in the audit log — there is no
unaudited entry point. Destructive writes still capture their before-state and
record an undo token where a clean inverse exists.

• If you set <PREFIX>_READ_ONLY=1, it now has no effect and the MCP server
  logs a warning at startup. Restrict writes via the connecting account instead.
• <PREFIX>_AUDIT_APPROVED_BY / <PREFIX>_AUDIT_RATIONALE still work, but are now
  optional audit annotations — recorded on the row when set, never required.
• The declared risk_level is carried into the audit row as a descriptive tier
  (a label, not a gate).

The governance harness is now: audit (MCP+CLI, unbypassable) · runaway/budget
safety guard · undo recording · output sanitize. policy.py is a small
risk-tier classifier; governance/readonly.py is deleted.

v0.4.0

Release notes — minio-aiops 0.4.0

Previous release: 0.3.0.

In this tool

• set_bucket_policy refuses a policy that denies this tool its own PutBucketPolicy. An explicit Deny beats any allow, so such a policy made its own undo un-appliable — and this tool has no IAM surface, so a bucket policy is the only way it can revoke its own access. (Only bites a non-root key; root bypasses policy evaluation.) set_lifecycle's docstring now says plainly that the rule is restored but expired objects are not.

Every tool in the line: previews and undetermined outcomes

This release fixes three harness defects that were silently degrading the audit
trail and the undo store.

A write that loses its response is no longer recorded as a failure. The
harness assumed a sanitized error meant nothing had happened. That assumption is
false in exactly the case that matters most: when a write severs its own
connection, the request has already landed, the response cannot come back, and
the operation was recorded as status=error with no undo token created at
all. Transport-level failures are now audited as status=unknown, the result
says plainly that the operation may have taken effect and should be verified
before retrying, and a write that stashed its before-state has its inverse
recorded anyway — flagged effectVerified: false, which undo_list and
undo_apply both surface. Existing undo.db files are migrated in place; their
rows read as verified, which is accurate, since the old code only ever recorded
on the confirmed path.

A dry-run no longer writes an undo token. Previews were recording inverses
built from a before-state they never had: the undo callback's permissive default
filled the gap with a guess, producing a real, applicable token for an operation
that never happened.

A dry-run no longer demands a named approver. Requiring an approval in order
to ask whether something needs approval inverts what a preview is for. The tier
is still computed and still audited, so the preview can tell you an approver
will be needed; it just no longer refuses to answer. The write itself is gated
exactly as before.

The invariant, now stated: a dry_run may read; it must never write. Guards
run on the preview path, which means a preview can and does report that an
operation would be refused.

Also line-wide

• Truncated text now ends in an ellipsis instead of being cut silently. This
  line already treats a silent cut as a defect for lists; it was doing exactly
  that to strings.
• Error messages are capped at 800 characters, not 300. These messages end
  with what to do instead, so the cap was removing the most useful sentence of
  every long refusal.

v0.3.0

Release notes — minio-aiops 0.3.0

Previous release: 0.2.1.

Fixed: only one of MinIO's three metrics endpoints was being scraped

MinIO splits its Prometheus exposition across /cluster, /node and /bucket, and
the metric names do not overlap. This package consumes 30 metric names and 12 of
them are absent from /cluster — every minio_node_drive_* (per-drive capacity),
every minio_heal_*, and every minio_bucket_usage_*.

The practical effect on a real server: heal drives returned an empty list, and
per-bucket capacity readers saw nothing. Confirmed against a live 4-drive erasure set.

metrics() now merges /cluster + /node (both required) and /bucket
(best-effort — some deployments disable it, and it is the expensive scrape on a
server with many buckets).

Fixed: drive_status reported a broken scrape as "no drives"

It caught every exception and returned [], so a failed metrics scrape was
indistinguishable from a healthy server with nothing to report. That is how the
bug above stayed invisible for the life of the tool.

