v0.1.0-rc7

What's Changed

Added

• Replace a push monitor's URL without deleting the monitor by @frankgraave in #349
• Seed every monitor type, a JSON assertion and both expiry notices in the demo estate by @frankgraave in #360

Fixed

• Report the monitored host's certificate when an HTTP check follows a redirect to another host by @frankgraave in #348
• Read a one-off maintenance window on the reader's clock, and say which windows have ended by @frankgraave in #350
• Refuse a data directory SubGlance cannot write with its owner and the chown that fixes it by @frankgraave in #352
• Leave starts_at and ends_at out of a weekly maintenance window instead of answering year 1 by @frankgraave in #353
• Answer a channel replace with its stored creation time instead of year 1 by @frankgraave in #354
• Speak TLS from the first byte to an email relay on port 465 instead of timing out every alert by @frankgraave in #355
• Fall back to 127.0.0.1 when a healthcheck on [::] finds no ::1, instead of reporting a running server unhealthy by @frankgraave in #356
• Export a channel imported without its credential so the file imports again, and let a form webhook move to another instance by @frankgraave in #357
• Name the owner and the fix when a mounted key, S3 secret or CA file cannot be read by @frankgraave in #358
• Name a tab icon in the dashboard shell so the browser stops asking the host root for one by @frankgraave in #359
• Test an untested address on Save monitor instead of refusing it by @frankgraave in #361
• Believe X-Real-Ip and X-Forwarded-For only when they agree by @frankgraave in #362
• Test changed check settings on Save changes instead of refusing them by @frankgraave in #363
• Keep pre-rule targets, resolvers and channel settings through an unchanged edit by @frankgraave in #364
• Keep each monitor's place in the schedule across a restart by @frankgraave in #367
• Tell the scheduler about monitor writes instead of waiting for its 30-second tick by @frankgraave in #368
• Write an empty request header value as it is on export, so a re-import keeps the monitor on by @frankgraave in #369
• Accept a partial import file that touches a channel stored without its credential by @frankgraave in #370
• Keep the watchdog pinging between checks of a slow schedule by @frankgraave in #371

Documentation

• docs: bring the README up to v0.1.0-rc7 by @frankgraave in #373

Everything else

• fix: keep channel credentials out of logged and stored delivery errors by @frankgraave in #288
• feat: give phone list-header controls a 44px target around their 36px face by @frankgraave in #290
• feat: recheck an unconfirmed failure every minute, not at the interval by @frankgraave in #291
• feat: tell a silent DNS resolver apart from twenty monitor outages by @frankgraave in #292
• feat: trust one certificate per monitor, or an extra CA for the instance by @frankgraave in #293
• feat: trust a certificate from the monitor forms by @frankgraave in #294
• feat: mute an incident's repeat alerts from a signed link in the alert by @frankgraave in #295
• feat: draw one primary button and one field fill on every screen by @frankgraave in #296
• fix: name the field on every channel save refusal by @frankgraave in #300
• fix: answer a malformed request body in the API's words, with its field by @frankgraave in #301
• fix: say where parsing stopped when a request body is empty or cut short by @frankgraave in #302
• fix: name the field on bulk tag, bulk channel and token expiry refusals by @frankgraave in #303
• fix: answer a monitor save the store could not write as a 500 by @frankgraave in #304
• fix: build the image with the Go and Node that CI tests and the archives ship by @frankgraave in #305
• fix: stop Dependabot proposing a new Node minor for the image by @frankgraave in #306
• feat: sign the published container image with keyless cosign by @frankgraave in #307
• fix: name the query parameter on every query-parameter refusal by @frankgraave in #308
• fix: refuse a stray command-line argument instead of dropping the flags after it by @frankgraave in #309
• fix: refuse a monitor hostname the resolver would refuse without asking by @frankgraave in #310
• fix: refuse connectivity targets, names and dns resolvers the lookup refuses by @frankgraave in #311
• fix: refuse channel settings the channel's own sender refuses by @frankgraave in #312
• fix: refuse a URL whose port or hostname every request refuses by @frankgraave in #313
• fix: refuse an SMTP host that every email delivery refuses by @frankgraave in #314
• fix: send bare addresses in the SMTP envelope and refuse unparseable ones by @frankgraave in #315
• fix: encode a non-ASCII email subject and label an 8-bit body by @frankgraave in #316
• fix: create the database, its WAL files and manual backups owner-only by @frankgraave in #317
• fix: withhold a Kuma server address its sender refuses instead of failing the file by @frankgraave in #318
• fix: refuse a backup bucket or region that every upload refuses by @frankgraave in #319
• fix: reject control characters in new object names by @frankgraave in #320
• fix: show the watchdog URL as scheme and host in logs and refusals by @frankgraave in #321
• fix: keep the secret keys and the watchdog URL out of the usage text by @frankgraave in #322
• fix: refuse credentials in the backup endpoint and keep them out of refusals by @frankgraave in #323
• fix: mask a user part of the base URL and backup target in the usage text by @frankgraave in #324
• fix: answer a subcommand's --help with its own usage by @frankgraave in #325
• fix: refuse a backup of a data directory that holds no database by @frankgraave in #326
• fix: refuse a subcommand flag that does not parse in one line by @frankgraave in #327
• fix: answer a wrong method on a known path with 405 and Allow by @frankgraave in #328
• fix: name the resource when a path id does not parse by @frankgraave in #329
• fix: keep a push note's text when it holds invalid UTF-8 by @frankgraave in #330
• fix: refuse control characters in a status page's title, description and public names by @frankgraave in #331
• fix: refuse control characters in tag values by @frankgraave in #332
• fix: refuse webhook header lines net/http will not send by @frankgraave in #333
• fix: refuse check settings on a monitor type that never reads them by @frankgraave in #334
• fix: fit a long alert to the length Slack, Discord, Telegram and ntfy take by @frankgraave in #335
• fix: cut quoted text in failure and delivery messages at a character by @frankgraave in #336
• fix: hold a monitor's free-text settings to a length limit by @frankgraave in #337
• fix: bound the key a failed sign-in is counted under, and the address of a new account by @frankgraave in #338
• fix: read X-Forwarded-Fo...

