uBix Vault v0.2.0-beta.1

Beta: hardening and completeness on top of the v0.1.0 MVP. uBix Vault is now usable for real workloads (see docs/DEPLOYMENT.md), though it has not had an external security review.

Pre-release. Not production-hardened. For production, use HashiCorp Vault or OpenBao.

Added

• Token TTLs, expiry, and renewal — tokens expire (default + explicit TTL; root non-expiring); expired tokens are rejected; renew-self extends them.
• Auto-unseal — protect the master key with a 32-byte KEK instead of Shamir shares, so a restarted server unseals itself (-auto-unseal-key).
• Health/readiness endpoint — GET /v1/sys/health, readiness encoded in the status code (200/503/501).
• Backup / restore — consistent, encrypted snapshots (POST /v1/sys/snapshot, operator snapshot save/restore).
• Root-token regeneration — recover a new root token from a quorum of unseal shares.
• Lease renewal, lookup, and cascading revocation — dynamic-DB leases renew/lookup; revoking a token revokes the credentials it created.
• Kubernetes auth method — pods exchange a ServiceAccount token for a scoped token, validated via the TokenReview API.
• HCL policy documents — accept HashiCorp-style HCL policies alongside JSON (in-house parser, no new dependency).
• Deployment guide (docs/DEPLOYMENT.md).

Changed

• TLS hardening — without TLS, the server binds loopback-only; non-loopback plaintext is refused unless -dev-no-tls is set.
• Seal status reports the seal type (shamir or auto).

Known limitations

• Not production-hardened; no external security review.
• Auto-unseal takes the KEK directly (pluggable cloud-KMS/HSM seal is future work); root regeneration is Shamir-only.
• The in-house HCL parser is a policy-grammar subset, not full HCL.
• Cascading revocation and lease renewal cover dynamic-database leases.

See CHANGELOG.md for the full list.