BREAKING — drive_status now returns an envelope instead of a bare list:
{"drives": [...], "returned": N, "error": str | None}. A non-null error means
the scrape failed; do not read an empty list as "healthy, nothing to see".

Also

• Byte and object counts are integers again. Prometheus is float-typed on the wire,
  so these rendered as 1500000.0 / 3.0; absent values stay null rather than
  becoming 0.
• bucket_exposure_audit findings now carry an explicit 1-based rank. They were
  already ordered worst-first by riskScore; the priority is now stated in the
  payload instead of left implicit in list position.

Live-verified

Against a real 4-drive erasure set: the erasure-set analysis correctly reported
LOW_FAILURE_TOLERANCE (write quorum 3 of 4 — only one more drive may fail), the
exposure audit correctly scored an anonymously-writable bucket high, and the
governance loop (set_versioning → undo_apply restoring Suspended) closed on
the live server. See docs/VERIFICATION.md — multi-node
MinIO and real healing remain unverified.

v0.2.1

Release notes — minio-aiops 0.2.1

Previous release: 0.2.0.

Live-verified

No behaviour changes. This release records the first end-to-end run against a real
MinIO server: connectivity, the reads, the exposure audit (it correctly scored an
anonymously-writable bucket high and named PUBLIC_WRITE_POLICY with a concrete
remediation), the governance loop (real set_versioning → undo_apply restoring it to
Suspended, the correct S3 inverse), and read-only mode removing exactly the 8 bucket
writes plus undo_apply while leaving every read in place.

Documentation now states what is confirmed and what is not:
distributed / multi-node MinIO is still unverified — healing was never exercised
against a real degraded drive or erasure set — as are lifecycle/quota writes and TLS
endpoints. See docs/VERIFICATION.md.

v0.2.0

Release notes — minio-aiops 0.2.0

Previous release: 0.1.0.

Headline: read-only mode

export MINIO_READ_ONLY=1

With this set the 9 write tools are never registered — an MCP
client lists 22 tools instead of 31. The writes are not hidden
behind a flag and not merely refused on call: they are absent from the session,
so a model cannot invoke one and cannot be argued into one. For a reviewer this
is checkable rather than promised — connect, list the tools, and the writes are
not there.

Enforcement is two layers deep: the @governed_tool harness refuses every
non-read operation (covering the CLI and in-process callers too), and the MCP
server removes write tools from list_tools(). Changing entry point does not
get around it.

BREAKING — return shapes changed

This release changes payloads that callers may be parsing. Both changes exist
to stop a result from misrepresenting itself:

1. Absent fields are now null, not "". A missing value and an empty value
   were previously indistinguishable, which invited consumers to invent the
   difference. Keys are still always present — only the value may be null.
2. Anything with a limit now returns an envelope —
   {"<items>": [...], "returned": N, "limit": L, "truncated": bool}. Truncation is
   measured (one extra row is fetched), never inferred from the page happening to
   be full. Where a genuine pre-cap total is knowable it is reported as total;
   where it isn't, total is deliberately omitted rather than echoing returned.

Also in this release

• docs/VERIFICATION.md — what the mock suite actually guarantees, a live
  verification checklist, and the criteria for claiming this tool verified.
• skills/minio-aiops/references/agent-guardrails.md — for driving this tool with a
  smaller / local model: which guardrails are now enforced for you, and a
  ready-made system prompt for the rest.
• Expanded operator playbooks in the skill documentation.
• The advertised tool count now matches what an MCP client actually lists
  (it includes undo_list / undo_apply), and a release gate keeps it honest.
• The (preview) label has been dropped. It never meant unreleased; verification
  status now lives in docs/VERIFICATION.md where it can be specific.

v0.1.0

First release (preview). Governed AI-ops with the line's built-in audit + budget + undo + graduated-approval harness, secure-by-default. CLI + MCP server. See README for the support matrix and CHANGELOG for details.