v0.1.0-rc6

What's Changed

Added

• An administrator can edit the connectivity check from Settings by @frankgraave in #211
• A certificate that expires soon alerts as 'expiring' without counting as downtime by @frankgraave in #218
• An owner who forgot the password can set a new one with subglance reset-password by @frankgraave in #219
• Alerts link back to the incident and the monitor when --base-url is set by @frankgraave in #220
• See where an account is signed in and sign a session out, without changing the password by @frankgraave in #221
• Watch a DNS record: a dns monitor compares A, AAAA, CNAME, MX or TXT with the values it expects by @frankgraave in #222
• Watch when a domain expires: a domain monitor reads the registration date over RDAP and warns ahead (feature) by @frankgraave in #223
• Make a status page your own: language (English or Dutch), accent colour, footer switch and an uploaded logo (feature) by @frankgraave in #224
• Moving from Uptime Kuma brings DNS monitors along as dns monitors (feature) by @frankgraave in #227
• Moving from Uptime Kuma brings Teams, Matrix and Pushover notifications along as webhook channels (feature) by @frankgraave in #229
• Moving from Uptime Kuma brings Mattermost, Rocket.Chat and Google Chat notifications along as webhook channels (feature) by @frankgraave in #230
• Moving from Uptime Kuma brings maintenance windows along as one-off and weekly windows (feature) by @frankgraave in #231
• Configuration files carry status pages, so a setup moves to another instance with its public pages (feature) by @frankgraave in #232

Fixed

• The web app builds on macOS and Windows: no two source files differ only in case by @frankgraave in #214

Documentation

• SubGlance's memory, CPU and image size beside Uptime Kuma's, measured for 24 hours by @frankgraave in #216
• docs: bring the README up to v0.1.0-rc6 by @frankgraave in #289

