v0.6.4

Inherited baseline rules, visible where you edit

Each tenant's Rules draft tab now shows the instance baseline delta in a collapsed read-only inherited panel above the editor: the summary line carries the counts (exclusion patterns, trusted login patterns, suppressed ids, added indicators), and expanding it shows the full patterns in grayed blocks. Operators editing a tenant see what already applies beneath the draft without switching to the Settings page. The baseline rides along on the tenant detail response (baseline, null when none is configured).

Check-default branding opt-out now covers the color

Use Check's default logo becomes Use Check's default logo and color: while a tenant is opted out, artifact generation also pins primaryColor to Check's default #F77F00, beating both the tenant's stored color and the instance default. The stored color is kept, not cleared, so lifting the opt-out restores it. The button is also offered on the Branding tab regardless of whether an instance default logo exists (previously it was hidden when the choice was a no-op today, which read as a missing feature -- opting out also pins the tenant against defaults added later).

GPO deployment quality-of-life

• Export-CheckGpoConfig.ps1 is downloadable from the onboarding wizard. The GPO-migration helper is bundled into the Worker and served behind the operator gate, so the adopt-config panel links it directly instead of pointing at the repo.
• The generated GPO install script retries while SYSVOL settles. New-GPO can return before the new GPO's SYSVOL folder permissions have propagated, so the first Set-GPRegistryValue could die with access denied (hit on a real DC). All registry writes now retry access-denied briefly (5 attempts, 3 seconds apart) before treating it as real; other errors still fail fast. Download a fresh copy from the Artifacts tab to pick this up.

Documentation

Refreshed the tenant Rules and Branding screenshots, the runbook (baseline visibility, Check-default branding, GPO migration download), and the full GitNexus wiki.

Upgrading

From a deploy-button copy, run the Sync upstream workflow from the Actions tab, or git pull and npm run deploy. No new D1 migration in this release (if you are coming from v0.6.2 or earlier, the deploy applies v0.6.3's 0002_use_default_logo.sql automatically). No workflow-file changes.

Full changelog: v0.6.3...v0.6.4