v0.1.609

What's Changed

• Render Ansible ANSI colours in playbook logs + enlarge scroll pane by @hellodk in #372
• Lint enforcement: pre-commit framework install + ruff-format baseline + tsc hook by @hellodk in #382
• Cap visible playbook log to last 500 lines with Show all toggle by @hellodk in #376
• Delta polling for playbook logs (?from_byte=N) by @hellodk in #378
• eslint: 53 errors → 0 (22 type fixes + 20 justified suppressions) by @hellodk in #383
• ARCH-001 — three-repo split (kri / pulse / hydra) by @hellodk in #381
• eslint pre-commit hook + worktree-safe venv path for local hooks by @hellodk in #384
• P0: never persist extravars to playbooks_dir host_vars/group_vars by @hellodk in #385
• Audit coverage: audit() on 37 state-changing handlers by @hellodk in #387
• P1: no plaintext ssh_pass in inventory + controller-key auth for bootstrapped nodes by @hellodk in #386
• P1: prevent playbook double-run on worker SIGKILL by @hellodk in #392
• Git source auth flow + Jenkins-style credentials store by @hellodk in #394
• P1: per-job playbook timeout + ansible-runner cancellation by @hellodk in #395
• P2: playbooks/ansible.cfg — static Ansible config out of env vars by @hellodk in #396
• Shared SecretInput — kill browser autofill on secret fields by @hellodk in #397
• P2: per-job orphan reaper cutoff + 5-min sweep by @hellodk in #398
• Integration suite green: triage of all 33 pre-existing failures by @hellodk in #404
• Fix node search on INET column (coalesce cast) by @hellodk in #405
• Webhook URLs: https-only for public hosts (security) by @hellodk in #406
• P2: TOFU host-key verification for playbook runs by @hellodk in #407
• P3: proactive SSH reachability gauge (kri_node_ssh_reachable) by @hellodk in #410
• Fix master: remove stale xfail markers left by #405/#406 by @hellodk in #412
• Fix: register all model classes (Base.metadata completeness) by @hellodk in #414
• Fix: fleet_embeddings.tsv generated column on the model (BM25) by @hellodk in #408
• Fix: dynamic group without predicate returns 422 (was 500) by @hellodk in #409
• Settings: merge Bootstrap+Advanced into Automation tab (closes #391) by @hellodk in #411
• Playbook failure diagnosis: honest banner + collections pre-flight + classification (#355/#357/#358) by @hellodk in #415
• Per-job timeout control in playbook run modal (closes #416) by @hellodk in #420
• Portable multi-mode monitoring + fix #356 hardcoded test path (#419) by @hellodk in #421
• Send test email button + SMTP port-465 SSL (closes #417, #418) by @hellodk in #422
• Expose /metrics via nginx (private-net restricted) for scraping (#419) by @hellodk in #423
• P1: fix SMTP password double-decrypt (all email broken) (closes #425) by @hellodk in #426
• Migrate kri from npm to pnpm everywhere (closes #424) by @hellodk in #427
• P1: fix pnpm frontend image build (node bump + .dockerignore) (closes #428) by @hellodk in #429
• Standalone systemd deploy path for kri (closes #431) by @hellodk in #432
• kri Grafana dashboard — portable JSON + k8s ConfigMap (closes #430) by @hellodk in #433
• fix: align react-dom to 19.2.7 to match react (React #527, UI down) by @hellodk in #440
• feat: Playbook Library — admin-curated workspace with per-operator favorites by @hellodk in #435
• fix(security): remove pillar token from bootstrap logs, fix path traversal guard by @hellodk in #472
• fix: salt keys list_keys returns degraded flag on PermissionError by @hellodk in #474
• fix(frontend): read URL tab param in SettingsPage, exclude Playbook Library from Save button by @hellodk in #473
• fix: timeout_seconds isinstance too strict, job_start_time pre-init before try by @hellodk in #475
• fix(security): reject JWT tokens missing jti claim to prevent revocation bypass by @hellodk in #482
• fix(security): remove ssh_password from Celery task arg, add acks_late=False, fix orphan reaper by @hellodk in #480
• fix(services): source index mismatch, remove service-layer commits, ON CONFLICT enable, clear enabled_by by @hellodk in #483
• chore(compliance): scripts/kri rename, test-reports gitignore, Traefik ingress, IST audit by @hellodk in #485