Everything else

• A refusal under a field can be read on every surface: body ink, red glyph by @frankgraave in #213
• A worded Delete button can be read in the dark theme: body ink, red bin by @frankgraave in #215
• The Delete item in the monitor action menu can be read in the dark theme: body ink, red bin by @frankgraave in #217
• Bring the API test suite back under CI's ten-minute limit (bug) by @frankgraave in #225
• The skip link says "Skip to main content" on every screen (accessibility) by @frankgraave in #226
• Uptime Kuma DNS import: tests for SOA records and AAAA expected values (enhancement) by @frankgraave in #228
• Race-detector runs no longer fail at random on a test that rewrote the process time zone (bug) by @frankgraave in #233
• Moving from Uptime Kuma brings status pages along without publishing protected pages (feature) by @frankgraave in #234
• Moving from Uptime Kuma brings Twilio notifications along as SMS channels by @frankgraave in #235
• Moving from Uptime Kuma brings Home Assistant notifications along as webhooks (feature) by @frankgraave in #236
• Moving from Uptime Kuma keeps the Content-Type a monitor's request body was sent with (fix) by @frankgraave in #237
• Uptime Kuma import: alert on the same failed check as Kuma by @frankgraave in #238
• Uptime Kuma import: warn about expiring certificates as early as Kuma did by @frankgraave in #239
• fix: name the Kuma monitors whose notifications did not come over by @frankgraave in #240
• fix: list the Kuma settings that change how an imported check runs by @frankgraave in #241
• fix: resend a lost ping within the check's timeout by @frankgraave in #242
• fix: retransmit a lost DNS query within the check's timeout by @frankgraave in #243
• test: stop the runner's clock before arranging a push deadline under Run by @frankgraave in #244
• test: wait for the loaded list before opening the dashboard's View panel by @frankgraave in #245
• feat: carry Kuma 2's domain expiry warning over as domain monitors by @frankgraave in #246
• feat: carry Kuma 2's saved error response over as capture_response by @frankgraave in #247
• feat: carry Kuma's Signal notifications over as a webhook to signal-cli-rest-api by @frankgraave in #248
• feat: carry Kuma's Bark notifications over as a webhook to the same Bark server by @frankgraave in #249
• feat: carry Kuma's WhatsApp (WAHA) notifications over as a webhook to the same WAHA server by @frankgraave in #250
• feat: carry Kuma's WhatsApp (Evolution) notifications over as a webhook to the same Evolution API by @frankgraave in #251
• feat: carry Kuma's WhatsApp (OpenWA) notifications over as a webhook to the same OpenWA server by @frankgraave in #252
• feat: carry Kuma's Apprise notifications over as a webhook to Apprise API by @frankgraave in #253
• test: take the maintenance stream sample at the window's creation instant by @frankgraave in #254
• feat: show per incident which channels its alerts reached by @frankgraave in #255
• test: wait for the DNS refusal's focus instead of sampling it once by @frankgraave in #256
• test: wait for the not-found tab title instead of sampling it once by @frankgraave in #257
• Compact dashboard: name a down monitor's failure kind in the row's chip by @frankgraave in #258
• Compact dashboard: keep names whole on a narrow list by @frankgraave in #259
• Inventory: add or remove a channel on a selection of monitors by @frankgraave in #260
• fix: keep reminders and first alerts out of one grouped message by @frankgraave in #261
• fix: write alerts raised after the notifier stops instead of holding them by @frankgraave in #262
• fix: carry routing rules, maintenance windows and status pages along with a tag rename by @frankgraave in #263
• fix: keep grouped alerts when the monitor they are filed under is deleted by @frankgraave in #264
• fix: leave outages that ran entirely inside maintenance off the public status page by @frankgraave in #265
• fix: let an exported file remove quiet hours, request headers and a body by @frankgraave in #266
• fix: refuse request headers that net/http cannot send by @frankgraave in #267
• fix: refuse an expected status the checker cannot parse by @frankgraave in #268
• fix: refuse a HEAD monitor that checks the response body by @frankgraave in #269
• fix: refuse a blank name and out-of-range retries when creating a monitor by @frankgraave in #270
• fix: keep a monitor's timeout within its interval by @frankgraave in #271
• fix: trim a new account's address and name the field a refusal is about by @frankgraave in #272
• fix: store a maintenance tag the way a monitor does and name the field a refusal is about by @frankgraave in #273
• fix: show a maintenance refusal under the field the server names by @frankgraave in #274
• fix: name the field a password change refuses and drop the auth: prefix by @frankgraave in #275
• fix: hold an imported quiet-hours window to the API's rules and name the refused field by @frankgraave in #276
• fix: show a refused quiet-hours window under the pa...

