1.14.0

Metadata read

2026-10-09 · #94 · closes #83, #86, #87, #88, #89, #90, #91, #92, #93, #95, #96

Metadata read. New MetadataReader roles at organization, stack, namespace and module level let someone see the name and id of a stack, namespace, module, runner, agent or integration without being granted read on it. That is what a runner or integration administrator needs to find the stacks and namespaces they must supply to. The terraform data sources use it too, so looking something up by name no longer needs full read. MetadataReader is now also a role on runners, agents and integrations.

Supplying something makes it nameable. A runner, agent or integration supplied to a stack, namespace or module can now be named by anyone who can read that scope, without a separate role on the runner, agent or integration. A stack role covers whatever is supplied below it.

The dashboard says what it will refuse, instead of failing. A form you cannot save opens read-only, saying so at the top, and an action you do not have permission for explains that in the dialog rather than erroring on click. Lists that might be empty because of permission now say so, instead of just looking empty.

A refused action no longer breaks the page. You get a notification and the page keeps working. When something does genuinely break, the error banner now carries enough detail to report it.

Destroying many modules at once no longer deadlocks. A destroy that removed several modules' inputs in parallel could fail some of them with a 500, reported as a transient failure suggesting retries. The dependency edge rebuild was taking a row's indexes in two different orders; it no longer does.

Upgrading applies a migration to IntegrationRoleAssignments that moves existing rows onto the correct foreign key columns, and migrations that add the tables and triggers behind the supply change above. Those work out the new access for the roles and supplies you already have, as part of the upgrade. A further migration redeploys the dependency edge rebuild.