v0.1.609

What's Changed

• Render Ansible ANSI colours in playbook logs + enlarge scroll pane by @hellodk in #372
• Lint enforcement: pre-commit framework install + ruff-format baseline + tsc hook by @hellodk in #382
• Cap visible playbook log to last 500 lines with Show all toggle by @hellodk in #376
• Delta polling for playbook logs (?from_byte=N) by @hellodk in #378
• eslint: 53 errors → 0 (22 type fixes + 20 justified suppressions) by @hellodk in #383
• ARCH-001 — three-repo split (kri / pulse / hydra) by @hellodk in #381
• eslint pre-commit hook + worktree-safe venv path for local hooks by @hellodk in #384
• P0: never persist extravars to playbooks_dir host_vars/group_vars by @hellodk in #385
• Audit coverage: audit() on 37 state-changing handlers by @hellodk in #387
• P1: no plaintext ssh_pass in inventory + controller-key auth for bootstrapped nodes by @hellodk in #386
• P1: prevent playbook double-run on worker SIGKILL by @hellodk in #392
• Git source auth flow + Jenkins-style credentials store by @hellodk in #394
• P1: per-job playbook timeout + ansible-runner cancellation by @hellodk in #395
• P2: playbooks/ansible.cfg — static Ansible config out of env vars by @hellodk in #396
• Shared SecretInput — kill browser autofill on secret fields by @hellodk in #397
• P2: per-job orphan reaper cutoff + 5-min sweep by @hellodk in #398
• Integration suite green: triage of all 33 pre-existing failures by @hellodk in #404
• Fix node search on INET column (coalesce cast) by @hellodk in #405
• Webhook URLs: https-only for public hosts (security) by @hellodk in #406
• P2: TOFU host-key verification for playbook runs by @hellodk in #407
• P3: proactive SSH reachability gauge (kri_node_ssh_reachable) by @hellodk in #410
• Fix master: remove stale xfail markers left by #405/#406 by @hellodk in #412
• Fix: register all model classes (Base.metadata completeness) by @hellodk in #414
• Fix: fleet_embeddings.tsv generated column on the model (BM25) by @hellodk in #408
• Fix: dynamic group without predicate returns 422 (was 500) by @hellodk in #409
• Settings: merge Bootstrap+Advanced into Automation tab (closes #391) by @hellodk in #411
• Playbook failure diagnosis: honest banner + collections pre-flight + classification (#355/#357/#358) by @hellodk in #415
• Per-job timeout control in playbook run modal (closes #416) by @hellodk in #420
• Portable multi-mode monitoring + fix #356 hardcoded test path (#419) by @hellodk in #421
• Send test email button + SMTP port-465 SSL (closes #417, #418) by @hellodk in #422
• Expose /metrics via nginx (private-net restricted) for scraping (#419) by @hellodk in #423
• P1: fix SMTP password double-decrypt (all email broken) (closes #425) by @hellodk in #426
• Migrate kri from npm to pnpm everywhere (closes #424) by @hellodk in #427
• P1: fix pnpm frontend image build (node bump + .dockerignore) (closes #428) by @hellodk in #429
• Standalone systemd deploy path for kri (closes #431) by @hellodk in #432
• kri Grafana dashboard — portable JSON + k8s ConfigMap (closes #430) by @hellodk in #433
• fix: align react-dom to 19.2.7 to match react (React #527, UI down) by @hellodk in #440
• feat: Playbook Library — admin-curated workspace with per-operator favorites by @hellodk in #435
• fix(security): remove pillar token from bootstrap logs, fix path traversal guard by @hellodk in #472
• fix: salt keys list_keys returns degraded flag on PermissionError by @hellodk in #474
• fix(frontend): read URL tab param in SettingsPage, exclude Playbook Library from Save button by @hellodk in #473
• fix: timeout_seconds isinstance too strict, job_start_time pre-init before try by @hellodk in #475
• fix(security): reject JWT tokens missing jti claim to prevent revocation bypass by @hellodk in #482
• fix(security): remove ssh_password from Celery task arg, add acks_late=False, fix orphan reaper by @hellodk in #480
