Changelog

• New Site A provider-style home page (hero, real screenshots, three steps, migration, comparison, FAQ), Cloud, Kubernetes, Load balancers and Providers pages marked 1.1 until they ship, pricing from one data file, and respirecloud.com as the main address f3a3c074
• New Test lab Real-server showcase seeder and starter projects (static, PHP+MariaDB, PHP+PostgreSQL, WordPress, Node, Python, Docker app, cron, worker, mail, backups) with a live start page; the lab's test mail is well formed ee5541a1
• Fixed Ai Tool data that describes the assistant's data fence (any nonce) or its note is defanged before wrapping, so the panel's own docs no longer stop a question as fence forgery (w11-149, found on the real test server) f808a9a4
• Fixed Design system The mouse wheel over a table scrolls the page once the table is at its end; CLI changes show one toast per burst that counts up instead of one per change e2adbc8b
• Fixed Release The customer-docs guard checks the allowed set instead of names (the security module's guide blocked every release build) d80bd6d6
• Fixed Security Releases ship only customer docs to the assistant's corpus (module guides, install, updates, feature specs) — never the internal security notes, which every installation carried and indexed; a build with security or findings paths fails; an updated installation forgets removed documents (w11-145, found on the real test server) 22d04f9f
• Fixed Ai,mail Tool results carry facts only (the hub's injection check rightly refused "Tell the user ..." inside a tool message); the hub's guardrail verdict is kept on safety events (codes only); DNS blocklist error answers (Spamhaus 127.255.255.25x) are no longer reported as listings 15eef0a7
• New Panel Projects — one plain-language page for a hosting customer's work: starters, Messages (webmail inbox and compose, mailboxes, aliases, deliverability), domains and data, and Keep it stable (releases, workers, cron, stats, logs, TLS, backups, mail delivery, protection, updates); shown by permission 3558765b
• Fixed General After the real-server re-test — every module, web package and the phone app at 1.0.0 (first stable version); RespireSoft AI works with the real hub (no consent push, per-locale model names, pinned aliases); booleans no longer redacted; Postfix restarts instead of a racy reload and listens on IPv6 where the server has it; Go back survives an automatic rollback; installer fixes (bus on 127.0.0.1, purge drops module roles, 10-minute start wait); the demo redeploy ends on a signed release (w11-138, w11-139, w11-140) 0230d9bf
• New General Wave 11 finish — seamless updates (ADR 0019), licence-bound distribution (ADR 0020), the guide (ADR 0021), PIN and trusted browsers (ADR 0022), AI with the licence (ADR 0023), scoped denies enforced, the panel on 443, the phone app download and QR, the Store's add-ons, the product site rewrite and the batch fix after the final lab run (w11-116 to w11-137) d690986f
• New General Wave 11 finished — the last build cards, one test phase, one batch fix, one re-test (the owner's rule of 2026-10-16) cef91f86
• Fixed Pluginhost,web,ui W11-100 — a change that has started finishes when the person who asked goes away (web/103: closing the browser during a site creation cancelled the module's database writes and answered 500 while the agent finished the work unrecorded, leaving the site 'provisioning'); a mutating call keeps its caller's deadline but not its cancellation, a read still stops with its caller (both tested); creating a site runs as a job with named steps (lab: through the screen and the CLI on a loaded node, no 500, the site active); the 'you will be asked for your password' notice shows as soon as a restore dialog opens, in the backups and the containers kits. 9d3332a2
• New Cdn,agent,catalog W11-98 — CDN image optimisation with imgproxy (pinned by digest, run on each edge through the panel's own container runtime, read-only, all capabilities dropped, signed URLs only, reachable only from the edge's nginx): w, h, fit, q and fmt (webp, avif, jpeg, png, auto from Accept), automatic WebP, originals untouched, invalid parameters 400, size / pixel / time caps 413 / 422 as administrator settings, resized images cached (a second request is a HIT) and purged with their original; large uncached files cached in 1 MB slices (a 200 MB object: the origin saw one request for the slice); the edge firewall for zone names over 36 characters through a short stable id. Each lab-proven with the real imgproxy. 7dbc8ca6
• Fixed Store,webmail,web,panel W11-96 — batch fix 9, each lab-proven: installing a Store add-on no longer deadlocks the Store (store/010: the name resolver read the catalogue inside an install step while the install held the manager's lock; it now reads once when the job starts; a test that waited forever now passes; lab: an add-on installed and upgraded with named steps while the Store kept answering); the webmail calendar fits at 1440 px (webmail/101: the date picker was wider than its sidebar); internal settings never reach a site's Config tab (web/102); a direct visit to an add-on the licence does not cover says so, with the Store and the licence one click away; the database screens walked with real MariaDB and PostgreSQL (databases/005–010, no change needed). 70f5854d
• New Auth,backups,dns,agent,install,jobs,panel,ui W11-97 + w11-99, merged together after one check cea0b63f
• Fixed Backups,databases,containers,terminal,ai,importers,store,host,site W11-94 + w11-95 + w11-93, merged together after one check 6e311ed3
• New Web,wafd,cdn,agent W11-92 — directory passwords and the firewall's last gaps: protect a path of a site with people and a realm (cPanel's Directory Privacy, AC-security-24): bcrypt hashes only, in files the web server reads and no other account can (lab: the other account and the site owner refused, www-data reads), an nginx auth_basic per path (a path and everything below it, longest wins), actions with dry runs and the Protection tab's card; lab: no or a wrong password 401, the right one 200 for static and PHP, the rest of the site open, protection kept through updates, reconcile, rollback, the firewall and the bot challenge; no clear password in the database, journal, logs or history. The uninspected requests during a firewall restart: one copy not bound yet and the other stopping let a request fall through to the backup; each copy is now listed twice (before 22 of 33,723 passed, after 0 of 32,628). The CDN edge's firewall runs as the same pair (stand-in proof: 11.5 % -> 0 of 16,388). 0a7d5a2f
• New Editor,extensions,wasmext,cluster,dns,web,wafd,apps,install W11-57 + w11-58 + w11-91 + w11-64, merged together after one check c6f5eebd
• New Backups,containers,accounts,importers,host,databases,dns W11-62 + w11-85 + w11-75, merged together after one check dbaa5592
