v0.1.0

Changelog

Features

• 55a0514: feat(api): /v1/metrics/reads-24h — instance usage metrics (steveokay mokaysteve@gmail.com)
• accd982: feat(api): /v1/sys/live and /v1/sys/ready probes (sealed/uninitialized/db-down aware) (steveokay mokaysteve@gmail.com)
• 0e6cdcc: feat(api): /v1/sys/oidc provider config (oidc:manage, audited, secret never returned) (steveokay mokaysteve@gmail.com)
• cf657de: feat(api): /v1/sys/oidc/federation config (oidc:manage, audited) (steveokay mokaysteve@gmail.com)
• 683cbde: feat(api): /v1/sys/oidc/federation/bindings CRUD (oidc:manage, audited) (steveokay mokaysteve@gmail.com)
• 9abc67c: feat(api): Boot composes store, seal discovery, unsealer, and kms auto-unseal (steveokay mokaysteve@gmail.com)
• da451a5: feat(api): GET /v1/audit/histogram (value-free bucketed counts) (steveokay mokaysteve@gmail.com)
• 0ddd34a: feat(api): GET /v1/audit/verify + /v1/audit/export (jsonl/csv, filters, self-audit) (steveokay mokaysteve@gmail.com)
• 5800886: feat(api): GET /v1/sys/backup (admin, audited, streamed) + POST /v1/sys/restore (empty-instance bootstrap) (steveokay mokaysteve@gmail.com)
• 5a4cf0b: feat(api): GET /v1/trash — per-item authz-filtered soft-delete listing (steveokay mokaysteve@gmail.com)
• 42adff7: feat(api): GET /v1/{rotation,sync}/.../runs run-history endpoints (steveokay mokaysteve@gmail.com)
• 47bcdff: feat(api): OIDC status/login/callback endpoints (session on success, audited) (steveokay mokaysteve@gmail.com)
• 750cf8a: feat(api): PATCH rename for projects and environments (name-only) (steveokay mokaysteve@gmail.com)
• dc32412: feat(api): POST /v1/auth/oidc/federate — CI token exchange (steveokay mokaysteve@gmail.com)
• 56fe720: feat(api): POST clone-environment (admin+, value-free env.clone audit) (steveokay mokaysteve@gmail.com)
• 0381267: feat(api): RequireAuth middleware with Principal context + per-IP rate limiting (steveokay mokaysteve@gmail.com)
• 7865615: feat(api): RequireUnsealed middleware and body-free request logger (steveokay mokaysteve@gmail.com)
• cc44b1d: feat(api): Server with chi router, health/seal-status, graceful shutdown (steveokay mokaysteve@gmail.com)
• 5dfe0a5: feat(api): add chi/cobra/term deps and project-wide JSON error envelope (steveokay mokaysteve@gmail.com)
• 78811f0: feat(api): audit auth login (success+failure), logout, password change (steveokay mokaysteve@gmail.com)
• e3c4c94: feat(api): audit token/user/member/seal handlers (success + centralized denial) (steveokay mokaysteve@gmail.com)
• cac01dd: feat(api): authenticated GET /v1/sys/version build-info endpoint (steveokay mokaysteve@gmail.com)
• 590b8a8: feat(api): authorize sys/seal (sys:seal) and token mint/list/revoke; scope-filtered listing (steveokay mokaysteve@gmail.com)
• 8c0ccd4: feat(api): config CRUD + lifecycle routes (+ ConfigRepo.GetIncludingDeleted for restore auth) (steveokay mokaysteve@gmail.com)
• 24cd6ff: feat(api): config version list + diff + rollback (steveokay mokaysteve@gmail.com)
• 63c56ac: feat(api): cursor pagination for GET /v1/projects (steveokay mokaysteve@gmail.com)
• c640824: feat(api): cursor pagination for environments + configs lists (steveokay mokaysteve@gmail.com)
• 0c6e7d1: feat(api): cursor pagination for members + transit keys lists (steveokay mokaysteve@gmail.com)
• d8900d3: feat(api): cursor pagination for tokens + users lists (steveokay mokaysteve@gmail.com)
• 560d1b4: feat(api): cursor-paginated /v1/audit/events for the viewer (steveokay mokaysteve@gmail.com)
• 3fc9315: feat(api): environment CRUD + lifecycle routes (steveokay mokaysteve@gmail.com)
• 20ad12d: feat(api): expose last_activity_at on project & environment lists (steveokay mokaysteve@gmail.com)
• 883c2b3: feat(api): global Idempotency-Key middleware (status-only replay) (steveokay mokaysteve@gmail.com)
• db465ce: feat(api): init/unseal/reset/seal handlers for shamir and kms seals (steveokay mokaysteve@gmail.com)
• c551454: feat(api): login/logout/me/password and token mint/list/revoke endpoints (steveokay mokaysteve@gmail.com)
• 45cd7ee: feat(api): master-key rotate + rekey ceremony endpoints (owner-only) (steveokay mokaysteve@gmail.com)
• df57357: feat(api): membership endpoints (instance/project/env) with delegation + last-owner guard (steveokay mokaysteve@gmail.com)
• e4eff44: feat(api): mint transit-scoped service tokens end to end (steveokay mokaysteve@gmail.com)
• be8f8ab: feat(api): opaque cursor codec + page-param parsing (steveokay mokaysteve@gmail.com)
• f7578fd: feat(api): owner-only project KEK rotate/rewrap/status endpoints (steveokay mokaysteve@gmail.com)
• e1ca5ab: feat(api): project CRUD + lifecycle routes (create/list/get/soft-delete/restore/destroy) (steveokay mokaysteve@gmail.com)
• 70b9d8c: feat(api): promote preview + apply endpoints (audited, RBAC, pipeline/lock enforced) (steveokay mokaysteve@gmail.com)
• d62855f: feat(api): promotion pipeline + locked-keys endpoints; wire promote service (steveokay mokaysteve@gmail.com)
• 32f63fb: feat(api): promotion request endpoints (create/list/get/approve/reject/cancel) (steveokay mokaysteve@gmail.com)
• 6b4ab69: feat(api): resolve authorizer adapter + sentinel error mapping (steveokay mokaysteve@gmail.com)
• 22f613d: feat(api): resolve reveals by default; ?raw=true opt-out; per-deref audit (steveokay mokaysteve@gmail.com)
• 023fffa: feat(api): rotation RBAC action, engine wiring, scheduler start (no routes yet) (steveokay mokaysteve@gmail.com)
• 865f5ef: feat(api): rotation REST handlers (masked, project-scoped, audited) (steveokay mokaysteve@gmail.com)
• d6b16b9: feat(api): secret batch write + per-key put + delete (each -> new config version) (steveokay mokaysteve@gmail.com)
• 93fc917: feat(api): secret masked list + reveal (one/all/historical) + key history (steveokay mokaysteve@gmail.com)
• 1ee1a04: feat(api): secret type on write, masked list, and reveal (steveokay mokaysteve@gmail.com)
• 68196c8: feat(api): serve embedded SPA as fallback; gate seal only on /v1 API paths (steveokay mokaysteve@gmail.com)
• ee06ca5: feat(api): sync RBAC action, engine wiring, scheduler start (no routes yet) (steveokay mokaysteve@gmail.com)
• 3235bc4: feat(api): sync REST handlers (masked, project-scoped, audited) (steveokay mokaysteve@gmail.com)
• d219745: feat(api): transit data-plane routes (encrypt/decrypt/sign/verify/rewrap/datakey) (steveokay mokaysteve@gmail.com)
• 44620b1: feat(api): transit key management routes + engine Delete/Get/List + error mapping (steveokay mokaysteve@gmail.com)
• bb1c109: feat(api): user management endpoints (create/list/disable) gated on user:manage (steveokay mokaysteve@gmail.com)
• 2a233fd: feat(api): wire audit.Recorder into Server + Boot; record/authorize helpers; central denial capture (steveokay mokaysteve@gmail.com)
• 32b1915: feat(api): wire authz engine, token scope in context, bootstrap+reconcile instance owner (steveokay mokaysteve@gmail.com)
• f53774b: feat(api): writeServiceError — map secrets/store sentinels to the HTTP envelope (steveokay mokaysteve@gmail.com)
• 730ecc8: feat(api,cli): init-ceremony admin bootstrap, first-unseal HMAC key, seal gating (steveokay mokaysteve@gmail.com)
• 7f5bdde: feat(audit): Event, canonical SHA-256 chain hash, Recorder.Record, Verify (100% cov) (steveokay mokaysteve@gmail.com)
• 74b5c3b: feat(audit): ship audit log to webhook/syslog with a high-water mark (steveokay mokaysteve@gmail.com)
• 84836b1: feat(auth): MintFederatedToken - short-lived CI-scoped service token (steveokay mokaysteve@gmail.com)
• c1fcb1c: feat(auth): OIDC provider config CRUD with master-key-wrapped secret (steveokay mokaysteve@gmail.com)
• 58e1d84: feat(auth): OIDC verifier core + start/verify against a mock IdP (steveokay mokaysteve@gmail.com)
• f8bb1b5: feat(auth): Principal seam, error sentinels, Argon2id PHC passwords (steveokay mokaysteve@gmail.com)
• 043d1e6: feat(auth): Service — HMAC keying, bootstrap admin, sessions, service tokens (steveokay mokaysteve@gmail.com)
• c0f0634: feat(auth): TOTP second factor for password logins (steveokay mokaysteve@gmail.com)
• ff881e0: feat(auth): federation claim matcher (exactly-one, deny-ambiguous) (steveokay mokaysteve@gmail.com)
• 955fbc7: feat(auth): federation config + binding CRUD with validation (steveokay mokaysteve@gmail.com)
• fedfb6e: feat(auth): federation verifier + FederateCILogin exchange (steveokay mokaysteve@gmail.com)
• e4daa88: feat(auth): per-token IP allowlists + new-IP anomaly note (steveokay mokaysteve@gmail.com)
• c1f3f87: feat(auth): progressive per-account lockout with admin unlock (steveokay mokaysteve@gmail.com)
• a574235: feat(auth): resolve OIDC claims to a pre-provisioned user + issue session (steveokay mokaysteve@gmail.com)
• f90fdc9: feat(auth): self-service session management + consolidate trackers (steveokay mokaysteve@gmail.com)
• 6d558f6: feat(auth): server-enforced session idle timeout (JANUS_SESSION_IDLE_TIMEOUT, default 30m, 0 disables) (steveokay mokaysteve@gmail.com)
• af28314: feat(auth): transit token scope (use/manage, optional key restriction) (steveokay mokaysteve@gmail.com)
• 24f6aa9: feat(auth): user management (create/list/disable); CreateInitialAdmin returns user id (steveokay mokaysteve@gmail.com)
• 002ba10: feat(auth): wire federation repos + verifier cache + shared types (steveokay mokaysteve@gmail.com)
• 5c42763: feat(authz): Engine.Can (user bindings + token capabilities), grant/revoke/list, EffectiveRole (steveokay mokaysteve@gmail.com)
• cd9d617: feat(authz): action vocabulary, role→action matrix, Resource, ErrForbidden (steveokay mokaysteve@gmail.com)
• f7c30b5: feat(authz): add admin+ project:update and env:update actions (steveokay mokaysteve@gmail.com)
• 2d43978: feat(authz): break-glass time-boxed role elevation (steveokay mokaysteve@gmail.com)
• 26a7745: feat(authz): oidc:manage instance action (admin+owner) (steveokay mokaysteve@gmail.com)
• 7f113c8: feat(authz): promotion:request action (developer+) (steveokay mokaysteve@gmail.com)
• 4e32377: feat(authz): secret:promote (developer+) and promotion:manage (admin+) (steveokay mokaysteve@gmail.com)
• fcc594e: feat(authz): sys:master-key action (owner-only) (steveokay mokaysteve@gmail.com)
• 84b9ecf: feat(authz): transit actions, Resource.TransitKey, transit token capabilities (steveokay mokaysteve@gmail.com)
• f34cdc1: feat(cli): --raw on run/download/get; secrets list shows origin column (steveokay mokaysteve@gmail.com)
• 51f03ed: feat(cli): .env export skips non-env-var keys with a comment (steveokay mokaysteve@gmail.com)
• f82e1e2: feat(cli): .janus.yaml binding + flag/env/file precedence resolution (steveokay mokaysteve@gmail.com)
• 81fa349: feat(cli): authenticated API client with envelope decode + auth-error rewrite (steveokay mokaysteve@gmail.com)
• db2ebd1: feat(cli): cobra janus CLI — server, init, unseal, seal-status, seal, migrate (steveokay mokaysteve@gmail.com)
• 1a9b044: feat(cli): credential + config store (auth.json, address/credential precedence) (steveokay mokaysteve@gmail.com)
• 9119c84: feat(cli): download --format files materializes secrets to disk (traversal-guarded) (steveokay mokaysteve@gmail.com)
• 95f55cf: feat(cli): env/json/yaml formatters with POSIX shell escaping (steveokay mokaysteve@gmail.com)
• dc3911a: feat(cli): janus backup / janus restore (streamed, key-preserving) (steveokay mokaysteve@gmail.com)
• 0f0714b: feat(cli): janus config create/list/delete/restore (steveokay mokaysteve@gmail.com)
• c6547f2: feat(cli): janus env create/list/delete/restore (steveokay mokaysteve@gmail.com)
• 7cde7b5: feat(cli): janus import from Doppler / Vault KV / AWS Secrets Manager (steveokay mokaysteve@gmail.com)
• 01ba45f: feat(cli): janus master-key status/rotate/rekey (steveokay mokaysteve@gmail.com)
