v1.0.0

Orion Belt v1.0.0

First release we’re calling stable for the SSH PAM/bastion: CA, MFA, JIT, ReBAC, recording, live watch, packages, and a documented /api/v1 compatibility promise. Not a new protocol or IdP — OIDC, HA, and RDP/VNC come later.

Highlights

• Permissions editor: all grants, edit remotes/TTL, upsert (GET/PATCH /admin/permissions)
• Recording compression (gzip / OBGZ1; recording.compression)
• Live session watch (GET /sessions/:id/watch + Sessions → Watch)
• Notification templates + per-user prefs
• JIT: optional access_type, reject notifications, stale pending expiry
• Password + TOTP login (console / CLI); key-login MFA only when auth.mfa_required
• JSON logs, Prometheus alert examples, hardening + observability docs
• make release-smoke + docs/V1_RELEASE_CRITERIA.md

Compatibility

• /api/v1 is the stable contract for v1.x — see API_STABILITY.md
• Plaintext casts still play; new flushes default to gzip unless compression: none

Upgrade

• Restart the gateway after config changes
• From source: make build-ui if you need the latest console assets embedded

What’s next

OIDC, HA, multi-protocol proxies, SDKs, compliance packs — see the roadmap.

Full Changelog: v0.9.0...v1.0.0