• Fixed Pluginhost,natsbus,core,files W11-90 — the panel stops answering after a long action (cluster/124, major): every module schedule held a pooled core database connection for its whole run while its own audit row waited for another, so on a loaded box overlapping scheduled runs took the whole pool and nothing recovered until a restart (lab evidence: 8 of 8 sessions idle on the schedule lock, a goroutine dump with 8 runs blocked in pgxpool.Acquire under writeAudit). Schedule locks now live on one dedicated session outside the pool; audit writers queue in the process instead of on pool connections; an agent op never outlives its caller's deadline and inherits the caller's time when it sets none (the lost write after op ok, and the fixed 60 s that cut installs mid-way); the files module's ssh key expiry no longer keeps rows open across host calls. Lab: a full web server install and a database engine install with 655 short reads alongside, median 2 ms, none failed; 219 scheduled runs ok. 74e25c9a
• Fixed Web,core,software,webmail,logs,ssl,lab W11-84 — batch fix 5, what filling a server like a real one exposed, each proven in the lab: protection settings work on sites with a certificate (web/100: Block set through the screen on an HTTPS site, attack-shaped requests refused with the block page and searchable on Logs; web/005 Allow through the screen); the Websites list reads each certificate's real state (web/101: six sites Valid, counter 6); a reseller sees the administrator's plans by their visibility (core/101, saved through the plan editor); PHP versions the distribution's sources cannot provide are not offered, with the reason (software/100, partly: a second version on a distribution that has one is not proven); webmail sessions listed and closed by their owner, gone browsers dropped, the limit says what to do (webmail/100); the Logs page says when the log store is not answering and offers Set up logs; the lab authority validates DNS-01 through the lab resolver so a wildcard certificate issues (ssl/100). Filed: core/102 (no page for past jobs or old notices). bcc35345
• New Apps,software,editor,containers,install W11-67 — the app builder without privileges: BuildKit in its rootless mode, no --privileged and no host user namespace, root in a build step an unprivileged uid of the node (lab, by hand on the node: uid_map 0->101000, a 1 GB step killed inside a 192 MB cap with the builder up), refused where the engine does not remap ids or the kernel forbids user namespaces (named), the installer's preflight warns; the privileged builder only behind the administrator's explicit risk switch, never a silent fallback; idle builders stop after 15 min and start on the next build; the server restart refuses against a live job and names it (tests); PHP Other directives shows a refused directive's reason next to the field; the editor's gallery tunnel refuses paths outside it, climbing paths and unserved methods at the gateway; the container runtime install gets its 20 min instead of the agent call's default 60 s. Not done -> w11-91: the deploy through the panel, the screens in a browser. cf38414d
• Fixed Cluster,cdn,dns,accounts,web,mail,ui W11-87 — batch fix 6, several servers: the Cluster page no longer goes blank on an unusual record (pool answers never null, every tab guarded, the same guard in the CDN and DNS pages; cluster/120); Move to another server on an account, a site and a mailbox (servers that can take it and why the others cannot, the plan, a fresh sign-in check, a job with named steps; lab: an account and a site moved with a probe running, nothing lost; cluster/122) and the Moves tab's states; placement rules out a server without the web server and says why, account creation refused when no server can take it (cluster/123, lab-proven); Enable an edge picks a server (cdn/120); the confirm button's label (cluster/121); a secondary that does not answer says so (dns/120). Not done: the mailbox move with a mail client connected, the CDN walk. Found: cluster/124 (the panel stops answering after a long action; card w11-90). The panel's browser test harness closes its server's connections and has 60 s to shut down. cde28063
• New Cdn,geoip,agent W11-89 — CDN rules at the edge: country allow / deny per zone from the country database, expanded to address blocks on the edge (lab: allowed and refused by country; with no database the controls say why); a rate limit per client address with a burst, answered 429 with Retry-After (lab); the web firewall at the edge through a second instance of the same firewall service, blocked requests on the zone's Security tab (lab: XSS and SQL injection refused, a normal request still a cache HIT, byte ranges through it); Brotli and gzip with a size minimum, zstd only where the distribution ships it and the Caching tab says so per edge; ranges on a 200 MB object. Image optimisation evaluated, not built (owner decision: imgproxy or a libvips service). 571130da
• Fixed Ai,egress,api,agent,site W11-88 — batch fix 7, the security review's AI findings: the local model runtime fenced to the panel's own user (ai/162, lab-proven); local means the address really dialled, not the kind chosen (ai/160); a stream the client leaves is still metered (ai/161, lab-proven: 50 cut streams, counters exact); consent checked on every provider path with sent-log rows for the gateway, embeddings and knowledge answers (ai/168); every read carries a consent category, deny by default (ai/163); the redactor as a table of named patterns with hosting's real secret shapes (ai/165); a Team member sees only their own sent rows (ai/164); forwarded addresses believed only from the panel's proxy (ai/169); untrusted marks survive into the next turn and labels are fenced (ai/166, ai/167); tool errors and previews fenced, approve and undo re-check the deny rules and kill switch, the gateway forwards only known fields. docs/security/ai.md and three sentences of the AI page follow. 4a401bc6
• Fixed Auth,apps,web,files,mail,software W11-83 — batch fix 4, the security review's findings: "this was not me" inside the panel needs the person's own browser session, never an API token (auth/140); a container build's Dockerfile is held inside the release, links included (apps/140); each account's web log folder is closed to other accounts and corrected at agent start (lab-proven from another customer's shell); folder share links refuse dot files by name unless the link includes hidden files (files/140); the mail antivirus socket is 660 with the spam filter in its group (mail/150); the php.ini deny-list completed and the decision written down (software/140); an OIDC test sign-on needs the provider's owner and never signs anyone in (auth/141). Not changed: archive extraction as root (GNU tar's defaults hold; needs a cluster lab). Lab-proven: the web logs only 0897116e
