0.18.0

v0.18.0

42 changes · 12 Bugfixes, 14 New Features, 7 New UI Features, 5 Chores, 4 Uncategorized · 253 points.

Bugfix

• RADD-822 field scope and field grants both say "project", so per-project restriction reads as missing _{access auth fields ux · 3 pts · 3c560737} Audit finding F12. A capability that exists but reads as missing is worth about as little as one that does not exist — and this one was reported as a suspected gap by the person who designed the system.
• RADD-810 ten client gates check a non-global atom globally, and nothing can tell _{auth ux web · 5 pts · 0aa40f32} RADD-808 fixed the Pages nav asking perms.global(page.read) for an atom that has been SPACE-scoped since RADD-791. A mechanical audit says it was not alone.
• RADD-824 nine manage atoms are never checked, and view.manage hides a button the API allows _{access auth ux · 5 pts · 12ecc7ce} Audit finding F13, from a direct question: does manage serve any real purpose? Measured rather than argued.
• RADD-840 search leaks read-restricted description text, and SLQ is a value oracle for restricted fields _{access ai fields search · 5 pts · 7bcdcadc} The corrected H3 (docs/specs/115-review/01-corrections.md §1). The audit worried about custom fields reaching the search index; they never do — search_index has four text columns (search/models.py:19-30), the indexer writes only those (indexer.py:81-87), and FieldDefinition.indexed is dead code. What IS live…
• RADD-839 five cross-project read leaks: timesheet, link/parent/epic hydration, SLQ autocomplete, rollup descendants _{access auth items timelogging · 5 pts · 9eb88ae6} Found by the spec-115 review (docs/specs/115-review/01-corrections.md §2): five readable_projects-level holes in the CURRENT model — live today, no relations involved. They belong in phase 0 beside RADD-834, both because they leak now and because fixing them builds exactly the plumbing relations (RADD-823/817)…
• RADD-834 bulk MOVE skips field grants, workflow guards and approvals; history publishes restricted field values _{access auth items · 5 pts · 7294e05f} Two live holes. Re-pointed by the spec-115 review (docs/specs/115-review/01-corrections.md §1): the audit cited bulk edit; the code says bulk edit is clean and the hole is bulk move — and it is worse than filed, because it skips more than field grants.
• RADD-807 CD downloads Helm from the internet on every deploy, so an outbound blip fails a release _{ci deploy · 3 pts · 7c36b576}

  What is wrong

• RADD-807 CD downloads Helm from the internet on every deploy, so an outbound blip fails a release _{ci deploy · 3 pts · 78b7a6b7}

  What is wrong

• RADD-807 CD downloads Helm from the internet on every deploy, so an outbound blip fails a release _{ci deploy · 3 pts · 744e8617}

  What is wrong

• RADD-834 bulk MOVE skips field grants, workflow guards and approvals; history publishes restricted field values _{access auth items · 5 pts · fd4b4c87} Two live holes. Re-pointed by the spec-115 review (docs/specs/115-review/01-corrections.md §1): the audit cited bulk edit; the code says bulk edit is clean and the hole is bulk move — and it is worse than filed, because it skips more than field grants.
• RADD-824 nine manage atoms are never checked, and view.manage hides a button the API allows _{access auth ux · 5 pts · 1a1eb5f5} Audit finding F13, from a direct question: does manage serve any real purpose? Measured rather than argued.
• RADD-822 field scope and field grants both say "project", so per-project restriction reads as missing _{access auth fields ux · 3 pts · 3c503d1f} Audit finding F12. A capability that exists but reads as missing is worth about as little as one that does not exist — and this one was reported as a suspected gap by the person who designed the system.