• fix(frontend): catalog_id null type, empty state guards, per-item toggle pending, WCAG contrast by @hellodk in #486
• fix(routes/ansible): extravars scrub, legacy fallback, cancel audit order, email actor, jti 401 by @hellodk in #481
• fix(workers): playbook lock per-playbook, maintenance_mode in presence sync, Salt log level, coalesce cast by @hellodk in #484
• fix(frontend): show degraded banner in SaltKeysPage when PKI dir is unreadable by @hellodk in #489
• fix(frontend): enforce IST timestamps in dateFormat, GroupExplorer, MonitoringPage by @hellodk in #490
• fix(security): scrub node_token from bootstrap stdout + no_log on URI task by @hellodk in #491
• feat(frontend): SaltMasterStatus widget in FleetHealthPage (#438) by @hellodk in #492
• fix(frontend): playbook UX — null catalog_id, per-item toggle, WCAG contrast, empty state by @hellodk in #487
• fix(security): enforce jti + revocation check in WebSocket auth by @hellodk in #510
• fix(security): scrub extravars + remove ssh_password from Celery broker by @hellodk in #511
• fix(ansible): source↔dir mapping + all-disabled fallback by @hellodk in #512
• fix(maintenance): reap_orphaned_bootstraps resets Node.bootstrap_status by @hellodk in #513
• fix(ansible): guard bootstrap_mac_mini.yml from generic run endpoint by @hellodk in #514
• fix(library): favorites 500→401 on bad sub claim, enable_source upsert by @hellodk in #515
• fix(frontend): per-item toggle pending, library load/error empty-state guard, WCAG contrast (closes #499 #500 #504) by @hellodk in #524
• fix: drop vestigial local pillar write + try/finally in bootstrap_node (closes #509) by @hellodk in #526
• feat: enforce node must belong to ≥1 group (block last-group removal) (closes #508) by @hellodk in #525
• feat: salt_masters model + migration (seed from SALT_MASTER) + nodes.salt_master_id (#516, epic #523) by @hellodk in #527
• feat: SaltMasterProbe prerequisite service + POST /salt/masters/{id}/test (#517, epic #523) by @hellodk in #528
• feat: salt-api key adapter — list/accept/reject/delete via wheel, drop PKI-FS reads (#518, epic #523) by @hellodk in #529
• feat: salt-master health polling beat task + cached GET /salt/masters/{id}/health (#519, epic #523) by @hellodk in #530
• feat: bootstrap resolves node master + health gate + live log streaming (#520 #498, epic #523) by @hellodk in #531
• feat: Salt Masters settings tab + list endpoint + bootstrap-modal health gate (#521, epic #523) by @hellodk in #532
• feat: salt masters CRUD + invariants (#533, epic #537) by @hellodk in #539
• feat: multi-master HA bootstrap (failover master list) + mandatory-master gate, health warn-not-block (#534, epic #537) by @hellodk in #540
• feat: global no-salt-master guard — block fleet activities + prompt to configure (#538, epic #537) by @hellodk in #541
• feat: node-vantage master reachability check in bootstrap (#536, epic #537) by @hellodk in #542
• feat(security): salt-api TLS + scoped external_auth ACL on all masters (#535, epic #537) by @hellodk in #543
• fix: live bootstrap log polling + AnsiText render + 5s flush (closes #544) by @hellodk in #546
• feat: saltmaster install supports Linux masters (cylon) (closes #545) by @hellodk in #547
• fix: make master-pubkey pre-seed optional in bootstrap (closes #549) by @hellodk in #550
• fix: SettingsPage syncs active tab when ?tab changes post-mount (closes #479) by @hellodk in #551
• feat: bootstrap log view uses LogPane (auto-follow, bigger, ANSI) — parity with executions (closes #553) by @hellodk in #554
• feat: per-master tls_verify + auto-accept minion key on bootstrap (closes #555) by @hellodk in #563
• chore: P3 cleanups + behavioural test rewrites + Trivy retry (#471 #478 #505 #548) by @hellodk in #552
• feat: salt-master provision model + master_provision_runs + SSH creds + node link (#556, epic master-lifecycle) by @hellodk in #564
• feat: salt masters single source of truth — derive api_url, trim fields, retire SALT_MASTER setting + SALT_API_* env (closes #562) by @hellodk in #565
