Changelog

• Fixed General W10-fix-20 — a stack-scoped Team member sees their stack (shared Visible helper), bell notices have a level (info/warning/failed), wrap and read in full, Team rows name resources and the invite dialog offers every kind, disabled New buttons give the reason, one state when certificates cannot load, AI plans mark only untrusted text aadf09e
• Fixed Gate A failed merge gate drops the squash (nothing stays staged); flaky token test fixed 11b3591
• Fixed Cluster W10-fix-18 — Linux user ids are allocated once, cluster-wide (cluster/013); a panel restart never breaks a move: steps are kept, the live node decides, unsure moves pause and can be continued or cancelled (011); database users move with their authentication strings and grants, MariaDB/MySQL and PostgreSQL, and PostgreSQL moves work (012) 20dd2bd
• Fixed General W10-fix-17 — mail held during a suspension is released on unsuspend, the public suspension page shows only the visitor message, suspend shows its plan and unsuspend asks first, the first cron job starts the cron service, web.sites.* accept slugs, scoped Team members see their buckets and get reasons on disabled buttons, plain scoped-grant refusals; accounts docs restored bf2b1fc
• Fixed General W10-fix-16 — pooling a site prepares the other node (the account's Linux user with the same ids, removed when its last site leaves) (cluster/010); creating things in a suspended account is refused, a suspension part that never answers is detected and retried, brand changes refresh the suspension page; the move's switch grace follows the DNS TTL and purge_source drops the old database copies be23ea5
• Fixed Cluster W10-fix-14a — DNS of an account points at the node it lives on, placement policies decide where a new account lands, moves use the installed database client names (MariaDB 13), the control node cannot be drained and roles in use cannot be dropped, a failed move leaves replicas and other moves alone, move back works, followers run in order (no 404s at the switch), constellation redraw 2e62ce3
• New Accounts Suspension really suspends (accounts/013) — sites serve a branded 503 with the reason and message, mailbox sign-in and submission refused, cron and the account's units held, terminal/editor/SSH (keys too) ended and refused; unsuspend restores everything incl. sites that were disabled before; itemised result, retries, plan 459b170
• Fixed SSL A Team member scoped to one certificate cannot upload, self-sign, request or order another one; status (fix-14b merged) c909e12
• Fixed General W10-fix-14b — a Team member scoped to one resource cannot create siblings (cdn, web, databases, mail, dns, storage, containers, domains, apps: account-wide grant required), CDN edges reload on a certificate change with roll back, scoped CDN numbers, bandwidth warnings at 80/95% with an owner notice c0474d6
• Fixed General W10-fix-13 polish — branded-host gate on SSO and mobile sign-in, BYO database servers on the egress guard (pinned), accounts.set_node only for cluster, branding nameserver lookup, Team scopes ownership-checked at invite, owner notice when staff open a mailbox, suspend dialog warns when email cannot leave, logs/cdn states instead of errors, audit system filter, stack names wrap on phones 45d7c04
• Fixed General W10-fix-12 — the panel's own email leaves through the local mail server (loopback relay trusted, valid default sender) and a failed send is shown to administrators (bell + audit), found-outside page for accounts with adopt, event redelivery backs off and parks, backups.job.create has a plan, plain import refusals, readable Live activity, Team remove/limit fixes; audit rows no longer dropped for a wrong outcome word 5cc0244
• Fixed Security One egress guard for every outbound request (internal/egress: resolve, check, pin, re-check redirects) — AI providers at run time (finding 005), storage connections checked at every use with rclone unprivileged behind an nftables fence (009), CDN edge workers fenced against rebinding (008 residual), webhooks, providers and Git deploy URLs on the same check; audited admin allow-list for private targets 1789211
