OpenSCM v0.7.10

Changed

• UI performance: a typical page now transfers ~290 KB instead of ~4.8 MB, and almost nothing on repeat visits. Every page previously pulled 4,847 KB of vendor JS/CSS across 31 files, uncompressed and uncacheable. Four independent fixes:

  • Static assets are now cacheable. They were served with no validator, so browsers re-downloaded everything on every navigation. Assets now carry an ETag (scoped to the build version) and Cache-Control: max-age=3600, and conditional requests get a 304 — repeat navigations transfer a few hundred bytes. The short max-age plus a version-scoped ETag means an upgrade still picks up new assets rather than pinning stale ones.
  • Responses are compressed (gzip/brotli, negotiated per request). Worth ~82% on the remaining assets and on the large HTML report tables.
  • Unused libraries removed. jQuery UI (252 KB, loaded only for an AdminLTE shim that guards against a clash which cannot occur once jQuery UI is gone), InputMask (100 KB) and Moment.js (60 KB) were on every page and referenced by nothing. The external Ionicons CDN stylesheet is also gone — no ion-* icon is used, and dropping it removes a third-party request per page load (which also blocked page render on air-gapped installs).
  • Heavy optional libraries are now opt-in per page. jszip/pdfmake/vfs_fonts (2.2 MB) load only on the five pages with Excel/PDF table buttons; Chart.js only on the dashboard and the two live report pages; Select2 and Duallistbox only on the form pages that use those widgets. Beyond bandwidth this removes the JS parse cost on every other page.

  Net: a baseline page goes from 4,847 KB / 31 files to 1,954 KB / 19 files, or ~290 KB on the wire once compressed — then near-zero on subsequent navigations.

---

OpenSCM v0.7.9

Fixed

• "Nothing queued — this policy does not apply to this system" when running a policy that clearly does apply. The per-policy Run button reported the row count from its INSERT OR IGNORE, which is 0 when the tests are already queued — e.g. clicking Run twice, or running a policy whose scheduled scan is still pending the agent's next check-in. That legitimate case was misreported as the policy not covering the host. Applicability is now counted separately from the insert, so Run reports the policy's applicable tests whether or not they were already queued; a genuinely uncovered system still reports that correctly.

---

OpenSCM v0.7.8

Added

• Click a PASS / FAIL / NA / EXCLUDED count to filter the report to those elements. On the system and policy compliance reports — live and saved/archived (Reports menu) — the status counts in each card header are now clickable: click Failed to show only that card's failing tests, click again (or another status) to change or clear the filter. Scoped per card so each policy (system report) or system (policy report) filters independently. Purely client-side — no reload. On the system report, NOT_SCANNED rows fall under the NA filter to match that report's NA count.

---

OpenSCM v0.7.7

Added

• Run a single policy on a single system, from the system report. Each policy card on the system compliance view gains a Run button that queues just that policy's tests for just that host — so after fixing a finding you can re-check the one machine instead of rescanning the fleet. Requires the Runner role; the action is audited (policy.run_on_system). Scans are queued to the agent, so results land on its next check-in rather than instantly, and the confirmation message says so. Requesting a policy that doesn't cover the system queues nothing and reports that, rather than a silent success.

Fixed

• Data loss: a long server outage no longer deletes every system on restart. With auto_prune_inactive enabled, the prune deleted any active system whose last_seen was older than the threshold — but while the server is down no agent can report, so after an outage longer than the threshold the whole fleet looked inactive and was wiped on the first 60-second tick, before any agent had a chance to check in. The prune is now gated on server uptime: a tenant is skipped until this server process has been running at least as long as its own threshold, so a stale last_seen can no longer be confused with "the server wasn't there to hear it". Genuinely absent systems are still pruned once that window has passed. Covered by regression tests.

