v0.5.0 — Shared foundation and guarded activity identities

v0.5.0 — Shared foundation and guarded activity identities

• Adopt the shared IBKR core and the packaged DEGIRO connector commands.
• Add versioned activity identities with exact ownership and duplicate checks.
• Add read-only historical previews and guarded comment conversion and reversal.
• Preserve simulation, uncertain-result stops, recovery journals and financial readback checks.

This release uses the exact source commit of v0.5.0-rc.2: d404ee7. That candidate passed first-install and retained-history upgrade qualification, including idempotence, conversion, reversal and uncertain-result recovery.

Publication builds fresh amd64 and arm64 images. Use the stable image digest returned by the publication workflow. Review the recovery guide before converting historical comments. Publishing this release does not deploy it or convert existing data.

v0.5.0-rc.2

Release candidate for Ghostfolio compatibility and DEGIRO identity maintenance.

• Supports observed Ghostfolio versions from 3.86.0 with operation-specific compatibility checks.
• Keeps unrelated account history outside the selected-account import decision while retaining global ownership checks.
• Reconciles MANUAL asset profile identifiers without duplicate imports.
• Ships journaled identity maintenance and reversal in the runtime image.
• Preserves exact financial data, origin restrictions and uncertain-write recovery guards.

This is a prerelease for qualification. It does not promote the stable image or deploy a connector. Historical conversion still requires explicit approval and exact destination qualification. Do not import raw historical archives.

v0.5.0-rc.1

First release candidate for the common IBKR foundation and versioned DEGIRO identities.

• Install the connector as a typed Python package with separate accounting, identity, transport, vault and journal modules.
• Adopt the pinned immutable core and preserve DEGIRO accounting and uncertain-write guards.
• Add controlled historical identity preview, apply, inspection and reversal commands.
• Handle MANUAL profile UUIDs and zero values with exact import readback.
• Refresh Supercronic to 0.2.51 and Bitwarden CLI to 2026.10.0.

Source: c9aa412 (#120, #121).

This prerelease is for qualification. Exact-image lab acceptance is pending. Historical conversion and financial writes require a separate approved operation. No automatic deployment or stable promotion is included. The latest image alias remains on the existing stable release.

v0.4.1 — Core redirect rejection and Compose defaults

What's Changed

Fixes

• fix: require native container checks and allow guarded merge methods by @flowcool in #76
• fix: propagate canonical Ghostfolio core redirect rejection by @flowcool in #82

Documentation

• docs: compact project state and follow stable image by @flowcool in #59
• docs: harden Compose defaults after v0.4.0 by @flowcool in #61
• docs: add fast-track working mode and initialize OpenSpec 1.13.2 by @flowcool in #78
• docs: OpenSpec baseline of current DEGIRO behavior by @flowcool in #83
• docs(agents): delegate the PR lifecycle to a cheap subagent by @flowcool in #84
• docs(agents): align agent skill adapters with sibling repos by @flowcool in #85

Maintenance and dependencies

• ci: centralize pip-audit dependency pin by @flowcool in #73
• chore: split Dependabot alerts and Renovate update ownership by @renovate[bot] in #74
• chore: remove contributor lab, acceptance and one-shot bench tooling by @flowcool in #77
• chore: remove the orphan contributor lab image by @flowcool in #80
• test: align cron date regression with Zurich contract by @flowcool in #88

Other changes

• Align dependency update policy by @flowcool in #86
• Restrict dependency release watch to pinned binaries by @flowcool in #87

New Contributors

• @renovate[bot] made their first contribution in #74

Full Changelog: v0.4.0...v0.4.1

v0.4.0 — Safer unattended operation

v0.4.0 — Safer unattended operation

This release consolidates the audit improvements delivered in the v0.4.0 cycle.