v0.1.0-rc5

What's Changed

Added

• A channel that stops delivering alerts is reported through another channel, on the dashboard and in /metrics by @frankgraave in #195
• A monitor that recovers before its alert got through sends one message: "was down for 3 minutes, now back up" by @frankgraave in #197
• Move from Uptime Kuma: subglance import uptime-kuma turns kuma.db into a configuration file by @frankgraave in #198
• Webhooks can send a body of their own, so Microsoft Teams, Matrix and Pushover receive SubGlance alerts directly by @frankgraave in #199
• A script that measures SubGlance's memory and CPU beside Uptime Kuma's on the same host by @frankgraave in #201
• A down monitor's page folds repeated failures into one row and puts the summaries first by @frankgraave in #202
• Dates, times and uptime figures are written the same way on every screen by @frankgraave in #206
• The status wall fills a television screen and counts every status by @frankgraave in #208

Fixed

• Every HTTP check opens a fresh connection: a renewed certificate or a server refusing new visitors shows on the next check, and recorded latency steps up to include the handshakes by @frankgraave in #193
• A push monitor that was paused, or whose deadline passed while SubGlance was down, gets one fresh window instead of a false alarm by @frankgraave in #194
• A recovery no longer arrives before the alert it closes when that alert's first delivery failed by @frankgraave in #196
• Memory goes back to the OS within seconds of a sign-in instead of minutes by @frankgraave in #200
• A mistyped address shows "Page not found" instead of the dashboard by @frankgraave in #205
• A taken port stops the server before it starts checking, with one clear error by @frankgraave in #207

Documentation

• The design document describes the controls as they are built: no UI kit underneath by @frankgraave in #210
• docs: bring the README up to v0.1.0-rc5 by @frankgraave in #212

Everything else

• test: measure status marks in both themes on seven screens (SUB-119) by @frankgraave in #118
• feat: add a Display section to the settings page (SUB-28) by @frankgraave in #119
• test: run the http-to-https header rule over a real TLS redirect (SUB-156) by @frankgraave in #120
• fix: ring the unlit lamp and waiting rail in --ink-3 (SUB-159) by @frankgraave in #122
• fix: give inventory name links a 24px target and walk /monitors on a phone (SUB-150) by @frankgraave in #123
• feat: pause, resume and delete a monitor from its detail page (SUB-119) by @frankgraave in #124
• docs: design the public status page: allowlist, threat model, data model, prototype (SUB-160) by @frankgraave in #125
• feat: fail an HTTP check when a field of its JSON body does not match (SUB-152) by @frankgraave in #126
• feat: deliver alerts to ntfy and Gotify (SUB-155) by @frankgraave in #127
• feat: hold off confirming outages while the host itself is offline (SUB-151) by @frankgraave in #128
• fix: prune the notification delivery log in the daily retention pass (SUB-162) by @frankgraave in #129
• feat: store status pages and their entries (SUB-153) by @frankgraave in #130
• feat: export and import configuration as YAML (SUB-154) by @frankgraave in #131
• feat: flag uptime windows longer than the monitor's life (SUB-119) by @frankgraave in #132
• fix: name the local_network cause in words instead of its raw key (SUB-151) by @frankgraave in #134