• New Databases W11-61 — the database tool (Adminer 6.1.1, pinned by checksum and verified before every start), built and OFF by default: one process per account as the account's own user in its slice with no network, reachable only through a root-owned socket and the editor's isolated origin and single-use ticket, an ephemeral database login with the chosen user's rights only; isolation of the running tool proven in a lab (user, slice, namespace, socket, refusals); a real sign-in against MariaDB and PostgreSQL NOT proven (the lab had no engine), so the setting stays off until w11-85 b3f2d0f7
• Fixed Auth,ssl,sizing,install,lab W11-77 — batch fix 3: the single sign-on provider's Remove shows a plan and removes (it relied on a browser confirm box); a provider on a private address can be allowed by an administrator — one host and port, through the egress guard, never link-local or cloud-metadata addresses —, a provider whose test failed is not offered on the sign-in page, plain http refused, the server's own pages get the panel's look; the installer always sets a default certificate authority for customer certificates and labs pass their own, and screens that depend on a certificate show its real state instead of On; the recommended sizing profile takes what is in use into account and a profile that would stop webmail or the spam filter names who is affected and asks again; small texts. Not attempted: webmail/060; a sign-in through the provider to the end is covered by tests only c3d3bb9e
• New Lab,site W11-71 — a showcase install: lab/tools/showcase-seed.sh fills a lab like a small hosting business through public actions only (services, a reseller with its brand and five customers, six sites with content and certificates, eleven mailboxes with real threads, a calendar and contacts, backups with a restore, traffic, the assistant on the lab's stand-in model with a plan waiting, a Store with an update), idempotent (second run 33 s, nothing changed); site/scripts/panel-shots.mjs photographs it (92 files). Bugs found by seeding: web/100 (protection settings rejected on any site with a certificate), web/101, core/101, software/100, webmail/100, ssl/100. Left out: one PHP version only, no wildcard certificate, the webmail, assistant-conversation, detail, Store and Logs photographs a2bffa78
• Fixed Core,auth,accounts W11-73 — "Sign in as this customer" acts as the account's own person, resolved on the server (the dialog sent the account's creator: a reseller's client opened as the reseller); password reset counts every request against its client and accepts the email field (a body naming the address "email" arrived empty and was never counted, refused or answered with mail); one audit verdict for the page and the CLI (intact / gaps / broken), an open incident shown with its missing ids; the tampering alert email proven in a lab and the notice says when it could not be emailed; a terminate plan that says what is kept; no "Write to ." without a support address; store job steps name the add-on. Sign-in throttling did not share the reset fault 99cf2aff
• New Site W11-76 — the product site, finishing: every "coming" line checked against STATUS (the security page, DNS, mail, apps, CDN, the API and reseller guides), five feature areas of their own (single sign-on, white label, sizing, whole-server recovery, the mobile app), the home page lays out below-the-fold sections lazily (mobile blocking time 420 / 200 / 630 ms before, 200 / 50 / 0 ms after, three runs each on a busy machine), application screenshots in the structured data, the admin, reseller and user guides follow today's navigation 771d9c62
• New Dns,security W11-66 — a zone transfer needs the key AND a listed address: transfers move to their own port answered by a second name-server process that checks the key, opened by the firewall module only to the secondaries' addresses (lab: the right key from an unlisted address times out, the listed one transfers, port 53 refuses both); a secondary's address moves in one action; this server as a secondary of an outside primary proven (a wrong key shows refused, not an empty zone; edits refused with the reason); promote a secondary with a plan, the old primary fenced until it follows (lab: primary stopped, promoted, edited, old primary came back as a secondary). Also fixed: the firewall rules for file transfer were never opened by their event. Not built: the screens for all of this; unit tests for promote and set_address a78490b2
• New Site W11-74 — the product site's second half: moved addresses answer 301 (/features/assistant/ to /ai/), the download page and install guide follow the real installer (Simple and Advanced, footprints, nine distributions, unattended, upgrade, uninstall; tables read from docs/install.md), pricing checked against the licence code, comparison pages for cPanel and Plesk with every outside fact read on the vendor's own page on 12 October 2026 and cited, a tour of twelve steps on today's panel. Left: areas of their own, application screenshots in the structured data, the home page's blocking time, the guides 860c1b6c
• Fixed Design system W11-65 — phone widths: a 390 px check that sees inner panes (every route and tab of every role: 26 views with something past the screen edge before, 0 of 393 after), fixed in the shared pieces (grid items shrink with their track, card headers keep their buttons on screen, tables stop cutting cells and titles on phones, declared sideways scrollers); security/013 the Protection page, ssl/011, web/009, ui/008, mail/016 and mail/015 (every CLI group lists its commands). Not fixed: a refusal inside the mail job (mail/015 step 4), tight pills on Protection at 390 px 0d4173a7
• New Site W11-70 — the product site true to today and findable: one page registry behind every head (titles, descriptions, canonical, the full Open Graph and Twitter sets), one linked JSON-LD graph per page, a sitemap with dates and images, an Atom feed, a manifest, llms.txt, a social card per page and a check that fails the build; AI as a headline (/ai/: 24 built-in jobs, plan and approve, your own model key, several providers with a model per job and a fallback order, a model on your own server with its limit stated) and as the home page's second section; every feature area moved from coming to built with its limits, new areas for apps, CDN, several servers, migrations and integrations; new panel screenshots. Left: comparison pages, the installer and download pages, the tour 8e340f49
• New Cdn W11-55 — the CDN's screens for what w11-26 built: a certificate state per custom host name (waiting for DNS, being ordered, active with its renewal date, failed with the reason) with Order again, private / public bucket origins, delete now or mark stale, purge when a site deploys (lab-proven: HIT, change, purge, MISS), edge logs under the customer's own account without query strings; two w11-26 faults the lab exposed fixed (deploy events arrived empty, a certificate never counted as covering its host names). Not built: rules at the edge, image optimisation; app-deploy purge unit-tested only b5e0a7c3
