v0.3.0

Changelog

Features

• f0c76d5: feat!: move secret ownership from the key to the project (@steveokay)
• b594530: feat(cli): add janus doctor preflight/diagnostic command (@steveokay)
• afc9772: feat(cli): janus admin reset-password — local-console disaster recovery (@steveokay)
• 62f1be3: feat(rbac): Groups screen + group bindings on Members (@steveokay)
• f6ccb03: feat(rbac): group CLI + OpenAPI spec (@steveokay)
• 56f2925: feat(rbac): group role bindings, schema + engine + OIDC claim sync (@steveokay)
• 93ba713: feat: delegated project creation via groups (@steveokay)
• b0c4884: feat: four-eyes protection at environment scope (@steveokay)
• 4f3b502: feat: scoped audit read (@steveokay)

Fixes

• 8872726: fix(cli): reuse one share reader so a piped quorum is read in full (@steveokay)
• efd4f87: fix(deps): bump grpc to v1.82.1 for GO-2026-6061 (@steveokay)
• 03ac699: fix(web): Members reported group-derived access as no access (@steveokay)
• e8e8e72: fix(web): read the protected (four-eyes) flag from the server, not the cache (@steveokay)
• 1568902: fix: authorize project creation before reading the request body (@steveokay)
• f1782db: fix: let a delegated creator see the owning-team picker (@steveokay)
• e775770: fix: the three remaining defects the new E2E coverage found (@steveokay)

Others

• a1839d3: Merge pull request #198 from steveokay/worktree-agent-ad96aa07185cd35c0 (@steveokay)
• 079e374: Merge pull request #199 from steveokay/worktree-agent-acb2fce15c0f7536f (@steveokay)
• 659ca05: Merge pull request #200 from steveokay/worktree-agent-ab8b6662897d04067 (@steveokay)
• 998abd5: Merge pull request #201 from steveokay/docs/wire-post-v020-work (@steveokay)
• 0d690cb: Merge pull request #202 from steveokay/fix/deep-link-protected-flag (@steveokay)
• 160a772: Merge pull request #203 from steveokay/ci/test-timeout (@steveokay)
• fa7dcad: Merge pull request #204 from steveokay/fix/rbac-probe-limiter-and-ui-defects (@steveokay)
• ea74309: Merge pull request #205 from steveokay/docs/track-rbac-org-scale (@steveokay)
• 2249b95: Merge pull request #206 from steveokay/feat/rbac-groups (@steveokay)
• e2b2dab: Merge pull request #207 from steveokay/fix/members-group-derived-access (@steveokay)
• 282b2e9: Merge pull request #208 from steveokay/feat/env-scoped-four-eyes (@steveokay)
• e82b8cc: Merge pull request #209 from steveokay/feat/delegated-project-creation (@steveokay)
• 644ecba: Merge pull request #210 from steveokay/fix/project-create-authz-ordering (@steveokay)
• fd548a5: Merge pull request #211 from steveokay/fix/delegated-creator-picker (@steveokay)
• 37cfacc: Merge pull request #212 from steveokay/feat/scoped-audit-read (@steveokay)
• 7c4d1b6: Merge pull request #213 from steveokay/feat/project-owner (@steveokay)
• 6e30ba3: Merge pull request #214 from steveokay/docs/release-0.3.0 (@steveokay)
• 8990d24: Merge remote-tracking branch 'origin/main' into worktree-agent-ab8b6662897d04067 (@steveokay)
• b30a20d: ci: give go test an explicit timeout instead of inheriting the 10m default (@steveokay)
• 100ae0d: docs: cut CHANGELOG 0.3.0 (@steveokay)
• 9264477: docs: design for group-based role bindings (@steveokay)
• 75e102d: docs: groups guide, trackers, CHANGELOG, and the follow-ups this build raised (@steveokay)
• 14fb6d3: docs: sweep every reference doc for group staleness (@steveokay)
• e1783f6: docs: track RBAC for an organisation with many product teams (@steveokay)
• 64b2bb2: docs: wire up the post-v0.2.0 work and record what it found (@steveokay)
• f906d27: test(e2e): browser coverage for Trash, tokens, members, four-eyes, break-glass (@steveokay)
• e5a8b24: test(rbac): e2e over the group security invariants (@steveokay)