• fix(services): source index mismatch, remove service-layer commits, ON CONFLICT enable, clear enabled_by by @hellodk in #483
• chore(compliance): scripts/kri rename, test-reports gitignore, Traefik ingress, IST audit by @hellodk in #485
• fix(frontend): catalog_id null type, empty state guards, per-item toggle pending, WCAG contrast by @hellodk in #486
• fix(routes/ansible): extravars scrub, legacy fallback, cancel audit order, email actor, jti 401 by @hellodk in #481
• fix(workers): playbook lock per-playbook, maintenance_mode in presence sync, Salt log level, coalesce cast by @hellodk in #484
• fix(frontend): show degraded banner in SaltKeysPage when PKI dir is unreadable by @hellodk in #489
• fix(frontend): enforce IST timestamps in dateFormat, GroupExplorer, MonitoringPage by @hellodk in #490
• fix(security): scrub node_token from bootstrap stdout + no_log on URI task by @hellodk in #491
• feat(frontend): SaltMasterStatus widget in FleetHealthPage (#438) by @hellodk in #492
• fix(frontend): playbook UX — null catalog_id, per-item toggle, WCAG contrast, empty state by @hellodk in #487
• fix(security): enforce jti + revocation check in WebSocket auth by @hellodk in #510
• fix(security): scrub extravars + remove ssh_password from Celery broker by @hellodk in #511
• fix(ansible): source↔dir mapping + all-disabled fallback by @hellodk in #512
• fix(maintenance): reap_orphaned_bootstraps resets Node.bootstrap_status by @hellodk in #513
• fix(ansible): guard bootstrap_mac_mini.yml from generic run endpoint by @hellodk in #514
• fix(library): favorites 500→401 on bad sub claim, enable_source upsert by @hellodk in #515
• fix(frontend): per-item toggle pending, library load/error empty-state guard, WCAG contrast (closes #499 #500 #504) by @hellodk in #524
• fix: drop vestigial local pillar write + try/finally in bootstrap_node (closes #509) by @hellodk in #526
• feat: enforce node must belong to ≥1 group (block last-group removal) (closes #508) by @hellodk in #525
• feat: salt_masters model + migration (seed from SALT_MASTER) + nodes.salt_master_id (#516, epic #523) by @hellodk in #527
• feat: SaltMasterProbe prerequisite service + POST /salt/masters/{id}/test (#517, epic #523) by @hellodk in #528
• feat: salt-api key adapter — list/accept/reject/delete via wheel, drop PKI-FS reads (#518, epic #523) by @hellodk in #529
• feat: salt-master health polling beat task + cached GET /salt/masters/{id}/health (#519, epic #523) by @hellodk in #530
• feat: bootstrap resolves node master + health gate + live log streaming (#520 #498, epic #523) by @hellodk in #531
• feat: Salt Masters settings tab + list endpoint + bootstrap-modal health gate (#521, epic #523) by @hellodk in #532
• feat: salt masters CRUD + invariants (#533, epic #537) by @hellodk in #539
• feat: multi-master HA bootstrap (failover master list) + mandatory-master gate, health warn-not-block (#534, epic #537) by @hellodk in #540
• feat: global no-salt-master guard — block fleet activities + prompt to configure (#538, epic #537) by @hellodk in #541
• feat: node-vantage master reachability check in bootstrap (#536, epic #537) by @hellodk in #542
• feat(security): salt-api TLS + scoped external_auth ACL on all masters (#535, epic #537) by @hellodk in #543
• fix: live bootstrap log polling + AnsiText render + 5s flush (closes #544) by @hellodk in #546
• feat: saltmaster install supports Linux masters (cylon) (closes #545) by @hellodk in #547
• fix: ma...

v0.1.56 — Ansible Playbook Runner + CI Hardening

Features

• Ansible Playbook & Role Runner: discovery, variable editor, Celery job queue
• Bulk group deletion, WebSSH browser terminal, Security dashboard

Infrastructure

• CI: unit + integration tests + coverage gate (75%)
• Weekly digest as GitHub Issue, animated blog post

Bug Fixes

• Salt returner test path, pre-push hook false-positive on OpenSSH placeholder