Changelog
Append-only record of operational changes. Bump OPERATIONS_DOC_VERSIONand add an entry whenever install, configure, operate, results-reading or security posture content changes.
History
| Date | Version | Summary |
|---|---|---|
| 2026-08-11 | 2.4.0 | Mesh idempotency: POST /api/public/svc/dispatch now accepts an x-svc-request-id idempotency key. Mutating flows (event_report) run at most once per (caller, request id) — retries replay the recorded response with replayed:true, a key reused with a different payload returns 409 idempotency_key_reuse, and a concurrent in-flight attempt returns 409 request_in_progress (retryable, stale claims expire after 60s). Outbound callPeer() generates one request id per logical call and reuses it across its automatic retries. |
| 2026-08-07 | 2.3.2 | Turnstile: re-enabled VITE_TURNSTILE_SITE_KEY (hostnames must be added in the Cloudflare dashboard before publish). Added docs/deploy/nso-deployment-runbook.md — operator runbooks for standing up the OpenVAS/GVM stack and enrolling+running a scanner worker. Smoke/regression suite verified green (svc-mesh, tenant-create, secret-column-grants, webhook-secret-access). |
| 2026-08-04 | 2.3.1 | Mesh: added POST /api/public/svc/relay — a bearer-authenticated (AGENT_RELAY_SECRET) endpoint that forwards an ad-hoc notice to mgr via reportEventToMgr(), so maintainers and automation can push information to mgr without signing into nso. |
| 2026-08-04 | 2.3.0 | Observability: nso now reports its own issues to mgr automatically via reportIssueToMgr() — unhandled server errors (system.error), asset verification failures (asset.verification_failed), and critical scan findings (finding.critical), with 5-minute de-duplication. Operators monitor issues in mgr instead of logging into nso. |
| 2026-07-13 | 2.2.0 | Documentation: added a step-by-step 'Update the service role key in env vars and redeploy' section to /operations/configure and README-SUPABASE.md, covering post-rotation propagation on Lovable Cloud (server secrets auto-updated), local .env.local sync, redeploy trigger, and verification. |
| 2026-07-13 | 2.1.9 | Documentation: added a step-by-step 'Rotate the Supabase service role key (Lovable Cloud)' guide to /operations/configure and README-SUPABASE.md covering when to rotate, the Cloud admin rotation flow, verification steps, and Lovable Cloud limitations (no Supabase dashboard access, no manual .env edits, no post-rotation recovery). |
| 2026-07-12 | 2.1.8 | Documentation: added a 'Where to paste API keys and env vars' section to /guides/supabase and README-SUPABASE.md with a step-by-step Supabase Project Settings → API walkthrough, a paste-destination table, and local vs. deployed secret-store guidance. |
| 2026-07-11 | 2.1.7 | Documentation: added an interactive client-side environment-variable validator on /guides/supabase that checks required names, HTTPS URL format, and JWT-shaped Supabase key format in real time. |
| 2026-07-11 | 2.1.6 | Documentation: added copy-to-clipboard buttons for API key / env var names and every code snippet on /guides/supabase to improve setup ergonomics. |
| 2026-07-11 | 2.1.5 | Documentation: added public /guides/supabase page mirroring README-SUPABASE.md with prerequisites, env vars, browser insert example, and HMAC-signed ingest webhook instructions. |
| 2026-07-11 | 2.1.4 | Documentation: added README-SUPABASE.md with prerequisites, installation steps, required environment variables, and copy-paste examples for inserting data and calling the HMAC-signed ingest webhook. |
| 2026-07-11 | 2.1.3 | CI quality gates: added a production build workflow (.github/workflows/build.yml) that runs `bun run build` on every pull request and main branch push, ensuring the production bundle compiles cleanly before merge. |
| 2026-07-11 | 2.1.2 | CI quality gates: added a Prettier format check step to the lint workflow so formatting regressions fail builds, and added the `format:check` package script. |
| 2026-07-11 | 2.1.1 | CI quality gates: added an ESLint lint workflow (.github/workflows/lint.yml) that runs on every pull request and main branch push, and fixed all existing lint errors so the check passes cleanly alongside the typecheck workflow. |
| 2026-07-11 | 2.1.0 | Dashboard polish + Compliance workspace. Severity chart Y-axis now shows real counts (or a % toggle) instead of a fixed 0–1 scale, and a System Health banner surfaces blocking (no verified assets) and warning (no scans in 30d) states. Compliance page is now framework-scoped (SOC 2, GDPR, ISO 27001, NIST CSF, CIS v8) via URL-persisted tabs, and each control has a detail page listing mapped vulnerabilities plus a private, tenant-scoped evidence upload flow (compliance-evidence storage bucket, signed downloads). |
| 2026-07-02 | 2.0.0 | Redesign v2: sidebar regrouped into Monitor / Governance / Operations / Admin / Docs sections with per-item microcopy tooltips. Dashboard posture score now hides behind a 'Pending' state until at least one verified asset has been scanned; severity chart shows an empty-state CTA when there are zero findings; recent-scan-activity panel is replaced by an onboarding checklist when no scans exist. Sign-out moved from a red bottom-of-sidebar button into a neutral Account dropdown menu. |