• 0465342: feat(cli): janus project create/list/delete/restore (steveokay mokaysteve@gmail.com)
• 0b40cfd: feat(cli): janus project rotate-kek/rewrap/kek-status (steveokay mokaysteve@gmail.com)
• 39d93af: feat(cli): janus promote / pipeline / secrets lock (steveokay mokaysteve@gmail.com)
• f70133c: feat(cli): janus promote request/requests/approve/reject/cancel (steveokay mokaysteve@gmail.com)
• 9245980: feat(cli): janus rotation create/list/get/update/delete/rotate (steveokay mokaysteve@gmail.com)
• bfdcb96: feat(cli): janus run skips non-env-var secret keys with a warning (steveokay mokaysteve@gmail.com)
• e91b7c9: feat(cli): janus secrets diff (value-free) (steveokay mokaysteve@gmail.com)
• 02afe0e: feat(cli): janus sync create/list/get/update/delete/sync (steveokay mokaysteve@gmail.com)
• 9e33766: feat(cli): janus token mint/list/revoke (steveokay mokaysteve@gmail.com)
• f2c6638: feat(cli): janus whoami + completion (steveokay mokaysteve@gmail.com)
• 6241a3c: feat(cli): login/logout commands with session storage (steveokay mokaysteve@gmail.com)
• b99f3ef: feat(cli): run — inject secrets as env, forward signals + exit code (steveokay mokaysteve@gmail.com)
• 07e3ee4: feat(cli): secrets download (env/json/yaml) with --plain disk guard (steveokay mokaysteve@gmail.com)
• 5b04ccd: feat(cli): secrets parent + list (masked) + get (raw value to stdout) (steveokay mokaysteve@gmail.com)
• 3d06801: feat(cli): secrets set + delete (batched into one config version) (steveokay mokaysteve@gmail.com)
• 7441b2f: feat(cli): secrets set --type and list TYPE column (steveokay mokaysteve@gmail.com)
• f4ca7dd: feat(cli): setup command (validate + write .janus.yaml) (steveokay mokaysteve@gmail.com)
• 47eef4f: feat(cli): slug/name -> config-id resolution with per-level errors (steveokay mokaysteve@gmail.com)
• aadd495: feat(crypto): AES-256-GCM primitives, ciphertext serialization, error sentinels (steveokay mokaysteve@gmail.com)
• b276e07: feat(crypto): Ed25519 sign/verify + TransitKeyAAD (steveokay mokaysteve@gmail.com)
• b130dbd: feat(crypto): KMS auto-unseal with AWS adapter behind fake-able interface (steveokay mokaysteve@gmail.com)
• 744f16b: feat(crypto): Keyring.RotateMaster (atomic master re-wrap + swap) (steveokay mokaysteve@gmail.com)
• f54b5e8: feat(crypto): Shamir unsealer with interactive share submission and KCV verification (steveokay mokaysteve@gmail.com)
• 0b5e6af: feat(crypto): ShamirUnsealer Progress() accessor and 1-of-1 seal support (steveokay mokaysteve@gmail.com)
• 5fa57d1: feat(crypto): SignWithSeed — Ed25519 sign from a 32-byte seed (steveokay mokaysteve@gmail.com)
• 2422f99: feat(crypto): Unsealer.Reseal + Shamir possession verify helper (steveokay mokaysteve@gmail.com)
• 4cb00e8: feat(crypto): add ShamirUnsealer.Reset to recover from a poisoned share (steveokay mokaysteve@gmail.com)
• 2821609: feat(crypto): in-memory keyring with sealed/unsealed state machine (steveokay mokaysteve@gmail.com)
• 29df52d: feat(crypto): key generation, wrap/unwrap with AAD binding (steveokay mokaysteve@gmail.com)
• 4c7a3b0: feat(crypto): keyring WrapTransitKey/UnwrapTransitKey (master-key seam for transit) (steveokay mokaysteve@gmail.com)
• 070b0bf: feat(crypto): master-key wrap/unwrap for the auth token-HMAC key (steveokay mokaysteve@gmail.com)
• cef9d5b: feat(crypto): rotation config + pending AAD helpers (steveokay mokaysteve@gmail.com)
• c23594e: feat(crypto): sync creds AAD + keyed change-detection fingerprint (steveokay mokaysteve@gmail.com)
• 13caab9: feat(crypto): unsealer contract, key check value, file seal-config store (steveokay mokaysteve@gmail.com)
• f9c2ecf: feat(crypto): vendor HashiCorp shamir package (vault v1.15.6, MPL-2.0) (steveokay mokaysteve@gmail.com)
• 64e6eca: feat(crypto): wrap OIDC client secret under the master key (steveokay mokaysteve@gmail.com)
• 39f28ba: feat(dev): Dockerfile, compose app service, 1-of-1 dev-unseal workflow (steveokay mokaysteve@gmail.com)
• 37c9d65: feat(dynamic): /v1/dynamic API — roles, creds, leases (steveokay mokaysteve@gmail.com)
• 8f75ec0: feat(dynamic): DynamicConfigAAD domain-separated envelope AAD (steveokay mokaysteve@gmail.com)
• 46af43b: feat(dynamic): add janus dynamic roles get for design-spec parity (steveokay mokaysteve@gmail.com)
• fa1eeaf: feat(dynamic): authz actions dynamic:manage + dynamic:issue (steveokay mokaysteve@gmail.com)
• 569a8b4: feat(dynamic): crash-safe credential issue + renew + revoke (steveokay mokaysteve@gmail.com)
• 1b4cc46: feat(dynamic): engine scaffolding — service, envelope, generation (steveokay mokaysteve@gmail.com)
• 96fc5d4: feat(dynamic): janus dynamic CLI (roles/creds/renew/revoke/leases) (steveokay mokaysteve@gmail.com)
• 3089188: feat(dynamic): lease-manager scheduler + post-unseal sweep (steveokay mokaysteve@gmail.com)
• 1b27f0b: feat(dynamic): migration 000012 for dynamic roles + leases (steveokay mokaysteve@gmail.com)
• 6493656: feat(dynamic): postgres executor with injection-safe interpolation (steveokay mokaysteve@gmail.com)
• d7b0279: feat(dynamic): role CRUD with placeholder + TTL validation (steveokay mokaysteve@gmail.com)
• 5a36ee6: feat(dynamic): store repos for dynamic roles + leases (steveokay mokaysteve@gmail.com)
• c380880: feat(dynamic): wire lease scheduler + JANUS_DYNAMIC_TICK + post-unseal sweep (steveokay mokaysteve@gmail.com)
• c34b547: feat(editor): bulk row selection + per-key read insights (steveokay mokaysteve@gmail.com)
• ba88fb9: feat(federation): GitLab, Buildkite, CircleCI OIDC issuers (steveokay mokaysteve@gmail.com)
• 3eff766: feat(masterkeys): Shamir rekey ceremony (proof-of-possession) (steveokay mokaysteve@gmail.com)
• a8a92a6: feat(masterkeys): rotation core + KMS single-call path (value-free) (steveokay mokaysteve@gmail.com)
• ec22b48: feat(metrics): Prometheus /metrics + admin health status + logging config (steveokay mokaysteve@gmail.com)
• debdfdb: feat(migrate): seal_config master_key_version + rotated_at (000019) (steveokay mokaysteve@gmail.com)
• be2017a: feat(notifications): SMTP email channel (net/smtp, value-free) (steveokay mokaysteve@gmail.com)
• 285f182: feat(notifications): webhook + Slack alerting via audit-tailing dispatcher (steveokay mokaysteve@gmail.com)
• 09d165b: feat(ops): DB pool tuning + shutdown grace + compose limits + CONTRIBUTING (steveokay mokaysteve@gmail.com)
• e8868d8: feat(ops): scheduled encrypted S3 backups + retention + restore-rehearsal (steveokay mokaysteve@gmail.com)
• 4d23cb1: feat(projectkeys): Rotate/Rewrap/Status service (lazy DEK re-wrap, value-free) (steveokay mokaysteve@gmail.com)
• 55e4f14: feat(promote): Diff/Preview/Apply engine (pipeline-checked, locked-aware, re-encrypt via set path) (steveokay mokaysteve@gmail.com)
• c1d3354: feat(promote): Idempotency-Key on apply (claim/complete/release, replay on retry) (steveokay mokaysteve@gmail.com)
• 6875f63: feat(promote): create-target preview (PreviewCreate + to_env param, audited source reveal) (steveokay mokaysteve@gmail.com)
• 9c859dd: feat(promote): record + expose promotion provenance (source env + version on the created config version) (steveokay mokaysteve@gmail.com)
• 5a35eac: feat(promote): request lifecycle (create/approve/reject/cancel) reusing Apply (steveokay mokaysteve@gmail.com)
• 1aa2c58: feat(resolve): inheritance merge (child-wins chain walk, cycle, broken base) (steveokay mokaysteve@gmail.com)
• 8093ad3: feat(resolve): package skeleton — ports, types, error sentinels (steveokay mokaysteve@gmail.com)
• fe5cd21: feat(resolve): reference grammar parser (local/absolute/$$ escape) (steveokay mokaysteve@gmail.com)
• 44017ec: feat(resolve): transitive reference expansion, cycles, depth cap, provenance (steveokay mokaysteve@gmail.com)
• f1b2a82: feat(rotation): AWS IAM access key + OAuth client-credential rotators (steveokay mokaysteve@gmail.com)
• d1423dc: feat(rotation): MySQL + Redis ACL rotators (steveokay mokaysteve@gmail.com)
• c9e76a3: feat(rotation): crash-safe rotate, backoff, failure state machine, audit (steveokay mokaysteve@gmail.com)
• f2a254e: feat(rotation): engine CRUD + RotateNow with masked views (steveokay mokaysteve@gmail.com)
• b7e9b5f: feat(rotation): engine skeleton + envelope-encrypted rotator config (steveokay mokaysteve@gmail.com)
• 0ea9061: feat(rotation): postgres single-role ALTER ROLE rotator (steveokay mokaysteve@gmail.com)
• 6bddd77: feat(rotation): record each run in rotation_runs within the mark tx (steveokay mokaysteve@gmail.com)
• d3710b8: feat(rotation): scheduler (RunDue/RunScheduler) with sealed-skip + recovery (steveokay mokaysteve@gmail.com)
• a68b143: feat(rotation): value generator, HMAC-signed webhook rotator, notify hook (steveokay mokaysteve@gmail.com)
• 658e485: feat(sdk): Go client SDK (typed reads + in-process cache) (steveokay mokaysteve@gmail.com)
• 51d1853: feat(sdk): Python client SDK (typed reads + in-process cache) (steveokay mokaysteve@gmail.com)
• 6003b1a: feat(sdk): TypeScript client SDK (typed reads + in-process cache) (steveokay mokaysteve@gmail.com)
• a80f2f6: feat(search): global key-name search (GET /v1/search/keys) (steveokay mokaysteve@gmail.com)
• f43411d: feat(secrets): CloneEnvironment deep-copies config tree + own secrets (steveokay mokaysteve@gmail.com)
• 5e8cdc0: feat(secrets): ReadRaw/ReadRawByID raw-read port for resolution (steveokay mokaysteve@gmail.com)
• f4fc29c: feat(secrets): allow filename-style secret keys (flat charset, no traversal) (steveokay mokaysteve@gmail.com)
• dbfff1c: feat(secrets): batched encrypted set + reveal round-trip (steveokay mokaysteve@gmail.com)
• 8b22f62: feat(secrets): best-effort soft-delete cleanup on failed CloneEnvironment (steveokay mokaysteve@gmail.com)
• 27e614a: feat(secrets): masked reads, version ops, historical reveal (steveokay mokaysteve@gmail.com)
• 6739189: feat(secrets): package skeleton — Service, errors, validation, zeroize (steveokay mokaysteve@gmail.com)
• 80cea94: feat(secrets): project KEK lifecycle + env/config passthrough (steveokay mokaysteve@gmail.com)
• a951ea7: feat(secrets): resolve project KEK per dek_key_version on read (rotation-aware) (steveokay mokaysteve@gmail.com)
• 063a4c1: feat(secrets): surface type in the inheritance-merged masked view (steveokay mokaysteve@gmail.com)
• 4df6443: feat(secrets): validated secret type, carried on write + reveal (steveokay mokaysteve@gmail.com)
• 1f24cda: feat(secretsync): engine CRUD + SyncNow with masked views (steveokay mokaysteve@gmail.com)
• 0214d02: feat(secretsync): engine skeleton + provider interface + envelope creds (steveokay mokaysteve@gmail.com)
• 1678117: feat(secretsync): github Actions provider (nacl sealed-box + raw REST) (steveokay mokaysteve@gmail.com)
• f7f5150: feat(secretsync): kubernetes Secret provider (server-side apply, verified TLS) (steveokay mokaysteve@gmail.com)
• 8336f8c: feat(secretsync): reconcile with keyed change-detection, project-scoped resolve, backoff (steveokay mokaysteve@gmail.com)
• c907489: feat(secretsync): scheduler (RunDue/RunScheduler) (steveokay mokaysteve@gmail.com)
• 7242564: feat(server): configurable HTTP read/write/idle timeouts (JANUS_HTTP_*) (steveokay mokaysteve@gmail.com)
• 6ec4d57: feat(server): global request-body cap (JANUS_HTTP_MAX_BODY_BYTES), restore exempt (steveokay mokaysteve@gmail.com)
• de5dabd: feat(server): native TLS listener (static certs + optional ACME) (steveokay mokaysteve@gmail.com)
• 2b81cdd: feat(store): AuditRepo.Histogram (by-bucket, by-result counts) (steveokay mokaysteve@gmail.com)
• f126b13: feat(store): Change carries an encrypt closure bound to value_version (steveokay mokaysteve@gmail.com)
• b935789: feat(store): ConfigRepo CRUD with inherits_from column (steveokay mokaysteve@gmail.com)
• c972610: feat(store): EnvironmentRepo CRUD (steveokay mokaysteve@gmail.com)