v0.2.0

Changelog

Features

• 25803c8: feat(audit): signed hash-chain checkpoints + guarded retention prune (8.1) (@steveokay)
• dd3e4ce: feat(auth): Kubernetes service-account federation + multi-issuer trust (@steveokay)
• 5d0ce5b: feat(auth): WebAuthn / passkeys for UI login (7.5) (@steveokay)
• b456a74: feat(auth): passwordless (discoverable) passkey sign-in (@steveokay)
• 0aa1061: feat(cli): add run --watch and janus render (config-version reload) (@steveokay)
• 0665fa8: feat(deploy): Helm chart + multi-mode deployment guide (@steveokay)
• d4bfe85: feat(observability): Grafana dashboard + example alert rules (roadmap 8.3) (@steveokay)
• df86339: feat(sdk): background lease auto-renew + Run-style helpers (Go/TS/Python) (@steveokay)
• 5169616: feat(secrets): explicit, audited value-version retention (roadmap 8.2) (@steveokay)
• 2ac2733: feat(sync): drift detection — read destinations back and report what changed (@steveokay)
• f61f2c3: feat(terraform): environment-scoped tokens + janus_secrets batch resource (@steveokay)
• bb309b0: feat(trust): supply-chain sweep — SECURITY.md, threat model, dependabot, signed releases (@steveokay)
• d6bc055: feat(web): mobile/tablet layout for the Atrium shell and read-mostly screens (@steveokay)
• c97160a: feat(web): paste-based import wizard for Doppler, Vault, and AWS Secrets Manager (@steveokay)

Fixes

• 2ce7117: fix(api): destroying a config or environment from Trash always failed (@steveokay)
• 717d567: fix(api,cli): QA findings — JSON 404 for unmatched /v1, clearer errors, config-UUID binding (@steveokay)
• 00fb231: fix(audit): bind prune's ship-HWM guard to shipping history + add retention floor (@steveokay)
• 7b4f537: fix(audit): make event_count a lifetime total; clarify prune HWM block (@steveokay)
• 17b9642: fix(audit): verify the hash chain before signing a checkpoint (M-5) (@steveokay)
• 680e6b5: fix(auth): reject TOTP code replay + revoke sessions on password change (@steveokay)
• 9a4811a: fix(auth): route OIDC discovery/JWKS through SSRF-hardened client (M-4/I-4) (@steveokay)
• fc0da2c: fix(authz): cap member-grant delegation at bound role, not effective role (@steveokay)
• 2ca8ac6: fix(net): SSRF guard + bounded dials on outbound clients (block IMDS/link-local, redirect control) (@steveokay)
• 146d727: fix(nethard): don't let an HTTP proxy silently defeat the SSRF guard (L-7) (@steveokay)
• e454b8e: fix(release): goreleaser prerelease: auto — rc tags don't become "Latest" (@steveokay)
• 9b3380d: fix(release): never let a prerelease take over the latest image tag (@steveokay)
• 3aa20f6: fix(web): a failed passkey enrolment no longer signs the user out (@steveokay)
• 799e63f: fix(web): surface expired sessions, and stop the value field collapsing (@steveokay)

