v0.1.0

Changelog

Features

• e71c776: feat(audit): forward-compat API — Source field + chain verify (governance Task 3) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 0c53371: feat(audit): tamper-evident secret-free audit store (governance Task 1) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 611f56d: feat(audit): wire the audit spine into the daemon + CLI (governance Task 2) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 5246e9d: feat(autoscale): --autoscale opt-in flag + label (Task 1) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 33ceeb3: feat(autoscale): the reactive memory-grow control loop (Task 3) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• cd4b456: feat(autoscale): wire the loop into poddled + observability (Task 4) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• d9a5c49: feat(broker): Broker facade composing vault+handles+server (1.B) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• c04bcef: feat(broker): Credential + Handle types (task 1.1) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• bc596ed: feat(broker): egress redaction — scrub secrets from outbound bodies (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 9c1c763: feat(broker): git Basic-auth mode in the gateway (connectors, layer 1/4) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• d5ac4d1: feat(broker): handle TTL with injectable clock + ErrExpired (1.H1) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 662b7e3: feat(broker): handle issue/resolve/revoke (task 1.3) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• a64a368: feat(broker): injecting gateway + tests (1.4 / 1.H3) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• e50f9d1: feat(broker): seal vault secrets in memguard enclaves (1.H2) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 8dc934d: feat(broker): serveable gateway — Server.Serve/Stop (1.5) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 2265b75: feat(broker): tenant-scoped in-memory Vault (task 1.2) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 844f3fc: feat(cli): attach + run commands; down revokes handles via poddled (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 788e7ed: feat(cli): root command on cobra (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 440fd8b: feat(cli): target a remote host via PODDLE_HOST (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• cd7f509: feat(config): template loader with extends composition (step 1/3) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 3065dfa: feat(connect): poddle connect CLI + up wires connectors into pods (layer 3/4) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• e6e4803: feat(connector): built-in argocd, jenkins, docker (declarative) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• d199559: feat(connector): built-in gitea, bitbucket, drone, pypi (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 85bb0d5: feat(connector): built-in github, gitlab, npm connectors + default base_url (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• a116eb3: feat(connector): declarative connector engine + connection store (layer 2/4) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• f5e4b90: feat(dashboard): /v1/policies CRUD API — the UI-editable policy contract (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 8165ea3: feat(dashboard): Pods view — live fleet + performance console (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 25e2b09: feat(dashboard): Preact SPA — audit view + policy editor (reusable for cloud) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 7cec059: feat(dashboard): poddle dashboard server over the /v1/audit* contract (governance Task 4) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• e2a434f: feat(dashboard): disciplined sparklines + table density on Pods (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 155e320: feat(dashboard): enrich the pod drill-down with live facts (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• ecf2d55: feat(dashboard): governance console — Overview with attention + secrets (console Task 1) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• ea6a31c: feat(dashboard): real URL routing + Go SPA fallback + pod drill-down (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• f8daf1b: feat(dashboard): restyle to match the poddle web design system (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)
• 16e0c68: feat(dashboard): segmented controls replace native dropdowns (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 692af49: feat(docs): arrow-key hints in the search footer (#11) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) a9a181f: feat(docs): command-palette search modal (#8) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 1953e0e: feat(docs): deepen docs — Security, Configuration, Headless & CI (#3) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 118ad66: feat(docs): per-command examples + FAQ / troubleshooting (#4) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 397db02: feat(docs): whole-row selectable search results + arrow-key navigation (#10) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 89db4bb: feat(down): remove a sandbox; portable tail keep-alive; provider lifecycle test (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 7843f11: feat(engine): add Create and Attach to the engine + podman provider (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 7ea2244: feat(engine): mounts + env in Create (for identity materialization) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) e54ab97: feat(exec): Runner abstraction with OS and Fake implementations (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) c7c02b4: feat(harness): claude-code harness slice (1.9) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 214b6f5: feat(harness): pod-side runtime abstraction (1.8) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) afedce0: feat(identity): identity add/ls/status/rm commands + up --identity (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 1002055: feat(identity): providers yield a broker.Credential (1.6 + 1.7) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 5dd93f3: feat(identity): store + Provider (auth-vendor) interface + fake (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 4b965ea: feat(identity/anthropic): claude setup-token provider -> CLAUDE_CODE_OAUTH_TOKEN (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 25e154d: feat(l4): Postgres termination proxy (SCRAM/md5/cleartext) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 4789869: feat(l4): Redis TCP broker — swap the handle for the real AUTH, then splice (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 895debd: feat(l4): SCRAM-SHA-256 client (Postgres auth, stdlib only) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 9af6c62: feat(ls): list sandboxes command, registered on root (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 22bf59e: feat(move): inherit the pod spec from its labels (Task 2) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 3b09208: feat(move): make headless resume real — stateful tasks + nudge + e2e (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) b122074: feat(move): poddle move — re-home a session onto a fresh, re-sized shell (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 422b820: feat(move): resume the conversation in its original mode after a move (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 1e398dd: feat(poddled): UDS control server + poddle daemon command (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 79f02e1: feat(poddled): control client + auto-spawn (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) effd95c: feat(poddled): daemon core + control API (persistent broker) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 834c01b: feat(poddled): run the L4 Redis listener; expose its addr; resolve handles (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 6571d01: feat(podman): connection-aware List over the sandbox domain type (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 2fe908b: feat(podman): run spec.Setup after create (1.C) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 37284e9: feat(policy): enforce governance policy at the reverse-proxy (enforce