Upgrade notes

• Direct invocations must set SYNC_MODE explicitly to rolling, prospective, or full_history. The supplied Compose configuration already sets rolling.
• HTTP Ghostfolio origins remain supported for the Docker Compose default http://ghostfolio:3333, but the connector now emits a clear warning before credentials can travel over HTTP. Use HTTPS or a trusted isolated network.
• In CRON mode, the image now includes a local liveness healthcheck for the scheduler process. It only detects that the scheduler has disappeared; it does not prove a scheduled run completed or send an alert. Use restart: unless-stopped as documented.

Security and reliability

• Docker build downloads now require HTTPS (including redirects) and TLS 1.2 or newer, while retaining the existing SHA256 verification.
• The Python dependency hash-lock approach was evaluated and documented. It is intentionally not enabled until a reviewed, multi-architecture wheel-only lock is available.
• The user documentation, troubleshooting guidance, recovery material, and architectural decision records now describe the supported DEGIRO scope and its operational tradeoffs.

No financial write behavior changed in this release.

What's Changed

Features

• feat: add local scheduled process healthcheck by @flowcool in #58

Fixes

• fix: require explicit DEGIRO synchronization mode by @flowcool in #55
• fix: warn before cleartext Ghostfolio credential transport by @flowcool in #56

Documentation

• docs: clarify supported DEGIRO scope and setup by @flowcool in #53
• docs: record DEGIRO credential API and matching trade-offs by @flowcool in #54

Maintenance and dependencies

• build: restrict artifact downloads and evaluate Python hash locking by @flowcool in #57

Full Changelog: v0.3.0...v0.4.0

v0.3.0 — Reviewable dry runs and Compose-first setup

Review DEGIRO proposals directly in Docker logs before enabling financial writes.

• Show every proposed activity with date, type, ticker, quantity, unit price, currency and fee.
• Show current Ghostfolio EUR cash → proposed cash and established exclusion counts (already imported, manual matches and repeated normalized candidates).
• Keep the optional private JSON proposal and add the verified period, cash before/after and exclusion counts; no automatic report files.
• Hide embedded source account IDs from custom fee/yield symbols in logs and escape text fields to keep each proposal on one log line.
• Simplify the README around copyable Docker Compose, one options/recommendations table and essential vault, mapping, account discovery and simulation steps. No repository clone is required.
• Document the glossary, architecture and durable-execution design decisions. Align Compose examples to v0.3.0.

Logs now include financial review details; restrict access to Docker logs and log viewers. Financial policy, write guards, journal format, immutable core and Apprise behavior are unchanged. Existing installations can select DEGIRO_IMAGE=ghcr.io/flowcool/ghostfolio-degiro-sync:v0.3.0; preserve mapping/state and review a dry run before enabling writes. Image rollback does not undo financial records.

Source: PR #52, merged as cd5bb0f0f5c3515d759085cf413974e276bc4757. Completed CodeRabbit review covers final head cdde909cf8493960d776df366f785a8a7bffb92a; all final-head required CI passed and 1,534 offline tests pass. The maintainer accepted the temporary pre-publication version pin and merged the PR. Publication verified: release workflow succeeded, including native amd64 and arm64 tests, scans and synthetic journeys. Anonymous registry verification confirms both platforms report v0.3.0 at the merge revision; the published manifest matches the CI artifact and latest resolves to the same digest: sha256:886357a1b04bdd28e4bfca699bec3460cf42f9674ec6b998a4f852f38eb703f0. A fresh anonymous pull and isolated synthetic community journey against this exact published image passed with zero financial writes. No production deployment is performed.

What's Changed

Features

• feat: expose dry-run proposals and streamline Compose documentation by @flowcool in #52

Maintenance and dependencies

• chore(deps): bump markdown from 3.10.3 to 3.11 in the python-minor-patch group by @dependabot[bot] in #46
• chore(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #47

New Contributors

• @dependabot[bot] made their first contribution in #46

Full Changelog: v0.2.3...v0.3.0

v0.2.3 — Clearer setup and safe failure diagnostics

Patch release for clearer setup and safe failure diagnosis.