• Fixed Licence W11-72 — no false "licence check overdue": the check-in loop follows the licence's own refresh window (a quarter of it early, every minute once overdue) instead of retrying only every quarter of the 24 h period; a licence that asks for a refresh after an hour was in grace five hours out of six while its service answered (seen on the demo) 52f8be36
• New Mail W11-60 — app-password sign-ins carry the real client address (believed only from the panel's own proxy; forgery refused in a lab), so bans hit the offender, and last use is recorded for contacts and calendar; sender reputation (reverse name, blocklists) in the mail set-up check with a score per domain. Not done: parts 3-6 of the card, browser walks, a RHEL-family node 5623d3dd
• New Sign-in W11-63 — SAML single sign-on: signed responses validated against the pinned provider certificate (subject and attributes read only from the verified element), redirect request and POST response, metadata import and download, certificate rollover, a Test sign-on, the SAML form on the single sign-on screen; 24 attack replays refused in a lab (the replay of a valid response by unit test only). Not built: encrypted assertions, signed requests, single logout 861d376b
• New Software,apps,editor,extensions W11-30 + w11-56 — free-form php.ini directives with an administrator-only list, a server restart with a plan, the OS package list cached, workspace trust as an editor policy, dry runs for panel extensions; app image builds run inside the account's own limits (proven in a lab: slice, memory cap with a plain out-of-memory message, CPU throttling, a cache per account); the editor reaches the policy-enforcing extension gallery through its own origin (search proven in the real editor; install from the view and a denial by id not re-proven) c57ad4b8
• New DNS W11-59 — secondary name servers: a transfer key per pair kept in the vault, a change reaches the secondary within seconds, a transfer without the key or with a wrong one is refused, per-zone state (in step / behind / down with the lag) that recovers when a secondary returns, a Secondaries tab and a Name servers page e5dd738a
• Fixed Test lab A pinned lab upgraded in place stays offline for the country database unless GEO_OFFLINE=0 c0912a48
• New Security W11-50 — the per-site firewall proven on AlmaLinux 10 with its events in the Logs page under the site's account, an offline country database for sign-in alerts (new country and impossible travel now fire; licence and status on a Licences page), an off-server copy of every audit checkpoint by syslog or signed webhook with a screen to compare a copy against the log 7b851b20
• New General W11-49 — import archives uploaded in the wizard (resumable, checksum shown, removed afterwards, hostile archives refused), plans say who may be given them and which modules they include with the host refusing what a plan leaves out, WHMCS / Blesta / HostBill modules as checksummed downloads with an end-to-end connector test, the recovery scripts placed on the server by the installer 43fe6602
• New Mail W11-48 — a guard in front of the contacts-and-calendar service (repeat rules that never end or cost minutes are refused in milliseconds, body and rate limits, its own resource slice), the service on the standard HTTPS port with a real certificate and nothing else exposed, app passwords for phones that the webmail's own sign-in refuses; a renewed certificate for a panel host name is now actually served f7752d55
• New Cdn W11-26 — certificates for custom hostnames issued at the edge and renewed on every edge, soft purge with stale-while-revalidate, purge on deploy, private bucket origins signed by the edge, customer API examples run for real; ssl renewals started by a person now reach the other servers 2dbcd916
• New Backups W11-46 — whole-server recovery run for real: a server with sites, MariaDB and PostgreSQL data, a mailbox, DNS, a certificate, people and vault secrets was backed up, destroyed and rebuilt on a blank node from the backup and the recovery bundle in 312 s, every item verified identical; eleven faults in the scripts and document fixed (the customer PostgreSQL restore would have dropped the panel's own database, module schemas got the wrong owner, services were not installed, file owners by name, the relay login file, S3 credentials in the bundle, a hung first backup); what does not come back is listed; wrong passphrase, missing bundle, newer backup and a node with accounts are refused plainly; the PostgreSQL backup / console / maintenance paths proven; a restore compares row counts per table and cleans up; the backup screens walked 670ddd3c
• New Webmail W11-36 — a calendar that syncs with a phone: month / week / day / agenda, time zones per event, repeating events with this / following / all edits, reminders as one bell notice, CalDAV proven both ways, invitations end to end (accept sends the standard reply, updates and cancellations apply only from the organiser), .ics import and export; hostile invitations and repeat bombs are bounded (expander limits, nothing fetched, text only); 32 isolation attempts refused; the mail gateway now holds one session per mailbox per panel session (three tabs: 2 connections, was 6) with a budget and parked idle connections 9d02b674
• New Importers W11-28 — live transfer from another server: connect over SSH (credentials in the vault, the host key pinned and confirmed, outbound only through the egress guard), discover its accounts, a plan per account, a first copy while the source stays live, a final incremental pass and a per-domain DNS checklist; everything from the source is treated as hostile (escaping links, device files and setuid bits dropped, a dump loaded as the account's own database user); a changed host key stops the transfer; nothing on the source is changed. Lab-proven from a plain Linux server; cPanel / Plesk / DirectAdmin discovery against fixtures only d5159851
• New Sizing,core,dns W11-29 — sizing is applied, not only recorded: web, database, cache and mail tune actions take the profile's numbers through each module's managed files with validation, a health check and rollback, keep values an administrator pinned, and are applied from the Sizing screen with a before / after plan (a 1 GB and a 4 GB lab node now run different nginx, MariaDB and PHP settings); an account's memory and CPU slice follow its plan and creating one warns when the plan oversells; modules can be switched on and off at runtime through the normal load and verification path (dependents refuse, data stays, no supervisor restart); panel hosts can front an allow-listed local service; a per-zone DNS record limit; replace-mode import order. Not built: DNS secondaries with TSIG ae65a124
