Portal v0.41.0 — Role and scope changes take effect immediately

Role and scope changes now take effect in open web sessions immediately. Changing a member's role, runner access, or pack access reconnects the session before it can keep acting on stale authority.

Runner and pack scopes govern current discovery, targeting, and new work. Run and audit history remains available to roles allowed to read it, including the runner and pack names needed to investigate what happened.

Security and access

• Billing managers get a finance-only console, while operators can own agents, approvals, and runbooks without gaining team or policy administration.
• Scoped admins cannot delegate more reach than they hold or arm account-wide pack cleanup.
• Reads that expose every pack version or an exact run command now require a checked subject instead of relying on already-filtered callers.
• The read-only staff console requires MFA proof tied to the current enrollment.

Console

• Navigation, actions, filters, and empty states now follow the member's role and access. Billing managers no longer see a dead Dashboard link, and no runner access is explained as a permission state rather than onboarding.
• Restricted pack and action views explain why results are limited.
• SSO group mappings paginate in both directions.
• Compact grouped filters are back; timestamp and source tooltips flip away from viewport edges; action menus close on Escape and outside clicks across app and marketing pages.

Packs

• The catalog now carries 100 packs and 1,689 actions.
• Consul can snapshot registration churn, and the debugging pack adds bounded process context, environment-key, argv, and connection reads.
• GCP Monitoring adds Cloud Logging name and entry reads.
• HCP Terraform plan summaries expose replacement paths.

Component releases

• Runner v0.20.1 and MCP Bridge v0.7.1 rebuild the existing component behavior with Go 1.26.6 for the current standard-library advisory batch.