v0.4.4

What's Changed

• Polish KyYard interface while preserving controls and settings by @Yoshiofthewire in #134
• fix: forward server settings via .env.server; hide environment controls from roles the server refuses by @Yoshiofthewire in #133
• docs: clarify standalone installation and test coverage by @Yoshiofthewire in #135
• Support pinned container proxy networking by @Yoshiofthewire in #136
• chore(ci): bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 in the actions group by @dependabot[bot] in #138
• Shorten README and organize documentation by topic by @Yoshiofthewire in #137
• Add MCP endpoint for AI agents (read-only by default, opt-in operator) by @Yoshiofthewire in #139
• test: use example.com for the Dashboard target name by @Yoshiofthewire in #140
• Fix KyYard bugs found while filming the launch videos by @Yoshiofthewire in #144
• Release Dependabot changes daily as vX.Y.Z.N by @Yoshiofthewire in #145
• fix(compat): tidy after ky-primitives replace; bump x/crypto to v0.58.0 by @Yoshiofthewire in #146
• release: v0.4.4 by @Yoshiofthewire in #147
• fix: two timing flakes (agent ledger replay test, expired inspection grant) by @Yoshiofthewire in #148

Full Changelog: v0.4.3...v0.4.4

v0.4.3

What's Changed

• fix(kubernetes): follow controllers of any kind in the installer-owner walk by @Yoshiofthewire in #125
• docs: verify release images against the release-image.yml signer by @Yoshiofthewire in #126
• chore(deps): bump postgres from 17-alpine to 18-alpine by @dependabot[bot] in #123
• chore(deps): bump golang.org/x/term from 0.46.0 to 0.47.0 in the go group by @dependabot[bot] in #124
• feat: Suite page driving the KyQuickStart suite runner by @Yoshiofthewire in #127
• fix(web): keep Suite app names and row actions on one line by @Yoshiofthewire in #128
• fix(suite): send the no-backup acknowledgement on install by @Yoshiofthewire in #129
• build(web): rebuild web/dist after #128 and #129 by @Yoshiofthewire in #130
• fix(sso): read app roles from KyIdentity's roles claim by @Yoshiofthewire in #131
• chore(release): 0.4.3 by @Yoshiofthewire in #132

Full Changelog: v0.4.2...v0.4.3

v0.4.2

First published KyYard release. Image: ghcr.io/busnes-app/kyyard:0.4.2 (attested by release-image.yml at this tag).

Upgrading

• Upgrade the server first, then every agent container. An agent upgraded ahead of its server refuses deployments and every container with a mount until the server catches up.
• The server now runs as uid 10001, not root. The first start chowns the data volume or ./data. Run apply-setup and other in-container commands with --user kyyard.
• On first start this release deletes the retired SCIM group tables (groups, group_members). Back up the database first if you want that data.
• Usernames are unique ignoring case. If two accounts differ only by case the server refuses to start and names them; see README → Upgrading.
• KY_SSO_AUTO_PROVISION now defaults to off.
• If KY_IMAGE still names ghcr.io/busness-app, re-pin it: that namespace is no longer controlled by this project.

Changes

• Installer support: KyQuickStart-managed workloads are labelled, and KyYard refuses generic edits, exec and delete on them. Unattended apply-setup for installer sign-on.
• Security: the agent protocol now has the server prove its identity, bound to a fresh agent nonce, before the agent signs.
• Security: login is throttled per username and no longer reveals which accounts exist; a known browser can escape a stranger's login backoff. Self-service account budgets are charged on the account limiter.
• Security: self-service MFA enrolment and password change (Settings → Security). init-admin also clears MFA with the password reset.
• Security: image pulls, recreates, runs and application plans are held to the registry rules, including the registry host of digest references. Deploys that keep a host-backed volume or host bind on a new image are gated, and /etc binds are limited to a read-only allowlist.
• Security: KyYard's own container on the built-in Local Docker endpoint is protected, and removing an application there needs a platform administrator.
• Security: device pairing secrets are stored only as SHA-256; the bootstrap admin password stays out of logs and argv; the KySignOn webhook body is bounded before its signature is checked.
• Directory sync: each identity-provider event applies once, in order, in one transaction with its account change; removals always apply and loss of admin is audited.
• Kubernetes: deploys roll without downtime and keep the running config until they land; workload Secret references the workload does not already carry are refused; pod exec attach is bounded to 20 seconds.
• Docker: recreates are undone and rolled back on failure; stop waits keep the container's grace and no longer take every command slot.
• Removed the retired SCIM and device-pairing packages.