New Feature

• RADD-828 no anonymous reporting: email ingest provisions a requester account instead _{access auth forms servicedesk · 8 pts · 1eca1ad1} Decision (Hussein, D9 + review Q1): drop anonymous reporting entirely. Email ingest auto-provisions a requester account for the sender, holding a dedicated seeded Requester role — not the Baseline. /public/pages and /public/csat stay. Rewritten by the spec-115 review to match the recorded decisions…
• RADD-820 grants carry an expiry and a granted-by, so access reviews are possible _{access auth · 5 pts · cb1a561c} Audit finding F11. The smallest item in the epic and independent of every other one — it can land whenever.
• RADD-826 project admins assign roles on their own project _{access auth ux · 5 pts · 03cf43e5} Decision D3 (Hussein): a project admin grants and revokes existing roles on their own project without holding global role.manage. Creating and editing role definitions stays instance-wide.
• RADD-818 plugins can register access resources, and uninstall sweeps their atoms _{access auth pluginmgr · 8 pts · 241be006} From the brief: "we need to make sure that new plugins dynamically can register with the RBAC / CRUD system so their permissions can be managed by the same entities Team, User, Role etc."
• RADD-819 deny precedence, so "this team cannot edit Priority" is one rule _{access auth · 5 pts · c3d31f11} Audit finding F3. Every layer of the access system is additive, and field grants are allowlists, so the most natural way an admin phrases a restriction is the one shape the model cannot take.
• RADD-816 every verb means one thing: normalise CRUD and make ownership a modifier _{access auth · 8 pts · 4b47586a} From the brief: "the Manage, Create, Update, Edit, Delete need to actually represent what they do." They do not. Audit findings F4, F5, F6.
• RADD-817 items adopt relations: own, assigned, and team _{access auth items · 8 pts · 0a46ef0c} The single largest capability gap the audit found (F2), and the one scenario in the brief that is outright impossible today.
• RADD-823 relations: a kernel mechanism for "mine / my team's / anyone's" on any resource _{access auth kernel · 13 pts · 1b382dc9} The single missing concept behind six impossible scenarios across four different resources. Spec 115 §5.4a has the full design.
• RADD-831 the LDAP sync syncs groups, not linked teams _{auth ldap teams · 8 pts · 99387397} The directory half of RADD-827. modules/ldap/groupsync.py currently pushes users into teams that are linked to an AD group. After this it syncs groups as groups, including their nesting, and stops knowing that teams exist.
• RADD-830 the subject graph: one memoised resolution of who an actor is _{access auth teams · 8 pts · 41e5ec7f} The performance-critical half of RADD-827, and the piece every other part of the wave resolves through. Spec 115 §5.6a.
• RADD-829 the groups entity, nesting, and the migration off linked teams _{auth ldap teams · 8 pts · 6e9addc5} The foundation of RADD-827. Spec 115 §5.6a has the design.
• RADD-814 scope becomes a property of the grant, not the atom _{access auth · 13 pts · c89cd0e4} The root cause behind six shipped bugs, and the thing that makes the roles matrix confusing to read. Audit finding F1 (docs/specs/115-access-control-audit.md §2).
• RADD-809 the permission inspector: resource grants, Team view, and backlinks to the source _{auth ux · 8 pts · 5b9dbfac} RADD-779 shipped the inspector and it works: GET /users/{id}/permissions[?project_id=] returns every atom with its provenance — baseline, which named role, whether an umbrella implied it, or the instance-admin short-circuit.
• RADD-823 relations: a kernel mechanism for "mine / my team's / anyone's" on any resource _{access auth kernel · 13 pts · 6fd0e984} The single missing concept behind six impossible scenarios across four different resources. Spec 115 §5.4a has the full design.