• feat: provision_master task — install/reconfigure salt-master with live streaming + probe (#557, epic master-lifecycle) by @hellodk in #566
• feat: Provision/Reconfigure master from UI with live LogPane (#558, epic master-lifecycle) by @hellodk in #567
• feat: light up salt-master nodes — badges, node panel, dashboard widget (#559, epic master-lifecycle) by @hellodk in #568
• feat: promote node to salt-master + master↔minion topology (#560, epic master-lifecycle) by @hellodk in #569
• chore: saltmaster CLI install shares provision playbooks + SSoT messaging (#561, epic master-lifecycle) by @hellodk in #570
• fix(db): migration 042 module-level revision ids — unbreak alembic chain (closes #571) by @hellodk in #572
• fix(deploy): k8s Deployment/Service manifests + env-driven compose paths + pin CI DB image (closes #577) by @hellodk in #582
• fix(observability): populate metrics, add alerts + beat heartbeat gauge, trace_id in logs (closes #576) by @hellodk in #583
• fix(security): require distinct Fernet key, WS revocation fail-closed, salt_ops input validation, RBAC+SSRF guards (closes #578) by @hellodk in #584
• fix(ui): IST timestamps + WCAG contrast sweep + a11y (closes #581) by @hellodk in #585
• feat(rag): fix reindex routing + true upsert/sweep, nomic prefixes + IVFFlat/probes + batch, eval harness + ingestion redaction + grounding (closes #573 #574 #575) by @hellodk in #586
• fix: behavioural guard tests + multi-group embedding + run-playbook allowlist parity + tasks RBAC (closes #580) by @hellodk in #587
• feat(arch): dedicated ansible queue+worker (control-plane isolation) + default-master delete guard (closes #579) by @hellodk in #588
• Move Salt Masters from Settings into the Overview hub by @hellodk in #590
• fix: auto-reassign nodes to default master on non-default master delete by @hellodk in #593
• Draggable AI Assistant widget with translucent fading panel by @hellodk in #594
• Enable netapi_enable_clients in salt_master role (fix 400 Client disabled) by @hellodk in #596
• Process-telemetry data pipeline (#598) by @hellodk in #608
• Read API for per-node process stats (#609) by @hellodk in #611
• Node-side psutil process collector (#610) by @hellodk in #612
• Wire NodeDetail Processes tab to psutil read API (#613) by @hellodk in #618
• Protected-target denylist + param validation for node actions (#615) by @hellodk in #619
• Execute approved node actions via guarded Salt dispatch (#614) by @hellodk in #622
• Rate-limit node action endpoints (#616) by @hellodk in #623
• Dry-run mode for node actions (#617) by @hellodk in #624
• Activate process collector on nodes during bootstrap (#625) by @hellodk in #626
• Track node action execution result via Celery callback (#621) by @hellodk in #627
• Dispatch non-destructive node actions + add service_enable (#628) by @hellodk in #630
• Denylist-aware action buttons + service_enable (#629) by @hellodk in #631
• Fix AI chat 500 — coerce non-str node cells in _sanitize_cell (#633) by @hellodk in #634
• Curated reversible harden/unharden compute Salt states (#632) by @hellodk in #635
• Authoritative LLM grounding + meaningful errors + graceful degradation (#637) by @hellodk in #638
• feat: LLM multi-model selector — Auto routing, health probing, fuzzy search by @hellodk in #636
• P0 audit batch: control-plane + secrets + LLM correctness (#640-643) by @hellodk in #649
• chore(deps): bump pnpm/action-setup from 4 to 6 by @dependabot[bot] in #600
• chore(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #599
• chore(deps): bump nick-fields/retry from 3 to 4 by @dependabot[bot] in #601
• chore(deps): update httpx requirement from >=0.28.0 to >=0.28.1 by @dependabot[bot] in #602
• chore(deps): update requests requirement from >=2.32.0 to >=2.34.2 by @dependabot[bot] in #603
• chore(deps): update pre-commit requirement from >=3.7 to >=4.6.0 by @dependabot[bot] in #604
• Audit P1 debt: cmdline redaction + LLM rate-limits + query-log retention by @hellodk in #652
• docs: RAG + LLM + Agentic architecture concept guide by @hellodk in #653