• Fixed Module SDK A malformed id reaching a uuid column answers invalid_params, not internal (modules and built-ins); scripts/test-all.sh runs the suite like the gate; status + backlog b27a964
• Fixed General W10-fix-11 — backup job/target ids that are not ids answer not_found instead of internal (backups/008), an alias's certificate is ordered when web announces the alias (ssl/007), scheduled discovery and drift scans verified in a lab (core/004) 1f94433
• New General Review part 4 — the editor origin can no longer run a panel passkey ceremony (finding 013, high), sign-out-everywhere / password change / admin revoke also revoke paired devices' refresh tokens (014, high), rotated sessions keep their device link so a device revoke ends them (015) 08bb18f
• Fixed General W10-fix-10 — catch-all no longer swallows mail for existing mailboxes/aliases, Sieve split (mail owns vacation, webmail owns rules; legacy files migrated), plan dialog buttons inside the dialog, CrowdSec fallback leaves no dead apt source + apt repairs broken third-party sources, restore of latest skips safety snapshots, mail server page state when mail is not enabled, account pickers show names, stack names readable at 390px, plain SSL plan lines; agent retries openat2 on EAGAIN eeb86d1
• New General Review part 3 — PostgreSQL role takeover across tenants closed (finding 010, critical: one name, one owner; group roles never altered as users), socket peer auth only for the postgres OS user (011, high), BYO database servers refuse private addresses (012) 17fffa5
• Fixed Core Scheduled actions with strict schemas run again — the scheduler sends scheduled_at only where the schema takes it (discovery, config-drift and sizing scans never ran); bugs backups/008, ssl/007 filed f1a6d79
• Fixed Security ADR 0018 hardening — system_calls authoritative for every nested system call incl. event/schedule handlers (finding 006, high), owner hints only where declared, audit rows bound to the call token and elevated refused on retained tokens (finding 007) fc4a705
• Fixed Test lab Pinned labs are never garbage-collected (a gc run removed the owner's demo); demo seed, in-place redeploy and smoke test in the repo; PUBLIC_EDITOR=0; bug mail/013 7ef5d42
• New Core Team — users invite and manage sub-users (scoped grants capped at the inviter's, expiry with immediate effect, per-user limit, single-use email invitation, /team screen) (core/003); fix: foreign account ids answer 404 across modules, sub-user Protection, admin-only mail server page for non-admins, backups picker names, sub-user dashboard wording (w10-fix-7b) fa8053e
• Fixed Cdn W10-fix-7a — edges install the njs package matching the installed nginx (no apt conflict on ubuntu 24.04/26.04), PowerDNS allows Lua record updates and GeoDNS restores the previous record on failure, port clash pre-check with the holder named and no restart loop, per-port edge probes, region note without GeoIP, custom-hostnames column 47b8936
• New General Review part 2 — DB import no longer runs customer dumps as root (finding 004, critical); CDN origin SSRF via hex/decimal IP spellings closed (finding 008, high; QA cdn/001); findings 005/006/007/009 proposed 20e30e3
• Fixed Security ADR 0018 module call identity (finding 001, high) — the host decides who a nested module call runs as (per-invocation call tokens), system calls only for actions a module declares in system_calls, caller stamped + audited, mail.sso.prepare only for webmail; retained calls for the AI turn, elevated calls for billing integrations 3303a30
• Fixed Security Ownership checks — branded panel hosts must belong to the brand owner's tenant (finding 003); certificates refused for names another account holds, wildcards refused over other tenants' names (finding 002, SSL side) ac19014
