v0.2.0

Changelog

Features

• 25803c8: feat(audit): signed hash-chain checkpoints + guarded retention prune (8.1) (@steveokay)
• dd3e4ce: feat(auth): Kubernetes service-account federation + multi-issuer trust (@steveokay)
• 5d0ce5b: feat(auth): WebAuthn / passkeys for UI login (7.5) (@steveokay)
• b456a74: feat(auth): passwordless (discoverable) passkey sign-in (@steveokay)
• 0aa1061: feat(cli): add run --watch and janus render (config-version reload) (@steveokay)
• 0665fa8: feat(deploy): Helm chart + multi-mode deployment guide (@steveokay)
• d4bfe85: feat(observability): Grafana dashboard + example alert rules (roadmap 8.3) (@steveokay)
• df86339: feat(sdk): background lease auto-renew + Run-style helpers (Go/TS/Python) (@steveokay)
• 5169616: feat(secrets): explicit, audited value-version retention (roadmap 8.2) (@steveokay)
• 2ac2733: feat(sync): drift detection — read destinations back and report what changed (@steveokay)
• f61f2c3: feat(terraform): environment-scoped tokens + janus_secrets batch resource (@steveokay)
• bb309b0: feat(trust): supply-chain sweep — SECURITY.md, threat model, dependabot, signed releases (@steveokay)
• d6bc055: feat(web): mobile/tablet layout for the Atrium shell and read-mostly screens (@steveokay)
• c97160a: feat(web): paste-based import wizard for Doppler, Vault, and AWS Secrets Manager (@steveokay)

Fixes

• 2ce7117: fix(api): destroying a config or environment from Trash always failed (@steveokay)
• 717d567: fix(api,cli): QA findings — JSON 404 for unmatched /v1, clearer errors, config-UUID binding (@steveokay)
• 00fb231: fix(audit): bind prune's ship-HWM guard to shipping history + add retention floor (@steveokay)
• 7b4f537: fix(audit): make event_count a lifetime total; clarify prune HWM block (@steveokay)
• 17b9642: fix(audit): verify the hash chain before signing a checkpoint (M-5) (@steveokay)
• 680e6b5: fix(auth): reject TOTP code replay + revoke sessions on password change (@steveokay)
• 9a4811a: fix(auth): route OIDC discovery/JWKS through SSRF-hardened client (M-4/I-4) (@steveokay)
• fc0da2c: fix(authz): cap member-grant delegation at bound role, not effective role (@steveokay)
• 2ca8ac6: fix(net): SSRF guard + bounded dials on outbound clients (block IMDS/link-local, redirect control) (@steveokay)
• 146d727: fix(nethard): don't let an HTTP proxy silently defeat the SSRF guard (L-7) (@steveokay)
• e454b8e: fix(release): goreleaser prerelease: auto — rc tags don't become "Latest" (@steveokay)
• 9b3380d: fix(release): never let a prerelease take over the latest image tag (@steveokay)
• 3aa20f6: fix(web): a failed passkey enrolment no longer signs the user out (@steveokay)
• 799e63f: fix(web): surface expired sessions, and stop the value field collapsing (@steveokay)

