v0.5.0 - fleet mode, signed self-update

The first release since the serverwatch rename, and the biggest yet: fleet
mode (master/child, phases 1-3 -- replication and local fallback, a full
alerting/incidents/routing engine, and a fleet web UI), signed releases with
a maintainer-verified, self-rolling-back update path, and a round of web UI
polish, all documented in a new security chapter.
Releases are Linux-only from this version on; v0.4.1 was the last to also
ship macOS (darwin) binaries. The license also changes, see below.

Added

• Fleet mode (master/child), phase 1. A master enrolls children with a
  one-line join code that pins its CA (no trust-on-first-use); children then
  talk to it over mutual TLS with 90-day client certificates that renew
  themselves, and can be revoked. Each child spools a copy of its samples, down
  events and alert log into a durable, capped outbox and ships it to the
  master, which keeps a per-node replica. A master outage loses nothing: the
  backlog drains in order when it returns, and if the outbox cap was hit the
  dropped range is rebuilt from the child's local store before newer data is
  sent. The master raises node-down alerts (folded into one fleet-connectivity
  alert when most of the fleet drops at once); a child warns locally when its
  link has been down for ten minutes.
• trinetra fleet commands: init, join, leave, disable,
  status, nodes, node revoke|rename|tag, and token create|list|delete.
  See the command reference.
• Config keys fleet.listen (default :9443), fleet.outbox_max_mb
  (default 512) and fleet.node_down_after (default 2m). The role and
  identity keys are managed by trinetra fleet and refused by config set.
• Control socket: requests take an optional node to read a remote node's
  replica through the same methods, plus new Fleet.* methods for fleet
  management. Both are backward compatible: requests without node behave as
  before.
• Fleet mode, phases 2 and 3: fleet alerting and the fleet web UI. The
  master now decides delivery for the whole fleet instead of just relaying
  node-down alerts. A child holding a valid lease routes its firing alerts to
  the master instead of delivering them itself, and falls back to local
  delivery (prefixed "via local fallback") if no receipt arrives within
  fleet.fallback_after or the lease expires -- at-least-once, deduplicated
  by (node, alert key, fired_at), never doubled up. On the master, every
  alert runs through a full pipeline -- silence, dependency fold, grouping,
  routing, escalation, delivery, receipt -- all recorded and explainable with
  fleet explain. New: ordered routes with matchers and continue fan-out
  to several escalation policies at once; multi-step escalation policies with
  repeat_every; silences and recurring maintenance windows (matched by tag,
  node name-glob-or-id, rule, and severity, and pushed to children so local
  fallback honours them too); incident grouping and dependency folding;
  fixed-grammar aggregate rules (count, avg/max/min, online,
  absent) evaluated fleet-wide on the master; and managed config, a closed
  10-key allowlist a master can push to children by tag, read-only locally
  and re-imposed on every apply. The master's Telegram messages gain Ack and
  Silence-1h inline buttons on incident fire notifications. New trinetra fleet subcommands: incidents, incident, ack, explain, silence add|list|expire, maintenance add|list|delete, route test, alerting show|apply, rules, managed list|set|delete|status, and node depends.
  New config keys fleet.fallback_after (default 2m) and
  fleet.link_down_warn_after (default 10m), both child-only and
  live-applied. See Fleet
  alerting.
• The fleet web UI. Every existing page is now also reachable per node
  under /n/{id}/..., with a replica banner and a stale-data indicator for
  remote pages, a top-bar node switcher, and a Ctrl/Cmd-K fuzzy palette
  (recent nodes, and a "web1 history"-style page-type jump). /fleet gains a
  health strip, a heatmap, top-N panels, a sortable/filterable live node
  table, and a compare view (up to 10 nodes, or an aggregate, one metric
  overlaid). New admin pages: /fleet/admin (tokens, node rename/tags/
  dependencies/revoke/remove, link health), /fleet/incidents (list and
  timeline, with ack/silence), /fleet/alerting (routes/policies/rules
  editor plus a route tester), /fleet/silences (silences and maintenance
  windows, times shown in the master's own local zone), /fleet/managed
  (managed-config fragments and per-node drift), and /fleet/audit (every
  fleet mutation, who and when). Remote-node actions (ack/unack, container
  logs) work whenever that node is currently connected, and are disabled
  with a reason when it isn't. See The web
  UI.
• Signed self-update. trinetra update status|check|apply|rollback
  fetches, independently verifies (CI signature + maintainer co-signature
  over a manifest of exact file hashes), stages, smoke-tests and swaps in a
  new release, then launches a guarded restart that confirms the new build
  is healthy within 90s or automatically rolls back and marks the version
  bad. trinetra install --require-signed runs the same signature check for
  the initial install. New config keys update.channel (default stable),
  update.source (default github), update.github_token, and
  update.check_interval (default 24h); the daemon checks on that cadence
  and alerts when an update becomes available, commits, or rolls back.
  Releases are Linux-only: from this release on, macOS (darwin) binaries
  are dropped (v0.4.1, as serverwatch, was the last release to ship them).
  Maintainer tooling (cmd/trinetra-release) and the key ceremony/release
  process are documented in Operations: Release keys and releasing.
  See Operations: Updating.