• Fixed General W10-fix-4 — local-root hidden, one icon per nav entry, domains badge at 390px, suspension email carries reason + message, plain not-installed messages (SSH/web/databases/mail/dns as states), Store Installed filter offline, empty app ids refused, job dialog without log lines, SSL plan warns before retiring a wildcard 2758a43
• New General Review part 1 (auth, privilege separation, tenant isolation) — 3 high findings; domains refuse a parent of another account's domain (finding 002) f1f5b23
• Fixed General W10-fix-3a — mail aliases/forwards listed + editable, host name change re-issues the cert and republishes DNS (with a UI), Dovecot 2.4 quota root, webmail trusts the panel's own mail cert (pin) with plain TLS errors, audited step-up SSO into mailboxes for staff; lab: mta.lab.test, Mailpit on :25, lab-dns-pdns.sh cdffd0f
• New SSL Certificate screens (list, detail, get/upload/CSR/self-signed sheets, settings + CAs), wildcard certificates via DNS-01 with ownership rule, ssl settings schema; fix(software): PHP/Runtimes pages make no admin-only calls for resellers and users (w10-fix-3b) cf96d64
• Fixed General W10-fix-3c — firewall UI changes apply (stored view normalised), schema errors as sentences in one place, Stacks table at 390px, reseller Protection picks an account, hardening/malware/CrowdSec wording, plain restic errors, backup run history 46306a8
• Fixed General W10-fix-2a — admin can create admin, breached/username passwords refused (embedded list), public panel address instead of loopback (RC_PUBLIC_URL), passkey on IP hosts, lockout duration, readable refusals, param aliases, unknown asset owner, OpenAPI without CSRF, webhook errors, audit names + hide system ticks, a11y labels, no 401s on sign-in 690848d
• Fixed General W10-fix-2b — importer prerequisites listed up front + failed commit keeps the dry run, wizard at 390px, rollback preview, required modules cannot be removed + remove preview, calm offline Store, capacity planner counts hosting accounts only, PHP default never a missing version, config pages show not-installed 16bd157
• Fixed Agent Apply /home 0711 when the agent starts, so existing servers get it too e9f49ad
• Fixed General W10-fix-1a — DNS zone hijack closed (ownership over every account, public suffixes, no domains under another account), failed account create rolls back, reseller plan assign, suspend reason/message/schedule, readable refusals, DNS not-installed message, zones for earlier domains, nav/overview/phone layout 94965d3
• Fixed General W10-fix-1b — apps deploy list 500, human errors (apps/web/databases), /home not listable (0711), step-up refusal says how to enrol, editor wording + chat off, sizing preview, DataTable keeps open row 2a156c3
• New Shell Assistant on every page (Ctrl/Cmd+J, Ctrl K ask), compact licence notice (grace/degraded), route/nav collision guard, shell initial load 246 -> 191 KB gz with a build-time budget check c48f534
• Fixed Test lab Pebble validates on 80/443 and unknown lab names resolve to cp1 (IPv4 only) — HTTP-01 orders work in every lab adcdc3c
• New Hostnames Panel + mail hostnames with SSL end to end (owner requirement #16, w9-23) f1e0a4f
• New Design system Importers wizard (source, pre-flight report, mapping, dry run, commit, rollback, past imports), Plans and sizing (plan editor with apply modes + exceed preview, presets, delete-with-migrate, export/import, capacity planner + what-if, overselling, server profile + re-tune), Integrations (webhooks with deliveries/dead-letter/replay, billing connectors, sign-in links, API, settings) abee430
• New Mobile Capacitor app + server side (system-browser PKCE sign-in with passkeys/TOTP/SSO, rotating refresh tokens with reuse sign-out, device registry + revoke, min app version, Mobile app screen with QR, licence-authenticated push relay), APK with no source maps 172c91f
• New Design system Software (OS packages with plans + holds + fingerprint-confirmed repos + allow-list + update policy; PHP versions, per-scope extensions, PECL with live logs, php.ini forms, FPM/opcache status; runtimes + tools with requests and EOL report) and Panel extensions (signed install with per-capability approval, developer mode, rollback, uninstall) 6d3d089
