Veirox Connect v0.3.0

Added

• Public distribution pipeline. First tagged release that reaches
  end users. Mirrors the veirox-cli pattern:
  • GoReleaser config (.goreleaser.yaml) builds musl-static binaries
    for linux/amd64 and linux/arm64, packages tarballs, deb, rpm,
    apk, and multi-arch Docker images.
  • Release workflow (.github/workflows/release.yml) targets
    veirox-cloud/veirox-dist for the GitHub Release so users get
    public download links without GitHub auth.
  • Two Docker tag variants: :vX.Y.Z (distroless static, just the
    binary) and :vX.Y.Z-k8s (alpine + binary + kubectl + helm — the
    Helm chart's default).
  • Helm chart (charts/veirox-connector/) moved out of
    veirox-backend into the connector repo and published as an OCI
    artifact at oci://ghcr.io/veirox-cloud/charts/veirox-connector.
  • One-line systemd installer at https://veirox.com/install.sh
    (lives in veirox-marketing/public/install.sh).
• DaemonSet mode in the Helm chart (mode: daemonset) — one
  connector per node, useful for multi-tenant clusters.
• Configurable HTTP /health endpoint for k8s probes (via
  healthEndpoint.enabled: true in values.yaml).
• Configurable replicas (.Values.replicas, default 1).
• Hardened pod + container security context in the Helm chart:
  runAsNonRoot, readOnlyRootFilesystem, seccompProfile, drop
  ALL capabilities, dedicated UID 10001 matching the k8s image.
• systemd unit hardening (in the deb/rpm/apk + install.sh):
  NoNewPrivileges, ProtectSystem=strict, capability bounding set
  empty, syscall filter, RestrictAddressFamilies to outbound only.
• Cosign keyless signatures on every artifact (binaries, archives,
  deb/rpm/apk packages, Docker images, Helm chart).

Changed

• Default backend URL moved to https://connect.veirox.com
  (dedicated subdomain with proper client-cert forwarding) from the
  legacy shared-SNI https://veirox.com. mTLS now works end-to-end
  without bearer-auth fallback.
• Cargo features: default = [] (dropped insecure-dev).
  Release builds no longer compile in bearer auth or plaintext ws://.
  Local dev still works via cargo build --features insecure-dev.
• Helm chart appVersion auto-bumped by the release workflow
  (helm package --app-version $(tag without v)) so chart + binary
  versions never drift.
• Helm chart Chart.yaml: sources: URL fixed to the actual
  GitHub repo. Added artifacthub.io annotations.
• CLAUDE.md / README.md: dropped dead references to non-existent
  agent/dist/ directory. Updated to point at the real
  charts/veirox-connector/, Dockerfile, and marketing-served
  install.sh.

Removed

• docker.io/msrashed/veirox-connector — no longer used.
  Replaced by ghcr.io/veirox-cloud/veirox-connector (org GHCR).
• oci://ghcr.io/msrashed2018/charts/veirox-connector — no
  longer used. Replaced by oci://ghcr.io/veirox-cloud/charts/veirox-connector.

Migration notes

Existing test installs using the personal-namespace image / chart
need to be uninstalled and reinstalled with the new URLs. There's
no in-place upgrade path because the registry hostnames changed.
Operators of in-cluster connectors:

helm uninstall veirox-connector
helm install veirox-connector \
  oci://ghcr.io/veirox-cloud/charts/veirox-connector --version 0.5.0 \
  …

Verify

# Tarballs (cosign keyless via GitHub OIDC):
cosign verify-blob \
  --signature   veirox-connector_<VER>_linux_<ARCH>.tar.gz.sig \
  --certificate veirox-connector_<VER>_linux_<ARCH>.tar.gz.pem \
  --certificate-identity-regexp '^https://github.com/veirox-cloud/veirox-connector/.github/workflows/release.yml@refs/tags/v.+' \
  --certificate-oidc-issuer    'https://token.actions.githubusercontent.com' \
  veirox-connector_<VER>_linux_<ARCH>.tar.gz