• c2cf6cc: feat(store): EnvironmentRepo.LastActivity aggregate over config versions (steveokay mokaysteve@gmail.com)
• 1fa17c5: feat(store): ListDeleted for projects/envs/configs + ProjectRepo.GetIncludingDeleted (steveokay mokaysteve@gmail.com)
• 3addc5c: feat(store): LockedKeyRepo (promotion-protected keys) (steveokay mokaysteve@gmail.com)
• 2a872d8: feat(store): MetricsRepo.Reads24h — on-demand reveal aggregation (steveokay mokaysteve@gmail.com)
• 3f06bee: feat(store): OIDC federation config + binding repos (steveokay mokaysteve@gmail.com)
• 5ac741a: feat(store): OIDCAuthRequestRepo (single-use, expiring login state) (steveokay mokaysteve@gmail.com)
• 5107e93: feat(store): OIDCIdentityRepo (link by issuer+subject) (steveokay mokaysteve@gmail.com)
• 4093658: feat(store): OIDCProviderRepo (upsert/get/delete) (steveokay mokaysteve@gmail.com)
• ed8ad70: feat(store): PipelineRepo (ordered promotion pipeline) (steveokay mokaysteve@gmail.com)
• a4fb92b: feat(store): Postgres-backed SealConfigStore (steveokay mokaysteve@gmail.com)
• 023de91: feat(store): ProjectKEKVersionRepo (insert/get/list-pending/delete-empty) (steveokay mokaysteve@gmail.com)
• 18a78be: feat(store): ProjectRepo CRUD with soft-delete/undelete/destroy (steveokay mokaysteve@gmail.com)
• 655e6cb: feat(store): ProjectRepo.LastActivity aggregate over config versions (steveokay mokaysteve@gmail.com)
• ac7e1f7: feat(store): ProjectRepo.RotateKEK atomic version bump (steveokay mokaysteve@gmail.com)
• 52ea13e: feat(store): RewrapAllUnderNewMaster + GetMasterKeyMeta (000019) (steveokay mokaysteve@gmail.com)
• 5c3e38d: feat(store): RotationRun ListRuns + capped insert helper (steveokay mokaysteve@gmail.com)
• e42ba31: feat(store): SecretRepo save (batched, atomic) + versioned reads (steveokay mokaysteve@gmail.com)
• 50763be: feat(store): SecretRepo.RewrapBatch resumable DEK re-wrap iterator (steveokay mokaysteve@gmail.com)
• e96ae05: feat(store): TransitRepo (create/append/config/trim/delete/get/list) (steveokay mokaysteve@gmail.com)
• 3491f21: feat(store): UpdateName for projects and environments (name-only) (steveokay mokaysteve@gmail.com)
• 155de55: feat(store): add NewID; ProjectRepo.Create takes caller-supplied id (steveokay mokaysteve@gmail.com)
• f7ca215: feat(store): audit_events table + AuditRepo (advisory-lock append, iterate, filtered list) (steveokay mokaysteve@gmail.com)
• 3c7b76a: feat(store): auth schema (users/sessions/service_tokens/auth_config) + UserRepo (steveokay mokaysteve@gmail.com)
• 1efd7d2: feat(store): connection pool, withTx, testcontainers harness (steveokay mokaysteve@gmail.com)
• b3d06b4: feat(store): error sentinels, pgx error mapping, domain models (steveokay mokaysteve@gmail.com)
• ac26ae1: feat(store): generic IdempotencyRepo (status-only, no body) (steveokay mokaysteve@gmail.com)
• b03ff2b: feat(store): index audit_events(action, occurred_at) for metrics (steveokay mokaysteve@gmail.com)
• d946575: feat(store): initial schema migration + embedded golang-migrate runner (steveokay mokaysteve@gmail.com)
• 8a7b3fa: feat(store): janus migrate subcommand + make migrate target (steveokay mokaysteve@gmail.com)
• be9c28d: feat(store): keyset pagination helpers (Cursor, keyset, limitSQL) (steveokay mokaysteve@gmail.com)
• 1be5bf5: feat(store): keyset-paginated audit ListPage (steveokay mokaysteve@gmail.com)
• ab9179b: feat(store): logical JSONL dump — SchemaVersion, IsEmptyForRestore, DumpBackup (steveokay mokaysteve@gmail.com)
• ade31f2: feat(store): migration 000005 — ON DELETE CASCADE for ownership FKs (inherits_from stays NO ACTION) (steveokay mokaysteve@gmail.com)
• 4c90ee8: feat(store): migration 000006 — transit tables + token transit scope (steveokay mokaysteve@gmail.com)
• 87b1dc4: feat(store): migration 000007 + OIDC models (providers, identities, auth requests) (steveokay mokaysteve@gmail.com)
• 8690c96: feat(store): migration 000009 — oidc federation config + bindings (steveokay mokaysteve@gmail.com)
• 6d360d7: feat(store): migration 000010 rotation_policies (steveokay mokaysteve@gmail.com)
• 55163ba: feat(store): migration 000011 sync_targets (steveokay mokaysteve@gmail.com)
• 8d9aef9: feat(store): migration 000020 — idempotency table + pagination indexes (steveokay mokaysteve@gmail.com)
• 9f86823: feat(store): nullable minter + CreateFederated for CI tokens (steveokay mokaysteve@gmail.com)
• 1795079: feat(store): project_kek_versions table (migration 000015) (steveokay mokaysteve@gmail.com)
• d07fdeb: feat(store): promotion pipeline + locked-keys tables (migration 000016) (steveokay mokaysteve@gmail.com)
• 8a49af0: feat(store): promotion_requests table + repo (migration 000021) (steveokay mokaysteve@gmail.com)
• 5aa068f: feat(store): role_bindings table + RoleBindingRepo (upsert, list, revoke, owner count) (steveokay mokaysteve@gmail.com)
• 6ae9a2c: feat(store): rotation_policies repo + backup inclusion (steveokay mokaysteve@gmail.com)
• cd222cc: feat(store): rotation_runs + sync_runs migrations (per-run history) (steveokay mokaysteve@gmail.com)
• 05b52bb: feat(store): secret history, version diff, and rollback (steveokay mokaysteve@gmail.com)
• 01348f1: feat(store): session, service-token, and auth-config repositories (steveokay mokaysteve@gmail.com)
• d454ae0: feat(store): sync_targets repo + backup inclusion (steveokay mokaysteve@gmail.com)
• 44d7a26: feat(store): transactional ordered RestoreBackup from JSONL records (steveokay mokaysteve@gmail.com)
• 0f7c298: feat(store): type column on secret_values (migration 000022) (steveokay mokaysteve@gmail.com)
• e2433d6: feat(sync): Cloudflare Workers + AWS Secrets Manager providers (steveokay mokaysteve@gmail.com)
• d4ecb3b: feat(sync): GitLab CI + AWS SSM sync providers (steveokay mokaysteve@gmail.com)
• 933ba3b: feat(sync): Vercel + Netlify env sync providers (steveokay mokaysteve@gmail.com)
• 4ac7306: feat(sync): record each run in sync_runs within the mark tx (steveokay mokaysteve@gmail.com)
• e2eb19b: feat(transit): create key + aes encrypt/decrypt with versioned wrapping (steveokay mokaysteve@gmail.com)
• 9d3f3b6: feat(transit): ed25519 sign/verify + datakey generation (steveokay mokaysteve@gmail.com)
• 018a5cc: feat(transit): engine skeleton, sentinels, janus:vN envelope (steveokay mokaysteve@gmail.com)
• d4d2a9b: feat(transit): rotate, config (min_decryption_version), rewrap, trim (steveokay mokaysteve@gmail.com)
• 0a8f208: feat(unseal): GCP KMS + Azure Key Vault auto-unseal (steveokay mokaysteve@gmail.com)
• 9fd2d7a: feat(version): internal/version build-info package; wire janus version (steveokay mokaysteve@gmail.com)
• 9fdaceb: feat(web): AuthCard branded shell (mockup §07) (steveokay mokaysteve@gmail.com)
• 81a6d3e: feat(web): Button primitive (variants/size/block/loading) (steveokay mokaysteve@gmail.com)
• fe59e47: feat(web): Card + Skeleton primitives (steveokay mokaysteve@gmail.com)
• 9e322bf: feat(web): Cmd/Ctrl+S saves the editor when dirty (steveokay mokaysteve@gmail.com)
• 7c9043d: feat(web): ConfirmDialog primitive (radix alert-dialog) (steveokay mokaysteve@gmail.com)
• 4f0a9bd: feat(web): ConfirmDialog-gated soft-delete on project/env/config views (steveokay mokaysteve@gmail.com)
• aebac8f: feat(web): EmptyState primitive (steveokay mokaysteve@gmail.com)
• e68cc96: feat(web): Input/Textarea/Select field primitives (steveokay mokaysteve@gmail.com)
• 1f56995: feat(web): Integrations hub — connector catalog with deep-links (#83) (steveokay mokaysteve@gmail.com)
• 3bb364f: feat(web): JSON/PEM value awareness + shortcuts help modal with g-nav chords (steveokay mokaysteve@gmail.com)
• 44f7340: feat(web): KeyHistorySheet — per-key version history with ephemeral audited reveal (steveokay mokaysteve@gmail.com)
• 2e754bf: feat(web): List | Matrix view toggle on the members page (steveokay mokaysteve@gmail.com)
• 67962e1: feat(web): Modal primitive (Radix Dialog — focus-trap/Esc/aria-modal) (steveokay mokaysteve@gmail.com)
• c2eb433: feat(web): PaletteProvider with global Cmd/Ctrl+K (steveokay mokaysteve@gmail.com)
• 8b1feef: feat(web): Pill primitive, env color util, useTitle contract test (steveokay mokaysteve@gmail.com)
• 983370b: feat(web): QR code for TOTP enrolment (steveokay mokaysteve@gmail.com)
• 604cc71: feat(web): ReadsStrip metric card (data/loading/empty/error-hides) (steveokay mokaysteve@gmail.com)
• aa984c2: feat(web): RevealOnce show-once secret modal (steveokay mokaysteve@gmail.com)
• 041b32a: feat(web): Sheet slide-over primitive (radix dialog) (steveokay mokaysteve@gmail.com)
• 0c6fd1b: feat(web): SortHeader sortable column header (steveokay mokaysteve@gmail.com)
• 9e04ab1: feat(web): TableSearch input with result count (steveokay mokaysteve@gmail.com)
• cfa83ee: feat(web): ThemeProvider — light/dark/system with persistence (steveokay mokaysteve@gmail.com)
• 6d6c7d9: feat(web): Tooltip primitive (Radix) + dependency (steveokay mokaysteve@gmail.com)
• 0a2a5d6: feat(web): Trash page (restore + typed-confirm destroy) + route/sidebar/palette (steveokay mokaysteve@gmail.com)
• 8ec683b: feat(web): accessibility pass — focus traps, ARIA, reduced-motion (steveokay mokaysteve@gmail.com)
• a5eab9a: feat(web): add SMTP channel type to Notifications create form (steveokay mokaysteve@gmail.com)
• 17f11ed: feat(web): add top-right close (X) button to Modal (steveokay mokaysteve@gmail.com)
• 0c01cc6: feat(web): app shell + router + bootstrap guards (sealed/login/app) (steveokay mokaysteve@gmail.com)
• 924b342: feat(web): audit endpoints + wire types (steveokay mokaysteve@gmail.com)
• 123d101: feat(web): audit event-count histogram (stacked bars, click-to-zoom) (steveokay mokaysteve@gmail.com)
• 5150f13: feat(web): audit filter presets (built-ins + localStorage) + page-size (steveokay mokaysteve@gmail.com)
• dc578e1: feat(web): audit histogram endpoint + zero-fill/bucket helpers (steveokay mokaysteve@gmail.com)
• 7f79715: feat(web): audit viewer — chain badge, filters, paginated table, export (steveokay mokaysteve@gmail.com)
• 9d85229: feat(web): auth context + login + change-password form (steveokay mokaysteve@gmail.com)
• 7ec8729: feat(web): board env-header menu - rename, clone, delete + recency subline (steveokay mokaysteve@gmail.com)
• 6e4d4a2: feat(web): brand mark, favicon, useTitle hook (steveokay mokaysteve@gmail.com)
• 89c6a8d: feat(web): branded auth and unseal cards with share progress (steveokay mokaysteve@gmail.com)
• 07c706a: feat(web): branded landing — hero CTA or open-a-project list (steveokay mokaysteve@gmail.com)
• 584e7ac: feat(web): branded top bar with breadcrumb, live seal pill, user menu (steveokay mokaysteve@gmail.com)
• 73b8a32: feat(web): breadcrumb resolving project/env/config from nav cache (steveokay mokaysteve@gmail.com)
• 68aaae0: feat(web): collapsible sidebar under 640px (steveokay mokaysteve@gmail.com)
• 2b73031: feat(web): coming-soon placeholders for deferred areas + empty states (steveokay mokaysteve@gmail.com)
• f0aad15: feat(web): command palette overlay with fuzzy search + keyboard nav (steveokay mokaysteve@gmail.com)
• 46e1c00: feat(web): command-palette item index from cache (key names only) (steveokay mokaysteve@gmail.com)
• 932fe47: feat(web): create-mode promotion preview shows revealable source values (previewCreate) (steveokay mokaysteve@gmail.com)
• 22de8cc: feat(web): dayLabel helper for audit date grouping (steveokay mokaysteve@gmail.com)
• 9f3ed58: feat(web): design tokens, base layer, cn helper (ui slice 1) (steveokay mokaysteve@gmail.com)
• 3ad43be: feat(web): drag-to-env promotion on the project board (steveokay mokaysteve@gmail.com)
• 9213929: feat(web): editor dirty buffer, add/edit/delete, batched Save as vN + guard (steveokay mokaysteve@gmail.com)
• c056bd7: feat(web): editor dirty-bar + review-diff modal (steveokay mokaysteve@gmail.com)
• c0a36ed: feat(web): editor import .env modal (steveokay mokaysteve@gmail.com)