• New Branding White-label brands (contrast-checked accents, sanitised SVG uploads, 20 versions), per-host branding of sign-in + shell + documents, reseller isolation on branded hosts, passkeys with the branded host as RP ID, panel hostnames (DNS verify + ssl order), private nameservers, branded email templates and customer pages, no-leak crawler a6a0015
• New Design system AI assistant (page + Ctrl+J side panel, streamed answers with sources, plan cards with per-step diffs, approve/reject/undo, providers, policy, kill switch, services), Store (catalogue, plan-first install/update/rollback/remove as jobs, trials), Licence (state, activate, add-ons, grace/degraded banner), Versions (catalog, follow-latest/pin, upgrade findings) 92fb508
• Fixed Install,lab Ship UI-only built-in modules (core, store) — stage dirs with ui/dist, plugin host skips dirs without bin/; docs: cards w9-20/21/22, w9-10 follow-ups eb85f26
• New Software Runtimes + global tools wired into the software module — catalog lines with EOL, streamed mise installs, detection from version files, select with on-demand cap + admin requests, removal refused while used, pinned tools on cron PATH, usage/EOL report; runtime op types moved to sdk/agentop a67664a
• New Design system Backups (targets, schedules, live runs, restore wizard with previews), Storage (buckets, keys, 12 connection kinds, built-in S3), Containers (Compose stacks, revisions, catalog, registries), CDN (zones, rules, purge, signed URLs, edges, external CDNs) 6b4d2dc
• New Design system Configuration screens (drift diffs, keep/restore/reset, found outside the panel, undo, history, server reset wizard), Protection (score fixes, firewall with keep/roll-back countdown, CrowdSec, scans), Logs (live tail, audit chain verify), Cluster (constellation, drain, pools, VIP failover, moves), Stats, Providers cd54a4a
• Fixed Test lab Labs install every module (RC_PROFILE=standard by default; SIZING=micro proves Micro on purpose) cd9473d
• New Software OS packages (allow-list, real apt/dnf plans, streamed apply + health watch, holds, signed third-party repos with fingerprint confirmation, queue) and PHP (versions with EOL, per-scope extensions, sandboxed PECL from an allow-list, validated php.ini, defaults per server/account/site) b2fb2de
• Fixed Agent Heartbeat facts report cgroup-limited CPUs and memory (containers/slices), not the host's b495757
• New Extensions,software Sandboxed WASM panel extensions (wazero; per-capability host calls checked against the calling user, no fs/net/clock beyond grants, fuel/memory/time caps, auto-disable on violations, signed or dev self-signed only) + runtimes via mise in a shared read-only store with version detection and admin-pinned global tools a0c611f
• New Apps Dockerfile and Compose deploy modes (BuildKit secrets never in layers or logs, per-release images, auto-revert, rollback, strict compose validation incl. build contexts), signed app templates from the Store 7dbe9f7
• Fixed Merge The test gate could never fail (go test | grep under pipefail inverted it); fix(apps): result schemas for the 10 actions that pushed the schema count past its baseline 8c349f9
• Fixed Installer An upgrade is never a fresh install — Micro's module trim only applies to brand-new servers 61ea318
• New Apps Every field customizable (runtime/custom mise spec, commands, hooks, env scopes, limits, restart policy), templates (versioned, scoped, YAML export/import), respirecloud.yaml/Procfile overrides with preview, per-app nginx snippets through web's validated layers 3518afb
• New Sizing Install profiles from cgroup-aware hardware (Micro idles at 582 MB with web + PHP 8.5 + MariaDB), re-tune with per-value diff + dry-run plan, capacity planner + what-if + export, plan presets, overselling off/warn/allow, plan apply modes, delete-with-migrate, strict export/import, audited changes 117a42a
