v1.0.11

Install this release:

bash <(curl -fsSL https://raw.githubusercontent.com/llmsyscore/llm-systems-manager/main/tools/installer/install.sh) --ref v1.0.11

The installer verifies llm-systems-manager-v1.0.11.tar.gz.sha256 before deploying anything.

---

This release consolidates and supersedes v1.0.8–v1.0.10 (published and replaced the same day while the Homebrew restart/InfluxDB work was hardened; those releases have been removed). Everything below is new since v1.0.7.

Homebrew install — fixed end to end (#437, #440, #442, #444, #447)

• Admin-tab restarts work under brew. The manager detects it runs from a Homebrew keg and restarts via process-exit instead of the sudoers systemctl grant (fixes the HTTP 500 "not permitted by sudoers"); the alarm-engine restart button now appears when the AE keg is installed, and restarts it via its management API (#437/#438).
• Self-restarts actually respawn. Homebrew's generated systemd units are Restart=on-failure, which excludes SIGTERM — so the old SIGTERM-self restart left services dead. The alarm engine hard-exits 1 on a requested restart (#442/#443) and caps its graceful shutdown at 10s so stops no longer hang on the manager's alarm WebSocket (#440/#441). The agent restarts via a programmatic uvicorn shutdown followed by exit 1, preserving its metric-drain/child-cleanup shutdown work — brew-installed agents can now be restarted from the admin tab and complete self-updates; a genuine startup failure now exits 3 instead of masquerading as a clean stop (#444/#449). The agent's first-TLS auto-restart is covered too.
• InfluxDB setup is automated — and targets the right InfluxDB. Two real-world traps fixed: the influx CLI ships in the separate influxdb-cli formula, and Homebrew's plain influxdb formula is now InfluxDB 3.x, which has no v2 API and never answers the v2 health endpoint this stack needs. Docs and caveats now say brew install influxdb@2 influxdb-cli, and the new llm-systems-influx-setup command (installed by the manager formula) starts the influxdb@2 service, onboards it, creates the alarm_engine_metrics + alarm_engine_metrics_rollup buckets with read/write scoped tokens, and writes them (plus the operator token) into [influxdb.tokens] — secrets never touch process argv (#437, #447/#448). The helper waits up to 120s with progress, bails out early with full diagnostics (service state + influxd log tail) if the service errors, gives a targeted message when only the v3 formula is installed, and is idempotent.
• Tap-side cleanups (llmsyscore/homebrew-tap): deduplicated caveats, dev/CI files pruned from the kegs (matching the deb/rpm payload), and the agent formula seeds the full example config with AGENT_OS set per platform instead of a one-line stub.

Release engineering

• Artifact-gated releases (#445/#446, #450/#451). The release pipeline now runs the full brew control-plane e2e — install, health, the alarm-engine self-restart, and real InfluxDB@2 provisioning via llm-systems-influx-setup — against the just-built tarball on macOS and Linux, and only publishes (release, deb/rpm, ghcr images) when it passes. This release is the first published through the gate. A workflow_dispatch dry-run mode tests any tag without publishing.
• Tap auto-bump fixed (llmsyscore/homebrew-tap#4, #6): the 6-hourly bump workflow now opens a PR via a GitHub-signed API commit instead of pushing to the protected main (which the ruleset rejected on every real release).
• CI now exercises the InfluxDB provisioning chain end to end — buckets created, tokens written to the TOML, permissions kept 0600, idempotent re-run (#447, homebrew-tap#5).

Component versions

Component	Version
Manager	v2026.07.19-1
Alarm engine	v2026.07.19-3
Agent	v2026.07.19-2

v1.0.7

Install this release:

bash <(curl -fsSL https://raw.githubusercontent.com/llmsyscore/llm-systems-manager/main/tools/installer/install.sh) --ref v1.0.7

The installer verifies llm-systems-manager-v1.0.7.tar.gz.sha256 before deploying anything.