• New Containers,terminal,storage W11-47 — a recorded shell inside a container of your own stack (a fixed unprivileged docker exec built by the agent, a grant per stack, never another account's container or a server shell) and bounded live logs with search (escape sequences neutralised); the terminal survives a reload or a dropped connection for five minutes (only the same panel session can re-attach, signing out ends it at once), per-person snippets (inserted, never run) and settings; buckets list folders, access plans say in plain words what becomes public (private / one folder / everything, no raw JSON), lifecycle rules with a preview; stack names beginning app- are reserved. Adminer is not built 15229b26
• New Mail W11-45 — deliverability: a mailbox that suddenly sends a flood is held (queued, never bounced; owner and administrator told once; release or discard with a plan; a bursts-allowed switch) with per-hour and per-day limits enforced; DMARC aggregate reports received, parsed as hostile input (size and expansion caps, no entities, nothing fetched, stored only for hosted domains) and shown per domain with plain findings and DNS fixes to approve; reverse-name and blocklist checks through the egress guard (public addresses only, cached, switchable) with a daily notice. Lab-proven: a 70-message flood held within a minute, 12 held messages delivered intact after release, a decompression bomb and a foreign report refused 86af1b51
• New Ai W11-44 — local models: an administrator enables a model runtime on the server (a container on loopback only, its own network, no capabilities, limits from the sizing profile; enable / start / stop / remove as jobs), pulls models from an allow-list with the size confirmed first and a fit check against memory and disk, and uses them as a provider that needs no consent; air-gapped mode is enforced in the egress layer (a request to a remote provider fails before any connection opens); a Local models screen. Isolation proven from another container and from a customer's own stack. Proven with a stub standing in for the runtime's API — the first run on real hardware has a checklist in modules/ai/docs.md 5624ea74
• New Sign-in W11-25 — single sign-on with OIDC (authorisation code + PKCE; discovery, keys and token endpoint through the egress guard; state and nonce bound to the browser and single-use; full ID-token validation with an algorithm allow-list; a person is found by provider + subject, never by email; just-in-time creation only by policy with a mapping whose default is no access; an administrator role never from a claim without an explicit switch; the panel's own second factor still applies unless the provider's is trusted by policy; administrators always keep a local way in), login-anomaly alerts (new device, failure burst, country / travel through a hook) with a this-was-not-me action that ends every session, a cookie-only session read so the SPA keeps the CSRF token in memory; 14 attack tests against a lab identity provider. SAML is not built 247512e6
• New Backups,databases W11-27 — scheduled dumps per database and restore to a new database by default (plan, named steps, table count checked), one-mailbox backup and restore into a Restored folder through the mail stack's own tools, a query console (read-only by default, 500 rows / 15 s, never a superuser, a write needs a switch and a plan and is audited) and maintenance actions, Backups / Query / Maintenance tabs; whole-server recovery scripts and docs/disaster-recovery.md WRITTEN but never run (the vault key stays out of the repository, in a passphrase-protected recovery bundle); the Sharing page no longer asks for a folder that may not exist. Lab-proven through the CLI on MariaDB; screens not yet walked e833e61d
• Fixed Ui,store W11-43 — a Store rollback shows a plan first (which version returns, that data written since is lost) and runs as a titled high-risk job (store/005); a job keeps its own title when saved and the dialog lists every step; the Home search finds every example its placeholder shows (cron, php.ini, mx …) with a test; breadcrumbs on every page; a Team member's role reads Team member; Templates opens without an account; Versions says Not installed; module states on Store and Versions; the webmail reflows when the assistant narrows the page, a reply draft renders as a card, the mailbox's own refusal is shown; the lab helper keeps its session after a step-up; the 390 px dark smoke for five people e203b0ce
• Fixed Files,web,ssl,databases W11-41 — findings of walk w11-38: FTP users can overwrite a file (files/003); the FTP ban is by address only, never by user name or successful logins (files/004); one Allow on a blocked request covers every rule it matched, never the score rule (web/005); the account's security score reads the websites' protection (security/012); an Install button with a plan and named steps on the Engines tab, and messages that know who reads them (databases/003); a certificate order that issues nothing ends failed with the authority's reason (ssl/010); nine minor and cosmetic fixes (File transfer switches, real example folders, SSH not installed said up front, plain plans, a page for a refused visitor) 27feb798
• Fixed Core W11-42 — the audit anchor no longer forgets: the root agent accepts a checkpoint only when it extends the previous one (it recomputes every hash link from the last checkpoint and requires the row count to grow by exactly those rows), a failed checkpoint opens an integrity incident that persists across restarts and later checkpoints until an administrator acknowledges it with step-up and a reason (the acknowledgement becomes part of the chain), verification lists every missing id, one bell notice and an email at once, a standing banner on the Audit page, the watch runs every minute (core/014: a deletion was forgotten after one minute); the Team picker pages through every list (core/015); a Sign in as this customer action for staff (core/012); plain invitation and reset messages; empty per-account folders removed on termination; the CLI lists a group's commands, suggests the closest command and parses false edcd8ca0
• New Mail W11-23 — the Mail server screen shows and edits what was command-line only (relay with a test, spam filter and antivirus, the default DKIM selector, the contacts and calendar service switch, module states), each change with its plan; app passwords for a mailbox (generated by the server, shown once, stored hashed, labelled, individually revocable — revoking ends open sessions; accepted by IMAP and submission on Dovecot 2.4, lab-proven; 2.3 rendered and unit-tested) 49e27165