• New Contracts Accounts.cron.create + robust account delete/re-create, mailbox and DB-user password hashes (originals keep working), domains.create skip_auto, wildcard event subscriptions (integrations uses '*'), firewall ip_proto (VRRP 112), 20 more result schemas 16bafea
• New Integrations Per-caller OpenAPI 3.1, signed webhooks, integration tokens, SSO links, WHMCS/Blesta/HostBill, rate limits, idempotent replay, batch 65f5a7e
• New Importers CPanel, Plesk, DirectAdmin, Hestia, FastPanel importers — hardened archive layer (traversal/links/devices/bombs/XXE refused, fuzzed), neutral model, pre-flight report, dry run + commit through the owning modules' actions, full rollback 0ff4690
• New Jobs Jobs and live progress everywhere (ADR 0016, owner requirement #22, w9-05) 0ddd1c9
• New Versions One signed version catalog — newest stable by default (w9-03, owner requirement #21) 9ee9850
• New Cluster Account moves finish end to end (accounts.set_node + web/ssl/dns/databases/mail followers, retry on failure, drain completes), pooled sites rendered on every backend, certificates mirrored to LB nodes and re-copied on renewal, cluster firewall needs applied through security's auto-rollback 0cef634
• New Design system Editor screen (Open VS Code, folder, extensions with policy verdicts, packs; admin install/settings/policy/instances) and Apps screen (30 presets + detect, deploy history/logs/rollback, runtime/commands, masked env, Git deploy key/webhook, workers/cron, Open in VS Code); module CSS compiled once by the shell; keyboard-friendly comboboxes; make web builds module UIs fbd58da

• New Core AI wiring — /ai/v1 gateway proxy, core.action.list, nested idempotency keys, shared ext schema (pgvector), docs shipped for the assistant; deterministic-preview rule 254b11b
• Fixed Audit Secrets masked by value inside free text; feat(licence): per-action editions 4294f12
• New Cdn Own edge network (per-zone nginx edges, pull + storage zones, purge by url/prefix/tag/all, signed URLs with rotation, hotlink, stale-on-error), GeoDNS steering with health failover, Cloudflare/Bunny integrations, customer API + snippets in 8 languages, stats and usage 39ce567
• New Ai Ops assistant (permission-filtered action tools, plans from the host's dry-run with approval bound to the plan hash, step-up for high risk, re-preview before each step, verify + undo), injection quarantine + redaction + full audit, providers (Anthropic with caching, every OpenAI-compatible, local), RAG (heading-aware chunks, hybrid search, abstention, per-model indexes), customer OpenAI-compatible gateway with metering + knowledge bases 3ed6423
• New Consistency Changes made outside the panel are discovered and adoptable (Linux users, cron lines, MariaDB/MySQL/PostgreSQL databases + users, hand-written nginx/php/postfix files, mail dirs); reset per service and per server with dry-run plans, snapshots + one-click undo, config history restore and automatic rollback on failed health checks; database config drift; hand-written web files survive generation swaps db77b1f
• New Webui Serve Store-installed module UIs (installed wins, like the plugin host); backlog: w8-04 follow-ups 3cba59c
• New Store,licence Signed modules (Ed25519 k-of-n envelopes, TUF-style roles/channels, tar.zst packages), lifecycle (install/upgrade with auto-rollback, rollback, remove, sideload, channels, staged rollout), plugin-host verification, signed licences (2-of-3 fingerprint, active/grace/degraded, revoke), entitlement gate for paid add-ons + trials, RespireSoft-hosted store/licence server + release CLI 1cf175f
• New Editor Browser gateway for VS Code — separate editor origin (port mode: own account; subdomain mode: per-account origins), one-time claim + grant cookie, panel-session revalidation, Origin rules, cookie/header stripping; bus tunnel (internal/tunnel) relayed by the root agent with SO_PEERCRED + unit-cgroup check; reserved core.* agent ops; node-scoped PTY/tunnel bus subjects (security fix); lab E2E 9452715