• feat: run the retention pass at a set time and catch up a missed one (SUB-162) by @frankgraave in #135
• feat: build the public status page model from state and history (SUB-153) by @frankgraave in #136
• feat: manage status pages through an admin-only API (SUB-153) by @frankgraave in #137
• perf: load the component workbench on demand (SUB-165) by @frankgraave in #138
• feat: compact the database from inside the process (SUB-162) by @frankgraave in #139
• feat: keep the database under an optional size limit (SUB-162) by @frankgraave in #140
• feat: build a status page's public answer from the database (SUB-153) by @frankgraave in #141
• feat: manage status pages from the settings screen (SUB-153) by @frankgraave in #142
• feat: say on the dashboard when this host has no outbound connection (SUB-151) by @frankgraave in #143
• feat: render the public status page as one self-contained document (SUB-153) by @frankgraave in #144
• feat: deliver alerts by SMS through an Android phone or Twilio (SUB-164) by @frankgraave in #145
• feat: export and import configuration files from Settings (SUB-163) by @frankgraave in #146
• feat: serve published status pages at /status/{slug} and as JSON (SUB-153) by @frankgraave in #147
• feat: retention run-now, compaction, run time and size limit in the API (SUB-162) by @frankgraave in #148
• feat: retention card — size limit, run time, last pass, run now and compact (SUB-162) by @frankgraave in #149
• feat: configure the connectivity check over the API (SUB-151) by @frankgraave in #150
• feat: give every card an icon tile, enforced by Card's type (SUB-167) by @frankgraave in #151
• feat: give every type role its own size, and put unstyled text on the scale (SUB-167) by @frankgraave in #152
• feat: draw every checkbox and radio through one component (SUB-167) by @frankgraave in #153
• feat: hold every monitors inventory row at one height (SUB-167) by @frankgraave in #154
• feat: finish the monitors page pass: selection column, lamp line, empty state (SUB-167) by @frankgraave in #155
• test: wait for the command menu's inventory instead of sampling it (SUB-169) by @frankgraave in #156
• fix: hold every notification channel row at one height (SUB-172) by @frankgraave in #157
• refactor: give settings cards their own classes instead of borrowed ones (SUB-171) by @frankgraave in #158
• refactor: move shared form, button and row-action classes into components (SUB-173) by @frankgraave in #159
• docs: state the name floor an editor's inventory row actually keeps (SUB-170) by @frankgraave in #160
• feat: show each channel's delivery state from the outbox (SUB-180) by @frankgraave in #161
• feat: keep only every-screen controls in the masthead (SUB-182) by @frankgraave in #162
• feat: one page frame per route — visible title, width rule, rail section (SUB-182) by @frankgraave in #163
• Inventory: names and addresses get their room before the columns (SUB-194, part 1) by @frankgraave in #164
• feat: incident rows give the name and the error their room, and line up their columns (SUB-194) by @frankgraave in #165
• feat: dashboard rows name the failure kind and keep names whole (SUB-194) by @frankgraave in #166
• fix: keep developer material out of the text users read (SUB-193) by @frankgraave in #167
• fix: round uptime down so 100% means no confirmed-down check (SUB-191) by @frankgraave in #168
• docs: bring README, architecture and install docs up to the code (SUB-185) by @frankgraave in #169
• fix: raise secondary ink to the ...