• chore(deps): update asyncssh requirement from >=2.14.0 to >=2.23.1 by @dependabot[bot] in #606
• chore(deps): update hypothesis requirement from >=6.100.0 to >=6.155.2 by @dependabot[bot] in #605
• Phase 0: backend-agnostic tool-calling core + tool_mode (#651) by @hellodk in #657
• [REVIEW] Ansible: salt_master re-applies ACL + restarts salt-api on already-provisioned master (#659) by @hellodk in #660
• fix: accurate test-connection toast + DB-driven minion presence by @hellodk in #656
• Observability: metrics + alerts + dashboard for node-actions / ingest / salt dispatch (#661) by @hellodk in #662
• #639 P1 cleanups: dead-endpoint removal + collector TLS + hypertable segmentby by @hellodk in #663
• fix: stop salt-api FD exhaustion + drive masters badge from config by @hellodk in #705
• Agentic A — Foundations: sanitizer, role-rank, agent data model, tool_mode wiring, quarantine + OTEL (#710) by @hellodk in #717
• Agentic B — Tool executor MVP: registry, bounded loop, 11 read-only tools, /agent/run/stream + UI (#711) by @hellodk in #718
• Agentic C — MLX tier router + serving states + benchmark (#712) by @hellodk in #719
• Agentic D — Write surface: quarantine + authoring tools + diff UI (#713) by @hellodk in #720
• Agentic E — Apply-with-approval: live tools, co-sign, promote (#714) by @hellodk in #721
• feat(agent): Phase F — hardening, red-team corpus, cost cap, runbooks (#715) by @hellodk in #722
• fix(deps): patch pip-audit/Trivy CVEs (cryptography, starlette, multipart, pydantic-settings) by @hellodk in #724
• test(integration): repair pre-existing integration test failures (fully green CI) by @hellodk in #727
• feat(credentials): consolidate SSH creds into first-class Credential store (#704) by @hellodk in #728
• fix(#665): TimescaleDB guard so migrations run on vanilla Postgres by @hellodk in #730
• fix(#667): unify LLM input budget + bound Anthropic + annotate node cap by @hellodk in #731
• fix(#644): approve/reject POST-only + TOCTOU-safe CAS by @hellodk in #729
• fix(#666): LLMAssistant + NodeDetail accessibility & contrast bundle by @hellodk in #732
• Consolidate Add Node into Import and fix import auto-bootstrap by @hellodk in #826
• fix(agent): no-progress guard + always emit a final answer (#740) by @hellodk in #836
• test(audit): fix stale audit-coverage test for relocated node.bootstrap.request (#374) by @hellodk in #838
• fix(security): resolve all 19 frontend Dependabot alerts by @hellodk in #841
• chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #676
• chore(deps): update alembic requirement from >=1.14.0 to >=1.18.4 by @dependabot[bot] in #678
• chore(deps): update bcrypt requirement from >=4.2.0 to >=5.0.0 by @dependabot[bot] in #677
• chore(deps): update slowapi requirement from >=0.1.9 to >=0.1.10 by @dependabot[bot] in #679
• chore(deps): update python-multipart requirement from >=0.0.31 to >=0.0.32 by @dependabot[bot] in #680
• chore(deps): update bandit requirement from >=1.7 to >=1.9.4 by @dependabot[bot] in #682
• fix(workers): stream node embeddings in batches (#744) by @hellodk in #832
• feat(fleet): surface SSH reachability in the UI (on-demand + bulk refresh) by @hellodk in #845
• fix(notify): log SMTP send failures instead of swallowing (#741) by @hellodk in #828
• fix(workers): grain-token ingest + probe DB session (#739,#738) by @hellodk in #831
• fix(ingest): reuse Redis client and make rate-limit INCR/EXPIRE atomic (#736, #737) by @hellodk in #825
• chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #723
• chore(deps): bump @tanstack/react-query from 5.100.10 to 5.101.0 in /frontend by @dependabot[bot] in #685
• fix(ssh): include credential fingerprint in SSH connection cache key (#733) by @hellodk in #839
• chore(deps): bump eslint from 10.4.0 to 10.5.0 in /frontend by @dependabot[bot] in #683
• fix(api): use asyncio.get_running_loop() inside coroutines (#740) by @hellodk in #837
• fix(agent): row-lock approvals + nullable pending-action node_id (#735, #742) by @hellodk in #835
• fix(workers): probe salt masters concurrently and free DB session (#734) by @hellodk in #829
