v1.2.0

v1.2.0 — Source-aware visibility, whole-library processing, and safer lifecycle operations

A minor release that makes the shared research corpus private by default, adds whole-library
processing and scheduled discovery, and hardens the backup, restore, update, and uninstall
lifecycle. A paper is public only when a trusted server adapter promoted it, and every read path —
feed, knowledge graph, citation, summary, vector search, and Ask — resolves access through one
persisted rule. This release changes application code, so the :1.2.0 images differ from :1.1.3.

Migrations 0104, 0105, and 0106 apply automatically and idempotently at startup and move the
corpus to the source-aware visibility model; verified scholarly rows are backfilled as public and
all other existing rows become private-unless-shelved. Migrations are forward-only — take a restore
point before upgrading.

Added

• Whole-library processing. An admin can queue eligible papers for download,
  analysis, and summary generation in one job, with per-paper progress and a
  partial result when some papers fail or are skipped.
• Paper knowledge export. A paper can be exported as Markdown with its
  summary, notes, cards, structured extractions, and BibTeX citation.
• Scheduled discovery. Each enabled source checks a rolling seven-day
  window for every configured topic, and administrators can opt in to automatic
  summaries for discovered papers.
• Ranking-model status. Pulse reports whether its learned ranking model is
  active instead of leaving the operator to infer it from results.
• Explicit instance ownership. Upgrades with one live administrator assign
  that account automatically; ambiguous multi-admin upgrades provide a host
  repair command, and database-managed owners can transfer safely in Admin.

Changed

• Safer lifecycle operations. Backup manifests bind every archive in a
  restore point; update transactions resume after interruption; uninstall is
  scoped to the registered Compose project; and recovery points are verified
  before a data-changing update proceeds.
• Clearer family access. Remote setup and sign-in require a verified named
  HTTPS address. Plain LAN HTTP exposes only /health/jarvis. Guided Tailscale
  setup can install the client with explicit consent on supported Linux hosts;
  private HTTPS, Cloudflare Tunnel, and Let's Encrypt paths report only what
  their checks prove. Cloudflare also has a non-interactive token-file path, so
  its credential never needs to appear in shell arguments. Multi-user installs
  can use privately shared one-time links when SMTP is not configured. A failed
  access-route change now restores and verifies the previous live dashboard and
  JARVIS-owned edge, not only its configuration file.
• Hardware-aware defaults. NVIDIA acceleration is selected when its runtime
  is ready, AMD uses ROCm only when the required device is available, and other
  AMD or Intel hosts stay on the supported CPU path unless Vulkan is selected
  explicitly.
• Complete disaster-recovery sets. Current restore points include the PDF
  object store and exactly the three keys coupled to restored data. Restores
  revoke transient sign-in state, preserve durable identities, rotate vector
  visibility state, and quarantine off-host integration credentials until an
  authenticated operator reviews them.
• Source-aware paper visibility. Only papers promoted by trusted server
  adapters are public. Local uploads, client-supplied batches, personal or group
  Zotero imports, unknown provenance, and ambiguous legacy Zotero rows remain
  private unless explicitly added to a user's library. Feed, graph, citation,
  summary, vector-search, and Ask paths use the same persisted rule.
• Audited frontend toolchain. Transitive YAML and glob parsers are locked to
  patched releases, and the existing Security workflow rejects future
  high-severity npm audit findings.

Fixed

• Shared papers survive user deletion. Removing a paper from one person's
  library no longer removes canonical data or another person's work.
• Embedding repair covers stale and missing vectors. Existing chunks are
  reconciled without downloading and parsing the PDF again.
• Partial jobs no longer read as complete. The Jobs panel labels partial
  outcomes separately and keeps their completed and failed counts visible.
• Cross-reference visibility matches Ask. Summaries and cross-paper
  retrieval now use the same persisted public-or-caller-library rule.

Upgrading

Run jarvis-research update (or ./update.sh); it stages the new application images (use
--build-local to rebuild from source), takes a fresh checksum-verified backup before the schema
migrations, advances the checkout fast-forward only, and commits after services report healthy. The
visibility migrations (0104–0106) are forward-only, so keep that restore point. To roll back to a
previously published release, pin JARVIS_VERSION to that tag and pull it.

Full changelog: CHANGELOG.md