v0.1.0-rc4

What's Changed

Added

• Tell the incident as a story, and stop acknowledged looking like fixed by @frankgraave in #52
• Give the monitors a page where they can be changed, not just watched by @frankgraave in #54
• Give the notification channels a page, and refuse to pretend they work by @frankgraave in #55

Fixed

• Anchor the reminder tests to the confirmation they are about by @frankgraave in #53
• Give each screen its own toolbar, one add drawer, and surfaces you cannot see through by @frankgraave in #56

Documentation

• Merge the four page proposals, with their answered questions by @frankgraave in #51

Everything else

• Make size a ladder, generate a style guide from it, and split the chrome by @frankgraave in #57
• Relate every column width by one ratio, and guard the ratio by @frankgraave in #58
• Make the channels list look like the rest of the product by @frankgraave in #61
• Reach the add button by navigation, not by a click mid-render by @frankgraave in #64
• Rebuild the expanded incident row around what each half actually holds by @frankgraave in #62
• Apply the owner's dashboard chrome notes, and move two written rules rather than break them by @frankgraave in #63
• Name the one real caller of --down-dim by @frankgraave in #65
• Put the mute control on the incident's own line, and let the row be as tall as its line by @frankgraave in #66
• Drain the status rail when the stream dies, and give it its own rung by @frankgraave in #67
• Compare the style guide's stylesheet to a fresh build too by @frankgraave in #68
• Diagnose TLS failures by what actually failed, not by what threw by @frankgraave in #69
• Stop reporting health while the pipeline is not doing its job (SUB-97) by @frankgraave in #70
• Cut the README to a front page, and stop it claiming two things that are false by @frankgraave in #71
• Encrypt notification channel configuration behind an explicit key (SUB-118) by @frankgraave in #72
• Document the secret key, and guard the table that documents it by @frankgraave in #73
• Answer --version without starting, and make the TLS floor settable (SUB-121, SUB-143) by @frankgraave in #74
• Make the product visible on day one with a demo-data seeder by @frankgraave in #76
• feat: complete monitor reads and on-demand detail checks by @frankgraave in #78
• fix: silence stale announcements and gate built pages with axe by @frankgraave in #79
• feat: change passwords and protect unsaved monitor forms by @frankgraave in #81
• fix: keep mockups on live tokens and accessible status patterns by @frankgraave in #80
• feat(web): add a TLS floor control to the monitor forms by @frankgraave in #77
• Answer "what recovered across this instance" with one endpoint, and give the incidents toolbar something real to hold by @frankgraave in #75
• feat: expose captured failures and explain suppressed responses by @frankgraave in #82
• feat: expose watchdog state without leaking its destination (SUB-87) by @frankgraave in #84
• feat: edit monitors safely and configure repeat alerts (SUB-68, SUB-91) by @frankgraave in #83
• feat: preview and apply atomic bulk tag changes (SUB-84) by @frankgraave in #85
• feat: command menu and consistent panel surfaces (SUB-25, SUB-113) by @frankgraave in #86
• feat: improve monitoring validation, evidence and maintenance by @frankgraave in #87
• test: cover masthead and page-toolbar placement in a real browser (SUB-136) by @frankgraave in #91
• feat: latency chart over 24h/7d/30d on the monitor detail page (SUB-23) by @frankgraave in #92
• feat: morph a monitor's name into its detail page title (SUB-23) by @frankgraave in #93
• feat: instance-wide default notification channel (SUB-124, part 1) by @frankgraave in #94
• feat: quiet hours per channel with hold-and-digest (SUB-124, part 2) by @frankgraave in #95
• feat: who hears about each monitor, on the notifications page (SUB-124, part 3) by @frankgraave in #96
• feat: quiet hours in the channel form (SUB-124, part 4) by @frankgraave in #97
• docs: tighten the contributor licence agreement by @frankgraave in #98
• feat: state each monitor's repeat alerts on the notifications page (SUB-124) by @frankgraave in #99
• feat: set retention windows on the settings page (SUB-28) by @frankgraave in #101
• fix: keep the masthead inside the viewport between phone and desktop widths (SUB-148) by @frankgraave in #103
• feat: scheduled database backups to S3-compatible storage (SUB-146) by @frankgraave in #100
• feat: API tokens on the settings page, with a role per token (SUB-28) by @frankgraave in #104
• feat: conditional retention saves with If-Match and 412 (SUB-28) by @frankgraave in #105
• feat: sticky section index on the settings page (SUB-28) by @frankgraave in #109
• feat: make the empty dashboard's next step a button (SUB-27) by @frankgraave in #111
• feat: instance diagnostics card on the settings page (SUB-28) by @frankgraave in #102
• fix: keep loaded detail and maintenance data when a refresh fails (SUB-27) by @frankgraave in #112
• feat: users card on the settings page, and a role endpoint (SUB-28) by @frankgraave in #106
• feat: reset the instance from the settings page, gated by a typed phrase (SUB-28) by @frankgraave in #107
• fix: fit list rows and the rows layout to the content column (SUB-149) by @frankgraave in #110
• feat: show scheduled backup status on the settings page (SUB-28) by @frankgraave in #108
• feat: tag routing rules with union semantics and per-monitor exclusions (SUB-147) by @frankgraave in #113
• fix: walk every route in the phone layout suite and lift two small targets (SUB-119) by @frankgraave in #114
• feat: guard the motion ladder and measure it in the browser (SUB-119) by @frankgraave in #115
• fix: keep a monitor's request headers off redirects to another origin (SUB-156) by @frankgraave in #116
• feat: close a confirmed incident only after a streak of passing checks (SUB-157) by @frankgraave in #117
• docs: bring the README's status table up to rc4 by @frankgraave in #121

Full Changelog: v0.1.0-rc3...v0.1.0-rc4

---

Verifying a download

sha256sum -c SHA256SUMS --ignore-missing

The checksum file itself is signed with cosign
using this repository's GitHub Actions identity — no private key involved:

cosign verify-blob SHA256SUMS \
  --certificate SHA256SUMS.pem --signature SHA256SUMS.sig \
  --certificate-identity-regexp 'https://github\.com/frankgraave/subglance/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Container images for the same tag are published separately to
ghcr.io/frankgraave/subglance.