Changed

• Renamed to Trinetra. serverwatch is now Trinetra ("Sees what you
  can't."): module github.com/InfoDiveLabs/trinetra, binaries trinetra,
  trinetra-ctl, trinetra-web, paths /etc/trinetra, /var/lib/trinetra,
  /run/trinetra, and the trinetra.service unit. The web UI, TUI, and
  notifications carry the new Trinetra visual identity. The GitHub repo moves
  to InfoDiveLabs/trinetra (the old Suraj-Tiwari/server-monitor URLs
  redirect).
  • Upgrade: download trinetra and the plugins you use
    (trinetra-ctl, trinetra-web) into one directory, then run the one
    command you already know, sudo trinetra install. On a host with an existing serverwatch install it detects it
    and migrates in place before the normal install runs: it stops and
    disables serverwatch.service, moves /etc/serverwatch →
    /etc/trinetra and /var/lib/serverwatch → /var/lib/trinetra (an
    atomic rename, or a byte-verified copy when the two are on different
    filesystems, so nothing is deleted before its replacement is proven in
    place), rewrites any config paths that pointed inside the old
    directories, then removes the old unit and plugin binaries (a drop-in
    override dir for the old unit, if any, is left in place with a note) and
    replaces /usr/local/bin/serverwatch with a compat symlink to
    trinetra; /usr/bin/serverwatch is deliberately left pointing at it
    rather than redirected or removed, so sudo serverwatch ... still
    resolves via secure_path on distros that omit /usr/local/bin. Both
    compat names are kept for one release, with a deprecation notice on use.
    It refuses rather
    than merges if both a serverwatch install and existing trinetra data are
    present, or a legacy directory is unexpectedly empty (likely an
    unmounted volume); --state-already-at-new-path adopts a state volume
    you moved yourself, --force proceeds past a serverwatch.service
    systemd could not confirm was stopped or a serverwatch daemon still
    running outside it (found through its pid file). An old plugin with no
    trinetra-ctl/trinetra-web counterpart next to trinetra is named in
    a WARNING: line of the summary. Until install has run, trinetra daemon and the config- and state-writing CLI commands refuse on a host
    that has only a serverwatch install, instead of starting empty. A
    /var/lib/trinetra/migrated-from-serverwatch marker records the
    migration; the whole thing is idempotent and resumable, and every stop
    point explains how to finish or roll back by hand. See Upgrading from a
    serverwatch install.
  • Kept on purpose: the web cookie names sw_session/sw_enroll/sw_login
    (renaming them would log every user out); the WebAuthn RP ID/origin
    handling (config-driven, bound into existing passkeys); config JSON keys;
    plugins.json key names; the control.sock/token file names inside the
    runtime dir; the /usr/local/bin/serverwatch → trinetra compat symlink
    and the /usr/bin/serverwatch link that keeps pointing at it (both
    removed in the next release); the
    SERVERWATCH_CONTROL_SOCKET/TOKEN environment fallback (also removed in
    the next release); and the literal "serverwatch-control" control-socket
    handshake magic string. Fleet certificates already issued under a
    serverwatch install keep their old subject names: the CA's Organization
    "serverwatch fleet" and the master certificate's CN "serverwatch fleet master" (cosmetic, nothing verifies them, left as is). Newly issued ones
    use "trinetra fleet" and "trinetra fleet master".

License

• License change: from this release on, Trinetra is licensed under the
  Functional Source License 1.1, ALv2 Future License (FSL-1.1-ALv2),
  © 2026 InfoDive Labs Pvt Ltd: free to use, self-host and modify for any purpose
  except a competing commercial product or service, and each release becomes
  Apache-2.0 two years after it is published. Releases up to v0.4.1 (published as
  serverwatch) stay MIT.

Unchanged

• Solo installs (no fleet.role, the default) run no fleet code, open no
  listener and create no fleet directories.

Verifying this release

Every binary is listed with its SHA-256 in manifest.json, which carries two independent Ed25519 signatures: manifest.ci.sig (made by CI) and manifest.maint.sig (the maintainer's offline co-signature). trinetra update and trinetra install --require-signed check both before anything runs. Binaries also carry a GitHub build-provenance attestation:

gh attestation verify trinetra-linux-amd64 --repo InfoDiveLabs/trinetra

For manual verification with only openssl and sha256sum, see Verify a download yourself.