v0.21.0
portunus-vault-trust-and-access (Chain C -- epic complete, 10/10)
Follow-on to v0.20.0. Completes the epic.
- LLM-suggests, human-confirms metadata --
portunus_suggest_metadataMCP tool proposes description/purpose/tags/group into a pending sidecar, never the live field. Confirm applies via the sameretag()a manual edit would use; reject discards without ever touching the live field. - Role/policy schema -- STUB ONLY --
portunus roles set/delete/show+ a new Settings page. Writes genuinely persist, butcheck_injectable()/retag()are byte-identical whether or not any policy exists -- proven directly, not just asserted. Deliberate groundwork for Petitio's future access-level engine. - Settings page -- org/project hierarchy overview + roles config, always visibly labeled "not yet enforced."
- Expanded first-run setup wizard -- explains Portunus, walks through your first vault's backend choice (including a real in-UI trigger for
gcloud auth login), a literally-disabled roles preview, and a first discover pass. Only ever shown once, on a genuinely uninitialized vault. - In-app About/Help page.
Full changelog: https://github.com/mdostal/portunus/blob/main/CHANGELOG.md#0210---2026-08-15