What's Changed

🐛 Bug Fixes

• #416: install methods must not damage each other — guards, scoped purge, mixed-state CI by @adrielnava in #417
• #421 #423: split-smoke authenticated proxy assertion + resilient influxdb2 purge by @adrielnava in #427
• #432: deb/rpm install/uninstall safety — purge scope, AE token gating, debconf URL validation, token display, payload audit by @adrielnava in #434
• #433: truthful InfluxDB status, no downgrade offers, packaged-unit restart buttons, docker tabs + fresh pulls, install output formatting by @adrielnava in #435

✨ Enhancements

• #387: Homebrew tap installer for the macOS agent + brew install CI by @adrielnava in #428

📝 Documentation

• #429: document the Homebrew (macOS) agent install method by @adrielnava in #430

Other Changes

• #418: shellcheck + actionlint CI gates + fixes for surfaced findings by @adrielnava in #419
• #418: split-install (modes 3+4) CI coverage + fix mode-4 no-InfluxDB die by @adrielnava in #420
• #418: CI — full-script uninstall + agent malformed-config no-restart-loop by @adrielnava in #422
• #418: CI — LSM_ env-completeness guard + InfluxDB notice assertion by @adrielnava in #424
• #418: CI — --source local (offline) + --source git install path jobs by @adrielnava in #425
• #418: CI — released → PR docker upgrade/persistence job by @adrielnava in #426
• #431: Homebrew expansion groundwork — brew config seeder, multi-OS brew CI, docs by @adrielnava in #436

Full Changelog: v1.0.6...v1.0.7

v1.0.6

Install this release:

bash <(curl -fsSL https://raw.githubusercontent.com/llmsyscore/llm-systems-manager/main/tools/installer/install.sh) --ref v1.0.6

The installer verifies llm-systems-manager-v1.0.6.tar.gz.sha256 before deploying anything.

What's Changed

✨ Enhancements

• #385: native .deb/.rpm packages for the manager + alarm engine by @adrielnava in #415

Full Changelog: v1.0.5...v1.0.6

v1.0.5

Install this release:

bash <(curl -fsSL https://raw.githubusercontent.com/llmsyscore/llm-systems-manager/main/tools/installer/install.sh) --ref v1.0.5

The installer verifies llm-systems-manager-v1.0.5.tar.gz.sha256 before deploying anything.

What's Changed

🐛 Bug Fixes

• #411: vLLM dashboard tab — host system metrics (CPU/RAM/Net/Disk) by @adrielnava in #413
• #412: containerized control plane — host-agent recognition + working restart buttons by @adrielnava in #414

Full Changelog: v1.0.4...v1.0.5

v1.0.4

Install this release:

bash <(curl -fsSL https://raw.githubusercontent.com/llmsyscore/llm-systems-manager/main/tools/installer/install.sh) --ref v1.0.4

The installer verifies llm-systems-manager-v1.0.4.tar.gz.sha256 before deploying anything.

What's Changed

🐛 Bug Fixes

• #403: self-update proxy surfaces non-SSE error bodies as a clean done frame by @adrielnava in #410

✨ Enhancements

• #392 #393: frozen-agent self-update + container guard for update.sh by @adrielnava in #404
• #389: offline install from an extracted release tarball (--source local) by @adrielnava in #408
• #407: ship the binary agent as a per-platform tarball (binary + example config + unit) by @adrielnava in #409

Other Changes

• #405: bucket PRs in auto-generated release notes by label by @adrielnava in #406

Full Changelog: v1.0.3...v1.0.4

v1.0.3

Install this release:

bash <(curl -fsSL https://raw.githubusercontent.com/llmsyscore/llm-systems-manager/main/tools/installer/install.sh) --ref v1.0.3

The installer verifies llm-systems-manager-v1.0.3.tar.gz.sha256 before deploying anything.