• Refresh the README with a visual overview, navigation and a complete Docker Compose setup guide.
• Clarify vault-only broker credentials, mapping currencies, container UID and filesystem permissions, optional date-window arguments and fresh rolling verification.
• Report allowlisted failure stages and reasons for configuration, vault operations, broker access, Ghostfolio reads and reconciliation. Diagnostics do not include credentials, request/response bodies or raw exception messages.
• Keep malformed command arguments private while preserving exit codes (2 for malformed arguments, 1 for operational failures).

Source: PR #50, merged as 6bdd0be94de1183dddbfe90bea5e2c6c547f1cdf. The reviewed head passed 1,527 offline tests, including 52 diagnostics/privacy scenarios, core integrity and native amd64/arm64 container checks. Completed CodeRabbit coverage applies to the exact reviewed head.

Image publication and public artifact verification are complete. Release workflow passed offline tests, dependency/security checks, native amd64/arm64 smoke and synthetic community acceptance. Both architectures include SBOM and provenance.

Use DEGIRO_IMAGE=ghcr.io/flowcool/ghostfolio-degiro-sync:v0.2.3 in the documented Compose configuration. Preserve mapping and state, keep DRY_RUN=1, and record the current image digest before any operator-controlled upgrade. Rollback uses the previous immutable image digest with the same persistent state. This patch does not change financial policy or authorize deployment or financial writes.

Published image: ghcr.io/flowcool/ghostfolio-degiro-sync:v0.2.3 (linux/amd64 and linux/arm64).

Immutable digest: sha256:bd1e548aec4c1fca2dcd7a8b2ea40a8c45f8ef4b82e80dc82a4849669b8e3e75. Stable latest resolves to the same digest. The anonymously fetched manifest matches the CI manifest.

The exact published digest passed anonymous Compose pull and the complete synthetic community journey from a clean clone of this release, with runtime networking disabled. Scheduled DRY_RUN failure delivered one notification through the real Apprise library with mocked HTTP; success remained silent. Switching to the previous v0.2.2 image and restoring this digest preserved synthetic mapping, state and journal hashes. Public manifest, architecture digests and verification evidence are attached. No production deployment or financial mutation was performed.

v0.2.2 — verified community multiarchitecture images

Community Docker Compose deployment with mandatory fresh Bitwarden/Vaultwarden credentials at every execution.

• Pull a versioned GHCR image for amd64 or arm64; local builds and host Python are contributor workflows.
• Configure a dedicated vault account, API credentials, master password and exact Login item UUID. Direct DEGIRO credential environment variables are rejected.
• Follow the root README for Ghostfolio authentication, discovery, mapping, persistent state permissions, DRY_RUN review and scheduling.
• Failed scheduled runs, including DRY_RUN, alert through optional Apprise; successful runs remain silent.
• Upstream release/source watches open review issues without changing versions or deploying.
• Remove personal deployment material and fix the CodeQL logging regression without weakening privacy coverage.

Breaking configuration change: migrate to the documented BW_* variables before upgrading. Keep DRY_RUN=1 until the proposal is reviewed. Preserve mapping and state volumes; record the previous image digest and restore that digest for rollback. No production deployment or financial mutation is included in this release.

Validation: 1,475 offline tests and native amd64/arm64 container CI passed. PR #48 and PR #49 passed guarded merges with completed exact-head CodeRabbit coverage; final PR #49 head is 9d7b532. PR #45 was merged separately by the maintainer with an explicit CodeRabbit override. The release workflow gates image publication with security scans, native smoke checks, a synthetic community journey, SBOM and provenance. Registry publication and anonymous community acceptance are complete: workflow https://github.com/flowcool/ghostfolio-degiro-sync/actions/runs/38146725561 succeeded on both native architectures.

Packaging correction: authenticate before the package exists, publish checked images by digest, then strictly verify version-tag absence before publishing the multiarchitecture manifest. First v0.2.0 image publication failed before any images were published; its source tag remains immutable. Failure diagnostics reveal only the phase and HTTP status.