# Docker images:
cosign verify ghcr.io/veirox-cloud/veirox-connector:<VER> \
  --certificate-identity-regexp '^https://github.com/veirox-cloud/veirox-connector/.github/workflows/release.yml@refs/tags/v.+' \
  --certificate-oidc-issuer    'https://token.actions.githubusercontent.com'

Install

• One-line systemd installer: curl -fsSL https://veirox.com/install.sh | sudo bash -s -- --token veirox_enr_...
• Helm chart: helm install veirox-connector oci://ghcr.io/veirox-cloud/charts/veirox-connector
• Docker: docker pull ghcr.io/veirox-cloud/veirox-connector:<VER>

See veirox.com/install.html for the full guide.

v0.1.3

Changelog

• 3ba9f8cf9672528227be7926a93d837400c5b3a2 feat: add veirox comment command for threaded discussions on resources
• c8bbbf78a8762bb8368cedd6812d529cd25a3dfd notifications: NT-11 Step 4 — remove legacy 'veirox notify channel' subtree

v0.1.2

Changelog

• b9d79de19eb4398d60ddcdb146ab1e1f587541a8 CLI: add 'veirox git' — workspace Source Control (status/diff/log/branches/stage/unstage/discard/commit/branch/checkout/fetch/pull/push)
• 9b83f1ec08230019b69232d212cd39853498fb6a cli: add 'veirox session search' (turn-level semantic search over past sessions)
• fe9c89c1b536cee37972b8dc5c42633cbce7b70c feat(calendar): CAL-03 — veirox calendar CLI (list/info/create/delete)
• 0d83450e4064670fcd3c5cf7318540c9c0d9a209 notifications(P2): CLI — mute/quiet-hours/digest/snooze prefs + delivery status
• de4d2a3f8acc437a9eee2c892720d60ffae70a9a notify: add 'veirox notify inbox' commands (list/read/read-all/unread-count)
• c4817e258ee62f96a6b5b7b9f0dd32b148b02273 notify: add destination + route commands (P1d)
• 448860a9833a0603d2f9786dc3cf3ec1714d3588 notify: add prefs show|set (per-user category matrix)

v0.1.1

Changelog

• 3bd5a714b9fdc857041ad52231d9608b38527d32 Add 'veirox org list --all [--search]' (platform-admin org enumeration)
• eadc187b19bc96091e87ce5afb760979aacc56bc Add --tag filter to entity list (DW-02 client surface)
• f717df106d40ea2fa5be6a357d028e74a4d57d08 Add veirox export command for entity Markdown/PDF download
• 0c7204276eb4fc745df0b993405233805454e1d3 Add veirox import command for entity Markdown import
• fc711ea714db4e54058f3b9102c9a81447c4059e Add veirox share command for public entity share links
• 73699cb736ee175237fba06a447cb80fb15514f7 Add bulk directory import: veirox import --dir
• ab92c020b9e19e84ec6fd7c5b1bd68045dc838be Add org create + project use; honor --project UUID for X-Project-ID
• 71dc25621718304d42ea6ef72ec63cbaae0bceb9 Add veirox org delete <slug|id> --yes (platform admin)
• 425e3302bcb3639db8a5c803abeda91f61ea2078 Add veirox org switch
• fa4a038b0e7d46e4c8a4b8223144657dcf4ea85e CLI cross-org ergonomics: --project slug resolution + api-key create --org
• f19b08c3d3a955d0f39e4afe7f6d3f5b03a75603 CLI: address Codex review of agent-run SSE streaming
• 97143b4c50610671437774832cd0a403cbc63bc9 CLI: stream agent run over SSE; include plaintext in api-key create/rotate JSON
• aa8d4547e1337002a0e7e5393c39a23a4a637aca cli: add 'agent search/reindex/rag-stats' + fix stale RAG types
• 80c0bd06f405bbe5e3042253a1f57d64c2b32f5a feat(entity): support story + plan kinds in CLI
• ae0cc35e5122810e2082eb85f3792500a20e1063 feat(quota): add veirox quota command with snapshot, policies, and alerts
• ccbd92749e040514b9ed27dca4859fc080c151d6 style: gofmt story/plan entity-kind additions

