v0.1.0

0.1.0 (2026-10-20)

Features

• a forgotten password is reset through a mailed link (#95) (7090346)
• a Tokens page, as the design canvas drew it, with the Launcher's warning (#64) (3aa172f)
• a User changes their email through a link mailed to the new address (#93) (7323e75)
• a User deletes their account (#94) (f5a693f)
• Admins assign Groups to App Roles, and tokens carry only that Client's roles (#35) (6fbe553)
• an admin dashboard and Audit page, as the design canvas drew them (#61) (bf7deae)
• an Admin gives a person a role directly, on the person page (#90) (6c608fa)
• Devices, where a User is signed in, each signed out on its own (#92) (bb11762)
• import Legacy Auth's people once (#99) (9b07a6c)
• Machine Identities sign in by token exchange or client credentials (#100) (adecad6)
• make the first Admin, list who waits for a Group, and alert on them (#40) (43705f3)
• MCP clients connect as Connected Apps, with consent, rotating tokens and the Gate (#101) (909bc6f)
• Personal Tokens, minted per Client and checked by introspection (#62) (e8360f9)
• read Clients from the cluster's Client objects (#33) (fd7ff62)
• record Audit Events for sign-ins and changes to Users, Groups and Assignments (#60) (8a3cac7)
• Secret Clients get their secret from identity in Vault KV, and Admins rotate it (#66) (0c230a2)
• sign a User in to a Client over OIDC (#31) (72deeb8)
• sign in with a passkey as the Second Factor (#42) (dcec1a1), closes #16
• sign in with an authenticator app, which Admins must use (#41) (bb078ea)
• sign out everywhere, with back-channel logout and an Admin's force sign-out (#44) (b79b83c)
• sign up, confirm by mail, sign in and edit the Profile (#28) (6488870)
• sign Users in to gated apps through the Gate, one host at a time (#43) (b37ab8a)
• signing keys survive restarts, sealed by Vault transit, and rotate every 90 days (#65) (1ab786c)
• step-up, an Admin's per-app window for a fresh two-factor proof (#91) (e77f82c)
• task dev runs a seeded identity, with a dev-only code 000000 (#73) (b5943fc)
• the Gate takes Personal Tokens on gated and token hosts (#63) (2088553)
• the Launcher shows a User's apps, with icons served from identity (#46) (4bb9bad)
• the redesigned UI, on the G2 design system (#74) (55cfc19)
• tools revoke their own tokens, and Connected Apps settle the review's open items (#103) (0731be0)
• Two-factor Groups, step-up without tokens or on the Gate, and Admin person edits (#96) (b4b2a0a)

Bug Fixes

• a tool revoking its token always revokes the token it sent (#121) (2126888), closes #120
• import no role for a retired KNOWLEDGE_API grant (#122) (67af5e9)
• publish the local stack's ports below the ephemeral range (#47) (4e909b8)
• review findings on Connected Apps, refresh tokens and imported passwords (#102) (8aadcca)
• say plainly what happened and what to do next (#39) (1ae4b24)