Others

• e9bde7c: Merge pull request #149 from steveokay/hardening/security-audit-fixes (@steveokay)
• e3b5a49: Merge pull request #150 from steveokay/trust/supply-chain-sweep (@steveokay)
• 7807dee: Merge pull request #151 from steveokay/test/playwright-smoke (@steveokay)
• 8139868: Merge pull request #152 from steveokay/feat/cli-watch-render (@steveokay)
• 9676bf0: Merge pull request #153 from steveokay/feat/audit-checkpointing (@steveokay)
• f0ec475: Merge pull request #154 from steveokay/docs/post1-batch-trackers (@steveokay)
• 4fdb0bb: Merge pull request #155 from steveokay/dependabot/pip/sdk/python/pip-6ffa451956 (@steveokay)
• 8c6f70e: Merge pull request #157 from steveokay/dependabot/github_actions/actions-256fe8712a (@steveokay)
• 4495582: Merge pull request #159 from steveokay/dependabot/go_modules/go-modules-e73c0cab33 (@steveokay)
• da8a0c0: Merge pull request #160 from steveokay/docs/cli-completeness (@steveokay)
• 1dcdb9e: Merge pull request #161 from steveokay/chore/dependabot-ignore-ts-major (@steveokay)
• 83608d5: Merge pull request #162 from steveokay/dependabot/npm_and_yarn/web/npm-fc6038b1a4 (@steveokay)
• 9df7777: Merge pull request #163 from steveokay/fix/goreleaser-prerelease-auto (@steveokay)
• fcd2a0a: Merge pull request #164 from steveokay/docs/readme-and-md-refresh (@steveokay)
• 5953d3c: Merge pull request #165 from steveokay/feat/helm-and-deployment-modes (@steveokay)
• 90e7a12: Merge pull request #166 from steveokay/fix/nethard-proxy-ssrf-gap (@steveokay)
• 439f3e8: Merge pull request #167 from steveokay/fix/audit-checkpoint-verify-before-sign (@steveokay)
• 43b3709: Merge pull request #168 from steveokay/fix/prune-retention-guards (@steveokay)
• a3d3030: Merge pull request #169 from steveokay/docs/remove-doppler-references (@steveokay)
• 04c83c3: Merge pull request #170 from steveokay/fix/qa-api-hygiene (@steveokay)
• 293d21d: Merge pull request #171 from steveokay/fix/qa-eventcount-consistency (@steveokay)
• a55a307: Merge pull request #172 from steveokay/fix/goreleaser-latest-tag (@steveokay)
• b57b690: Merge pull request #173 from steveokay/test/go-fuzz-parsers (@steveokay)
• 3a7b0fc: Merge pull request #174 from steveokay/feat/k8s-sa-federation (@steveokay)
• 4eba4c2: Merge pull request #175 from steveokay/feat/sync-drift-detection (@steveokay)
• 81d5106: Merge pull request #176 from steveokay/feat/webauthn-passkeys (@steveokay)
• 9f6ea44: Merge pull request #177 from steveokay/docs/section7-trackers (@steveokay)
• f916af6: Merge pull request #178 from steveokay/test/schema-enum-guard (@steveokay)
• 463387e: Merge pull request #179 from steveokay/test/webauthn-browser-e2e (@steveokay)
• 0f260b2: Merge pull request #180 from steveokay/feat/grafana-dashboards (@steveokay)
• c37cb17: Merge pull request #181 from steveokay/feat/value-version-retention (@steveokay)
• d40e462: Merge pull request #182 from steveokay/docs/section8-trackers (@steveokay)
• 3137fdc: Merge pull request #183 from steveokay/feat/sdk-lease-autorenew (@steveokay)
• 02cd704: Merge pull request #184 from steveokay/feat/webauthn-passwordless (@steveokay)
• ff49ce5: Merge pull request #185 from steveokay/docs/sdk-passwordless-trackers (@steveokay)
• ede23b1: Merge pull request #186 from steveokay/feat/terraform-env-tokens-batch (@steveokay)
• 3ea1b59: Merge pull request #187 from steveokay/feat/web-import-wizard (@steveokay)
• 283ac19: Merge pull request #188 from steveokay/docs/two-day-sweep (@steveokay)
• cf4f96a: Merge pull request #189 from steveokay/fix/session-expiry-401 (@steveokay)
• db24b1f: Merge pull request #190 from steveokay/ci/module-coverage-and-trackers (@steveokay)
• baae333: Merge pull request #191 from steveokay/fix/trash-destroy-soft-deleted (@steveokay)
• 21c98ae: Merge pull request #192 from steveokay/feat/mobile-tablet-layout (@steveokay)
• 6151afd: Merge pull request #193 from steveokay/fix/401-ceremony-vs-expiry (@steveokay)
• e9e522d: Merge pull request #194 from steveokay/docs/close-out-roadmap (@steveokay)
• b4aa661: Merge pull request #195 from steveokay/docs/staleness-sweep (@steveokay)
• 127186b: Merge pull request #196 from steveokay/docs/readme-front-door (@steveokay)
• 6f3b993: Merge pull request #197 from steveokay/release/v0.2.0 (@steveokay)
• 61ab215: chore(ci): Bump the actions group with 10 updates (@dependabot[bot])
• 5112c7b: chore(ci): dependabot — ignore TypeScript major-version bumps (web + sdk/ts) (@steveokay)
• 1b6f053: chore(deps): Bump the go-modules group with 7 updates (@dependabot[bot])
• 04310e5: chore(deps): Bump the npm group in /web with 5 updates (@dependabot[bot])
• de6fda9...