• Fixed Ai,web,logs W11-34 — the assistant and the AI services walked end to end in a lab, with eight fixes: site-health notices were refused silently (the notice schema lacked the level field), a site with a certificate from the ssl module reported none (an expired one is now named), a down site is no longer counted as running, the server-data refresh was refused every five minutes, AI services fit a phone, site logs are rotated; site logs proven per customer with secrets masked and a per-site filter; every assistant entry point passes against seeded failures (21 entries), incl. deploy, file, terminal and webmail summary / draft; customer AI services proven (key limits answer 429, PDF / DOCX uploads, vector collections, isolation); a PostgreSQL slow-statement reader; GPU detection and the model fit list for local models (the runtime itself is not built) 32efa6e3
• New Core W11-40 — a crashed module is restarted by the host (seen within half a second, full verification on every restart, backoff with a cap, its call tokens revoked, a call during the gap answers a plain retryable error and a mutating call that was in flight answers 'unknown outcome', jobs end failed with the reason, one notice per episode; a module that keeps failing is left failed while the panel works); a root-only local command resets the sign-in factors of a locked-out person (never reachable over the network, sessions ended, enrolment forced, audited); node down / recovered events; a cancelled job keeps its last lines; a plain message at the mail connection limit 4d7daad5
• New Webmail W11-35 — the webmail's new features walked in a mail lab (conversations and search across folders, scheduled send with every session closed, snooze, rule save) and fixed: an undo-send hold is now written down and survives a crash or restart, a refused scheduled send raises a notice and shows the server's reason; contacts that sync with a phone — a DAV service installed through the agent (off until enabled), signed in against the mail stack with the mailbox's own password, each mailbox confined to its own data (16 isolation attempts refused), a Contacts screen with groups and vCard import / export, recipient autocomplete d47a45af
• New Installer W11-15 — installer round two: every supported system installed for real (Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux 9 / 10, Rocky 9 / 10: install, re-run, dry run, uninstall, purge, Advanced with mail + DNS + both databases and the 12-step acceptance flow, taken port, Compact); Standard on 2 GB and Full on 4 GB with antivirus (a test virus refused); a download is fetched and verified before anything is installed and an older signed release is refused; the administrator's email reaches first-run setup; antivirus on RHEL-family systems; a default backup target with the first account; ten install bugs fixed (a customer PostgreSQL stopping the panel's own database on older systems, antivirus never starting on Debian / Ubuntu, Advanced mode dying after the last question, …); 154 harness checks da7502b5
• New Files W11-22 — share links (hashed 256-bit token, expiry, password with lockout, download limit, instant revocation, served as attachments through the confined file service), file versions inside the account with retention and restore, FTP(S) users (its own service, off by default, TLS required, each user jailed to one folder, own password, optional read-only, ban after repeated failures), WebDAV at /dav/ over the confined file service, an SSH server settings screen with review and automatic rollback, a plain precondition when SSH is not installed, image and text previews, hourly upkeep. Lab-proven through the API incl. every escape attempt; the two new screens not yet seen in a browser 919f0742
• New Webmail W11-24 — search and conversations across all folders with operators people know (a reply in Sent joins the mail it answers), scheduled send held on the server with a Scheduled view (edit, cancel, explicit time zone), snooze that returns the message unread at the top, rule save keeps other active scripts. Unit-tested; not yet walked in a lab. Contacts and calendar (Radicale behind the mail stack's own sign-in) are designed, not built 5b08520c
• New Ai,web,logs W11-33 — a site's own web and PHP logs are shipped to the log store under its account, so the Logs page and the 502 helper read the real error line; site health reflects the runtime (PHP pool, upstream, certificate expiry) with a plain reason and one notice per change, without flapping; customer AI services get their screens (per-key limits, activity and code snippets), knowledge-base uploads of PDF and DOCX with status and retry, and vector collections with a REST API; scripted reasoning for four more assistant jobs. Unit-tested; not yet walked in a lab fcfbfa0f
• New Cluster,databases W11-20 — database replication between servers for MariaDB and PostgreSQL: set up with a plan and a job (replication user in the vault, base copy, streaming over TLS between the two cluster addresses), status with lag and plain errors, planned and emergency promote with fencing (the old primary goes read-only, the replica catches up, then the old primary is stopped and masked; a promote that cannot confirm the fence is refused unless the risk is accepted), rebuild of the old primary as the new replica; honest limits shown in the product (asynchronous, one replica per engine, no automatic failover) 41f8f4b1
• New Ai W11-32 — AI depth, second half: lab fixtures seed real failures (full disk, failed backup, a bounce with its reverse-DNS reply, a stopped PHP pool, a failed certificate, drift, a slow query, missing SPF) and every reachable assistant entry point was walked against them; a remote provider receives nothing until its consent step is saved, and a refused category is proven end to end; per-key gateway limits (requests per minute, tokens per day, spend per month) answer 429 with Retry-After; the 502 helper is always offered; mail jobs can resolve the domain; a question-only request is now written to the data-sent log e6a8b2e8
• New Web,security W11-21 — per-site protection: a web application firewall (Coraza with the OWASP Core Rule Set, compiled into the agent and run as its own unprivileged service; off / detect / block, paranoia levels, exceptions proposed from a blocked request, a kill switch, fail-open by default, validate -> apply -> health check -> rollback), rate-limit presets, security-header presets with a preview, a proof-of-work bot challenge, hotlink protection; the security score counts the firewall mode, the TLS grade and headers with a plain reason each 46884cc4
• Fixed Gate Web unit tests are part of the merge gate; the module CSS isolation test builds its own fixtures (they sat under an ignored dist/ and never reached a fresh checkout, so the test was red on main) 8abeaadc