---

OpenSCM v0.7.6

Fixed

• Agent (scmclient): stop duplicate/orphaned agents from piling up. Field hosts accumulated dozens of stray scmclient daemons over successive self-upgrades (an older restart path spawned a detached copy instead of replacing the process), and some grew to multi-GB RSS. The agent now takes a single-instance advisory lock (scmclient.lock, next to the config) at startup in daemon mode; a second instance logs and exits instead of running in parallel. The lock is O_CLOEXEC (Rust default), so it releases across the upgrade exec() and the re-exec'd binary re-acquires it cleanly — no self-deadlock. The run / --help / --version one-shots are unaffected.
• Agent memory: switched to a single-threaded Tokio runtime. The agent is a strictly sequential heartbeat loop but ran on the multi-threaded runtime, whose per-worker glibc malloc arenas never return freed memory — long-lived agents ballooned to multi-GB RSS / 20-GB VSZ. current_thread uses one arena, so memory plateaus low and flat. No functional change.
  • Operators: existing strays are detached from the service manager, so upgrading won't clear them. Clear once with systemctl stop scmclient && pkill -x scmclient && systemctl start scmclient (adjust the unit name).

---

OpenSCM v0.7.5

Fixed

• Compliance-trend charts now plot the hourly axis in the viewer's browser timezone. The 0.7.4 timezone work converted .datetime HTML elements, but the trend charts (dashboard fleet trend + system/policy report trends) render their X-axis from server-side bucket labels, which stayed in UTC. The hourly range — the only one with a clock — is now shifted to local time client-side (e.g. a 09:00 UTC point shows as 12:00 in GMT+3); daily/weekly/monthly/yearly are date-only and unchanged.

---

OpenSCM v0.7.4

Changed

• All timestamps in the web UI now render in the viewer's browser timezone. Previously times were shown inconsistently — some as raw UTC, some as the server's local time. The server now emits every displayed timestamp as canonical UTC, and a single shared converter (base.html) localizes every .datetime element to the browser's zone, appending the zone abbreviation (e.g. 15/06/2026, 17:30:00 GMT+3). Covers systems, audit log, reports (live, saved, and diffs), containers, enrollment tokens, and the active-key timestamp. The per-page duplicate converters were removed in favor of the shared one.

Added

• templates_parse smoke test that parses every embedded Tera template, so a template syntax error fails the build instead of crash-looping the server at startup.

---

OpenSCM v0.7.3

Added

• Hourly / Daily / Weekly / Monthly / Yearly ranges on the system and policy trend charts. The Compliance Trend card on the live report pages gains the same range selector as the dashboard's fleet trend (?range=, default Hourly = last 24 hours; Daily = last 30 days; Weekly/Monthly = last 12; Yearly = last 10). Buckets average their hourly snapshots — score and the tooltip's pass/fail tallies alike. The card now shows from the first snapshot (previously hidden until two existed), so switching to a sparse bucket can't hide the selector, and it can be collapsed with the same minimize control as the dashboard's trend card.

Fixed

• Container compliance percentages are now rounded to 2 decimals. The stored per-container score and the policy-level container axis (policies.score_container) were written as raw SQL division results, so the report badges and the container detail page showed values like 66.66666666666667%. Both are now ROUND(…, 2) at the source; existing stored values are rewritten on the first recalculation after upgrade.

---

OpenSCM v0.7.2

Added

• Per-system and per-policy compliance trends. The system and policy live report pages gain a Compliance Trend chart showing the entity's hourly history (design: docs/design/0.7.2-entity-trends.md). A new entity_compliance_history table records one snapshot per scanned system and policy every hour, carrying both compliance axes — so flipping a Per-test / Per-system / Per-policy toggle re-renders the whole line with no artificial step (the 0.6.6 dual-mode approach). Not-scanned entities are skipped (gaps render as gaps); tooltips show each snapshot's pass/fail tallies; the card hides until 2+ points exist. Schema v36 → v37.
• Two trend retention settings (Settings → General): System/Policy Trend Retention (default 90 days — high-volume, per-entity hourly rows) and Compliance Trend Retention (default 365 days), both pruned in the daily retention pass with retention.* audit rows, 0 = keep forever. Note: the fleet-wide dashboard trend (compliance_history) was previously kept forever — existing installs start trimming it to 365 days on upgrade; set 0 to restore the old behaviour.

---

OpenSCM v0.7.1

Fixed

• Database errors in report/list sub-queries are no longer silently swallowed. Eight query sites used unwrap_or_default() on a fetch, so a DB error (e.g. a missing column on a partially-migrated database) rendered an empty section with no trace — the same failure class that hid the 0.7.0 Systems-page container-list bug. They now log the error and degrade to the same empty fallback: test add/edit condition lists, the Systems-page agent-package lookup, per-system and container-detail container results, and the container attach in live/PDF policy reports and saved snapshots.

---