• d1aaeb4: feat(web): editor reveal-all (one audited bulk reveal) + auto-re-mask on blur/idle (steveokay mokaysteve@gmail.com)
• 66a86db: feat(web): editor rowState + dotenv parser (steveokay mokaysteve@gmail.com)
• c437b4b: feat(web): editor toolbar — key filter, import, history (steveokay mokaysteve@gmail.com)
• 3aaf619: feat(web): embed SPA with go:embed + SPA-fallback handler and CSP (steveokay mokaysteve@gmail.com)
• e20adcf: feat(web): empty state for configs with no secrets (steveokay mokaysteve@gmail.com)
• b4df3e7: feat(web): env-columns project board with inheritance nesting (steveokay mokaysteve@gmail.com)
• 8e04a8c: feat(web): expandable audit rows (full event + hash chain) + date grouping (steveokay mokaysteve@gmail.com)
• b4d3b0a: feat(web): first-run onboarding checklist on the dashboard (steveokay mokaysteve@gmail.com)
• b73af84: feat(web): friendly error-envelope message mapping (steveokay mokaysteve@gmail.com)
• ca9dc90: feat(web): fuzzy subsequence matcher for command palette (steveokay mokaysteve@gmail.com)
• 86cc07a: feat(web): global secret-key search in command palette (steveokay mokaysteve@gmail.com)
• 0fd45aa: feat(web): health panel in Settings backed by GET /v1/sys/status (steveokay mokaysteve@gmail.com)
• 836c8cb: feat(web): history button opens version sheet in secret editor (steveokay mokaysteve@gmail.com)
• 78d4840: feat(web): inheritance connector lines on the project board (steveokay mokaysteve@gmail.com)
• 08370ea: feat(web): inline "Copied!" state on copy-to-clipboard buttons (steveokay mokaysteve@gmail.com)
• ccb320a: feat(web): inline key validation for filename-style keys + not-env-var hint (steveokay mokaysteve@gmail.com)
• e8246c7: feat(web): keyHistory + revealKeyVersion endpoints (per-key history) (steveokay mokaysteve@gmail.com)
• 6a8a5d6: feat(web): keyboard-shortcut help overlay ("?") (steveokay mokaysteve@gmail.com)
• 6b0a90c: feat(web): lightweight create forms for project/environment/config (steveokay mokaysteve@gmail.com)
• 51559c5: feat(web): locked-key management + pipeline configuration UI (steveokay mokaysteve@gmail.com)
• da0ec77: feat(web): master-key rotate control + Shamir rekey modal (shares shown once) (steveokay mokaysteve@gmail.com)
• c3aabe3: feat(web): master-key status in Settings instance section (steveokay mokaysteve@gmail.com)
• b3213d8: feat(web): members & users page — roles, guardrail surfacing, show-once password (steveokay mokaysteve@gmail.com)
• f044af3: feat(web): metrics endpoints + reads-24h query hooks (steveokay mokaysteve@gmail.com)
• 14eca1a: feat(web): migrate brand-deep foregrounds to brand-text for dark AA (steveokay mokaysteve@gmail.com)
• 1738631: feat(web): mount ThemeProvider + no-flash theme script (steveokay mokaysteve@gmail.com)
• 0238cd4: feat(web): mount instance Reads 24h strip on Projects list (steveokay mokaysteve@gmail.com)
• eee4bce: feat(web): mount project-scoped Reads 24h row on board (steveokay mokaysteve@gmail.com)
• 265b780: feat(web): on-demand editor reveal — mount loads masked metadata only, values fetched per-key/bulk into ephemeral state (steveokay mokaysteve@gmail.com)
• 78223e2: feat(web): password generator + non-blocking JSON/PEM validation (steveokay mokaysteve@gmail.com)
• 8c05a08: feat(web): per-type value editor (textarea for multiline) + type selector + type-aware save (steveokay mokaysteve@gmail.com)
• 9c448a3: feat(web): polish create-project modal (helper copy, primary CTA) (steveokay mokaysteve@gmail.com)
• 65c73eb: feat(web): project card quick-action menu with rename (steveokay mokaysteve@gmail.com)
• 22d17c3: feat(web): project overview dashboard — env cards, key counts, reads placeholder (steveokay mokaysteve@gmail.com)
• 3365bba: feat(web): project switcher + env/config tree sidebar (steveokay mokaysteve@gmail.com)
• 7779403: feat(web): projects list glyph, recency line, created/activity sort (steveokay mokaysteve@gmail.com)
• 9a8ddc3: feat(web): projects list — searchable card grid with config counts (steveokay mokaysteve@gmail.com)
• e192156: feat(web): promote into a new target config from the board (create-target UI) (steveokay mokaysteve@gmail.com)
• f14bd03: feat(web): promoted-from- indicator on board card, version history, and editor header (steveokay mokaysteve@gmail.com)
• 5e90e3b: feat(web): promotion diff modal (per-key selectable, locked-aware, audited reveal) (steveokay mokaysteve@gmail.com)
• d510825: feat(web): promotion endpoints + types + mocks (steveokay mokaysteve@gmail.com)
• a96c69e: feat(web): promotion requests approvals page, review, and request-instead flow (steveokay mokaysteve@gmail.com)
• 290ac76: feat(web): pure RBAC matrix assembly + role tone (steveokay mokaysteve@gmail.com)
• 425de76: feat(web): pure dirty-buffer logic (summary + batch mapping) (steveokay mokaysteve@gmail.com)
• 1f19999: feat(web): re-skin LoginPage onto branded AuthCard + kit (steveokay mokaysteve@gmail.com)
• cd65399: feat(web): re-skin UnsealPage onto branded AuthCard + success segments (steveokay mokaysteve@gmail.com)
• 07ed97b: feat(web): read-only RBAC matrix grid (sticky, role chips, +N env) (steveokay mokaysteve@gmail.com)
• 1b5bcba: feat(web): recencyLabel helper for project/env cards (steveokay mokaysteve@gmail.com)
• dca98d2: feat(web): redesigned secret table (pills, rails, reveal/copy, per-row actions) (steveokay mokaysteve@gmail.com)
• 9275fb6: feat(web): rename + clone endpoints; created_at/last_activity_at types (steveokay mokaysteve@gmail.com)
• 18f122c: feat(web): replace the React/Nocturne SPA with the Svelte Atrium UI (steveokay mokaysteve@gmail.com)
• 90b3202: feat(web): revealKeyRaw endpoint for on-demand raw editor reveals (steveokay mokaysteve@gmail.com)
• 4afddbf: feat(web): route projects list + board; remove old landing/overview (steveokay mokaysteve@gmail.com)
• d4fc31e: feat(web): search + sort on members role-bindings and users tables (steveokay mokaysteve@gmail.com)
• 6475ca2: feat(web): search + sort on the tokens table (steveokay mokaysteve@gmail.com)
• cb56eac: feat(web): searchable add-member user picker (steveokay mokaysteve@gmail.com)
• aa33c24: feat(web): secret editor masked list + origin badges + audited reveal (steveokay mokaysteve@gmail.com)
• f758424: feat(web): secret type registry + endpoint types (steveokay mokaysteve@gmail.com)
• ff829f2: feat(web): secret-table horizontal-scroll containment + Esc-to-cancel edit (steveokay mokaysteve@gmail.com)
• f022b9f: feat(web): self-service TOTP enroll/manage in Settings (steveokay mokaysteve@gmail.com)
• 8b3858b: feat(web): service tokens page — mint (show-once), list, revoke (steveokay mokaysteve@gmail.com)
• 0aeadbc: feat(web): show type change in the review diff (value-free) (steveokay mokaysteve@gmail.com)
• 44a7db8: feat(web): sidebar primary nav (Doppler) with contextual project tree (steveokay mokaysteve@gmail.com)
• f93abb7: feat(web): sidebar redesign — sections, env colors, active rail, icons (steveokay mokaysteve@gmail.com)
• 6861f55: feat(web): skeleton loaders + shell icon-button tooltips (steveokay mokaysteve@gmail.com)
• 5fd26c3: feat(web): sticky header on operations tables (steveokay mokaysteve@gmail.com)
• 7c5258b: feat(web): success/error toasts across mutations (steveokay mokaysteve@gmail.com)
• 1afc171: feat(web): surface account lockout in Members + Login (steveokay mokaysteve@gmail.com)
• bd569a4: feat(web): theme toggle (light/dark/system) in user menu (steveokay mokaysteve@gmail.com)
• 01c3e9b: feat(web): timeAgo util for dashboard rows (steveokay mokaysteve@gmail.com)
• de5294a: feat(web): toast system (radix) with app-level provider (steveokay mokaysteve@gmail.com)
• 0a94d4a: feat(web): token/user/member endpoints + wire types (steveokay mokaysteve@gmail.com)
• a4bce86: feat(web): topbar command-palette trigger + theme toggle; instance /audit route (steveokay mokaysteve@gmail.com)
• 35b87fe: feat(web): track secret type in the dirty buffer + row state (steveokay mokaysteve@gmail.com)
• 0b308a9: feat(web): transit crypto playground (encrypt/rewrap/sign/verify) (steveokay mokaysteve@gmail.com)
• d68d377: feat(web): transit key management — rotate/configure/trim/delete (steveokay mokaysteve@gmail.com)
• 36bf5c6: feat(web): transit page — key list, nav, create-key modal (steveokay mokaysteve@gmail.com)
• fd03141: feat(web): transit types + endpoints (steveokay mokaysteve@gmail.com)
• b272e23: feat(web): trash types + listTrash/delete/restore/destroy endpoints (steveokay mokaysteve@gmail.com)
• c7308ea: feat(web): typed endpoint fns + query client with global 401/503 routing (steveokay mokaysteve@gmail.com)
• 9dbf808: feat(web): typed fetch client with ApiError + MSW test harness (steveokay mokaysteve@gmail.com)
• 834c016: feat(web): unseal screen (shamir shares + progress + reset; kms auto) (steveokay mokaysteve@gmail.com)
• 4eb2823: feat(web): useRbacMatrix fan-out hook (403-tolerant, shared cache) (steveokay mokaysteve@gmail.com)
• a3d2e33: feat(web): useTableControls filter+sort hook (steveokay mokaysteve@gmail.com)
• 443f8fd: feat(web): user menu dropdown (radix) with initials avatar (steveokay mokaysteve@gmail.com)
• 75a5554: feat(web): value generator (password/hex/base64) in the secret editor (steveokay mokaysteve@gmail.com)
• 2363fdd: feat(web): version chip opens per-key history sheet in the secret editor (steveokay mokaysteve@gmail.com)
• 626ed70: feat(web): version endpoints + radix/puppeteer deps (b2) (steveokay mokaysteve@gmail.com)
• a9e7416: feat(web): version history list, key-name diffs, audited rollback flow (steveokay mokaysteve@gmail.com)
• fbea660: feat(web): wire audit route; docs(fe): check off B3 audit viewer (steveokay mokaysteve@gmail.com)
• a49a178: feat(web): wire tokens/members routes; docs(fe): check off B4 (steveokay mokaysteve@gmail.com)
• ce2bd5b: feat(web,docs): editor import/export, env rename, and the Atrium doc set (steveokay mokaysteve@gmail.com)
• 2b74b71: feat(web/editor): SecretTable sortable headers + checkbox column + Updated cell + active ring (steveokay mokaysteve@gmail.com)
• d260674: feat(web/editor): bulk reveal + copy/download .env (audited, confirm-gated) + keyboard nav (steveokay mokaysteve@gmail.com)
• 07116e3: feat(web/editor): exportEnv .env formatter (parseDotenv round-trip) (steveokay mokaysteve@gmail.com)
• 62e4bb6: feat(web/editor): import .env preview + changed-only toggle + zero-match empty state (steveokay mokaysteve@gmail.com)
• ce95d3e: feat(web/editor): importClassify (value-free add/update preview) (steveokay mokaysteve@gmail.com)
• 5aed6ad: feat(web/editor): sortRows pure helper (key/origin/updated/version, added pinned) (steveokay mokaysteve@gmail.com)
• f621e2f: feat(web/editor): sorting + multi-select + SelectionBar (bulk delete wired) (steveokay mokaysteve@gmail.com)
• 08f579d: feat(web/editor): useRowNav hook (arrows+vim, input-focus guarded) (steveokay mokaysteve@gmail.com)
• 89f1641: feat(web/editor): useRowSelection hook (toggle/setAll/prune) (steveokay mokaysteve@gmail.com)
• 8980935: feat(web/nocturne): N1 command palette restyle (names-only invariant preserved) (steveokay mokaysteve@gmail.com)
• fe41088: feat(web/nocturne): N1 gradient canvas + real motion system (smoke keeps solid dark bg) (steveokay mokaysteve@gmail.com)
• c396b23: feat(web/nocturne): N1 kit primitives re-skinned to Nocturne tokens (steveokay mokaysteve@gmail.com)
• 333ac22: feat(web/nocturne): N1 shell restyle — glow logo, gradient-wash active nav, Nocturne topbar (steveokay mokaysteve@gmail.com)
• 899c0bf: feat(web/nocturne): N1 token foundation — dark+light Nocturne tokens + tailwind roles (steveokay mokaysteve@gmail.com)
• acd8d73: feat(web/nocturne): N2 board enrichment — ops health chips, created-at line, prod tint (steveokay mokaysteve@gmail.com)