| 2026-06-26 | 1.9.6 | Platform super-admins can now bypass DNS verification on a per-asset basis (with a required typed reason) so a one-off scan can run without waiting for live DNS propagation. Bypassed assets show a distinct amber 'Bypassed by admin' badge — never the green 'Verified' badge — and every flip is double-logged to /settings/platform-audit and /settings/verification-audit. |
| 2026-06-26 | 1.9.5 | Asset verification now separates basic DNS resolution from TXT ownership verification: Retry/Refresh checks A, AAAA, and CNAME records and shows when a domain resolves even if the required ownership TXT token is still pending. |
| 2026-06-26 | 1.9.4 | Individual asset Retry verification now treats DNS mismatches/no-record responses as pending status updates instead of red failure toasts; red toasts are reserved for the check itself failing to run. |
| 2026-06-26 | 1.9.3 | Asset DNS refresh now treats unresolved/mismatched TXT checks as pending status updates instead of emitting red failure toasts for every auto-refresh or Refresh all run; individual Retry verification still shows the detailed mismatch reason. |
| 2026-06-26 | 1.9.2 | Asset DNS verification now shows the exact required TXT value beside both accepted host names, with a one-click copy button and a note that unrelated existing TXT records such as SPF or Google verification do not satisfy ownership verification. |
| 2026-06-26 | 1.9.1 | Asset DNS verification UI now displays both TXT lookup candidates — the asset's root host (e.g., sun.com) and the _nso-verify subdomain — and clearly labels which candidate matched, mismatched, or returned no record. |
| 2026-06-26 | 1.9.0 | Asset DNS verification now accepts a TXT record on either the asset's root host (e.g., sun.com) or the _nso-verify subdomain. The app checks both hosts in parallel and reports the result for each. |
| 2026-06-25 | 1.8.0 | API docs: documented the cron hook `/api/public/hooks/scan-schedules-tick` with the required `Authorization: Bearer $CRON_SECRET` (or `x-cron-secret`) header and added production and local curl examples to the /api-docs page. |
| 2026-06-25 | 1.7.0 | B4 guardrails + ZAP chunking. New tenant settings `daily_scan_quota` (default 200) and `per_asset_concurrent_scans` (default 1) enforced at queue time, at chunked-queue time, and again at worker lease time so a busy asset can't starve workers. Scans page shows a live 'X of Y scans used today / N remaining' banner. ZAP is now chunkable: 'Queue chunked scan' splits a default URL-path seed list (/, /api, /admin, /login, /static, /v1, /v2, /health) across N parallel children; chunk 0 also runs the passive baseline. Worker zap runner honors chunk_spec.paths and chunk_spec.profile. |
| 2026-06-25 | 1.6.0 | Scan chunking (Track B3) for Nmap + Nuclei: Scans page now offers 'Queue chunked scan' (2–8 parallel chunks). Nmap chunks split the 1–65535 port range; Nuclei chunks split by severity bucket. Children run independently on any available worker; a new DB trigger aggregates child status/percent into the parent (chunking → aggregating → succeeded/failed). Worker SDK honors chunk_spec via -p / -severity / -tags flags. |
| 2026-06-25 | 1.5.0 | Desktop workers (Track B1+B2): cross-platform nso-worker binaries (macOS/Linux/Windows × amd64/arm64) released via GitHub Actions. New 'Enroll desktop worker' flow on Settings → Workers issues a one-time 8-char code + QR; `nso-worker enroll --api-url <URL> --code <CODE>` exchanges it for a bearer and saves config to ~/.nso/worker.json. Public endpoint POST /api/public/worker/v1/enroll backs the flow. Codes expire in 15 minutes and are single-use. |
| 2026-06-25 | 1.4.0 | External report storage (Track A): scan workers can now upload raw reports to a tenant-owned S3 / R2 / MinIO bucket instead of the built-in storage. New Settings → Storage page lets owners add, test, and default an S3-compatible sink. Two-phase worker upload (POST /report/init → PUT signed URL → POST /report/finalize) added alongside the existing single-shot /report route for backward compatibility. |
| 2026-06-25 | 1.3.0 | Analyze page: saved history panel. Signed-in users automatically save each uploaded result + AI explanation to a private, RLS-scoped history (new public.result_analyses table); view or delete past entries from the page. |
| 2026-06-25 | 1.2.0 | New /operations/analyze page: upload a JSON/CSV/XML/log result file and get an AI-generated plain-language explanation plus likely failure causes (via Lovable AI gateway, server-side). |
| 2026-06-25 | 1.1.0 | Reading results: added step-by-step walkthrough, example outputs per scanner (Edge/Nmap/Nuclei/ZAP/Trivy), and common failure modes (DNS not verified, worker offline, timeouts, FP patterns). |
| 2026-06-25 | 1.0.0 | Initial release: /services catalog, /operations living document (install, configure, operate, how to read results, security posture, dashboard, changelog). |