Others

• e9bde7c: Merge pull request #149 from steveokay/hardening/security-audit-fixes (@steveokay)
• e3b5a49: Merge pull request #150 from steveokay/trust/supply-chain-sweep (@steveokay)
• 7807dee: Merge pull request #151 from steveokay/test/playwright-smoke (@steveokay)
• 8139868: Merge pull request #152 from steveokay/feat/cli-watch-render (@steveokay)
• 9676bf0: Merge pull request #153 from steveokay/feat/audit-checkpointing (@steveokay)
• f0ec475: Merge pull request #154 from steveokay/docs/post1-batch-trackers (@steveokay)
• 4fdb0bb: Merge pull request #155 from steveokay/dependabot/pip/sdk/python/pip-6ffa451956 (@steveokay)
• 8c6f70e: Merge pull request #157 from steveokay/dependabot/github_actions/actions-256fe8712a (@steveokay)
• 4495582: Merge pull request #159 from steveokay/dependabot/go_modules/go-modules-e73c0cab33 (@steveokay)
• da8a0c0: Merge pull request #160 from steveokay/docs/cli-completeness (@steveokay)
• 1dcdb9e: Merge pull request #161 from steveokay/chore/dependabot-ignore-ts-major (@steveokay)
• 83608d5: Merge pull request #162 from steveokay/dependabot/npm_and_yarn/web/npm-fc6038b1a4 (@steveokay)
• 9df7777: Merge pull request #163 from steveokay/fix/goreleaser-prerelease-auto (@steveokay)
• fcd2a0a: Merge pull request #164 from steveokay/docs/readme-and-md-refresh (@steveokay)
• 5953d3c: Merge pull request #165 from steveokay/feat/helm-and-deployment-modes (@steveokay)
• 90e7a12: Merge pull request #166 from steveokay/fix/nethard-proxy-ssrf-gap (@steveokay)
• 439f3e8: Merge pull request #167 from steveokay/fix/audit-checkpoint-verify-before-sign (@steveokay)
• 43b3709: Merge pull request #168 from steveokay/fix/prune-retention-guards (@steveokay)
• a3d3030: Merge pull request #169 from steveokay/docs/remove-doppler-references (@steveokay)
• 04c83c3: Merge pull request #170 from steveokay/fix/qa-api-hygiene (@steveokay)
• 293d21d: Merge pull request #171 from steveokay/fix/qa-eventcount-consistency (@steveokay)
• a55a307: Merge pull request #172 from steveokay/fix/goreleaser-latest-tag (@steveokay)
• b57b690: Merge pull request #173 from steveokay/test/go-fuzz-parsers (@steveokay)
• 3a7b0fc: Merge pull request #174 from steveokay/feat/k8s-sa-federation (@steveokay)
• 4eba4c2: Merge pull request #175 from steveokay/feat/sync-drift-detection (@steveokay)
• 81d5106: Merge pull request #176 from steveokay/feat/webauthn-passkeys (@steveokay)
• 9f6ea44: Merge pull request #177 from steveokay/docs/section7-trackers (@steveokay)
• f916af6: Merge pull request #178 from steveokay/test/schema-enum-guard (@steveokay)
• 463387e: Merge pull request #179 from steveokay/test/webauthn-browser-e2e (@steveokay)
• 0f260b2: Merge pull request #180 from steveokay/feat/grafana-dashboards (@steveokay)
• c37cb17: Merge pull request #181 from steveokay/feat/value-version-retention (@steveokay)
• d40e462: Merge pull request #182 from steveokay/docs/section8-trackers (@steveokay)
• 3137fdc: Merge pull request #183 from steveokay/feat/sdk-lease-autorenew (@steveokay)
• 02cd704: Merge pull request #184 from steveokay/feat/webauthn-passwordless (@steveokay)
• ff49ce5: Merge pull request #185 from steveokay/docs/sdk-passwordless-trackers (@steveokay)
• ede23b1: Merge pull request #186 from steveokay/feat/terraform-env-tokens-batch (@steveokay)
• 3ea1b59: Merge pull request #187 from steveokay/feat/web-import-wizard (@steveokay)
• 283ac19: Merge pull request #188 from steveokay/docs/two-day-sweep (@steveokay)
• cf4f96a: Merge pull request #189 from steveokay/fix/session-expiry-401 (@steveokay)
• db24b1f: Merge pull request #190 from steveokay/ci/module-coverage-and-trackers (@steveokay)
• baae333: Merge pull request #191 from steveokay/fix/trash-destroy-soft-deleted (@steveokay)