• Fixed Cli A control socket that can't be created no longer stops the panel from starting 0fbddb0
• New Cli Respirecloudctl on the action registry (friendly verbs, --dry-run plans, table/json/yaml, completion), root-only local socket with SO_PEERCRED as local-root, via:cli audit + changes.cli events, live UI query sync with 'changed via CLI' toasts 06a6d5a
• New Cluster Node roles/labels/cordon/drain, placement policies with simulate, HAProxy pools (health checks, sticky, TLS termination, graceful drain, rollback on failed reload), keepalived floating IPs, site sync, account migration up to the switch 880e109

• New Core Dry runs pass through cross-module calls (callee previews), reads run normally inside a preview 7c4bcb5
• New Dns,providers External-DNS delegation (records, ACME challenges), delete-first replace import, 22 libdns providers (26 native total), Hostinger/GoDaddy mock tests 7d1090c
• New Providers Registrar/DNS-host connections with API keys (Cloudflare, Hostinger, GoDaddy, Porkbun + custom REST adapters with SSRF guard), import, external DNS push, NS switch, DS publish, expiry events 37029bf

• New Pluginhost Built-in actions can be previewed (pluginhost.IsDryRun) when their manifest declares dry_run 1619618
• New Mail,webmail Mail admin (deliverability ring + record-preview fixes, DMARC/MTA-STS, DKIM rotation, mailboxes, aliases/catch-all, server self-test + queue) and the three-pane webmail client (live updates, search, labels, shortcuts, rules, out-of-office, identities, sandboxed HTML); Sieve keeps webmail rules + vacation on every sync 0eaf7c6
• Fixed Merge Auto-resolved go.sum/pnpm-lock conflicts went on to roll the merge back; now they proceed to the gates d5084e6
• New Site Respirecloud.respiresoft.com — 47 pages, 15-step guided tour, docs generated from module manifests, changelog from git, Lighthouse 95–100; scripts/deploy-site.sh eb79d55
• Fixed Panel The account's 2FA page is "Sign-in security" in the nav (the Security module kept its name) 041be27
• Fixed Design system Disabled list items for both cmdk (data-disabled=true) and Radix menus (data-disabled="") 6319c43
• Fixed Design system Command/combobox options were unclickable — cmdk sets data-disabled="false" on enabled items 72d8bae
• Fixed Panel 2FA grace period — remind until the deadline, lock to Security only once enrol_enforced 2a44b8f
• New Distros Ubuntu 22.04/24.04/26.04, Debian 12/13, AlmaLinux 9/10, Rocky 9/10 dae127b
• New Databases Bring-your-own servers (MySQL/MariaDB/PostgreSQL/ClickHouse/Valkey), on-demand engines (MySQL 8.4, PGDG 14–18, ClickHouse, Qdrant, FerretDB), snippets, clean import, Adminer SSO fc00485
• Fixed General SPA routes with dots, Input icon padding, large audit values summarised; feat: public Git webhook route for apps a6f4b14
• New Apps,editor Runtimes via mise, 30 framework presets, Git deploy with atomic releases + webhook + rollback + auto-revert, workers/cron; code-server per account on a unix socket with Open VSX policy 6a09cc4
• New Design system Accounts, domains, dns zone editor, web site workspace — inline editing, plan previews, health chips, batch DNS apply a5caa11
• Fixed Panel Step-up dialog uses POST /api/v1/auth/stepup (rotating cookie + CSRF); cache lazy module routes so suspended loads resolve 0af8b72
• New Design system Databases, file manager (uploads, CodeMirror editor, trash, SSH page) and browser terminal (xterm, splits, root frame, recordings) b30d726
• New Platform Managed files with drift detection + adopt/reapply/reset/unmanage (web, mail, dns), slugs for accounts/domains/sites 659d753
• New Core Module settings at runtime — core.module.list/settings.get/settings.set, schema-validated, secrets masked, Reconfigure RPC (no restart) 6d042ba

• New Core Host.AgentTimeout (<=30 min) for long ops; panel HTTPS uses the ssl-deployed certificate when present (hot reload) b2fc8ac
• New SSL ACME via lego — HTTP-01, wildcard DNS-01, node-generated keys, auto-SSL, ARI renewals, uploads, revoke, deploy to web/mail/panel 5f13f7a