• 7d3b096: feat(web/nocturne): N2 home activity feed (names-only, 403-hidden) (steveokay mokaysteve@gmail.com)
• c972292: feat(web/nocturne): N2 home header (greeting + chain badge) and project cards (steveokay mokaysteve@gmail.com)
• 05e56a9: feat(web/nocturne): N2 home stat cards (reads/rotations/syncs/chain) (steveokay mokaysteve@gmail.com)
• 9f13971: feat(web/nocturne): N2 relativeTime util (steveokay mokaysteve@gmail.com)
• fca1e0c: feat(web/nocturne): N2 route map — home at /, projects at /projects, sidebar+palette entries (steveokay mokaysteve@gmail.com)
• 5ad0bae: feat(web/nocturne): N3 save-bar glow + kit buttons across editor dialogs and version history (steveokay mokaysteve@gmail.com)
• d7c727b: feat(web/nocturne): N3 secret table restyle — layered card, row washes+hover, metadata line, toolbar tokens (steveokay mokaysteve@gmail.com)
• 5f767e4: feat(web/nocturne): N3 tokens — row washes, bar glow, teal glyph-d + spec glyph carve-out (steveokay mokaysteve@gmail.com)
• 6663788: feat(web/nocturne): N4 audit restyle — layered table, sticky header, chain-badge glow, kit buttons (steveokay mokaysteve@gmail.com)
• 480bf98: feat(web/nocturne): N4 members restyle — layered tables, sticky headers, kit buttons (steveokay mokaysteve@gmail.com)
• aa84390: feat(web/nocturne): N4 operations restyle — tokens, kit buttons/pills, inline last-error expand (steveokay mokaysteve@gmail.com)
• 752d232: feat(web/nocturne): N4 tokens restyle — layered table, sticky header, kit buttons/inputs (steveokay mokaysteve@gmail.com)
• 75e36d5: feat(web/nocturne): N4 transit restyle — tokens, kit Modal for create-key, kit buttons/inputs, playground (steveokay mokaysteve@gmail.com)
• f036098: feat(web/nocturne): N5 T1 — settings shell + subnav + appearance section, route swap (steveokay mokaysteve@gmail.com)
• e484337: feat(web/nocturne): N5 T2 — instance section (seal status, typed-confirm seal, backup download) (steveokay mokaysteve@gmail.com)
• bd5b5ca: feat(web/nocturne): N5 T3 — OIDC provider section (view/edit/delete, secret required on save) (steveokay mokaysteve@gmail.com)
• b6b91ca: feat(web/nocturne): N5 T4 — CI federation section (config + trust bindings CRUD) (steveokay mokaysteve@gmail.com)
• 5022bda: feat(web/nocturne): N5 T5 — OIDC sign-in button on login page (behind /v1/auth/oidc/status) (steveokay mokaysteve@gmail.com)
• 80c70ac: feat(web/nocturne): N6 T1 — shared ConfigPicker + rotation create flow (write-only secrets) (steveokay mokaysteve@gmail.com)
• bbe0a38: feat(web/nocturne): N6 T2 — sync target create flow (github/k8s, write-only creds) (steveokay mokaysteve@gmail.com)
• 398b186: feat(web/nocturne): N6 T3 — dynamic role create flow (SQL templates, write-only admin DSN) (steveokay mokaysteve@gmail.com)
• 3669fc8: feat(web/nocturne): N6 T4 — app ErrorBoundary + real 404 route (replaces silent redirect) (steveokay mokaysteve@gmail.com)
• 566bd0c: feat(web/nocturne): N7 T2 — palette action commands (new project, export audit, toggle theme) (steveokay mokaysteve@gmail.com)
• 788f94a: feat(web/nocturne): N7 T3 — copy-error feedback + add-secret empty-state CTA (steveokay mokaysteve@gmail.com)
• 7068aca: feat(web/ops): OpsTable sortable column headers (steveokay mokaysteve@gmail.com)
• 5b1dccf: feat(web/ops): api.patch + ops endpoints & wire types (steveokay mokaysteve@gmail.com)
• c32368a: feat(web/ops): dynamic panel (roles/issue/leases/delete) (steveokay mokaysteve@gmail.com)
• 73774df: feat(web/ops): dynamic role bulk-delete + lease bulk-revoke (steveokay mokaysteve@gmail.com)
• 7dc47e4: feat(web/ops): ephemeral issued-credentials modal (shown once) (steveokay mokaysteve@gmail.com)
• 280d167: feat(web/ops): health overview strip (current-state counts) (steveokay mokaysteve@gmail.com)
• 6e87cf6: feat(web/ops): lease drill-in sheet (renew/revoke) (steveokay mokaysteve@gmail.com)
• b26a49e: feat(web/ops): operations page + route + sidebar + palette (steveokay mokaysteve@gmail.com)
• aa79261: feat(web/ops): project→config map + 403-tolerant fan-out hook (steveokay mokaysteve@gmail.com)
• 58cb23e: feat(web/ops): rotation panel (rotate-now/pause/interval/delete) (steveokay mokaysteve@gmail.com)
• 7a9df3f: feat(web/ops): rotation+sync sort, bulk ops, run-history drill-in (steveokay mokaysteve@gmail.com)
• d6c7ef8: feat(web/ops): rotation/sync/dynamic-roles aggregators (steveokay mokaysteve@gmail.com)
• 458d515: feat(web/ops): shared OpsTable/StatusPill/RelTime/LastError primitives (steveokay mokaysteve@gmail.com)
• e5cf7ac: feat(web/ops): sync panel (sync-now/pause/interval/delete) (steveokay mokaysteve@gmail.com)
• 9c6d6bd: feat: Terraform provider (terraform-provider-janus) (steveokay mokaysteve@gmail.com)
• de56681: feat: advisory secret max-age / expiry policy (steveokay mokaysteve@gmail.com)
• fd27a24: feat: carry secret type through promotion and clone (steveokay mokaysteve@gmail.com)
• 05304b0: feat: cross-environment diff view (value-free config compare) (steveokay mokaysteve@gmail.com)
• 609369e: feat: masked list shows inherited keys with own/inherited/overridden origin (steveokay mokaysteve@gmail.com)
• 7f7bac2: feat: per-key secret annotations (owner + note) (steveokay mokaysteve@gmail.com)
• 66b3e74: feat: require-approval for protected-config edits (four-eyes) (steveokay mokaysteve@gmail.com)
• 95b0948: feat: token last-used + user last-login tracking (steveokay mokaysteve@gmail.com)
• 55adab9: feat: unused-secret detection (advisory, from audit reveals) (steveokay mokaysteve@gmail.com)

Fixes

• a032ac6: fix(api): abort audit export on mid-stream store error (no silent truncation) (steveokay mokaysteve@gmail.com)
• 85a6d04: fix(api): audit denied reference dereferences (final-review #4) (steveokay mokaysteve@gmail.com)
• 6162949: fix(api): authorize clone against source env's real project (block cross-project exfil) (steveokay mokaysteve@gmail.com)
• 99c6c38: fix(api): close unseal race share leak; precise init/unseal error taxonomy (steveokay mokaysteve@gmail.com)
• 47f785e: fix(api): deliver new rekey shares even if the post-commit audit write fails (steveokay mokaysteve@gmail.com)
• ce01131: fix(api): pre-flight table-existence check on backup (clean error, not reset, on inconsistent schema) (steveokay mokaysteve@gmail.com)
• 436383b: fix(api): reject zero-record restores (audit-seq poisoning), record-count audit detail, log hygiene, 64MB record cap (steveokay mokaysteve@gmail.com)
• 3d78c86: fix(api): resolve RBAC resource from target id, not path params (cross-project IDOR) (steveokay mokaysteve@gmail.com)
• 8420986: fix(api): rotation conflict returns "conflict" code, not "validation" (steveokay mokaysteve@gmail.com)
• 37e55a1: fix(api): route protected-config rollback + promote through four-eyes (steveokay mokaysteve@gmail.com)
• 21480ec: fix(api,cli): serialize init against TOCTOU; janus unseal --reset; refresh README (steveokay mokaysteve@gmail.com)
• e07c357: fix(auth): #nosec G101 on svcTokenPrefix (gosec entropy false-positive post-rename) (steveokay mokaysteve@gmail.com)
• 4668db7: fix(auth): bounds-check and strictly parse stored Argon2 params (crafted-hash DoS) (steveokay mokaysteve@gmail.com)
• 932af99: fix(authz): guard memberPut demotion of last instance owner; fail-closed guards (steveokay mokaysteve@gmail.com)
• 6d9f54b: fix(cli): JANUS_CONFIG_DIR override for portable config dir + test isolation (steveokay mokaysteve@gmail.com)
• 0ef44ab: fix(cli): download --output enforces 0600 via atomic temp+rename (M9 review) (steveokay mokaysteve@gmail.com)
• c3b8f2b: fix(cli): janus seal authenticates (--token / stored session) — was guaranteed 401 in production (steveokay mokaysteve@gmail.com)
• 2f8a967: fix(cli): resolve restore via /v1/trash; tag token list scope fields (steveokay mokaysteve@gmail.com)
• 912585e: fix(cli): route cobra command output to stdout so pipelines can capture it (steveokay mokaysteve@gmail.com)
• 361d29b: fix(cli): suppress echo on interactive rekey share entry; scope rotate hint (steveokay mokaysteve@gmail.com)
• 9ff48aa: fix(cli): warn on --share argv exposure; fallback for non-envelope errors; wire assertions (steveokay mokaysteve@gmail.com)
• 8129abc: fix(cli+api): atomic --out writes, abort truncated backup streams, docs table rows, header timeout, 409 UX pin (steveokay mokaysteve@gmail.com)
• 4d29149: fix(crypto): clamp pre-epoch TOTP counter instead of uint64-wrapping (gosec G115) (steveokay mokaysteve@gmail.com)
• 28fcc21: fix(crypto): make AAD encoding injective (length-prefixed fields) (steveokay mokaysteve@gmail.com)
• 105284e: fix(crypto,ci): use uint64 AAD length prefix (clears gosec G115); pin gosec to Go-1.26-compatible v2.27.1 (steveokay mokaysteve@gmail.com)
• a89215c: fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970) (steveokay mokaysteve@gmail.com)
• e04763f: fix(editreq): claim-before-commit approval + protect pending-request KEK versions (steveokay mokaysteve@gmail.com)
• fdd70c0: fix(masterkeys): never discard new shares after a committed rotation (steveokay mokaysteve@gmail.com)
• c6d4fb6: fix(metrics): bound the http method label; drop test-only /status nil-authz path (steveokay mokaysteve@gmail.com)
• 482c8f9: fix(notifications): repair empty outbox deliveries + prefill SMTP edits + bound SMTP dial (steveokay mokaysteve@gmail.com)
• 0da36c6: fix(oidc): bind login state to initiating browser (login-CSRF defense) (steveokay mokaysteve@gmail.com)
• 03b79cc: fix(promote): create-target authz resolves project scope; audit source reveal; zeroize reveal maps (steveokay mokaysteve@gmail.com)
• 8f51ff9: fix(promote): mark request applied only on Apply success (no stranded state) (steveokay mokaysteve@gmail.com)
• bb0d5b0: fix(promote): re-encode idempotency replay via writeJSON (clears gosec G705, consistent JSON) (steveokay mokaysteve@gmail.com)
• 85ddf1a: fix(promote): review polish — decided-request GET skips pipeline check; OpenAPI schema (steveokay mokaysteve@gmail.com)
• b5a6fbb: fix(resolve): enforce same-environment inheritance; zeroize deref residue (steveokay mokaysteve@gmail.com)
• cbd9848: fix(rotation): RotateNow marks policy due for crash recovery; notify rotated_at (steveokay mokaysteve@gmail.com)
• 53ade91: fix(rotation): migration 000037 relaxes type CHECK for mysql/redis/oauth/aws_iam (steveokay mokaysteve@gmail.com)
• 1e73d10: fix(rotation): respect backoff for pending policies; sealed is not a failure (steveokay mokaysteve@gmail.com)
• 6af1872: fix(search): derive truncated from post-authz visibility only (steveokay mokaysteve@gmail.com)
• 9e8288f: fix(secrets): LatestVersion returns 0 for a version-less config; add ref-RBAC e2e (steveokay mokaysteve@gmail.com)
• 99f2beb: fix(secrets): a version-less inheriting config is readable (steveokay mokaysteve@gmail.com)
• e855fab: fix(secrets): address M3 final-review follow-ups (steveokay mokaysteve@gmail.com)
• 5139eb3: fix(secrets): guard value_version->uint64 conversion (gosec G115); centralize DEK AAD (steveokay mokaysteve@gmail.com)
• 94eaec0: fix(secrets): recover reads from the KEK rewrap-retire TOCTOU (steveokay mokaysteve@gmail.com)
• 6e5b156: fix(secretsync): record config's current version on sync, not frozen 0 (steveokay mokaysteve@gmail.com)
• 200739c: fix(secretsync): validate GitLab project id to prevent URL injection (steveokay mokaysteve@gmail.com)
• 8ab5082: fix(spa): address final adversarial review findings (steveokay mokaysteve@gmail.com)
• 47afc0d: fix(store): EnvironmentRepo.LastActivity filters soft-deleted environments (steveokay mokaysteve@gmail.com)
• 6972066: fix(store): rewrap soft-deleted projects too (avoid stranding KEK on undelete) (steveokay mokaysteve@gmail.com)
• 51c826d: fix(store): single-snapshot dump (repeatable read), table-scoped error wrapping, root-first configs order, in-tx emptiness re-check (steveokay mokaysteve@gmail.com)