• chore(rules): forbid Cursor/AI attribution in repo artifacts by @hellodk in #849
• fix(llm): endpoint enable/disable toggle + chat role normalization (#840) by @hellodk in #842
• chore: remove stray .claude/worktrees gitlinks breaking CI by @hellodk in #847
• fix(llm): treat empty 0-token response as endpoint failure (#840) by @hellodk in #846
• fix(bootstrap): normalise ssh_host_key to valid known_hosts token (#840) by @hellodk in #843
• feat(bootstrap): minimal bootstrap + runtime node_exporter/minion vars by @hellodk in #833
• chore(deps): bump typescript-eslint from 8.60.1 to 8.62.0 in /frontend by @dependabot[bot] in #684
• feat(nodes): unified node health rollup by @hellodk in #850
• docs(mockups): add node health rollup UI mockup by @hellodk in #851
• fix(agent): constrain LLM-controlled Salt tools (#771 #775 #776 #777 #779) by @hellodk in #853
• fix(credentials): stop minting secret-less credentials; harden resolver (#704/#701/#725) by @hellodk in #857
• docs: fix references, license, version/coverage consistency (USR audit batch) by @hellodk in #856
• fix(deploy): add salt-master to compose + portable volume paths (#812 #816) by @hellodk in #855
• fix(security): auth refresh rate limit, ingest fail-closed, FERNET env, self-approval block (#765 #766 #768 #772) by @hellodk in #854
• fix(config): accept legacy FERNET_SECRET_KEY for zero-touch redeploy (#765 follow-up) by @hellodk in #859
• fix(agent): harden prompt/cost/output paths (#770 #773 #774 #778 #780 #781 #782) by @hellodk in #860
• refactor(arch): unify minion-id validator, drop inline SSH creds, add hypertable compression, beat HA notes (#752 #748 #753 #754) by @hellodk in #862
• fix(security): auth /metrics, CSP, drop X-XSS, trusted-IP login RL, force admin pw change, drop cmd.run (#763 #764 #755 #759 #757 #820 #758) by @hellodk in #863
• test: add behavioral coverage for agent + rate-limit paths (#795 #801 #803 #807) by @hellodk in #861
• perf(arch): shared Redis client, cached Fernet cipher, non-blocking Celery wait (#747 #751 #745) by @hellodk in #864
• fix(ux): friendly login errors instead of raw backend detail (#865) by @hellodk in #866
• fix(sre): k8s securityContext + NetworkPolicy/PDB/HPA + pg_backup hardening (#760 #762 #767 #769 #761) by @hellodk in #867
• test(infra): per-test DB isolation, async loop-scope fix, mutation CI (#805 #806 #804) by @hellodk in #868
• test: behavioral + contract + property coverage; de-flake mtime test (#809 #811 #808 #802) by @hellodk in #869
• fix(frontend): reduce SecurityPage SSH-session poll to 30s (#792) by @hellodk in #876
• fix(frontend): use the user's local timezone instead of hardcoded Asia/Kolkata (#796) by @hellodk in #877
• feat(frontend): error boundary, focus-trapped modals, a11y headers, model tests + digest email (#785 #794 #790 #793 #647 #620) by @hellodk in #878
• fix(api): unbreak master — rate-limit headers, import validate, agent reject by @hellodk in #875
• feat(frontend): migrate to Tailwind CSS v4 (#852, supersedes #686) by @hellodk in #858
• fix(frontend): harden WebSocket auth & move tokens off localStorage (UX-1/2/4) by @hellodk in #871
• test: stop excluding fleet_platform/agent from coverage gate (#799) by @hellodk in #870
• docs: rebrand "Mac/macOS Fleet Management" to "Fleet Management" by @hellodk in #874
• fix(credentials): remove inline SSH credential read-fallback (#748, ARC-4) by @hellodk in #873
• refactor(arch): break service->API and route->worker import coupling (#746, #749) by @hellodk in #872
• feat(frontend): pnpm docs, stable keys, Dashboard polling, virtualization, model-selector tests (#814 #797 #791 #789 #648) by @hellodk in #881
• fix(backend): RAG citations/logging, intent routing, ingest idempotency, Linux salt onedir (#669 #670 #672 #696) by @hellodk in #883
• fix(master): restore api->worker layering + tuple-aware llm_context after #883 by @hellodk in #889
• ci: enforce coverage on fleet_platform/agent (Closes #799) by @hellodk in #884
• docs(adr): agent execution-model decision (Closes #880) by @hellodk in #885
• fix(frontend): replace dangerouslySetInnerHTML with AnsiText in BootstrapModal by @hellodk in #886