Task 2) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 99ef908: feat(policy): forward proxy — govern arbitrary egress (enforce Task 3) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 891b45e: feat(policy): named governance policy model + evaluator (enforce Task 1) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) be0de79: feat(policy): project + global policy sources, pluggable Store (config foundation) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 2ac93fa: feat(remote): broker-advertise address + automated loopback-ssh remote e2e (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) df11701: feat(secure): block_paths — refuse mounts that expose host secrets (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) b41fbd6: feat(secure): credential-file scan on mounts (warn / block) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 3469f68: feat(sizing): poddle resize + burstable CPU + task sizing hooks (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 2721f69: feat(state): stateless pods — session state on named volumes (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) e979544: feat(stats): poddle stats — live CPU/memory for running pods (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 32cd138: feat(task): poddle task --detach (fire-and-forget) + poddle logs (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 6fb28e1: feat(task): poddle task — run a coding agent headless in a secretless pod (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 9dd4de7: feat(up): --exec (run a command in the pod, no attach) + anthropic upstream override (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) dc77c4a: feat(up): --harness flag resolved from a harness registry (1.10) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 393d240: feat(up): --template + apply resolved template to the spec (step 2/3) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 26731e3: feat(up): clone template repo into /workspace (step 3/3) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 9212eb1: feat(up): create a sandbox and connect to it (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) e243c52: feat(up): interactive identity select when --identity is omitted (1.E) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) bce45e2: feat(up): make the broker reachable from the pod (1.D) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 5b30960: feat(up): route brokered creds through poddled; --detach works (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) d99dc3a: feat(up): secretless identity wiring; remove the token-into-pod path (1.11) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 13df1d3: feat(up): up-scoped broker lifecycle + detach guard (1.12) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 45879f5: feat(up): wire Postgres datastores through the L4 broker (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 0691f5e: feat(up): wire Redis datastores through the L4 broker (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) e079dc1: feat(v0): poddle daemon status + poddle version + real README (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 54c9b2e: feat(web): 'How it works' as an auto-rotating workflow carousel (#21) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) bfa4341: feat(web): WCAG-AA contrast pass + robots/llms.txt + JSON-LD (#6) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 4f773f9: feat(web): centralize verified company legal details in legal.json (#22) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) c6e45d6: feat(web): cloud funnel, stronger positioning, comparison, github badge (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 4781a49: feat(web): drive all pricing from pricing.json (#24) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 80964f1: feat(web): generated /.well-known/security.txt (RFC 9116) + unify security contact (#25) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) e21c04a: feat(web): marketing site — flow, connectors, pricing, code-gen docs, security & legal, SEO (#1) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 8709cdf: feat(web): multi-page docs generated from the CLI + S-tier polish (#2) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 2b2508e: feat(web): redesign 'Why poddle' - grouped, icons, differentiators first (#19) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) a99a38a: feat(web): remove hero eyebrow; elevate Governable/Auditable to shipped governance (#16) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 3301e73: feat(web): rework 'The problem' section headers (#17) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) Fixes 74bf301: fix(broker): challenge git with WWW-Authenticate on 401 (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) aa43a87: fix(ci): Taskfile e2e-up desc — drop leading backtick (invalid YAML) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) de07340: fix(ci): drop path filter from web.yaml so manual pipelines compile (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) b543711: fix(ci): pull base images via AWS ECR Public mirror, not Docker Hub (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 418e284: fix(ci): re-add e2e-remote.yaml with plain-scalar commands only (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 24455eb: fix(ci): remote fixture — mkdir /run/podman + wait for the api socket (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 36a8ad8: fix(ci): web.yaml push/pull_request only — path filter breaks manual pipelines (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) e42fa0b: fix(dashboard): Overview correctness — live pod count + honest secrets ledger (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) eb0db0a: fix(docs): denser search results + real-browser verification (#9) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 22edcd9: fix(docs): slim down the docs search field (#7) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 7febb73: fix(e2e): L4 redis upstream on host networking (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 0845510: fix(e2e): isolate the resize e2e in its own step; CPU-only (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) dd1da61: fix(move): default --harness to claude-code; narrow the e2e lifecycle task (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) d724b9f: fix(sizing): task hooks resize CPU only; document move as the memory answer (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 637b7fe: fix(stats): standalone stats e2e that skips on rootless no-cgroup (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) e2b8a69: fix(test): autoscale grow e2e — poll size=strong, don't misread inspect errors (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) eae4d02: fix(test): forward e2e — pass the curl command as one arg to poddle run (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) bd0c894: fix(up): bind governance policy even without a connector (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) c8f41a2: fix(web): P1 consistency — sizes, planned labels, honest claims, em-dashes (#5) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 912a8bf: fix(web): correct home claims to match shipped code + track the rest in ROADMAP (#15) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 80b5582: fix(web): resolve all axe WCAG A/AA violations (0 across 17 pages) (#12) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) Other changes b81105b: perf(docs): non-render-blocking Pagefind stylesheet (#13) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 4b63e56: refactor(cli): App composition struct injected into all commands (1.A) (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) d378263: refactor(dashboard): brand is just "poddle" + sentence-case UI copy (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 336136e: refactor(dashboard): capitalize controlled vocabulary across the console (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 416a17c: refactor(dashboard): copy pass + density — human labels, honest empty states (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com) 78dc38f: refactor(engine): introduce Engine contract; podman is the in-process impl (sebastianstupak 100760888+sebastianstupak@users.noreply.github.com)