v0.1.0

Changelog

Features

• 55a0514: feat(api): /v1/metrics/reads-24h — instance usage metrics (steveokay mokaysteve@gmail.com)
• accd982: feat(api): /v1/sys/live and /v1/sys/ready probes (sealed/uninitialized/db-down aware) (steveokay mokaysteve@gmail.com)
• 0e6cdcc: feat(api): /v1/sys/oidc provider config (oidc:manage, audited, secret never returned) (steveokay mokaysteve@gmail.com)
• cf657de: feat(api): /v1/sys/oidc/federation config (oidc:manage, audited) (steveokay mokaysteve@gmail.com)
• 683cbde: feat(api): /v1/sys/oidc/federation/bindings CRUD (oidc:manage, audited) (steveokay mokaysteve@gmail.com)
• 9abc67c: feat(api): Boot composes store, seal discovery, unsealer, and kms auto-unseal (steveokay mokaysteve@gmail.com)
• da451a5: feat(api): GET /v1/audit/histogram (value-free bucketed counts) (steveokay mokaysteve@gmail.com)
• 0ddd34a: feat(api): GET /v1/audit/verify + /v1/audit/export (jsonl/csv, filters, self-audit) (steveokay mokaysteve@gmail.com)
• 5800886: feat(api): GET /v1/sys/backup (admin, audited, streamed) + POST /v1/sys/restore (empty-instance bootstrap) (steveokay mokaysteve@gmail.com)
• 5a4cf0b: feat(api): GET /v1/trash — per-item authz-filtered soft-delete listing (steveokay mokaysteve@gmail.com)
• 42adff7: feat(api): GET /v1/{rotation,sync}/.../runs run-history endpoints (steveokay mokaysteve@gmail.com)
• 47bcdff: feat(api): OIDC status/login/callback endpoints (session on success, audited) (steveokay mokaysteve@gmail.com)
• 750cf8a: feat(api): PATCH rename for projects and environments (name-only) (steveokay mokaysteve@gmail.com)
• dc32412: feat(api): POST /v1/auth/oidc/federate — CI token exchange (steveokay mokaysteve@gmail.com)
• 56fe720: feat(api): POST clone-environment (admin+, value-free env.clone audit) (steveokay mokaysteve@gmail.com)
• 0381267: feat(api): RequireAuth middleware with Principal context + per-IP rate limiting (steveokay mokaysteve@gmail.com)
• 7865615: feat(api): RequireUnsealed middleware and body-free request logger (steveokay mokaysteve@gmail.com)
• cc44b1d: feat(api): Server with chi router, health/seal-status, graceful shutdown (steveokay mokaysteve@gmail.com)
• 5dfe0a5: feat(api): add chi/cobra/term deps and project-wide JSON error envelope (steveokay mokaysteve@gmail.com)
• 78811f0: feat(api): audit auth login (success+failure), logout, password change (steveokay mokaysteve@gmail.com)
• e3c4c94: feat(api): audit token/user/member/seal handlers (success + centralized denial) (steveokay mokaysteve@gmail.com)
• cac01dd: feat(api): authenticated GET /v1/sys/version build-info endpoint (steveokay mokaysteve@gmail.com)
• 590b8a8: feat(api): authorize sys/seal (sys:seal) and token mint/list/revoke; scope-filtered listing (steveokay mokaysteve@gmail.com)
• 8c0ccd4: feat(api): config CRUD + lifecycle routes (+ ConfigRepo.GetIncludingDeleted for restore auth) (steveokay mokaysteve@gmail.com)
• 24cd6ff: feat(api): config version list + diff + rollback (steveokay mokaysteve@gmail.com)
• 63c56ac: feat(api): cursor pagination for GET /v1/projects (steveokay mokaysteve@gmail.com)
• c640824: feat(api): cursor pagination for environments + configs lists (steveokay mokaysteve@gmail.com)
• 0c6e7d1: feat(api): cursor pagination for members + transit keys lists (steveokay mokaysteve@gmail.com)
• d8900d3: feat(api): cursor pagination for tokens + users lists (steveokay mokaysteve@gmail.com)
• 560d1b4: feat(api): cursor-paginated /v1/audit/events for the viewer (steveokay mokaysteve@gmail.com)
• 3fc9315: feat(api): environment CRUD + lifecycle routes (steveokay mokaysteve@gmail.com)
• 20ad12d: feat(api): expose last_activity_at on project & environment lists (steveokay mokaysteve@gmail.com)
• 883c2b3: feat(api): global Idempotency-Key middleware (status-only replay) (steveokay mokaysteve@gmail.com)