• feat(agent): native + anthropic tool-calling in planner via tool_mode (Closes #651) by @hellodk in #888
• feat(agent): AGENT_ENABLED kill-switch (default off) (Closes #879) by @hellodk in #887
• test(agent): unblock master — enable AGENT_ENABLED for agent integration tests (#887 fallout) by @hellodk in #894
• refactor(backend): decompose ansible.py route god-file + extract ansible_tasks helpers (#750) by @hellodk in #893
• refactor(frontend): decompose NodeDetail god component into tab components + memoization (#787) by @hellodk in #892
• test: convert source-scrape unit tests to behavioral assertions (#800 #671) by @hellodk in #895
• feat(frontend): SSE job-event push to replace polling fan-out (#756) by @hellodk in #896
• fix(docs): exclude internal plan/sprint docs from Jekyll build (#890) by @hellodk in #897
• feat(frontend): migrate more polling sites to SSE push-invalidation (batch 2) (#756) by @hellodk in #898
• fix(salt): Linux parity for process_report states (os_family guards, no runtime pip) (#673) by @hellodk in #899
• test: convert source-scrape unit tests to behavioral (batch 2) (#800 #671) by @hellodk in #900
• fix(deploy): pg_backup uses apk on Alpine base + E2E buildx pull resilience (#891) by @hellodk in #901
• fix(deploy): guard kri deploy against stale/off-master checkouts (#902) by @hellodk in #904
• fix(ci): E2E stack uses fleet_platform DB, not non-existent fleet_demo by @hellodk in #903
• test: convert source-scrape unit tests to behavioral (batch 3) (#800 #671) by @hellodk in #909
• feat(nodes): guarded 'Harden node' / 'Unharden' action + UI (#675) by @hellodk in #908
• feat(frontend): migrate job-state pollers to SSE push (batch 3) (#756) by @hellodk in #907
• feat(ui): reusable ToggleSwitch + adopt in LLM endpoint enable toggles by @hellodk in #910
• feat(bootstrap): install node telemetry deps (psutil/macmon/tart) + drop bootstrap_full gate (#625 #613 #47) by @hellodk in #911
• fix(e2e): seed admin+viewer users so the Playwright suite can log in (#905) by @hellodk in #906
• feat(fleet): node health rollup v2 — minion-primary + salt-master dimension + overview tiles (#356) by @hellodk in #912
• docs(fleet): correct health-rollup docstring issue ref (#356 -> #912) by @hellodk in #914
• docs(audit): add external audit deliverables by @hellodk in #915
• docs(presentation): polish exec-demo deck by @hellodk in #916
• feat(worker): resolve bootstrap SSH creds via credential_resolver (#913) by @hellodk in #919
• chore(salt): retire dead ml.mlx_cluster primitive (#882) by @hellodk in #918
• feat(frontend): push live job/bootstrap state via SSE — final polling migration (#756) by @hellodk in #917
• test: convert source-scrape unit tests to behavioral (batch B) (#671 #800) by @hellodk in #920
• test: convert source-scrape unit tests to behavioral (batch A) (#800 #671) by @hellodk in #922
• feat(events): push Salt ExecutionJob (+Celery) state over SSE (#921) by @hellodk in #923
• test: convert/harden source-scrape unit tests (batch D) (#671 #800) by @hellodk in #925
• feat(creds): drop deprecated inline ssh_* credential columns from nodes/groups (#913) by @hellodk in #924
• test(unit): convert source-scrape tests to behavioral — batch E (#800) by @hellodk in #928
• fix(e2e): make Playwright suite green — seed fixtures + spec drift + validation 500 (#905) by @hellodk in #926
• test(unit): convert source-scrape tests to behavioral — batch G (#800) by @hellodk in #929
• test(unit): convert source-scrape tests to behavioral — batch F (#800) by @hellodk in #930
• fix(frontend): restore Tailwind v4 plugin, keychain autofill polish, fix kri seed path by @hellodk in #932
• fix(frontend): show Bootstrap form on unregistered nodes by @hellodk in #933
• fix(llm): support reasoning models, token accounting + agent quarantine by @hellodk in #936
• docs(platform): Ansible/Salt compliance contract for external apps by @hellodk in #937
• docs: Ansible role-consolidation + push-telemetry bootstrap design by @hellodk in #934

Full Changelog: v1.0.0...v0.1.609