v0.1.0-beta.1

Container image published to GHCR — SBOM + SLSA provenance attested, cosign-signed:

ghcr.io/icebergai/iceberg-ttx:0.1.0-beta.1

Pull, verify (cosign / attestation), and deploy instructions: docs/RELEASING.md.

What's Changed

• Platform polish, samples, and role preview by @Scriptception in #1
• [codex] Polish shell navigation and preview UX by @general-grivas in #2
• [codex] Add exercise-scoped group injects by @general-grivas in #3
• [codex] Improve exercise communications workflow by @general-grivas in #4
• [codex] Redesign scenario editor builder by @general-grivas in #5
• [codex] Add linear inject flows and team comments by @general-grivas in #6
• Document Phase 15: linear inject flows + team comments by @richardmhope in #7
• Clean up lint/security findings; add bandit + vulture config by @richardmhope in #26
• Security hardening: P0/P1 auth fixes + audit logging (#8 #9 #10 #11 #23) by @richardmhope in #27
• Async DB migration (asyncpg/AsyncSession), Postgres-only, + skill alignment by @richardmhope in #29
• Clear tech-debt backlog: Alembic, logging, task lifecycle, DRY, cycle-detection by @richardmhope in #33
• Hoist unnecessary function-local imports to module top by @richardmhope in #34
• Rename project from Deep Thought to IcebergTTX by @richardmhope in #41
• Fix README CI badge URL after repo rename by @richardmhope in #42
• Fix WebSocket DB-pool exhaustion (#35) and observer broadcasts (#38) by @richardmhope in #43
• Fix scenario/inject/comm correctness (#37, #39, #40) by @richardmhope in #44
• Add Apache-2.0 license, project metadata, and repo hygiene by @richardmhope in #45
• Fix README async promote snippet and stale DB comment by @richardmhope in #48
• Bump actions/setup-python from 5 to 6 by @dependabot[bot] in #47
• Bump actions/checkout from 4 to 7 by @dependabot[bot] in #46
• Restyle UI to the shared Iceberg design system by @richardmhope in #50
• Security hardening P2 (#13, #14, #15, #16) by @richardmhope in #51
• Refactor: dedupe exercise→scenario→definition resolution (code smell #1) by @richardmhope in #52
• Refactor: resolve code smells #2–#8 (batched) by @richardmhope in #53
• Perf: bound rate-limiter memory (#49) + memoise scenario parse (#22) by @richardmhope in #54
• Swap python-jose for PyJWT by @richardmhope in #55
• Replace hand-rolled cycle detection with stdlib graphlib by @richardmhope in #56
• Trust X-Forwarded-For only from the proxy via uvicorn (fixes #36) by @richardmhope in #57
• Store small list columns as native JSONB by @richardmhope in #58
• CI: pin GitHub Actions to commit SHAs (CICD-SEC-3) by @richardmhope in #59
• Harden container/k8s IaC (PSS restricted, TLS, NetworkPolicy) by @richardmhope in #60
• Run tests in parallel with pytest-xdist (-n auto) by @richardmhope in #62
• Scope facilitator access per-exercise via ownership (#12) by @richardmhope in #63
• Ship audit events to a SIEM (#24) by @richardmhope in #64
• Beta readiness: admin bootstrap CLI, self-hosted Alpine + CSP, SECURITY.md scope by @richardmhope in #76
• Ignore unknown .env keys (fix local dev crash on shared compose/app .env) by @richardmhope in #78
• Run bandit + pip-audit in CI (closes #72) by @richardmhope in #79
• Lint the workflows in CI with zizmor + actionlint (closes #81) by @richardmhope in #83
• Strict CSP: @alpinejs/csp build + app-level security headers (closes #77) by @richardmhope in #84
• Add OIDC/SSO authentication (Entra, Okta, Auth0, Authentik) (#25) by @richardmhope in #85
• Add DB-aware readiness probe; keep liveness DB-free (closes #71) by @richardmhope in #86
• Add community-health files and backup/restore docs by @richardmhope in #87
• Replace nginx with Caddy; authenticate WebSockets via cookie (closes #68) by @richardmhope in #88
• Registration controls: REGISTRATION_ENABLED toggle + rate limit (closes #67) by @richardmhope in #89
• Add Zensical GitHub Pages site (Iceberg-styled) by @richardmhope in #90
• Add CodeQL analysis workflow (closes #80) by @richardmhope in #91
• Fix website correctness + hero button contrast in light mode by @richardmhope in #92
• Pluggable AI providers: Anthropic, Bedrock, OpenAI, Ollama, Gemini (#26) by @richardmhope in #93
• Fix caddy booboo by @richardmhope in #94
• Update readme with deprecated local install by @richardmhope in #95
• Tidy up old files by @richardmhope in #98
• Outbound HTTP proxy for LLM, SIEM and OIDC egress (#97) by @richardmhope in #99
• Show every active exercise; stop guessing which one is "live" (#96) by @richardmhope in #100
• Docs: update test count to 392 after #96 by @richardmhope in #101
• Admin-driven password reset (#66) by @richardmhope in #102
• Adopt uv + lockfile for reproducible builds (#73) by @richardmhope in #103
• Single-source the version from package metadata (#73) by @richardmhope in #107
• Release workflow + GHCR publish + versioning docs (#73) by @richardmhope in #108

New Contributors

• @Scriptception made their first contribution in #1
• @general-grivas made their first contribution in #2
• @richardmhope made their first contribution in #7
• @dependabot[bot] made their first contribution in #47

Full Changelog: https://github.com/IcebergAI/IcebergTTX/commits/v0.1.0-beta.1