• Fixed Shell W11-13 — shell and design-system traps: the shell's first load is 186 KB (was 199.7 of 200) with sign-in, step-up and toasts loaded on demand; inline editors survive a refetch; a module bundle that ships CSS outside its own scope fails its build (all 31 pass); non-searchable dropdowns work from the keyboard; the open assistant pushes the page aside on wide screens, is resizable, and toasts no longer cover it; the job dialog shows why a job cannot be cancelled; Store install / upgrade / rollback are jobs with named steps; webmail images are fetched through the egress guard and inlined; breadcrumbs use the new categories; a compact Home for people with few tools fa3ffe9c
• New Ai W11-18 — AI depth, first half: webmail thread summary and reply draft behind a per-mailbox switch (a draft only fills the reply box), a slow-query list with Explain this query, this server's configs and logs in answers (collected from an allow-list, redacted before indexing, owned per account, re-scanned on retrieval), consent per provider and data category enforced before anything enters a prompt, a data-sent log, air-gapped mode, an admin overview with the safety dashboard, dry runs on provider / policy / kill switch; a quoted SPF prefix now replaces instead of doubling; GPU detection and the model fit check for local models 670ce3d5
• Fixed Cluster,mail W11-19 — findings of the cluster walk: at a mail cutover the old server closes every open mail session and refuses sign-ins before the final pass (an open IMAP session lost 133 of 210 changes; now 0 of 172); a cutover that fails lifts the freeze at once and pauses with a plain reason (mail sat queued 13 minutes behind 'internal error'); a floating address leaves a load balancer whose HAProxy died whatever the preempt setting (91 % of probes failed; now back in ~1.5 s); deliveries after a freeze are paced; cross-distro moves ignore the target's skeleton files; a stopped server is shown offline after three missed heartbeats and refused as a move target; mail.names.repair validates its account id 1d0ff8ba
• New Store W11-17 — the Store is never empty and never looks broken: a built-in catalogue generated from the release (29 modules, 3 add-ons, 31 starter app templates, 16 editor packs), three calm connection states with the saved catalogue's age, one action feeding the Store, Licence, Versions and Apps template pages; a panel with a saved Store root but no Store address starts normally; a dead Store address no longer stalls pages; lab/tools/store-seed.sh gives a running lab (or the demo) a Store with sample add-ons e5d9a18f
• New Jobs W11-12 — long actions run as jobs with named steps, a title that names the object and cancel where stopping is safe: database export / import, certificate orders (each ACME phase), importers analyze / run / rollback, app detect and deploy (cancel now stops the container stack apply), image pulls, editor extensions, config resets; a job at a step that must not be interrupted refuses cancel with the reason; two load-sensitive tests hardened 61add459
• New Ai W11-16 — the assistant is one feature in everything: every screen provides typed context (shown as removable chips), an AskAssistant entry point sits where the problem is on 17 screens plus Home (explain this error, check this configuration, set up a service's DNS records, review security …), 22 built-in jobs as reviewable data, answers end in a plan the person approves; text from the screen is fenced, redacted and can never become a step; no-provider and disabled states; history with search, export and delete; a lab stub provider f0b9e0b7
• New Licence,release W11-10 — edition limits are enforced (accounts, resellers, nodes, CDN edges) with a plain refusal naming the limit, the use and the edition that lifts it; expiry and downgrade stop new things and never existing ones; licensing events reach webhooks and the audit log; scripts/release.sh builds a signed release (keys embedded from files, modules signed, a signed manifest) with --test-keys for labs; the installer verifies the manifest's signature, size and checksum before installing a download; Store install/upgrade have a dry run; snapshots cover views and functions and refuse what they cannot roll back fc24e83c
• New Auth,branding W11-11 — outgoing mail works from day one: a real default sender (never @localhost), a Sending email page (this server / a relay / not set up) with a test email that reports the real answer; a failed panel email raises one admin notice per cause and the screen offers the link to copy; password reset by email (single-use hashed token, 30 min, rate limits, no account enumeration, sessions ended, second factor still required); quota-warning emails at 80 % and 100 %; a Team member manages their own sign-in security ef16f145
• New Install,mail,ssl W11-14 — what the installer needed from the modules: mail relay / spam filter / antivirus / DKIM selector as actions (relay password in the secret store, antivirus refused below 3.6 GB with the number); install jobs report named steps and progress; a panel or mail certificate order that issues nothing fails with the CA's reason and can be retried, and the installer adds the CA (the panel's HTTPS came up empty before); store.channel.set scope; a default backup target action; installer and docs use them (112 harness checks) 7466230a
• New Cluster,mail W11-09 — mail moves with the account: mailboxes, Sieve, DKIM keys, aliases, forwarders, autoresponders and quotas follow an account move over the existing node-to-node stream (copy while mail flows, a verified final pass during a short freeze, the old server relays afterwards); resumable, abortable, move back works; mail.names.repair for accounts moved earlier; Dovecot 2.4 keeps adopted overrides. Lab: 1615 messages sent through two moves, 1615 delivered 5fb9f68a
• New Shell W11-01 — Home and navigation redesigned: every tool in an illustrated category (tinted icon chips, one-line descriptions), search across all tools, a pinned dock with reorder, recently used, a sidebar of foldable categories with a rail, the Configuration hub, pin toggles on tiles, sidebar entries, page headers and in Ctrl/Ctrl K; pins stored per person through core.prefs with a localStorage fallback; design spec docs/design/navigation-home.md f23f3ceb
• New Core W11-08 — the audit chain hashes canonical JSON (scheme per row, old rows keep verifying) and is anchored by signed checkpoints the root agent keeps: deleting or re-chaining the newest rows fails core.audit.verify; Host.DeleteSecret; the impersonated person gets a notice and an audit row, impersonation id in its own column; webmail sessions end with the panel session; accounts.deleting is a synchronous step (containers removes stacks there); duplicate username proven 409 a9f563dc
• New Installer W11-03 — a real installer: preflight, Simple and Advanced modes, Compact / Standard / Full / Custom footprints, answers file and flags for unattended installs, plan + dry run, the panel's own PostgreSQL and Valkey, services installed through the panel's own actions, upgrade in place, uninstall; docs/install.md; bash test harness (102 checks); lab modes PANEL_DB=local and INSTALL=none. Proven on ubuntu2604 (all scenarios), debian13 and alma10 (install, compact, re-run) 8c1d414a