• New Containers Docker + Compose with a strict canonical validator, signed one-click catalog (10 apps), stacks in the account slice, upgrades with snapshot + auto-rollback feda3af
• Fixed General Resolve conflict markers committed with the webmail merge; add guarded merge script 43695f0
• New Webmail IMAP/SMTP/ManageSieve gateway, threads, search, send with undo, rules, IDLE events, strict HTML sanitiser 32c4cba
• Fixed Installer Write the HTTPS listener settings into respirecloudd.env 777ad83
• Fixed Agent Rename security's diff/health helpers that clashed with web's after merge ba3d3d6
• New Security Nftables firewall with auto-rollback, CrowdSec, ClamAV/YARA quarantine, integrity, hardening, score 3f57980
• New Storage and backups Rclone connections, built-in S3 (SeaweedFS), restic backups + restores e14a4f9
• New Stats and logs Agent collectors, VictoriaMetrics/VictoriaLogs, per-account tenants, scoped PromQL/LogsQL, alerts, audit verify + tamper check 6a0b454
• New Terminal Browser terminal gateway — cookie + Origin + single-use session-bound ticket, caps, revalidation, root step-up, audit 3ddaf3e

• New Panel HTTPS listener (RC_TLS_LISTEN, internal-CA cert) + lab PUBLIC=<port> to open a lab panel by IP:port 7a8d331
• New Panel The RespireCloud SPA — passkey/password/TOTP sign-in, setup, security page, nav from modules, generic action pages, Ctrl K, plan previews, step-up, module UI runtime; embedded in respirecloudd 3052b72
• New Sign-in One impersonation flow, initial passwords, suspension revokes access, session rotation on step-up/password change, 2FA required for admin+reseller 6f96501

• New Websites Nginx + PHP-FPM sites, layered configs with validate/swap/health/auto-rollback, HTTP-01 + cert install contract f064672
• New Files and terminal File ops as the account user (openat2 BENEATH), SSH keys/modes, SFTP chroot, hardening, PTY sessions over the bus f1719a0
• Fixed Installer Wait for the API before enrolling the local agent (race once several modules load) b04d0d9
• New Mail Postfix + Dovecot + Rspamd — domains, mailboxes, aliases, forwarders, DKIM/ARC, DMARC, MTA-STS, queue d5cc98b
• New DNS PowerDNS zones, records, templates, DNSSEC, import/export, history, reconcile, ACME hooks ff58a65
• New Core Manifest schedules (system-actor internal actions, advisory-locked), Host.Limit read, account deletion stops the account slice first 54b8280
• New Databases MariaDB/MySQL, PostgreSQL, per-account Valkey — dbs, users, grants, remote, quotas, dump/restore 83bc695
• Fixed Identity The bootstrap admin always holds the built-in admin role 9900801
• New Test lab Multi-instance lab (LAB=<id>, <=3 concurrent, FAKENET=min|full, lab-ps, lab-gc) 5f52d54

• New Design system RespireCloud glass design system @rc/ui + gallery 1d622ab
• New Sign-in Passwords (Argon2id), passkeys, TOTP, recovery codes, sessions + CSRF, step-up, API tokens, login protection 98e533f
• New Agent Driver registry (init-registered module drivers) and allow-listed system.apt.ensure 66192ab
• New Identity Roles, scoped grants, plans, impersonation, rbac.Service wired into startup a654f09
• New Security Per-node NKey enrolment, internal CA + TLS 1.3 bus, per-node NATS permissions 49a4c25
• New Domains Domains module — IDNA, dry-run plans, scoped grants, durable accounts.deleted subscription 44fc5c8
• New Test lab Lab v2 — Valkey, cluster profile, fake internet (Pebble, CoreDNS, Mailpit, SeaweedFS) fd976de
• New Agent Per-account slices (cgroup v2 limits), quotas, allow-listed service control c69e919
• New Core Durable cross-module events (JetStream RC_EVENTS), manifest subscriptions, internal actions 21e4bf6
• New Module SDK Dry-run plans + inverse actions; docs(adr): 0013 platform decisions f02143d
• New Module SDK Scoped grants (Actor.scoped, Call.Can), manifest resources, rbac.Resolver contract 442f253
• New Test lab Docker lab v1, Makefile, systemd units, install skeleton 9602205
• New Accounts Reference module end to end; built-in core module; create rollback on refusal 0ddcb4d

Planning and design work for this milestone.