v0.2.0

⚠️ Breaking change: authentication is now ON by default

agent.auth.enabled defaults to true everywhere. If you ran 0.1.x, flows that
assumed an open API will now get 401 — including plain docker run and any
docker compose up that doesn't set the variable.

Migration — pick one:

• Set a password: AGENT_AUTH_PASSWORD=<secret> (user defaults to admin), or
  read the random one the app generates and logs once at startup
  (docker logs <container>).
• Explicitly opt out for local experiments: AGENT_AUTH_ENABLED=false
  (the bundled compose dev/offline-demo stack already does this).

/api/health remains open in every mode. Rationale: the generated-password flow
removed the friction case for off-by-default, and a public, pullable image
changed the stakes — a shell-executing agent should never ship open.

Also in this release: tools receive the acting user (ToolContext), per-user
outbound credentials (CredentialResolver, Cistern first), an Audit panel in
the web UI, and a test-integrity system prompt.

---

What's Changed

• chore(deps): Bump eclipse-temurin from 21-jdk-jammy to 25-jdk-jammy by @dependabot[bot] in #31
• revert: temurin 25 runtime bump (#31) — Gradle 8.14.5 cannot run on it by @josepharuja in #40
• feat: Parts B and C — identity reaches tools, per-user outbound credentials by @josepharuja in #39
• feat: auth on by default, everywhere by @josepharuja in #42
• feat: audit trail panel in the web UI — see what the agent did, as whom by @josepharuja in #43
• fix: system prompt — tests are specifications, not obstacles (#26) by @josepharuja in #44
• chore: v0.2.0 by @josepharuja in #45

New Contributors

• @dependabot[bot] made their first contribution in #31

Full Changelog: v0.1.2...v0.2.0

v0.1.2

What's Changed

• Secure the actuator and docs endpoints; make tool-call failures visible; set budgets from data by @josepharuja in #25
• Validate the agent's toolchain end to end, and record where it goes wrong by @josepharuja in #27
• Document this week's hard-won gotchas, and add two skills for the repeats by @josepharuja in #29
• chore: v0.1.2 hardening — auth-on image default, Gradle 8.14.5, Dependabot by @josepharuja in #30

Full Changelog: v0.1.1...v0.1.2

v0.1.1

What's Changed

• fix: bump Spring Boot 3.3.4 → 3.5.3, Tomcat → 10.1.55 (CVE cleanup) by @josepharuja in #24

Full Changelog: v0.1.0...v0.1.1

v0.1.0

What's Changed

• chore: Apache 2.0 licence, and say what the audit log does and does not record by @josepharuja in #11
• feat(tools): a pod tool — the agent asks Cistern, as itself, and can be refused by @josepharuja in #13
• fix: propagate the authenticated user across async boundaries by @josepharuja in #14
• Make the agent runnable offline, and able to verify its own work by @josepharuja in #15
• fix: don't include db in readiness when no DataSource exists by @josepharuja in #16
• fix: lock down CORS and refuse the shipped default password by @josepharuja in #20
• feat: release pipeline — tagged multi-arch GHCR images with SBOM and scan by @josepharuja in #21
• fix: pin trivy-action to an existing tag (v0.36.0) by @josepharuja in #22
• chore: rename to Penstock by @josepharuja in #23

New Contributors

• @josepharuja made their first contribution in #11

Full Changelog: https://github.com/enrichmeai/penstock/commits/v0.1.0