v0.1.0

Changelog

• 52780334d0fb8597c3df81da744ba3effb6495fd ci: keep CLI lint advisory and preflight Docker
• 0a821dbe72dcb4694a8d0d8e360aa9ae4ee8886f ci: make advisory checks report green jobs
• f7d4ddad968fac56974d65e84e42654c0a2b961b ci: remove invalid OSV skip-git flag
• 34c7d3fdc2c9ebe5ea76110840f9f42d95eb6ca4 cli: catch up to post-rebrand vrx_k_ prefix + fix 5 tasks-module bugs
• 73606ee86fcfa9e3b9bd650935a7caf250f52aa3 docs(changelog): v0.1.0 — agent settings, api-key update, connector policy, audit/secret fixes
• 3d3473620cf7ebe532f06dec4aaf795561c0c892 feat(agent): add 'veirox agent settings' to show project agent config
• 168fcf5b5a617b74e5d3201e8d20ff6cda2a78da feat(cli): api-key update + connector policy set/rules (EN-6, EN-7)
• b30dcb33258365566d01398887e77d126485619c feat(completion): enterprise-grade shell auto-completion
• b96d95b508bff76e87a9bda3efdd3aff5abc84c8 feat(secret): get --plain prints the decrypted value
• a9bb38410f7cdf7a0cf7574ca16c41cd8ba92bf2 feat: add org set-llm-key / clear-llm-key commands
• 7e5f5573be5a4cefe9029ac6e10ab6848aa42c92 feat: add veirox infra + veirox env CLI commands
• 338dd505a9835d6d3bb74ad124aa58fe86083a40 feat: add veirox-platform admin CLI binary
• d4e541cdaaf5d1a08f516fe28e97212395b108c1 feat: add veirox-platform binary
• 652c3888822f6051d53854ea6d09870510e3647d fix(audit): stats shape + days param; export streams CSV/JSON file
• 11123939b2522865cbdb4fc3590899c366ae82a4 fix(release): build veirox-platform for windows to match veirox archive
• 5887b322d0a76f2fdfab19180f6bb9f0081a4ad7 fix(session,task,chat): align CLI types/commands with backend contract
• 55f6e01a26f09200d4ded2b75208b6f1cb9e0088 fix(webhook): point 'webhook metrics' at /webhook-metrics/latency
• 5d714d403d3adf563cd9999ae69bd63d11008f47 fix: align AdminCostCeiling json tags with actual API response
• 3c93375897b62ac6f2d513ee3a329034c83d5600 fix: correct admin feature-flags effective URL paths
• 38962aefa7a081b302800fe4cd31a003dea73137 fix: update paths in .gitignore, CLAUDE.md, and README.md to reflect agent-entities structure

v0.0.3

Changelog

• 51098a596167cebf116c00838993d42afe6af1a5 chore(release): prepare v0.0.3 — restore Docker image build
• 20e6f325aa55a3257327309693ae6f34936b6e57 ci(gitleaks): install to RUNNER_TEMP so no sudo is needed
• 5ccef1e7f9b319e06857fa01a32afd7e89c8cfca fix(lint): handle ignored Write/Close returns to satisfy errcheck

v0.0.2

Changelog

• fbf1ec9d4ed6852ceb370e74d20dee39004b3116 api/types: drop FsEntryOut / FsEntryListOut
• 3ea444f37685839da40f0006266a54c64c32d1fd chore(release): prepare v0.0.2 — fix CLI distribution end-to-end
• 25213b0db205f137265d42a5bd1659746ff7d669 ci: move all CLI workflows to self-hosted droplet runner
• 3132a2643add489d1f1986a8f3c74be21c0b5447 cli: add veirox entity command tree
• d3567bb476e90e612dc7731b184bcb6cfd3c3627 cli: drop legacy per-kind FS wrappers
• a290e944eb8f2e4ba27ff0f1292f453ff738dbf8 fix(release): publish CLI artifacts to public veirox-dist repo
• 79f12b2625694f30f3c3107060903d742a34e0a4 fix(release): skip Docker build until runner Docker group is fixed
• 92fc2d30d08023d8d0012c60a859d6cd3c7b4c3e idempotency: scope key attachment per-route to the methods the backend honours
• f3fcc74fc7ed3204bde113b21ef10e603afbfb99 task: send --prompt body, use cron_schedule json tag