• fd7048a: fix(transit): enforce min_decryption_version in Verify; rewrap preserves AAD (steveokay mokaysteve@gmail.com)
• 3d46df1: fix(transit): key-restricted transit tokens keyed by key name (steveokay mokaysteve@gmail.com)
• ed9c43c: fix(web): RevealOnce — announce hint via Dialog description; guard clipboard copy (steveokay mokaysteve@gmail.com)
• 3e13cb5: fix(web): align User and SealStatus types + all test mocks with real API shapes (steveokay mokaysteve@gmail.com)
• 095f1f1: fix(web): avoid Array.at() in TableSearch test (tsconfig lib is ES2020) (steveokay mokaysteve@gmail.com)
• 3937f0b: fix(web): board env rename toast shows the new name, not the stale prop (steveokay mokaysteve@gmail.com)
• dbf2129: fix(web): declare color-scheme so dark-mode native popups are legible (steveokay mokaysteve@gmail.com) e8a53c5: fix(web): distinguish metadata errors from loading in overview rows (steveokay mokaysteve@gmail.com) 805634b: fix(web): drop staged type when removing a key so removed stays removed (steveokay mokaysteve@gmail.com) 7289e4c: fix(web): editor edit-cancel affordance + clear revealed on save (steveokay mokaysteve@gmail.com) 6940fa9: fix(web): errorMessage passes 403/409 curated messages before generic map (steveokay mokaysteve@gmail.com) 5c001c5: fix(web): hide export anchors in the audit forbidden state (steveokay mokaysteve@gmail.com) 09ee5be: fix(web): palette a11y — activedescendant, groups, IME + reopen-clear (steveokay mokaysteve@gmail.com) 4a413ea: fix(web): pin the RBAC matrix corner header on both axes (sticky top-0) (steveokay mokaysteve@gmail.com) 500c9d0: fix(web): project-board env skeleton, page heading, cycle-safe config tree (steveokay mokaysteve@gmail.com) 25451a6: fix(web): rename toast uses new name from mutation input (steveokay mokaysteve@gmail.com) 38b090b: fix(web): reset rekey mutation after reveal; skip cancel on completion (steveokay mokaysteve@gmail.com) 61a6ec4: fix(web): send {old,new} to /v1/auth/password (change-password was broken) (steveokay mokaysteve@gmail.com) 84d64b9: fix(web): solid modal surfaces (bg-elevated + backdrop-blur) to match the promote modal (steveokay mokaysteve@gmail.com) 1cc9a90: fix(web): stop env-column header overlap on many-environment boards (steveokay mokaysteve@gmail.com) c6cde62: fix(web): surface config-fetch errors on board & project cards (steveokay mokaysteve@gmail.com) 64c00cf: fix(web): teach cn() the custom rounded/shadow token scales (steveokay mokaysteve@gmail.com) c61553b: fix(web): trim bound to min_decryption_version; record B5 transit UI (steveokay mokaysteve@gmail.com) 1f0f883: fix(web): visible rollback-disabled hint; cover rollback failure toast (steveokay mokaysteve@gmail.com) f04932b: fix(web/editor): T8 review nits — restore URL stubs in test, real export count, guard nav reveal (steveokay mokaysteve@gmail.com) d9d3987: fix(web/editor): conditional zero-match hint (don't mention Changed only when off) — T9 nit (steveokay mokaysteve@gmail.com) a8a6a66: fix(web/editor): exportEnv single-quotes " values so export→import round-trips (steveokay mokaysteve@gmail.com) 1c13686: fix(web/nocturne): AA-safe primary button text + restore secondary/danger hover feedback (steveokay mokaysteve@gmail.com) 8c43d43: fix(web/nocturne): N5 T2 review nits — drop invisible seal toast, silence shell MSW, add sealed/seal-error tests (steveokay mokaysteve@gmail.com) ba5c4ff: fix(web/nocturne): N5 T4 review nits — positional claim-value aria-labels, add multi-claim + provider-delete tests (steveokay mokaysteve@gmail.com) c60be49: fix(web/nocturne): drop overflow-hidden so audit sticky header actually sticks (T2 review) (steveokay mokaysteve@gmail.com) 73b4a89: fix(web/nocturne): floor bucket math in relativeTime (59m59s was rendering 60m ago) + boundary tests (steveokay mokaysteve@gmail.com) 92f0122: fix(web/nocturne): pluralize editor key count (T2 review) (steveokay mokaysteve@gmail.com) be3510a: fix(web/nocturne): repoint Projects breadcrumb to /projects; HomePage useTitle; test-harness /projects route (T2 review) (steveokay mokaysteve@gmail.com) a9a3e16: fix(web/nocturne): share audit resultTone in activity feed + Pill status text, tooltips, skeleton height (T5 review) (steveokay mokaysteve@gmail.com) 1593b59: fix(web/nocturne): show overdue instead of 'next: X ago' in stat cards; NaN-guard soonest (T4 review nit) (steveokay mokaysteve@gmail.com) 08dacc6: fix(web/ops): drop unused within import (tsc noUnusedLocals) (steveokay mokaysteve@gmail.com) 35a655f: fix(web/ops): generalize IntervalModal heading (shared by rotation+sync) (steveokay mokaysteve@gmail.com) e034d02: fix(web/ops): guard negative run duration + surface sync keys_count (steveokay mokaysteve@gmail.com) 45f795b: fix(web/ops): reseed IntervalModal input on open (avoid stale value) (steveokay mokaysteve@gmail.com) 1ca8787: fix(web/ops): reset issue mutation after handoff to drop residual plaintext (steveokay mokaysteve@gmail.com) 8898670: fix(web/ops): surface non-403 enumeration errors + follow-up tests/docs (steveokay mokaysteve@gmail.com) Others f86ec9d: Add project spec and milestone 1 design doc (scaffold + crypto layer) (steveokay mokaysteve@gmail.com) b3b3374: Merge branch 'docs/integrations-hub-spec' (steveokay mokaysteve@gmail.com) a5db2de: Merge pull request #1 from steveokay/milestone-1-crypto (steveokay mokaysteve@gmail.com) 945a546: Merge pull request #10 from steveokay/chore/tracker-federation (steveokay mokaysteve@gmail.com) 62e9b4b: Merge pull request #100 from steveokay/feat/notifications (steveokay mokaysteve@gmail.com) 01dde8f: Merge pull request #101 from steveokay/feat/totp-2fa (steveokay mokaysteve@gmail.com) e99a3e7: Merge pull request #102 from steveokay/feat/account-lockout (steveokay mokaysteve@gmail.com) 642234c: Merge pull request #103 from steveokay/feat/metrics-health (steveokay mokaysteve@gmail.com) 12b2834: Merge pull request #104 from steveokay/feat/global-key-search (steveokay mokaysteve@gmail.com) d19864e: Merge pull request #105 from steveokay/feat/value-generator (steveokay mokaysteve@gmail.com) e6f4a0d: Merge pull request #106 from steveokay/feat/smtp-notifications (steveokay mokaysteve@gmail.com) 852d0df: Merge pull request #107 from steveokay/feat/editor-format-shortcuts (steveokay mokaysteve@gmail.com) 263ca3c: Merge pull request #108 from steveokay/docs/parked-decisions (steveokay mokaysteve@gmail.com) 58c3c82: Merge pull request #109 from steveokay/feat/tls-listener (steveokay mokaysteve@gmail.com) c902ab4: Merge pull request #11 from steveokay/milestone-5-auth (steveokay mokaysteve@gmail.com) ab120a9: Merge pull request #110 from steveokay/docs/tls-shipped (steveokay mokaysteve@gmail.com) 55cb5ed: Merge pull request #111 from steveokay/feat/secret-max-age (steveokay mokaysteve@gmail.com) ae3a0c1: Merge pull request #112 from steveokay/docs/max-age-shipped (steveokay mokaysteve@gmail.com) 94bd844: Merge pull request #113 from steveokay/feat/onboarding-checklist (steveokay mokaysteve@gmail.com) 391c485: Merge pull request #114 from steveokay/feat/sync-gitlab-awsssm (steveokay mokaysteve@gmail.com) d0f929a: Merge pull request #115 from steveokay/feat/unused-secret-detection (steveokay mokaysteve@gmail.com) 5d55357: Merge pull request #116 from steveokay/docs/sync-unused-shipped (steveokay mokaysteve@gmail.com) 3ed2177: Merge pull request #117 from steveokay/feat/cross-env-diff (steveokay mokaysteve@gmail.com) f6923a5: Merge pull request #118 from steveokay/feat/gcp-azure-autounseal (steveokay mokaysteve@gmail.com) 0ce711e: Merge pull request #119 from steveokay/feat/token-user-lastused (steveokay mokaysteve@gmail.com) e9510d7: Merge pull request #12 from steveokay/chore/rename-kh-to-janus (steveokay mokaysteve@gmail.com) 85d5727: Merge pull request #120 from steveokay/docs/three-features-shipped (steveokay mokaysteve@gmail.com) 8ca7fa1: Merge pull request #121 from steveokay/feat/ci-federation-issuers (steveokay mokaysteve@gmail.com) c4d0748: Merge pull request #122 from steveokay/feat/ops-hardening (steveokay mokaysteve@gmail.com) c44f456: Merge pull request #123 from steveokay/feat/sync-cloudflare-awssecrets (steveokay mokaysteve@gmail.com) a580bb5: Merge pull request #124 from steveokay/feat/editor-bulk-insights (steveokay mokaysteve@gmail.com) 1419d7d: Merge pull request #125 from steveokay/docs/four-features-shipped (steveokay mokaysteve@gmail.com) b9db9b6: Merge pull request #126 from steveokay/feat/break-glass (steveokay mokaysteve@gmail.com) 621fbe3: Merge pull request #127 from steveokay/feat/token-ip-allowlist (steveokay mokaysteve@gmail.com) 9ee33de: Merge pull request #128 from steveokay/docs/breakglass-ipallowlist-shipped (steveokay mokaysteve@gmail.com) 8480f93: Merge pull request #129 from steveokay/feat/secret-annotations (steveokay mokaysteve@gmail.com) 871c96f: Merge pull request #13 from steveokay/milestone-6-rbac (steveokay mokaysteve@gmail.com) ee9de64: Merge pull request #130 from steveokay/feat/sync-vercel-netlify (steveokay mokaysteve@gmail.com) acb338e: Merge pull request #131 from steveokay/feat/audit-shipping (steveokay mokaysteve@gmail.com) 1efbe07: Merge pull request #132 from steveokay/feat/scheduled-s3-backups (steveokay mokaysteve@gmail.com) b932b4c: Merge pull request #133 from steveokay/fix/board-header-overlap (steveokay mokaysteve@gmail.com) af6c40c: Merge pull request #134 from steveokay/docs/annotations-shipping-sync-backups (steveokay mokaysteve@gmail.com) d34e6f9: Merge pull request #135 from steveokay/feat/inbound-importers (steveokay mokaysteve@gmail.com) 596e72c: Merge pull request #136 from steveokay/feat/require-approval-prod-edits (steveokay mokaysteve@gmail.com) aec519f: Merge pull request #137 from steveokay/feat/rotators-mysql-redis (steveokay mokaysteve@gmail.com) a3eb312: Merge pull request #138 from steveokay/docs/approval-rotators-importers (steveokay mokaysteve@gmail.com) fb0071b: Merge pull request #139 from steveokay/feat/go-client-sdk (steveokay mokaysteve@gmail.com) 09a44f0: Merge pull request #14 from steveokay/docs/m6-rbac (steveokay mokaysteve@gmail.com) bb6579a: Merge pull request #140 from steveokay/feat/accessibility-pass (steveokay mokaysteve@gmail.com) 4a3b6ed: Merge pull request #141 from steveokay/feat/rotators-iam-oauth (steveokay mokaysteve@gmail.com) e72311b: Merge pull request #142 from steveokay/docs/rotators2-sdk-a11y (steveokay mokaysteve@gmail.com) d12682e: Merge pull request #143 from steveokay/docs/index-sync (steveokay mokaysteve@gmail.com) 656bd2d: Merge pull request #144 from steveokay/feat/typescript-sdk (steveokay mokaysteve@gmail.com) f20d331: Merge pull request #145 from steveokay/feat/python-sdk (steveokay mokaysteve@gmail.com) e422b9e: Merge pull request #146 from steveokay/feat/terraform-provider (steveokay mokaysteve@gmail.com) 0d825c1: Merge pull request #147 from steveokay/docs/terraform-sdks-shipped (steveokay mokaysteve@gmail.com) 48d52c8: Merge pull request #148 from steveokay/hardening/approval-bypass-fixes (steveokay mokaysteve@gmail.com) e445aff: Merge pull request #15 from steveokay/milestone-7-audit (steveokay mokaysteve@gmail.com) a756c7f: Merge pull request #16 from steveokay/docs/m7-audit (steveokay mokaysteve@gmail.com) 22ae8c0: Merge pull request #17 from steveokay/milestone-8-rest-api (steveokay mokaysteve@gmail.com) 7871a44: Merge pull request #18 from steveokay/milestone-9-cli (steveokay mokaysteve@gmail.com) c86bfeb: Merge pull request #19 from steveokay/milestone-10-transit (steveokay mokaysteve@gmail.com) fa7fd3a: Merge pull request #2 from steveokay/milestone-1-complete (steveokay mokaysteve@gmail.com) 68bbc76: Merge pull request #20 from steveokay/milestone-11-resolution (steveokay mokaysteve@gmail.com) 