v1.0.0

v1.0.0: the GMS/GAA portal, the eRegister, the alert impact matrix and safer sign-in

First tagged release since v0.31 (a planned v0.32 was never published). Everything below has been running on staging.

Weather service (GMS and GAA)

• Alerts: GMS alerts are now green only. Yellow, orange and red are CAP warnings, started
  from a Raise to warning button that opens a pre-filled CAP draft. A repeat raise opens the
  existing warning instead of creating a second one.
• Forecasts and outlook: forecast weather types and wider portal pages; the tropical outlook
  moved under Forecasts with each storm tracked as its own system; NHC data is downloaded by hand.
• Staff portal: portal tabs and headers, friendlier PDF names, GMS website polish and an
  outlook feed.
• Notifications: each person chooses the bell and the email for every event. Urgent events
  always reach the bell and repeats fold into one notification. New time-based alerts: forecast
  overdue, warning expiring, missing hourly observation, failed sends, queries and new NHC products.

eRegister (hourly observations)

• Observation store and a publish gate so each station-hour is published by exactly one source.
• Optional review, corrections (rejecting a correction restores the original), verification rules,
  hour-to-hour warnings and a METAR cross-check; pressures and humidity are calculated.
• Station 78958 is now entered by hand every hour.

HR

• Phone clock-in punches wait for a supervisor's approval; one rule decides who may review, also
  after a department transfer. A supervisor needs a review role in the punch's own organisation.
• A "Returned" status for forms.

Accounts and security

• One permission list for API keys; verified email is needed for money and power.
• Organisation-bound permissions, membership grants and team management.
• Exact sign-in return addresses and reserved names.
• Superusers need an authenticator by default outside local development. Deployments keep this
  off (AUTH_PRIVILEGED_MFA_MODE defaults to disabled) until you switch it on.

Bookings and Events (both paused products)

• Public booking flow, studio screens and deposits; paid tickets, organiser orders and refunds.
  Payments stay off in production until Stripe secrets are set.

Platform and deployment

• A pre-migration backup gate (warns by default); web apps call the API on the internal network.
• admin.barrels.gd becomes the Barrels staff console and the GMS/GAA portal moves to
  gms.barrels.gd.
• Recovery when the network subnet changes; CSP report-only on docs and signal.
• Dependency and security updates (FastAPI 0.161, Pillow 13, brotlicffi, filelock and others).

Alert impact matrix, stations and PDFs (new since the planned v0.32)

• Impact matrix: alerts use the WMO 4x4 likelihood-by-impact grid with a suggested colour. A forecaster can override it with a reason (10 or more characters); the reason stays internal and is never in published XML, public JSON or feeds. New permission cap.library.manage controls the hazard library editor.
• Station registry: list, add and edit stations in the eRegister (API only for now; station 78958 can only be renamed).
• PDFs: every server-made PDF now sends the same safe headers and file names; HR form previews share one component with the forecast preview.
• Security fixes: patched dnspython and msgpack in the API image.

Before you deploy

1. The production secret BARRELS_ADMIN_SSO_CLIENT_SECRET is set.
2. The deploy checks the latest database backup before migrations.
3. After deploy: API health, then sign in to each portal.