What's Changed

• #397: fix misleading Docker LSM_ALARM_ENGINE_URL guidance by @adrielnava in #398
• #400: native agents reach a Dockerized alarm engine over TLS by @adrielnava in #401
• #399: frozen agent — restore LD_LIBRARY_PATH for system shell-outs by @adrielnava in #402

Full Changelog: v1.0.2...v1.0.3

v1.0.2

Install this release:

bash <(curl -fsSL https://raw.githubusercontent.com/llmsyscore/llm-systems-manager/main/tools/installer/install.sh) --ref v1.0.2

The installer verifies llm-systems-manager-v1.0.2.tar.gz.sha256 before deploying anything.

What's Changed

• #395: Docker default login/admin fix + config-render completeness + no-clone quickstart by @adrielnava in #396

Full Changelog: v1.0.1...v1.0.2

v1.0.1

Install this release:

bash <(curl -fsSL https://raw.githubusercontent.com/llmsyscore/llm-systems-manager/main/tools/installer/install.sh) --ref v1.0.1

The installer verifies llm-systems-manager-v1.0.1.tar.gz.sha256 before deploying anything.

What's Changed

• #384: Docker Compose control-plane release via ghcr.io by @adrielnava in #390
• #386: PyInstaller single-file agent binaries (Linux + macOS) by @adrielnava in #391
• Fix arm64 ghcr image builds: libc6-dev beside gcc + arm64 PR build check by @adrielnava in #394

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Install this release:

bash <(curl -fsSL https://raw.githubusercontent.com/llmsyscore/llm-systems-manager/main/tools/installer/install.sh) --ref v1.0.0

The installer verifies llm-systems-manager-v1.0.0.tar.gz.sha256 before deploying anything.