New UI Feature

• RADD-836 make access legible: View as, audience indicator, a real refusal, impact preview _{access auth ux web · 13 pts · cfea85c2} Four usability pieces that are not polish: each is what makes the model in spec 115 operable, and each is cheapest built beside the thing it explains. Spec 115 §5.10.
• RADD-815 the roles matrix groups by resource, and scope is chosen on the grant _{auth ux web · 5 pts · 15a0aa59} The UI half of RADD-814, and the part the brief actually complains about: "this messiness of needing item.view on global scope even when I want it limited to a project must be solved, because it is confusing and not obvious to someone managing permissions."
• RADD-833 Groups admin screen, and the inspector shows the path _{auth teams ux web · 5 pts · 339477ac} The visible half of RADD-827. Without it, groups are a mechanism nobody can see — which is the failure spec 87 recorded when all 47 global atoms were ungrantable for a year because nothing could deliver them.
• RADD-843 the nav shows only what is useful to the actor — one predicate source for sidebar, rail, palette, pins _{access ux web · 5 pts · 97e93bef} Requested by Hussein during the spec-115 review; full inventory and per-area rules in docs/specs/115-review/05-nav-gating.md. A user with no access to worklogs should not see the Timesheet link; no readable project → no Projects nav; no readable space → no Docs; cycles the same.
• RADD-842 per-item writability: the SPA gets a per-row capability answer once relations exist _{access fields web · 5 pts · 679c2467} Split out by the spec-115 review (docs/specs/115-review/03-execution-plan.md NEW-D, 02-decision-review.md D10): relations + D10 break a shipped contract nobody listed.
• RADD-832 groups are grant subjects, and teams can contain them _{access auth teams web · 8 pts · c751bd57} The half of RADD-827 that delivers the actual ask: "I also want to be able to provide grants to AD groups directly not just through teams."
• RADD-836 make access legible: View as, audience indicator, a real refusal, impact preview _{access auth ux web · 13 pts · e581d730} Four usability pieces that are not polish: each is what makes the model in spec 115 operable, and each is cheapest built beside the thing it explains. Spec 115 §5.10.

Chore

• RADD-835 sweep every surface that names, counts, links to or notifies about a row _{access auth testing · 13 pts · 15dd6e95} Relations (RADD-823) hide rows. Every surface that names, counts, links to, exports or notifies about a row must resolve through the same seam, or it becomes the leak. Spec 115 §5.9 has the checklist; this issue is the sweep.
• RADD-825 narrow the Baseline to item.read@own, with a pre-flight report first _{access auth · 5 pts · b2027697} Decision D2 (Hussein): the Baseline narrows from item.read to item.read@own, so a signed-in user sees only issues they reported until granted more. Correct destination — safe-by-default, and the right posture for a service desk with external requesters.
• RADD-841 search_index carries relation columns so relations can reach search _{access search · 3 pts · a830de63} Prerequisite for RADD-823/817 reaching search, split out by the spec-115 review (docs/specs/115-review/03-execution-plan.md NEW-C) because it is a schema change with its own migration and must land before the relations kernel.
• RADD-825 narrow the Baseline to item.read@own, with a pre-flight report first _{access auth · 5 pts · b4392600} Decision D2 (Hussein): the Baseline narrows from item.read to item.read@own, so a signed-in user sees only issues they reported until granted more. Correct destination — safe-by-default, and the right posture for a service desk with external requesters.
• RADD-821 audit the access system end to end and write spec 115 _{access auth docs · 5 pts · c2dc0a22} A full sweep of the access system — atoms, roles, grant scoping, the spec-92 resource ACL framework, plugin contribution and the inspector — against a brief asking for control at global, project, component and field level, with ~20 named scenarios.

Uncategorized

• docs: codebase scan findings for later review _92c9e7a0
• RADD-827 Groups are their own entity: teams stop pretending to be directory objects _{access auth ldap teams · 595ef81c} Decision (Hussein): an AD group should be a first-class entity, not something linked to a team. Groups can be members of teams; groups can be granted access directly; teams stay flat.
• RADD-813 access control: full control at every scope, and a model that explains itself _{access auth ux · a0c18759} The audit is written up in full at docs/specs/115-access-control-audit.md. This epic carries the work.
• RADD-813 access control: full control at every scope, and a model that explains itself _{access auth ux · 78f2c653} The audit is written up in full at docs/specs/115-access-control-audit.md. This epic carries the work.

Changes from v0.17.2 to v0.18.0.

---

Mirrored from project.radd-hq.com on 2026-09-12. Documentation is written there; this copy is regenerated by scripts/publish_wiki.py and hand edits do not survive it.