AppTown v1.0.0-rc.11

Flokkit AppTown v1.0.0-rc.11

RC11 repairs container publication, Infrastructure reads and provider confirmation
for Portainer targets,
updates AppTown's Go toolchain to 1.27.3, adds current MCP discovery, and tightens
the resources AppTown's interface loads. It includes all changes since RC9. Take matching database and file backups before
upgrading, as described in the
upgrade guide.

New and improved

• Complete container build inputs. Server and worker container builds copy
  the interface resource policy into the compiler stage. A failed compiler call stops the image
  build immediately. RC10's container publication failed before an installable
  release was produced; these notes cover all changes since the last installable
  release, RC9.
• Inspect and confirm unverified Portainer targets. The target page offers
  inspection of the provider's current identity and asks an administrator to
  confirm that exact observation. Standalone Docker environments reached through
  Portainer's Docker agent are supported. Swarm and other unsupported endpoint
  kinds remain refused. Confirmation records current destination and resource
  associations; it does not establish historical ownership or authorize deletion.
• Infrastructure keeps unavailable observations visible. If a target cannot
  attribute its placements, its recorded deployments remain visible with unknown
  observed state and the reason. Other targets retain their observations. An
  unknown or stale observation is distinguished from a successful empty inventory.
• Current MCP discovery. Clients using MCP 2026-07-28 can discover AppTown
  and make stateless requests with current client metadata. Existing initialized
  sessions retain their ownership checks. Current credentials and permissions are
  checked on each request; successful discovery and legacy initialization retain
  distinct audit records.
• Restricted interface resources. AppTown's interface loads scripts, fonts
  and external stylesheets from its own origin. Its resource policy permits its
  API and terminal connections and the configured browser error-reporting
  destination. Markdown images from external origins become labelled links;
  same-origin images, raster data images and the exact https://apptown.dev
  tour-image origin remain supported. Task-list completion remains visible.
  Hosted applications and previews keep their own policies.
• Go 1.27.3 and library updates. AppTown's server, CLI and worker use Go
  1.27.3. Building AppTown from source requires Go 1.27.3 or newer. Updates
  include age, Sigstore, certificate transparency, container-registry and Docker
  clients, canonical JSON, OAuth and related libraries. Staticcheck and
  golangci-lint are updated for compiler compatibility.
• Dependency maintenance. Security updates bound RSA JWK parsing and fix
  quadratic HTML parsing in deployment checks. Docker runtime/base images and
  the Node build-image digest are updated. Renovate covers coordinated project
  tool pins, stock toolchains and runtime images; a private-Docker proposal still
  requires worker-profile qualification before it can be used.
• Upgrade and interruption regression coverage. The frozen RC9 fixture is
  included for subsequent upgrades. The CLI interruption test waits until its
  child process has recorded a usable process ID before sending a signal.

Declaration changes

No application-contract, workflow, check, scanner or pack declaration fields are
added or removed. Dependency-maintenance annotations and configuration
are updated; existing runtime qualification requirements remain in force.

HTTP API changes

These changes are relative to RC9. The HTTP API remains experimental. The
OpenAPI description
contains the available route definitions.

• GET /oauth/login.js serves the fixed same-origin OAuth login-page script.
  AppTown's interface responses send the resource policy described above.
• /mcp supports the MCP 2026-07-28 stateless discovery/request transport when
  that protocol version is explicit and no session ID is supplied. Requests with
  session IDs retain legacy session ownership checks. Authentication, body limits
  and tool authority are unchanged.
• GET /api/v1/infrastructure returns recorded placements with unknown state
  when an individual target's attribution is unavailable, instead of failing
  the whole read. It retains other targets' observations and reports the reason.
• The existing GET and POST /api/v1/targets/{name}/provider-association
  inspection and confirmation operations support standalone Docker agent
  endpoints. No new confirmation route is added.

Deprecations

None.