716d7d9: Merge pull request #21 from steveokay/milestone-12-spa-core (steveokay mokaysteve@gmail.com) 0c9adca: Merge pull request #22 from steveokay/milestone-13-ui-slice1 (steveokay mokaysteve@gmail.com) e124c60: Merge pull request #23 from steveokay/milestone-14-ui-slice2 (steveokay mokaysteve@gmail.com) acf8303: Merge pull request #24 from steveokay/milestone-15-b2-history (steveokay mokaysteve@gmail.com) c35db4e: Merge pull request #25 from steveokay/milestone-16-b3-audit (steveokay mokaysteve@gmail.com) 8d98e3b: Merge pull request #26 from steveokay/milestone-17-b4-tokens-members (steveokay mokaysteve@gmail.com) 5dfa479: Merge pull request #27 from steveokay/milestone-18-r1-dual-theme (steveokay mokaysteve@gmail.com) 49c2d45: Merge pull request #28 from steveokay/milestone-19-r2-shell-palette (steveokay mokaysteve@gmail.com) c021166: Merge pull request #29 from steveokay/milestone-20-r3-projects-board (steveokay mokaysteve@gmail.com) 3d49333: Merge pull request #3 from steveokay/rename-to-janus (steveokay mokaysteve@gmail.com) dcb346a: Merge pull request #30 from steveokay/milestone-21-r4-polish (steveokay mokaysteve@gmail.com) cfb23ab: Merge pull request #31 from steveokay/milestone-22-b5-transit-ui (steveokay mokaysteve@gmail.com) a13f809: Merge pull request #32 from steveokay/docs-tracker-sync (steveokay mokaysteve@gmail.com) 85bc8f3: Merge pull request #33 from steveokay/milestone-23-editor-redesign (steveokay mokaysteve@gmail.com) e6080e0: Merge pull request #34 from steveokay/worktree-oidc-federation (steveokay mokaysteve@gmail.com) 2584da2: Merge pull request #35 from steveokay/usage-metrics (steveokay mokaysteve@gmail.com) d94b9d8: Merge pull request #36 from steveokay/docs-metrics-tracker (steveokay mokaysteve@gmail.com) 7b566be: Merge pull request #37 from steveokay/kit-feedback (steveokay mokaysteve@gmail.com) 51a806a: Merge pull request #38 from steveokay/docs-kit-feedback-tracker (steveokay mokaysteve@gmail.com) 9345b35: Merge pull request #39 from steveokay/worktree-oidc-ci-federation (steveokay mokaysteve@gmail.com) 38efaae: Merge pull request #4 from steveokay/milestone-2-store (steveokay mokaysteve@gmail.com) 3de3486: Merge pull request #40 from steveokay/auth-unseal (steveokay mokaysteve@gmail.com) 3ed6549: Merge pull request #41 from steveokay/a11y-responsive (steveokay mokaysteve@gmail.com) 00eaef6: Merge pull request #42 from steveokay/docs-slice4-tracker (steveokay mokaysteve@gmail.com) 1a6d952: Merge pull request #43 from steveokay/docs-status-phase2 (steveokay mokaysteve@gmail.com) 07fd4ba: Merge pull request #44 from steveokay/editor-p2 (steveokay mokaysteve@gmail.com) 062e153: Merge pull request #45 from steveokay/docs-editor-p2-trackers (steveokay mokaysteve@gmail.com) a662790: Merge pull request #46 from steveokay/editor-ondemand (steveokay mokaysteve@gmail.com) 9e7a846: Merge pull request #47 from steveokay/docs-ondemand-trackers (steveokay mokaysteve@gmail.com) 0ccd39e: Merge pull request #48 from steveokay/ops-probes-seal-idle (steveokay mokaysteve@gmail.com) 5cf4a9b: Merge pull request #49 from steveokay/ops-backup-restore (steveokay mokaysteve@gmail.com) cea5778: Merge pull request #5 from steveokay/chore/tracker-m2-merged (steveokay mokaysteve@gmail.com) 8ef62d9: Merge pull request #51 from steveokay/fix/backup-preflight-table-check (steveokay mokaysteve@gmail.com) 90ced5c: Merge pull request #52 from steveokay/phase3-static-rotation (steveokay mokaysteve@gmail.com) 5363291: Merge pull request #53 from steveokay/phase3-sync-integrations (steveokay mokaysteve@gmail.com) 5a8df82: Merge pull request #54 from steveokay/phase3-dynamic-postgres-creds (steveokay mokaysteve@gmail.com) 551d560: Merge pull request #55 from steveokay/ops-console-web (steveokay mokaysteve@gmail.com) 4f1d0e6: Merge pull request #56 from steveokay/ops-console-followups (steveokay mokaysteve@gmail.com) c1fa0e9: Merge pull request #57 from steveokay/docs-gap-audit (steveokay mokaysteve@gmail.com) 0040fd2: Merge pull request #58 from steveokay/ui-redo-spec (steveokay mokaysteve@gmail.com) 5bbbc1e: Merge pull request #59 from steveokay/docs-status-refresh (steveokay mokaysteve@gmail.com) d73a286: Merge pull request #6 from steveokay/milestone-3-secrets (steveokay mokaysteve@gmail.com) 69e5e01: Merge pull request #60 from steveokay/ci-web-guard (steveokay mokaysteve@gmail.com) 0300a93: Merge pull request #61 from steveokay/nocturne-n1 (steveokay mokaysteve@gmail.com) ba94ae1: Merge pull request #62 from steveokay/nocturne-n2 (steveokay mokaysteve@gmail.com) a7b8ff7: Merge pull request #63 from steveokay/nocturne-n3 (steveokay mokaysteve@gmail.com) 089ec55: Merge pull request #64 from steveokay/nocturne-n4 (steveokay mokaysteve@gmail.com) e81ba41: Merge pull request #65 from steveokay/nocturne-n5 (steveokay mokaysteve@gmail.com) 322c86e: Merge pull request #66 from steveokay/nocturne-n6 (steveokay mokaysteve@gmail.com) c9ac2cf: Merge pull request #67 from steveokay/nocturne-n7 (steveokay mokaysteve@gmail.com) b795fa7: Merge pull request #68 from steveokay/editor-depth (steveokay mokaysteve@gmail.com) 5b6ddfb: Merge pull request #69 from steveokay/ops-console-depth (steveokay mokaysteve@gmail.com) 72334af: Merge pull request #7 from steveokay/chore/m3-review-followups (steveokay mokaysteve@gmail.com) a423070: Merge pull request #70 from steveokay/ops-console-depth-web (steveokay mokaysteve@gmail.com) 01186b6: Merge pull request #71 from steveokay/project-kek-rotation (steveokay mokaysteve@gmail.com) 9666785: Merge pull request #72 from steveokay/kek-toctou-fix (steveokay mokaysteve@gmail.com) 66fda61: Merge pull request #73 from steveokay/env-promotion (steveokay mokaysteve@gmail.com) cf81b75: Merge pull request #74 from steveokay/env-promotion-followups (steveokay mokaysteve@gmail.com) 96f2b91: Merge pull request #75 from steveokay/promotion-provenance (steveokay mokaysteve@gmail.com) e2cb29b: Merge pull request #76 from steveokay/modal-solidify (steveokay mokaysteve@gmail.com) 8f89232: Merge pull request #77 from steveokay/master-key-rotation (steveokay mokaysteve@gmail.com) 4eef1e3: Merge pull request #78 from steveokay/docs-gaps-refresh (steveokay mokaysteve@gmail.com) d87f73b: Merge pull request #79 from steveokay/api-hardening-pagination-idem (steveokay mokaysteve@gmail.com) 8adfa61: Merge pull request #8 from steveokay/milestone-4-bootstrap (steveokay mokaysteve@gmail.com) 3158106: Merge pull request #80 from steveokay/crypto-coverage-gate (steveokay mokaysteve@gmail.com) e960448: Merge pull request #81 from steveokay/ui-depth-trash-history-audit (steveokay mokaysteve@gmail.com) 17d8d19: Merge pull request #85 from steveokay/feat/cli-control-plane (steveokay mokaysteve@gmail.com) 394c9bb: Merge pull request #86 from steveokay/feat/release-hygiene (steveokay mokaysteve@gmail.com) 1f2eaea: Merge pull request #87 from steveokay/feat/promotion-approval (steveokay mokaysteve@gmail.com) f24b2d7: Merge pull request #88 from steveokay/feat/list-ergonomics (steveokay mokaysteve@gmail.com) 3f32aea: Merge pull request #89 from steveokay/feat/board-depth (steveokay mokaysteve@gmail.com) d214735: Merge pull request #9 from steveokay/docs/m4-operations (steveokay mokaysteve@gmail.com) 4f8fc83: Merge pull request #90 from steveokay/feat/typed-secrets (steveokay mokaysteve@gmail.com) 3a3f9e9: Merge pull request #91 from steveokay/feat/ui-polish-sweep (steveokay mokaysteve@gmail.com) 0db855b: Merge pull request #92 from steveokay/feat/rbac-matrix (steveokay mokaysteve@gmail.com) 2828b68: Merge pull request #93 from steveokay/feat/audit-depth (steveokay mokaysteve@gmail.com) 78a17fd: Merge pull request #94 from steveokay/feat/filename-keys (steveokay mokaysteve@gmail.com) b60bee1: Merge pull request #95 from steveokay/feat/atrium-ui (steveokay mokaysteve@gmail.com) 801f5bc: Merge pull request #96 from steveokay/feat/atrium-updates (steveokay mokaysteve@gmail.com) 6af5b29: Merge pull request #97 from steveokay/docs/freshness-pass (steveokay mokaysteve@gmail.com) 6ec5f96: Merge pull request #98 from steveokay/feat/session-management (steveokay mokaysteve@gmail.com) 49c76d3: Merge pull request #99 from steveokay/fix/change-password-fields (steveokay mokaysteve@gmail.com) b9a042f: Merge remote-tracking branch 'origin/main' into feat/rotators-iam-oauth (steveokay mokaysteve@gmail.com) 5eca50b: Merge remote-tracking branch 'origin/main' into feat/scheduled-s3-backups (steveokay mokaysteve@gmail.com) cf22f14: Merge remote-tracking branch 'origin/main' into feat/secret-annotations (steveokay mokaysteve@gmail.com) b3157d7: Merge remote-tracking branch 'origin/main' into feat/terraform-provider (steveokay mokaysteve@gmail.com) 093a6cc: Merge remote-tracking branch 'origin/main' into feat/terraform-provider (steveokay mokaysteve@gmail.com) 0c176d0: Merge remote-tracking branch 'origin/main' into feat/token-ip-allowlist (steveokay mokaysteve@gmail.com) d5146ef: Merge remote-tracking branch 'origin/main' into feat/typescript-sdk (steveokay mokaysteve@gmail.com) 0180836: Merge remote-tracking branch 'origin/main' into milestone-6-rbac (steveokay mokaysteve@gmail.com) c769ba2: build(oidc): add go-oidc/v3 + x/oauth2 (+ go-jose test dep) (steveokay mokaysteve@gmail.com) 67e8add: build(web): Dockerfile web stage + Makefile web/build/test wiring (steveokay mokaysteve@gmail.com) 33329df: build: goreleaser config + release Dockerfile (multi-arch binaries + GHCR image) (steveokay mokaysteve@gmail.com) 3825feb: chore(dev): move dev stack ports to 8210 (janus) and 5433 (postgres) (steveokay mokaysteve@gmail.com) b5f03a8: chore(go): pin toolchain go1.26.5 — clears govulncheck GO-2026-5856 (crypto/tls ECH) (steveokay mokaysteve@gmail.com) e0ba903: chore(oidc): go mod tidy — promote go-jose/v4 to a direct dependency (steveokay mokaysteve@gmail.com) cde0c49: chore(store): pin go1.26.4 toolchain (clears govulncheck); update trackers/docs (steveokay mokaysteve@gmail.com) 52f755b: chore(web): build export url with a single params object (no stray separator) (steveokay mokaysteve@gmail.com) a058f15: chore(web): drop orphaned revealKey endpoint (editor now raw-only) (steveokay mokaysteve@gmail.com) 888c3c6: chore(web): fix stale auth/me mock shape; amend spec for error-row treatment (steveokay mokaysteve@gmail.com) 624b040: chore(web): scaffold Vite + React-TS + Tailwind + Vitest project (steveokay mokaysteve@gmail.com) 136d102: chore(web/nocturne): N4 gate sweep — ConfirmDialog on kit buttons, ops nit, tracker (steveokay mokaysteve@gmail.com) c3969d2: chore(web/nocturne): N5 gate sweep — EmptyState/LoginPage alias fixes + ui-redo tracker (steveokay mokaysteve@gmail.com) 6be2ef8: chore(web/nocturne): N6 gate sweep + ui-redo tracker (steveokay mokaysteve@gmail.com) bb10c74: chore(web/nocturne): N7 verification sweep + ui-redo tracker (Nocturne N1–N7 complete) (steveokay mokaysteve@gmail.com) b4562a2: chore: apply Task 1 review fixes (bind pg to localhost, pin gosec, branch CI); add status tracker (steveokay mokaysteve@gmail.com) 71b7604: chore: gitignore .superpowers/ brainstorm scratch (steveokay mokaysteve@gmail.com) b7fc180: chore: gitignore local janus-cli.md reference (steveokay mokaysteve@gmail.com) f57a056: chore: ignore .claude/ local settings (steveokay mokaysteve@gmail.com) 9425b7a: chore: license Janus under Apache-2.0 (LICENSE + NOTICE) (steveokay mokaysteve@gmail.com) 023cc6a: chore: mark task 2 complete in status tracker (steveokay mokaysteve@gmail.com) a5f6b7f: chore: mark task 3 complete (steveokay mokaysteve@gmail.com) 6bce673: chore: mark task 4 complete (steveokay mokaysteve@gmail.com) 5d70e01: chore: mark task 5 complete (steveokay mokaysteve@gmail.com) d111a39: chore: mark task 6 complete (steveokay mokaysteve@gmail.com) 95ad4ea: chore: mark task 7 complete (steveokay