Verify the actual native config inside published attested OCI indexes against the scanned/tested local image before assembling the version manifest. The prior v0.2.1 version manifest was never published because its post-push metadata check failed; source tags remain immutable.

Published image: ghcr.io/flowcool/ghostfolio-degiro-sync:v0.2.2 (linux/amd64 and linux/arm64).
Immutable digest: sha256:fc7b8fa858cc9878e8ac970c06a42d0d19e57c6f648e8e56b5284fc208720752; stable latest resolves to this same digest. Both architectures include SBOM and build provenance attestations.

Anonymous pull and the complete community Compose journey passed from a clean checkout of v0.2.2 using isolated synthetic vault/broker/destination/notification responses and network-disabled runtime containers. Scheduled DRY_RUN failure delivered one alert through the real Apprise library with mocked HTTP, success stayed silent. An actual image change and restore by captured digest preserved mapping, state and journal hashes. Public manifest and verification evidence are attached to this release. No production deployment or financial mutation was performed.

v0.2.1 — community Compose and GHCR bootstrap

Community Docker Compose deployment with mandatory fresh Bitwarden/Vaultwarden credentials at every execution.

• Pull a versioned GHCR image for amd64 or arm64; local builds and host Python are contributor workflows.
• Configure a dedicated vault account, API credentials, master password and exact Login item UUID. Direct DEGIRO credential environment variables are rejected.
• Follow the root README for Ghostfolio authentication, discovery, mapping, persistent state permissions, DRY_RUN review and scheduling.
• Failed scheduled runs, including DRY_RUN, alert through optional Apprise; successful runs remain silent.
• Upstream release/source watches open review issues without changing versions or deploying.
• Remove personal deployment material and fix the CodeQL logging regression without weakening privacy coverage.

Breaking configuration change: migrate to the documented BW_* variables before upgrading. Keep DRY_RUN=1 until the proposal is reviewed. Preserve mapping and state volumes; record the previous image digest and restore that digest for rollback. No production deployment or financial mutation is included in this release.

Validation: 1,462 offline tests and native amd64/arm64 container CI passed. PR #48 has a completed CodeRabbit review covering 9bf20db and passed the guarded merge. PR #45 was merged separately by the maintainer with an explicit CodeRabbit override. The release workflow gates image publication with security scans, native smoke checks, a synthetic community journey, SBOM and provenance. Registry publication is tracked separately from source release publication.

Packaging correction: authenticate before the package exists, publish checked images by digest, then strictly verify version-tag absence before publishing the multiarchitecture manifest. First v0.2.0 image publication failed before any images were published; its source tag remains immutable. Failure diagnostics reveal only the phase and HTTP status.

v0.2.0 — community Compose and fresh vault credentials

Community Docker Compose deployment with mandatory fresh Bitwarden/Vaultwarden credentials at every execution.

• Pull a versioned GHCR image for amd64 or arm64; local builds and host Python are contributor workflows.
• Configure a dedicated vault account, API credentials, master password and exact Login item UUID. Direct DEGIRO credential environment variables are rejected.
• Follow the root README for Ghostfolio authentication, discovery, mapping, persistent state permissions, DRY_RUN review and scheduling.
• Failed scheduled runs, including DRY_RUN, alert through optional Apprise; successful runs remain silent.
• Upstream release/source watches open review issues without changing versions or deploying.
• Remove personal deployment material and fix the CodeQL logging regression without weakening privacy coverage.

Breaking configuration change: migrate to the documented BW_* variables before upgrading. Keep DRY_RUN=1 until the proposal is reviewed. Preserve mapping and state volumes; record the previous image digest and restore that digest for rollback. No production deployment or financial mutation is included in this release.

Validation: 1,454 offline tests and native amd64/arm64 container CI passed on PR #45. The maintainer merged PR #45 with an explicit CodeRabbit override. The release workflow gates image publication with security scans, native smoke checks, a synthetic community journey, SBOM and provenance. Registry publication is tracked separately from source release publication.