• 21c98ae: Merge pull request #192 from steveokay/feat/mobile-tablet-layout (@steveokay)
• 6151afd: Merge pull request #193 from steveokay/fix/401-ceremony-vs-expiry (@steveokay)
• e9e522d: Merge pull request #194 from steveokay/docs/close-out-roadmap (@steveokay)
• b4aa661: Merge pull request #195 from steveokay/docs/staleness-sweep (@steveokay)
• 127186b: Merge pull request #196 from steveokay/docs/readme-front-door (@steveokay)
• 6f3b993: Merge pull request #197 from steveokay/release/v0.2.0 (@steveokay)
• 61ab215: chore(ci): Bump the actions group with 10 updates (@dependabot[bot])
• 5112c7b: chore(ci): dependabot — ignore TypeScript major-version bumps (web + sdk/ts) (@steveokay)
• 1b6f053: chore(deps): Bump the go-modules group with 7 updates (@dependabot[bot])
• 04310e5: chore(deps): Bump the npm group in /web with 5 updates (@dependabot[bot])
• de6fda9: chore(deps): Update mypy requirement in /sdk/python in the pip group (@dependabot[bot])
• c334254: ci: test the nested modules; close out the trackers (@steveokay)
• 9eaa71b: docs(cli): make cli.md a complete command index (break-glass + operator/misc) (@steveokay)
• 0716d90: docs(deploy): fix Swarm example — Janus has no _FILE env convention (@steveokay)
• 54fa02b: docs(design,helm): drop Doppler from mockups and chart metadata (@steveokay)
• 2142273: docs(roadmap): add post-1.0 roadmap (trust/supply-chain, product depth, longevity, test depth) (@steveokay)
• 003fa9c: docs(trackers): mark CLI watch/render (7.1-7.2) + Playwright smoke (9.1) done (@steveokay)
• b02c6f4: docs(trackers): mark WebAuthn passwordless + SDK lease auto-renew shipped (@steveokay)
• b25ee05: docs(trackers): mark audit checkpointing + retention (8.1) done (@steveokay)
• 1d6c083: docs(trackers): mark post-1.0 security-audit remediation done (@steveokay)
• baed7ff: docs(trackers): mark §7 product depth shipped; correct the sync-provider claim (@steveokay)
• 8a8e9e1: docs(trackers): mark §8 operational longevity shipped (@steveokay)
• cbefcda: docs(trackers): record v0.1.0 + PR #148 hardening; track registry publishes (@steveokay)
• acf1b47: docs: bring the front door back in line with two days of shipping (@steveokay)
• cf862e7: docs: close the gaps this week's work left, and mark the archive as historical (@steveokay)
• 7b543f5: docs: drop comparative third-party marks; add trademark notice (@steveokay)
• eaffd24: docs: make the README a front door, not a build tracker (@steveokay)
• 6fdaa2a: docs: mark the mobile/tablet layout shipped; close out the roadmap (@steveokay)
• 7750367: docs: refresh README + guides for post-v0.1.0 features (@steveokay)
• 3fcf7a1: docs: remove comparative Doppler references from prose (@steveokay)
• 33489b3: harden(api): security headers on API responses + .dockerignore + compose/doc notes (@steveokay)
• 402f87a: merge main: reconcile tracker edits from #149/#150 (@steveokay)
• 4a4b119: merge main: reconcile with nethard proxy fix (#166) + checkpoint verify-before-sign (#167) (@steveokay)
• 432819d: merge: API security headers + .dockerignore + compose/doc hardening (L-1/L-3/L-4/L-5/L-6) (@steveokay)
• 4c86fec: merge: SSRF guard + bounded dials on outbound clients (M-4/L-2) (@steveokay)
• 3233522: merge: reject TOTP replay + rotate/revoke sessions on password change (M-2/M-3) (@steveokay)
• 71359f2: release: cut v0.2.0 (@steveokay)
• be0e30a: test(auth): pin Kubernetes claim handling to a REAL cluster token (@steveokay)
• c49e535: test(e2e): verify the WebAuthn browser ceremony; track deferred sub-items (@steveokay)
• 41b944b: test(fuzz): 7 Go fuzz targets over the hostile-input parsers (9.2) (@steveokay)
• 1eb0969: test(schema): guard DB enum CHECKs against the code's accepted values (@steveokay)
• 5c27be8: test(web): add Playwright E2E smoke suite for the flagship path (9.1) (@steveokay)