v0.1.0-rc.1

0.1.0-rc.1 (2026-11-01)

Features

• audit: add event emitter with fail-closed default and stub JSONL sink (2d42f9b)
• audit: durable segmented spool and shipping consumer loop (37912b2)
• audit: Grafana dashboards, alert rules, and a Trino stand-in for Athena (e7f6a9f)
• audit: Grafana panels and schemas for actor_type and the CI run (people vs bots, bot sessions by repository) (76a9b35)
• audit: S3 and Datadog sinks with signed, hash-chained batches (aa9c99f)
• audit: ship events and recordings to the control plane (8639342)
• bots in audit events and the console (actor_type and the CI run on sessions, a Bots page, run links) (437f135)
• ca: bot certificates carry a marker and the CI facts; people can't use the bot: prefix (3dfbbf3)
• ca: issue and verify user and component certificates (c32ee9c)
• ca: SSH user and host CAs; worker labels in component certificates (f5cf87b)
• changes held for approval, and server-side guardrails (#195) (4f5e26f)
• cli: colour, glyphs, aligned tables, spinner, and tidy errors (4e0116b)
• cli: limen login --bot for GitHub Actions, GitLab, and any OIDC provider (442552a)
• cli: limen manage, the client guide, and the Phase 14 stage 1 demo (#193) (b9340b6)
• cli: limen ssh, ssh-proxy, and config ssh (e74591e)
• cli: login (PKCE and device), logout, status, ls, and admin commands (c61f76f)
• cli: resource filters, show/connect/conns, --detach, completions; console label filter (#89) (e770b1d)
• cli: scripts/install-cli.sh builds limen and installs it to ~/.local/bin (#24) (72de08c)
• cli: show a small logo on top-level help, --version and login (#165) (cea4fb2)
• component: shared identity storage, enrollment, and renewal (4ced612)
• compose: the kube stack's cluster is a Compose service (k3s) (#38) (3727817)
• console: audit trail page, outstanding join tokens, and an optional Grafana link (54acee5)
• console: auto-refresh list pages (#90) (94596eb)
• console: browser sign-ins last LIMEN_CONSOLE_SESSION_TTL (default 8h), separate from the CLI certificate (59f345c)
• console: built-in dashboards drawn as server-side SVG; drop the Grafana link (Grafana stays optional) (a574851)
• console: dashboards split people and bots and rank bot sessions by repository (7a60ded)
• console: edit what the console owns, and decide held policy changes (#198) (2f51326)
• console: pickable dashboards with drill-down and richer audit filters (#104) (2d8c142)
• console: redesigned console with light and dark themes, sign-in page, themed Dex (0b730cf)
• console: resource icons and colour, sign-out page (111c402)
• console: resources page (6d6c434)
• console: web console, worker revoke, and shared admin operations (f550c20)
• control-plane: bot login with workload identity tokens (GitHub Actions, GitLab, generic OIDC): exact matching, one use per token, audited with the CI run (28a3bcd)
• control-plane: labels on static join tokens (762c0c2)
• control-plane: list live tunnels for proxy peering (5a81c24)
• control-plane: OIDC login, policy admin, enrollment, and registry (6317df3)
• control-plane: one write path for policy, with an owner per document (#190) (31db9fe)
• control-plane: serve limen.manage.v1 for admins and bot writers (#191) (e0f5ec7)
• control-plane: serve signed policy snapshots and SSH session certificates (a19c080)
• control-plane: user certificates last 1 hour by default, set with --default-cert-ttl (#166) (1a49aeb)
• core: add secret wrapper, identity URIs, and jittered backoff (5bac19e)
• every kind through the management API, and writers' roles and mappings (#197) (3622490)
• lock users and kill sessions (7521aca)
• metrics reference, CA signing metrics, and alert examples (#102) (e5f55a4)
• Phase 10, OpenSearch and Elasticsearch access (ADR-0036) (#35) (38ec584)
• Phase 11, RabbitMQ and Kafka access (ADR-0037) (#33) (5a742cf)
• Phase 12 internal web SSO and TCP access (ADR-0022) (#47) (5f89d63)
• Phase 13 access workflows and insight (#124) (c07a5ac)
• Phase 4 demo, development fake CI issuer, bots guide, policy reference, threat model TB8, ADR-0019 accepted, ADR-0032 (agents) (63357fa)
• Phase 5, scale-out (ADR-0020) (#26) (fbc66c4)
• Phase 6, SQL database access: PostgreSQL, MySQL, Aurora, Redshift (ADR-0033) (#27) (7f31576)
• Phase 7, Redis and Valkey access (ADR-0034) (#29) (38b653f)
• Phase 8, Kubernetes access by impersonation ...