v1.7.1 — security & reliability fixes

Flagpost v1.7.1 — a security and reliability patch release. Multi-worker and multi-instance deployments should upgrade; single-worker installs (the default) are unaffected by the security issue but get the reliability fixes. No migrations, no configuration changes.

🔒 Security — GHSA-p679-w29c-326x (medium)

WebSocket access could survive revocation on other workers. Room authorization runs once, at the WebSocket handshake. When access is revoked — a ban, account deletion, team removal, or role change — Flagpost closes the user's live sockets. In deployments running more than one worker (WEB_CONCURRENCY > 1) or multiple instances, that eviction only reached the worker that handled the revoking request, so the user's sockets on other workers stayed open.

Fixed in #462: revocation now reaches every worker through the cross-worker relay and takes effect before any socket close is attempted, and the relay's subscriber is supervised so a Redis restart or a silently dropped connection can't quietly disable it. See the advisory for affected versions and workarounds, and the updated ADR-0025 for the design.

Note for multi-worker operators: after a Redis restart, every worker now closes its WebSockets (spread over a few seconds) so clients reconnect and re-authorize — expect a brief reconnect wave rather than silence.

🛠️ Reliability — background work no longer cut off silently

The event bus caps every handler at 10 seconds, including background ones, which cancelled several slow tasks mid-run with nothing but a log line:

• Challenge instances (#457, #460) — provisioning gets a realistic budget, image pulls and Kubernetes readiness have real overall bounds, and a provision that fails or runs too long is marked failed with a specific reason and cleaned up, rather than left stuck and relabelled minutes later.
• Announcements (#458) — notifications are delivered in committed batches; a large all-participants announcement could previously deliver no notifications at all.
• Automations (#459) — email actions have a timeout, rule evaluation has a realistic budget, and a cancelled run is logged instead of silently half-completing.

✨ Also included

• Admin skills matrix (#444): participant search and a theme-aligned heat map. (Merged just after the v1.7.0 tag, so it ships here.)
• Docs: ADR-0042 (the upcoming code-judge design), the ADR-0025 amendment, and a CLAUDE.md note on the event-bus timeout.

Full changelog: v1.7.0...v1.7.1