v1.0.0-rc.3

Features

• Discovering now first connects to the destination Spacelift account and records its VCS integrations and worker pools, so a bad Spacelift credential (or an account with nothing that can actually run a plan) fails immediately instead of after a long walk through the source estate.
• Exported stacks and modules are matched against the destination account's VCS integrations and, where exactly one match exists, bound to it; an account with more than one matching integration can be disambiguated with a new source setting. Generated code now renders that bound integration and, for repositories tracked by raw git, a dedicated block carrying the repository URL.
• Added an audit check that fails an account outright if it has no worker pool able to accept a run — no undrained worker in any private pool, and no usable public pool — since the generated migration itself needs somewhere to run.
• Added a context-secrets mutation capability: secret values held on a shared variable set, which previously always came over empty, can now be recovered (opt-in, same throwaway-and-revert discipline as the existing secret capture) alongside per-workspace secrets.
• Terraform private-registry providers are now discovered, audited, and generated as their Spacelift equivalent, placed in their real space; only the provider definition migrates, so a finding flags each one to re-publish its versions afterwards.
• Run tasks are now discovered and surfaced as an audit-only finding naming each one and how many workspaces use it, since the external callout has to be reconnected by hand.
• Policies and policy sets are now discovered and surfaced as audit-only findings, since there's no reliable automatic translation of the underlying rules.
• Added a publish last command that re-fetches and replays the admin stack's most recent plan or apply log, so a scrolled-past run can be reviewed again without re-running or re-planning.
• Applying a plan now requires proof the latest plan was actually read and a person's explicit approval; an agent acting alone can no longer trigger an apply, and the flags involved have changed accordingly.
• Mutating a staged batch now requires a person's prior, explicit approval of exactly which capabilities will run; an agent cannot grant that approval on its own, and approval is invalidated automatically if the staged batch changes before it runs.
• An AI agent driving discover or mutate is now required to first read the relevant guidance and prove it did so; a human at an interactive terminal is unaffected.
• Stacks whose source Terraform version is newer than what the runner supports are now generated in a runnable state on a custom workflow, with a scaffolded runner image and init/plan/apply/destroy commands, instead of landing broken.

Fixes

• A stack or module with no VCS repository, generated with the corresponding finding ignored, now renders a placeholder that actually plans instead of an empty required value that fails validation outright.
• A Terraform workflow-tool version expressed as a range (rather than an exact version) is now classified correctly, fixing cases where a bounded range was incorrectly treated as requiring the custom workflow.
• A captured secret is now matched by its kind as well as its key, fixing a case where a Terraform variable and an environment variable sharing the same name could have their captured values cross over.
• When more than one mutation capability is requested in a single run, they now execute one at a time rather than concurrently, avoiding the risk of two capabilities colliding while writing to the local store at the same time.
• Discover no longer captures an agent pool's live agent count, which changes as agents connect and disconnect and was making repeated discover runs against an unchanged estate report differently each time.
• Finalizing a staged batch now refuses to proceed while it still holds captured secret values or state that haven't been pushed to Spacelift yet, naming what's outstanding and which command to run first; the suggested next step after mutating now points through the right order of finalize steps; and a finalize report now names each skipped item and the specific reason it was skipped, rather than just a count.
• Fixed capitalization of vendor acronyms (VCS, API, ID, JSON, SHA, URL) in human-readable table headers.
• Output written for piping (agent use) is no longer vulnerable to control characters or escape sequences leaking through from source data and corrupting the encoded result.

Security Updates

• Fixed a flaw where setting any single configuration value, even an unrelated one, could rewrite the whole configuration file with previously-referenced secrets (source tokens, the Spacelift key secret, VCS tokens) expanded to their literal plaintext on disk, instead of preserving the original reference.