v1.2.3

v1.2.3 — Runnable recovery procedures, a hardened outbound boundary, and a quick start

A patch release that closes the gap between what the product says and what it does: every documented recovery procedure is now a command that runs as written, provider model lists and background jobs report what actually happened, and the outbound address policy applies on every path. It also adds a one-screen quick start alongside the full deployment guide.
This release includes one automatic migration (0111); it applies on startup and needs no operator action.
This release changes application code, so the :1.2.3 images differ from :1.2.2.

Added

• Documented recovery procedures are commands you can run. Restoring an older unsigned backup on the same host, checking a restore's progress, and preparing an off-site restore request no longer require assembling container commands by hand, and accepting a backup whose database version cannot be checked is a flag on the same-host command (restore legacy … --allow-unknown-schema). Accepting an unverified backup still requires typing the acceptance phrase at a prompt, and an off-site set is refused outright. Checking progress and preparing a request work while the stack is stopped; restoring replays into a running database and says so instead of failing part way through.
• The models each provider actually offers. Provider configuration lists the models the provider reports, with an indication of how fresh that list is, rather than only a fixed built-in set. Vendor-namespaced identifiers from routers and self-hosted endpoints are accepted, and a provider that fails to answer is retried at a paced interval rather than on every request.
• A one-screen quick-start guide — clone, run setup, and analyze a first paper — alongside the full deployment guide for anything non-standard.
• The citation graph opens what it shows. Selecting a paper opens it; selecting a reference the library does not hold shows what is known about it.
• A durable second copy of the signed-restore requirement, so an update cannot silently return an installation to accepting unauthenticated backups.

Fixed

• Backup and restore integrity. A backup is refused when its encryption key is absent, when its manifest cannot gate a restore, and when a database dump is incomplete. Retention can no longer delete every restore point, a sweep reports what it really did, restoring a backup whose database version cannot be checked requires an explicit acknowledgement, and vector and off-site capture are reported honestly without blocking recovery.
• Background job outcomes. Jobs abandoned by an interrupted worker are marked failed with an instruction to start them again rather than sitting as running forever, and a failure to record that outcome is reported distinctly instead of being discarded. Advisory waits and batch sizes are bounded, duplicate scheduling is prevented, and periodic work stays on schedule across restarts.
• Account deletion and impersonation scope. Deleting an account revokes that user's sessions without disturbing anyone else's, a departed user's stored vectors and rows are verified to agree after a purge, and service impersonation is scoped to the address that may use it.
• Uninstall and setup. Uninstall shows every removal it will perform, including a directory outside the installation folder, keeps the backup offer when removing everything, and reports whether the final removal succeeded. Setup verifies the installed command can be found, and an interrupted install's staging folder — which can hold credential copies — is moved aside rather than deleted, and only when its owner is provably gone.
• A failed update always explains how to roll back, even when it cannot record its own progress.
• Local uploads are identified by their full content, so distinct documents are no longer treated as the same paper; migration 0111 derives the new identifier where the short form is unambiguous.
• Automation settings report partial saves honestly, and a skipped download is no longer shown as a failed step.

Changed

• The outbound address policy applies on every path. The Better BibTeX (Zotero) connection now refuses carrier-grade-NAT, reserved, multicast and unspecified destinations like every other outbound path, and re-checks the host on each request rather than trusting one indefinitely. A provider whose host resolves to a private address can be allowed deliberately, through a setting listing the hostnames permitted, rather than by disabling the protection.
• Git is no longer part of the supported operations path. The manual describes product commands throughout, repair-only fallbacks are labelled as such, and misuse of a command now names the correct invocation.
• Dependencies updated within their supported ranges, including the machine learning stack, and the hosted checks now run on a supported Node release. Dependency floors were raised to their patched releases, two expired exceptions in the Python dependency scan were removed so that scan runs with no exceptions at all, and the frontend scan carries one routing-library advisory with a dated removal trigger that does not affect a running instance.
• The upload area states the size limit it enforces. Single-file uploads accept up to 50 MB; whole-folder imports are unchanged.
• Documentation corrected where it described behavior inaccurately: cloud provider support, the knowledge graph controls, and how the scheduler treats a catch-up run that coincides with an interval run. The first-run tour no longer offers the topic step to signed-in users who cannot act on it.

Upgrading

An installation already on v1.2.2 upgrades in place:

jarvis-research update

An installation on v1.1.3, v1.2.0, or v1.2.1 runs the one-time bootstrap from the installation directory:

(
  set -e
  bootstrap="$(mktemp)"
  trap 'rm -f "$bootstrap"' EXIT
  curl -fsSL -o "$bootstrap" \
    https://raw.githubusercontent.com/limitcycle-oss/jarvis-rd-assistant/v1.2.3/scripts/update-bootstrap.sh
  bash "$bootstrap" --repo "$PWD" --to v1.2.3
)

Either path validates the selected release, creates and authenticates a restore point, stages the new images, advances the checkout fast-forward only, and commits after services report healthy. Because this release migrates data, rolling back to an earlier version afterwards requires a matching database restore.

Full changelog: CHANGELOG.md