v0.17.1

Added

• Administrators can pin an immutable default image for each platform
  component through authenticated image-default endpoints.
• Component image lists identify the pinned default so user-facing clients can
  preselect it and fall back to the latest image when no valid pin exists.

v0.17.0

Added

• Proof-authenticated auth/oob Trust Tasks let an existing Keyring identity
  sign in through a short-lived QR or same-device request, a two-digit
  confirmation, explicit wallet approval, and a bounded browser session.
• Completed VTA claims and administrator grants create revocable Keyring login
  bindings; verified legacy claims are linked on first use, and users can list
  or revoke bindings together with their derived sessions.
• Farm DID documents advertise a validated SignInPortal service, and a new
  integration contract documents the Keyring sign-in protocol and outcomes.

Changed

• The Helm chart configures the sign-in portal from the frontend host by
  default and supports a Farm display name for Keyring approval screens.
• The Keyring acquisition contract now covers both authenticated and public
  VTA claims and separates acquisition from the new sign-in flow.

v0.16.1

Changed

• Updated Trust Task protocol support for VTA authentication and errors, DID
  Hosting ACL management, and the related Go dependencies.

Fixed

• Full Stack setup recovery includes an enabled Trust Registry and can resume
  failures from its final setup step.
• Trust Registry DID verification uses propagation-aware public DNS lookups so
  newly created records are not blocked by stale host-level DNS caches.

v0.16.0

Added

• Capability-token-protected public endpoints reserve, inspect, confirm, and
  reject claims from enabled public-signup VTA pools without requiring a Farm
  account.
• Administrators can create and pause public-signup pools, monitor public
  inventory states, and add capacity to an existing pool with idempotent
  admission and preparation.
• Startup recovery resumes interrupted pool preparation alongside sessions and
  upgrades.

Changed

• Updated Trust Tasks Go dependencies.

Fixed

• VTA DID logs are validated and stripped of merged command diagnostics before
  publication to DID Hosting.

v0.15.2

Breaking

• Removed the standalone /api/v1/status/vta endpoint; VTA availability is
  now included in /api/v1/status/platform.

Added

• Public infrastructure status reports sanitized Database, Kubernetes, and
  Vault component states in one response.
• Public platform status reports sanitized VTA, Mediator, DID Hosting, and VTC
  component states while collecting concurrent failures without fail-fast
  cancellation.

v0.15.1

Added

• Public, rate-limited status endpoints report VTA Farm control-plane, VTA,
  and shared-platform availability without exposing dependency or
  infrastructure details.

Changed

• Internal monitoring endpoints accept MONITOR_TOKEN through Authorization
  Bearer authentication so credentials do not need to appear in monitored
  URLs; query-token authentication remains temporarily available for cutover.

v0.15.0

Added

• Full Stack deployments can optionally provision a Trust Registry during
  creation or enable one later, with resumable setup, explicit failure states,
  and safe teardown behavior.
• Trust Registry provisioning creates its identity, grants setup access,
  publishes its referral through the VTA, configures the VTC, and verifies the
  resulting connection.
• Trust Registry images, resource defaults, capacity estimates, upgrades,
  exports, and recovery are supported alongside the existing Full Stack
  components.

v0.14.2

Changed

• Updated the Trust Tasks Go dependency.

Fixed

• Legacy mobile connection reservations are settled during migration so they
  no longer prevent users from creating or refreshing QR codes.
• Failed Keyring administrator grants reach a final state, expose the failure
  reason, and allow users to generate a new QR code instead of repeatedly
  retrying the failed grant.

v0.14.1

Added

• Users and administrators can recover sessions that fail during component
  deployment by selecting replacement images and resuming from the failed
  stage. Recovery reconciles existing deployments while preserving PVC data
  and completed setup jobs.
• Full-stack recovery accepts image selections for VTA, Mediator, DID Hosting,
  and VTC; VTA-only recovery accepts the VTA image.

Fixed

• Container image responses list latest, nightly, and main builds ahead
  of other available images.

v0.14.0

Added

• Administrators can create batches of pre-provisioned VTAs, reserve them for
  QR-based claims, confirm or reject claimants, retry failed preparation, and
  clean up unused inventory.
• Pooled VTAs prepare DNS, DID, storage, and Kubernetes resources in advance,
  then remain scaled to zero until a confirmed claim activates them.
• Container image responses identify latest, nightly, and main builds and
  include image creation times.

Changed

• Cluster capacity estimates account for pooled inventory while distinguishing
  parked, zero-replica VTAs from active workloads.
• Updated Go networking, synchronization, and WebAuthn dependencies.