1.9.0

The permission model, documented and browsable

2026-07-28 · #26 · closes #25

Every operation in the API reference now states which roles may call it, derived at generation time from the same permission maps the server enforces — so documentation and enforcement cannot diverge. 354 operations documented, 15 explicitly skipped with a stated reason, 0 silent gaps. A new endpoint cannot ship undocumented; pre-commit fails.

• PermissionDocExtractor resolves each controller action to the secured repository that enforces it, convention-first with [PermissionSource] as an explicit override. Pure reflection off uninitialised instances, so the live server and the headless generator emit identically.
• Machine-readable and human-readable — an x-snapcd-permissions extension for tooling, and a "Required permissions" block in each operation description for readers.
• /RoleCapabilities dashboard page for browsing the catalogue in-product.

This release also fixed enforcement gaps that the unification surfaced: corrected parenthesisation in the run-job role check, added missing authorization on MissionRun cancel/rerun, aligned StackContributor and StackReader across the stack subtree, and unified role-assignment repositories on {Owner, IdentityAccessManager} for all verbs.

Behaviour change: Contributor no longer grants the ability to manage role assignments. Review any grants that relied on it.