mokaysteve@gmail.com) 68e7e02: chore: mark task 8 complete (steveokay mokaysteve@gmail.com) 103e08d: chore: mark task 9 complete — milestone 1 crypto layer done (steveokay mokaysteve@gmail.com) 6cb79a3: chore: rename kh -> janus (finish Keyhaven->Janus rename) (steveokay mokaysteve@gmail.com) 8b5af05: chore: scaffold repo (module, entrypoint, Makefile, compose, CI) (steveokay mokaysteve@gmail.com) 1236fb7: ci: fix web job for Atrium scripts + session-management docs sweep (steveokay mokaysteve@gmail.com) d1c2d38: ci: release workflow (goreleaser -> binaries + GHCR) + PR goreleaser check (steveokay mokaysteve@gmail.com) 0408ae1: ci: run web tests + dual-theme smoke on PRs (gaps.md 7.1) (steveokay mokaysteve@gmail.com) 19d0f42: docs(api): M8 REST API plan (9 tasks) + spec cascade correction (steveokay mokaysteve@gmail.com) be6ec38: docs(api): add Milestone 8 secret-facing REST API design spec (steveokay mokaysteve@gmail.com) acd7dec: docs(api): correct /v1/audit/verify response shape to match VerifyResult (steveokay mokaysteve@gmail.com) 76c5851: docs(api): hand-authored OpenAPI 3.1 spec for all /v1 endpoints (steveokay mokaysteve@gmail.com) 2f45f2d: docs(audit): M7 implementation plan (7 tasks, build-green ordering) (steveokay mokaysteve@gmail.com) e08b475: docs(audit): add Milestone 7 hash-chained audit log design spec (steveokay mokaysteve@gmail.com) fabc19c: docs(auth): add Milestone 5 auth design spec (steveokay mokaysteve@gmail.com) d0ed5ed: docs(auth): add Milestone 5 implementation plan (steveokay mokaysteve@gmail.com) 702c2cd: docs(bootstrap): add Milestone 4 implementation plan; spec notes two crypto additions (steveokay mokaysteve@gmail.com) 682873a: docs(bootstrap): add Milestone 4 server-bootstrap design spec (steveokay mokaysteve@gmail.com) 617ae1c: docs(bootstrap): rename Progress() to SubmittedShares() per Task-2 review (steveokay mokaysteve@gmail.com) 9490a7d: docs(changelog): consolidate 0.1.0 for first tag (2026-07-24) (steveokay mokaysteve@gmail.com) f3e00ea: docs(changelog): filename-style secret keys + materialize-to-files (steveokay mokaysteve@gmail.com) 8764270: docs(changelog): note dotted keys skip refs + GitHub Actions sync (steveokay mokaysteve@gmail.com) 3a85a9f: docs(changelog): typed secrets (steveokay mokaysteve@gmail.com) 3f68b2a: docs(cli): CLI reference, README quickstart, status/operations for M9 (steveokay mokaysteve@gmail.com) 4a199dd: docs(cli): M9 secrets CLI implementation plan (13 tasks) (steveokay mokaysteve@gmail.com) 0b6304e: docs(cli): add Milestone 9 secrets CLI design spec (steveokay mokaysteve@gmail.com) 503151e: docs(cli): mark §6 CLI control plane done; document CLI create/token flows (steveokay mokaysteve@gmail.com) 921f539: docs(crypto): document KMSClient.Decrypt fresh-plaintext ownership contract (steveokay mokaysteve@gmail.com) ef571f6: docs(crypto): note KMS/Shamir Init locking asymmetry; sync plan gosec version (steveokay mokaysteve@gmail.com) c26b87d: docs(design): add Nocturne canonical mockup (shell + editor + home, both themes) (steveokay mokaysteve@gmail.com) 56194c6: docs(design): dark redesign spec + Doppler-calibrated dark/light mockup (steveokay mokaysteve@gmail.com) 28f2bad: docs(design): lock approved UI visual system (mockup + token spec + CLAUDE.md rules) (steveokay mokaysteve@gmail.com) 54c96eb: docs(dynamic): clarify MarkRevoked idempotency + fix test comment (steveokay mokaysteve@gmail.com) 95eec28: docs(dynamic): design spec for Phase 3.3 dynamic Postgres credentials (steveokay mokaysteve@gmail.com) 790576e: docs(dynamic): implementation plan for Phase 3.3 dynamic Postgres creds (steveokay mokaysteve@gmail.com) 18b4086: docs(dynamic): operator + runbook docs for dynamic Postgres credentials (steveokay mokaysteve@gmail.com) 8639ed7: docs(dynamic): reconcile password-quoting deviation from the design spec (steveokay mokaysteve@gmail.com) c5478a7: docs(editor): on-demand reveal rework spec + plan (mount = masked-only, ephemeral values) (steveokay mokaysteve@gmail.com) 5c2febd: docs(editor): §3 P2 polish spec + plan (reveal-all/re-mask, ⌘S, dialog a11y) (steveokay mokaysteve@gmail.com) 9dc1e64: docs(fe): check off B2 version history + dialog/toast kit items (steveokay mokaysteve@gmail.com) 5d36fce: docs(fe): check off R2 shell & command palette (steveokay mokaysteve@gmail.com) c9c063a: docs(fe): check off R3 projects list & board (steveokay mokaysteve@gmail.com) 780ca5e: docs(fe): check off R4 screen polish (steveokay mokaysteve@gmail.com) 7973516: docs(fe): check off slice-1 foundations + shell; record review follow-ups (steveokay mokaysteve@gmail.com) aa3a589: docs(fe): check off slice-2 landing, dashboard, empty states; record mock-drift lesson (steveokay mokaysteve@gmail.com) 7f8be69: docs(fe): check off §3 secret editor redesign (steveokay mokaysteve@gmail.com) 647fa9b: docs(fe): check off §4 kit + §5 feedback (PR #37) (steveokay mokaysteve@gmail.com) a49d35f: docs(fe): check off §6 auth/unseal + §7 a11y/responsive (PRs #40, #41) (steveokay mokaysteve@gmail.com) 8f8eb9c: docs(fe): check off §8 usage-metrics dashboard (D, PR #35) (steveokay mokaysteve@gmail.com) 111287c: docs(fe): distinguish token vs member SHIPPED descriptions (steveokay mokaysteve@gmail.com) 9446a37: docs(fe): link slice-1 plan + record shadcn-lean decision in tracker (steveokay mokaysteve@gmail.com) 4674ce4: docs(fe): reconcile legacy dark-mode + env-tabs items delivered by R1/R3 (steveokay mokaysteve@gmail.com) 8bde214: docs(gaps): mark #7 (pagination+idempotency+hardening) done via PR #79/#80 (steveokay mokaysteve@gmail.com) f4e3e0d: docs(gaps): mark #8 UI depth done (1.10 trash/restore, 1.11 per-key history, 2.3 audit expand) — PR #81 (steveokay mokaysteve@gmail.com) 9ef7160: docs(gaps): mark ops-console §2.2 sorting/bulk/run-history/health done (steveokay mokaysteve@gmail.com) bdcd1e3: docs(gaps): mark tokens/members search+sort done (2.5/2.6) (steveokay mokaysteve@gmail.com) 3e98255: docs(gaps): mark §2.3 audit histogram + presets + page-size done (steveokay mokaysteve@gmail.com) f749165: docs(gaps): mark §2.4 projects/board depth done (steveokay mokaysteve@gmail.com) 1571033: docs(gaps): mark §2.6 RBAC matrix + picker search done (steveokay mokaysteve@gmail.com) 51cd837: docs(gaps): mark §4.1 rotation done; re-rank remaining priorities (steveokay mokaysteve@gmail.com) b33e0e7: docs(gaps): mark §7.2-7.5 release hygiene done (steveokay mokaysteve@gmail.com) 5f856d7: docs(guides): add two-factor authentication (TOTP) how-to (steveokay mokaysteve@gmail.com) 9d3d4d1: docs(k8s): explain sync target --api-url and --k8s-token (incl. Docker Desktop) (#84) (steveokay mokaysteve@gmail.com) 9e4ae32: docs(oidc): C1 login flow, endpoints, UI handoff; record crypto-lib exception (steveokay mokaysteve@gmail.com) 498630f: docs(oidc): CI federation (C2) flow, endpoints, GitHub Actions example (steveokay mokaysteve@gmail.com) 601e80a: docs(ops)+test(cli): update operations.md for authenticated janus seal; cover stored-address fallback (steveokay mokaysteve@gmail.com) 325eab6: docs(ops): document JANUS_SESSION_IDLE_TIMEOUT; clarify idle-timeout and probe-test comments (steveokay mokaysteve@gmail.com) a9dcc14: docs(plan): API hardening implementation plan (pagination, idempotency, timeouts) (steveokay mokaysteve@gmail.com) 15e6f85: docs(plan): B2 version history drawer implementation plan (steveokay mokaysteve@gmail.com) f76b15f: docs(plan): B3 audit viewer implementation plan (steveokay mokaysteve@gmail.com) 3b0fd89: docs(plan): B4 tokens & members implementation plan (steveokay mokaysteve@gmail.com) e71accc: docs(plan): B5 transit UI implementation plan (steveokay mokaysteve@gmail.com) ccf8de0: docs(plan): CLI control plane implementation plan (8 TDD tasks) (steveokay mokaysteve@gmail.com) 913fca1: docs(plan): Nocturne N1 implementation plan (tokens, shell, motion) (steveokay mokaysteve@gmail.com) 976f4a2: docs(plan): Nocturne N2 implementation plan (home command center, /projects, board enrichment) (steveokay mokaysteve@gmail.com) 4a3e31c: docs(plan): Nocturne N3 implementation plan (editor restyle + riders) (steveokay mokaysteve@gmail.com) d7c81fd: docs(plan): Nocturne N4 implementation plan (admin/ops restyle + timeAgo fold) (steveokay mokaysteve@gmail.com) 256c3af: docs(plan): Nocturne N5 implementation plan (settings hub + OIDC login button) (steveokay mokaysteve@gmail.com) 571b30c: docs(plan): Nocturne N6 implementation plan (ops create flows + ErrorBoundary/404) (steveokay mokaysteve@gmail.com) 5c22eb0: docs(plan): Nocturne N7 implementation plan (final polish sweep) (steveokay mokaysteve@gmail.com) fbcfe7a: docs(plan): OIDC CI federation (C2) — 14 TDD tasks for subagent-driven execution (steveokay mokaysteve@gmail.com) ceafea0: docs(plan): OIDC human login (C1) — 15 TDD tasks for subagent-driven execution (steveokay mokaysteve@gmail.com) 2c0ed60: docs(plan): Phase 3.2 sync integrations implementation plan (steveokay mokaysteve@gmail.com) 11b8856: docs(plan): R1 dual-theme foundation implementation plan (steveokay mokaysteve@gmail.com) 2c4ee73: docs(plan): R2 shell & command palette implementation plan (steveokay mokaysteve@gmail.com) a33f886: docs(plan): R3 projects list + env-columns board + create-project modal (steveokay mokaysteve@gmail.com) 7a83e89: docs(plan): React SPA core editor — 15-task TDD plan (steveokay mokaysteve@gmail.com) 527bf49: docs(plan): UI depth #8 — trash/restore + per-key history + audit detail (steveokay mokaysteve@gmail.com) 4b35090: docs(plan): UI slice 1 — design tokens + app shell implementation plan (steveokay mokaysteve@gmail.com) 4cf48ec: docs(plan): UI slice 2 — landing + EmptyState + project overview (steveokay mokaysteve@gmail.com) 3d0e34e: docs(plan): audit viewer depth implementation plan (gaps §2.3) (steveokay mokaysteve@gmail.com) 7963b39: docs(plan): component kit + feedback implementation plan (9 tasks) (steveokay mokaysteve@gmail.com) 95e5f7b: docs(plan): config inheritance + secret references — 12-task TDD plan (steveokay mokaysteve@gmail.com) f0d230f: docs(plan): correct N4 sticky-header approach — remove overflow-hidden; ops table stays non-sticky (T2 review finding) (steveokay mokaysteve@gmail.com) 916a0cf: docs(plan): correct localeCompare sort expectations in Task 1 test (steveokay mokaysteve@gmail.com) f490303: docs(plan): defer Task 9 (in-app unsaved guard) — needs data-router migration (steveokay mokaysteve@gmail.com) 72c8e40: docs(plan): drop redundant gitignore step in T3 (blanket dist/ already covers) (steveokay mokaysteve@gmail.com) 5f087d5: docs(plan): environment promotion (Phase A) implementation plan (15 tasks, TDD) (steveokay mokaysteve@gmail.com) 5ad3737: docs(plan): filename-style secret keys implementation plan (steveokay mokaysteve@gmail.com) dddab26: docs(plan): fix Task 5 test — soft-delete reuse row before undelete (slug clash) (steveokay mokaysteve@gmail.com) d5123f4: docs(plan): fix github secret-name validator identifier in 3.2 plan (steveokay mokaysteve@gmail.com) cca8add: docs(plan): integrations hub implementation plan (4 TDD tasks) (steveokay mokaysteve@gmail.com) 4dae325: docs(plan): list ergonomics implementation plan (6 TDD tasks) (steveokay mokaysteve@gmail.com) 5e5b345: docs(plan): master-key rotation implementation plan (12 tasks, TDD) (steveokay mokaysteve@gmail.com) 82ab88d: docs(plan): members RBAC matrix implementation plan (gaps §2.6) (steveokay mokaysteve@gmail.com) 39c2ba2: docs(plan): operations console (rotation/sync/dynamic) web UI — 11 TDD tasks (steveokay mokaysteve@gmail.com) 42ac5ef: docs(plan): operations console depth implementation plan (12 tasks, 2 phases) (steveokay mokaysteve@gmail.com) 37339bb: docs(plan): project-KEK rotation implementation plan (9 tasks, TDD) (steveokay mokaysteve@gmail.com) 1f90213: doc...