OpsWarden v1.0.13

OpsWarden v1.0.13 closes the P0–P3 recovery and hardening roadmap.

Alertmanager acceptance

• The rule form exposes both alert_firing and alert_resolved and explains
  that resolution is an independent event, not an automatic incident close.
• Component and real-browser tests cover the lifecycle contract at a mobile
  viewport.
• The exact 1 MiB body boundary is tested.
• A pinned, bounded mutation campaign tested 48 mutations in the Alertmanager
  trust boundary: 45 caught, three compile-time unviable, none surviving.

Deployment security

• Browser WebSocket upgrades require an exact configured Origin; cross-site,
  null, malformed and repeated origins receive HTTP 403 before upgrade.
  Originless native clients remain supported and still authenticate in-band.
• Every application Docker build/runtime base is pinned to an immutable
  multi-architecture SHA-256 digest, with a CI regression gate.
• New SQL migrations are immutable and explicitly classified as expand,
  backfill or contract. Destructive SQL is rejected from compatible phases.

The companion Ops releases add backup freshness alerts, guarded Kubernetes
release-state restoration and centralized Loki/Alloy log collection.

Install

Platform	Artifact
Linux (Debian/Ubuntu)	OpsWarden_1.0.13_amd64.deb
Linux (portable)	OpsWarden_1.0.13_amd64.AppImage
Windows	OpsWarden_1.0.13_x64-setup.exe
macOS	OpsWarden_1.0.13_aarch64.dmg

Verify a download against SHA256SUMS. Every artifact carries a GitHub
build-provenance attestation.

Server image

ghcr.io/opswarden-git/opswarden-server@sha256:1acd2b9bff23bf61bd014cfe38d1680ab0f9a9bd301a15c8f167720d7b488919

Production pins this digest, never a mutable tag.

What's Changed

• docs: reconcile roadmap after v1.0.12 by @RomeoCavazza in #130
• refactor: split websocket and reaction tests by @RomeoCavazza in #131
• refactor(server): split automation config domain by @RomeoCavazza in #132
• refactor(server): split PostgreSQL adapter tests by @RomeoCavazza in #133
• refactor: finish splitting oversized source files by @RomeoCavazza in #134
• docs: reconcile the post-backup roadmap by @RomeoCavazza in #135
• test(alertmanager): enforce lifecycle acceptance by @RomeoCavazza in #136
• feat(security): complete P3 deployment hardening by @RomeoCavazza in #137
• Release v1.0.13 by @RomeoCavazza in #138

Full Changelog: v1.0.12...v1.0.13