• db465ce: feat(api): init/unseal/reset/seal handlers for shamir and kms seals (steveokay mokaysteve@gmail.com)
• c551454: feat(api): login/logout/me/password and token mint/list/revoke endpoints (steveokay mokaysteve@gmail.com)
• 45cd7ee: feat(api): master-key rotate + rekey ceremony endpoints (owner-only) (steveokay mokaysteve@gmail.com)
• df57357: feat(api): membership endpoints (instance/project/env) with delegation + last-owner guard (steveokay mokaysteve@gmail.com)
• e4eff44: feat(api): mint transit-scoped service tokens end to end (steveokay mokaysteve@gmail.com)
• be8f8ab: feat(api): opaque cursor codec + page-param parsing (steveokay mokaysteve@gmail.com)
• f7578fd: feat(api): owner-only project KEK rotate/rewrap/status endpoints (steveokay mokaysteve@gmail.com)
• e1ca5ab: feat(api): project CRUD + lifecycle routes (create/list/get/soft-delete/restore/destroy) (steveokay mokaysteve@gmail.com)
• 70b9d8c: feat(api): promote preview + apply endpoints (audited, RBAC, pipeline/lock enforced) (steveokay mokaysteve@gmail.com)
• d62855f: feat(api): promotion pipeline + locked-keys endpoints; wire promote service (steveokay mokaysteve@gmail.com)
• 32f63fb: feat(api): promotion request endpoints (create/list/get/approve/reject/cancel) (steveokay mokaysteve@gmail.com)
• 6b4ab69: feat(api): resolve authorizer adapter + sentinel error mapping (steveokay mokaysteve@gmail.com)
• 22f613d: feat(api): resolve reveals by default; ?raw=true opt-out; per-deref audit (steveokay mokaysteve@gmail.com)
• 023fffa: feat(api): rotation RBAC action, engine wiring, scheduler start (no routes yet) (steveokay mokaysteve@gmail.com)
• 865f5ef: feat(api): rotation REST handlers (masked, project-scoped, audited) (steveokay mokaysteve@gmail.com)
• d6b16b9: feat(api): secret batch write + per-key put + delete (each -> new config version) (steveokay mokaysteve@gmail.com)
• 93fc917: feat(api): secret masked list + reveal (one/all/historical) + key history (steveokay mokaysteve@gmail.com)
• 1ee1a04: feat(api): secret type on write, masked list, and reveal (steveokay mokaysteve@gmail.com)
• 68196c8: feat(api): serve embedded SPA as fallback; gate seal only on /v1 API paths (steveokay mokaysteve@gmail.com)
• ee06ca5: feat(api): sync RBAC action, engine wiring, scheduler start (no routes yet) (steveokay mokaysteve@gmail.com)
• 3235bc4: feat(api): sync REST handlers (masked, project-scoped, audited) (steveokay mokaysteve@gmail.com)
• d219745: feat(api): transit data-plane routes (encrypt/decrypt/sign/verify/rewrap/datakey) (steveokay mokaysteve@gmail.com)
• 44620b1: feat(api): transit key management routes + engine Delete/Get/List + error mapping (steveokay mokaysteve@gmail.com)
• bb1c109: feat(api): user management endpoints (create/list/disable) gated on user:manage (steveokay mokaysteve@gmail.com)
• 2a233fd: feat(api): wire audit.Recorder into Server + Boot; record/authorize helpers; central denial capture (steveokay mokaysteve@gmail.com)
• 32b1915: feat(api): wire authz engine, token scope in context, bootstrap+reconcile instance owner (steveokay mokaysteve@gmail.com)
• f53774b: feat(api): writeServiceError — map secrets/store sentinels to the HTTP envelope (steveokay mokaysteve@gmail.com)
• 730ecc8: feat(api,cli): init-ceremony admin bootstrap, first-unseal HMAC key, seal gating (steveokay mokaysteve@gmail.com)
• 7f5bdde: feat(audit): Event, canonical SHA-256 chain hash, Recorder.Record, Verify (100% cov) (steveokay mokaysteve@gmail.com)
• 74b5c3b: feat(audit): ship audit log to webhook/syslog with a high-water mark (steveokay mokaysteve@gmail.com)
• 84836b1: feat(auth): MintFederatedToken - short-lived CI-scoped service token (steveokay mokaysteve@gmail.com)
• c1fcb1c: feat(auth): OIDC provider config CRUD with master-key-wrapped secret (steveokay mokaysteve@gmail.com)
• 58e1d84: feat(auth): OIDC verifier core + start/verify against a mock IdP (ste...