What's Changed

• docs: host README screenshots in-repo (fix broken images for logged-out visitors) by @adrielnava in #5
• chore: repoint references to llmsyscore org + add SECURITY.md by @adrielnava in #7
• fix(installer): drop privileges via as_run_user instead of $SUDO -u by @adrielnava in #9
• fix(alarm-engine): logged best_effort for broad except-pass (#10, 1/3) by @adrielnava in #11
• fix(manager): logged best_effort for broad except-pass (#10, 2/3) by @adrielnava in #14
• fix(agent): logged best_effort for broad except-pass (#10, 3/3) by @adrielnava in #15
• fix(alarm-engine): DB-first update_config + drop dead method (#12, #13) by @adrielnava in #17
• fix(agent): truthful bench/autotune cancel reporting (#16) by @adrielnava in #18
• fix(manager): read Cheroot qsize property, not method (#21) by @adrielnava in #22
• fix(alarm-engine): clamp reactivex "Rx" logger to WARNING (#23) by @adrielnava in #24
• fix(manager): text/plain proxy errors, stop reflecting method/exception (#27) by @adrielnava in #28
• fix(manager): escape/coerce data at frontend DOM-XSS sinks (#29) by @adrielnava in #31
• fix(alarm-engine): escape agent/operator data at main.js DOM-XSS sinks (#30) by @adrielnava in #32
• fix(agent): honest pkill exit code on no-tracked-process cancel branch (#20) by @adrielnava in #35
• fix(alarm-engine): 422 + log when a found notification config is unparseable (#19) by @adrielnava in #36
• feat(manager): manager-origin CSP on proxied HTML instead of stripping it (#34) by @adrielnava in #37
• fix: stop leaking exception/traceback text in HTTP/SSE responses (#33) by @adrielnava in #38
• fix(manager): allow cdn.jsdelivr.net in proxy CSP so the AE SPA Chart.js loads (#39) by @adrielnava in #40
• fix(manager): harden /alarm/ frontend path guard against sibling-prefix bypass by @adrielnava in #42
• fix(manager): serve alarm index from a constant path to clear CodeQL #63 by @adrielnava in #44
• fix(manager): route alarm frontend assets via send_from_directory to clear CodeQL #73 by @adrielnava in #46
• fix: resolve four code-quality scanning findings by @adrielnava in #48
• fix: harden the broad empty-except handlers (py/empty-except) by @adrielnava in #50
• fix: remove dead module globals (py/unused-global-variable) by @adrielnava in #52
• fix: remove unused JS local variables (code scanning) by @adrielnava in #54
• fix: clear CodeQL dead-code findings (unused imports, dead local, duplicate imports) by @adrielnava in #56
• refactor(alarm-engine): public TTL accessor, derived venv paths, document TOML regex by @adrielnava in #58
• style: split import, name WS-host skip set + test poll constants by @adrielnava in #60
• refactor: dedupe normId, fix docstring, clarify auto_resolve_cycles, consolidate time import by @adrielnava in #62
• refactor(alarm-engine): correct stale seed docstring, hoist update field set, minor renames by @adrielnava in #64
• refactor(alarm-engine): accurate warning, warm-up debug log, shared default/uuid helpers, alert cache TTL setting by @adrielnava in #66
• refactor(alarm-engine): address CodeQL findings in repositories.py by @adrielnava in #69
• feat(branding): replace site logo with Context concentric-ring mark by @adrielnava in #72
• fix(manager): use longer lifetime cap for proxied long-running op streams by @adrielnava in #74
• feat: configurable llama.cpp install/upgrade methods by @adrielnava in #75
• docs(readme): note configurable llama.cpp install methods by @adrielnava in #76
• fix(manager): exclude venv from agent self-update bundle by @adrielnava in #78
• fix(agent): report llama build failure when a required tool is missing by @adrielnava in #80
• fix(agent): preflight per-method build tools; pick unzip/tar by asset extension by @adrielnava in #82
• fix(agent): select release_binary asset by backend (default CPU) by @adrielnava in #85
• feat(agent): setup-time llama.cpp install (#88) + true in-place upgrade (#89) by @adrielnava in #90
• fix(agent): propagate new config sub-keys into untouched blocks on upgrade (#91) by @adrielnava in #92
• fix(agent): filter tar members on self-update extract (#93) by @adrielnava in #94
• fix(agent): cap source-build -j at nproc, never emit bare -j by @adrielnava in #95
• fix(agent): source upgrade rebuilds existing tools + post-swap cleanup by @adrielnava in #99
• feat(agent): benchmark falls back to PATH when tool not beside LLAMA_BIN by @adrielnava in #100
• fix(agent): source build sets CMAKE_BUILD_TYPE=Release + HIP env for rocm by @adrielnava in #108
• fix(manager): keep per-card avg gen/prompt t/s live, stop flicker to dashes by @adrielnava in #109
• fix(agent): installer auto-llama — clean output, fix sed crash, add failure menu (#103-106) by @adrielnava in #111
• fix: hf download output formatting (#102) + llm-control panel reset on agent switch (#101) by @adrielnava in #112
• fix(agent): make release_binary in-place upgrade idempotent (#107) by @adrielnava in #113
• fix(agent): config reconcile adds missing sub-keys to activated blocks (#96) by @adrielnava in #115
• fix(manager): seed per-card perf cells so re-renders don't flash blank (#110) by @adrielnava in #116
• fix(agent): gate liquidctl on real hardware + scrub non-finite metric floats (#119) by @adrielnava in #120
• fix(manager): hide Admin tab unless role admin AND admin-CIDR (#117) by @adrielnava in #121
• fix(agent): flat release_binary install so upgrades don't break systemd (#118) by @adrielnava in #122
• docs(agent): annotate CodeQL py/empty-except handlers in llama modules (#123) by @adrielnava in #124
• refactor(auth): remove two dead module globals (#127) by @adrielnava in #128
• fix(manager): backfill perf sparklines on manager-tab entry (#131) by @adrielnava in #133
• harden(agent): contextual release-move error + reject '..' in version (#129) by @adrielnava in #135
• test(manager): add frontend JS unit-test harness + extract series helpers by @adrielnava in #136
• feat(agent): subscribe to llama.cpp /models/sse for push-based model state by @adrielnava in #142
• fix(manager): stream proxied event-stream upstreams via thread_pumped by @adrielnava in #143
• fix(agent): treat idle /models/sse read-timeout as benign reconnect by @adrielnava in #145
• Enable the agent's InfluxDB self-monitor probe (read unified-...