v0.1.0-rc3

What's Changed

Fixed

• Fix the ternary that made every release a snapshot by @frankgraave in #49

Documentation

• Keep dependency bumps out of the release notes, for real this time by @frankgraave in #50

Everything else

• docs: record the measured typography and token-discipline defects by @frankgraave in #1
• fix: require the editor role to issue an API token by @frankgraave in #2
• feat: guard spacing and radius the way colour and type are guarded by @frankgraave in #3
• refactor: decide tracking once on the body instead of per component by @frankgraave in #4
• feat: ship a docker-compose.yml and document the 60-second start by @frankgraave in #5
• feat: let the image check its own health by @frankgraave in #6
• feat: give a monitor key/value tags by @frankgraave in #7
• feat: open one monitor and see what is wrong with it by @frankgraave in #8
• Filter and group the dashboard by tag by @frankgraave in #9
• fix: bind every type size to one whole-pixel leading by @frankgraave in #11
• Let the heartbeat bar fit the phone it is drawn on by @frankgraave in #10
• Ping an external dead man's switch while checks are running by @frankgraave in #13
• test: measure the phone layout in a browser, since jsdom cannot by @frankgraave in #12
• Add push monitors: let a cron job or backup report in for itself by @frankgraave in #14
• Keep the response that explains a failed check by @frankgraave in #15
• Create the first account and sign in from the browser by @frankgraave in #16
• Repeat an unacknowledged alert until someone answers by @frankgraave in #17
• Create and read push monitors from the dashboard by @frankgraave in #18
• Gate the frontend on coverage, dependency audit and bundle size by @frankgraave in #19
• Add a control accent, border roles and a depth ladder by @frankgraave in #20
• Say the status in words, and stop repeating the heartbeat bar in lists by @frankgraave in #21
• Show a new monitor at once, and survive a render crash by @frankgraave in #28
• Make a type face a role, and give the radius and weight ladders their missing steps by @frankgraave in #29
• Self-host the sans and mono typefaces by @frankgraave in #30
• Add the five chip kinds and the icon tile by @frankgraave in #31
• Give the heartbeat tooltip a structure, and mark incomplete buckets by @frankgraave in #32
• Send the alerts: an outbox, five channels, and a way to test them by @frankgraave in #33
• Mask every channel secret, and keep push tokens out of the log by @frankgraave in #34
• Harden the unauthenticated surface: setup race, forwarding headers, and three floods by @frankgraave in #36
• Make retention configurable, prune the rollup, and let the file shrink by @frankgraave in #37
• Add a backup subcommand, and refuse to start against a newer schema by @frankgraave in #38
• The reference visual style, layer 2: components, layout, charts and the tokens under them by @frankgraave in #40
• Stop a notification channel from being an SSRF proxy by @frankgraave in #35
• Group the alerts that belong to one outage by @frankgraave in #39
• The reference visual style, measured: tokens, the card pattern, and guards for both by @frankgraave in #41
• Two surfaces, not three: drop the panel wrapper and make the lift visible by @frankgraave in #42
• Stop one outage from spending its snapshot budget twice by @frankgraave in #43
• Let the alert grouping window be configured by @frankgraave in #44
• Make the honest-status section honest again by @frankgraave in #45
• Stop the screen saying "Up" after it stopped knowing by @frankgraave in #46
• Refuse a channel whose destination is blocked when it is saved, not at 03:00 by @frankgraave in #47
• Make a tag produce something people can actually download by @frankgraave in #48

New Contributors

• @frankgraave made their first contribution in #1
• @dependabot[bot] made their first contribution in #23

Full Changelog: https://github.com/frankgraave/subglance/commits/v0.1.0-rc3

---

Verifying a download

sha256sum -c SHA256SUMS --ignore-missing

The checksum file itself is signed with cosign
using this repository's GitHub Actions identity — no private key involved:

cosign verify-blob SHA256SUMS \
  --certificate SHA256SUMS.pem --signature SHA256SUMS.sig \
  --certificate-identity-regexp 'https://github\.com/frankgraave/subglance/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Container images for the same tag are published separately to
ghcr.io/frankgraave/subglance.