• Fixed Team W11-07 — a Team member's lists apply the grant in the query before the page limit (web, dns, mail, domains, ssl, cdn, databases, storage, containers, apps) through one SDK helper; cursors and totals count only what the member may see; a regression test per module 82db4f2a
• New Nav W11-02 — every menu entry has a category, a description and search keywords (contract in docs/tasks/w11/navigation-contract.md); the five config pages form one hub; core.prefs.get|set stores per-person preferences (pins), read-only while impersonating; a core-only no_audit flag for low-risk preference writes cf9b94bd

• New Site Serve the product site on a port (pm2 respirecloud-site, 127.0.0.1:7900) — the owner's FastPanel site is a reverse proxy; status d83307cb
• Fixed General W10-fix-20 — a stack-scoped Team member sees their stack (shared Visible helper), bell notices have a level (info/warning/failed), wrap and read in full, Team rows name resources and the invite dialog offers every kind, disabled New buttons give the reason, one state when certificates cannot load, AI plans mark only untrusted text aadf09e0
• Fixed Gate A failed merge gate drops the squash (nothing stays staged); flaky token test fixed 11b35914
• Fixed Cluster W10-fix-18 — Linux user ids are allocated once, cluster-wide (cluster/013); a panel restart never breaks a move: steps are kept, the live node decides, unsure moves pause and can be continued or cancelled (011); database users move with their authentication strings and grants, MariaDB/MySQL and PostgreSQL, and PostgreSQL moves work (012) 20dd2bd0
• Fixed General W10-fix-17 — mail held during a suspension is released on unsuspend, the public suspension page shows only the visitor message, suspend shows its plan and unsuspend asks first, the first cron job starts the cron service, web.sites.* accept slugs, scoped Team members see their buckets and get reasons on disabled buttons, plain scoped-grant refusals; accounts docs restored bf2b1fce
• Fixed General W10-fix-16 — pooling a site prepares the other node (the account's Linux user with the same ids, removed when its last site leaves) (cluster/010); creating things in a suspended account is refused, a suspension part that never answers is detected and retried, brand changes refresh the suspension page; the move's switch grace follows the DNS TTL and purge_source drops the old database copies be23ea50
• Fixed Cluster W10-fix-14a — DNS of an account points at the node it lives on, placement policies decide where a new account lands, moves use the installed database client names (MariaDB 13), the control node cannot be drained and roles in use cannot be dropped, a failed move leaves replicas and other moves alone, move back works, followers run in order (no 404s at the switch), constellation redraw 2e62ce31
• New Accounts Suspension really suspends (accounts/013) — sites serve a branded 503 with the reason and message, mailbox sign-in and submission refused, cron and the account's units held, terminal/editor/SSH (keys too) ended and refused; unsuspend restores everything incl. sites that were disabled before; itemised result, retries, plan 459b170a
• Fixed SSL A Team member scoped to one certificate cannot upload, self-sign, request or order another one; status (fix-14b merged) c909e127
• Fixed General W10-fix-14b — a Team member scoped to one resource cannot create siblings (cdn, web, databases, mail, dns, storage, containers, domains, apps: account-wide grant required), CDN edges reload on a certificate change with roll back, scoped CDN numbers, bandwidth warnings at 80/95% with an owner notice c0474d65
• Fixed General W10-fix-13 polish — branded-host gate on SSO and mobile sign-in, BYO database servers on the egress guard (pinned), accounts.set_node only for cluster, branding nameserver lookup, Team scopes ownership-checked at invite, owner notice when staff open a mailbox, suspend dialog warns when email cannot leave, logs/cdn states instead of errors, audit system filter, stack names wrap on phones 45d7c046
• Fixed General W10-fix-12 — the panel's own email leaves through the local mail server (loopback relay trusted, valid default sender) and a failed send is shown to administrators (bell + audit), found-outside page for accounts with adopt, event redelivery backs off and parks, backups.job.create has a plan, plain import refusals, readable Live activity, Team remove/limit fixes; audit rows no longer dropped for a wrong outcome word 5cc02445
• Fixed Security One egress guard for every outbound request (internal/egress: resolve, check, pin, re-check redirects) — AI providers at run time (finding 005), storage connections checked at every use with rclone unprivileged behind an nftables fence (009), CDN edge workers fenced against rebinding (008 residual), webhooks, providers and Git deploy URLs on the same check; audited admin allow-list for private targets 1789211c
• Fixed Module SDK A malformed id reaching a uuid column answers invalid_params, not internal (modules and built-ins); scripts/test-all.sh runs the suite like the gate; status + backlog b27a964d
• Fixed General W10-fix-11 — backup job/target ids that are not ids answer not_found instead of internal (backups/008), an alias's certificate is ordered when web announces the alias (ssl/007), scheduled discovery and drift scans verified in a lab (core/004) 1f944339
• New General Review part 4 — the editor origin can no longer run a panel passkey ceremony (finding 013, high), sign-out-everywhere / password change / admin revoke also revoke paired devices' refresh tokens (014, high), rotated sessions keep their device link so a device revoke ends them (015) 08bb18f4
• Fixed General W10-fix-10 — catch-all no longer swallows mail for existing mailboxes/aliases, Sieve split (mail owns vacation, webmail owns rules; legacy files migrated), plan dialog buttons inside the dialog, CrowdSec fallback leaves no dead apt source + apt repairs broken third-party sources, restore of latest skips safety snapshots, mail server page state when mail is not enabled, account pickers show names, stack names readable at 390px, plain SSL plan lines; agent retries openat2 on EAGAIN eeb86d12
• New General Review part 3 — PostgreSQL role takeover across tenants closed (finding 010, critical: one name, one owner; group roles never altered as users), socket peer auth only for the postgres OS user (011, high), BYO database servers refuse private addresses (012) 17fffa52
• Fixed Core Scheduled actions with strict schemas run again — the scheduler sends scheduled_at only where the schema takes it (discovery, config-drift and sizing scans never ran); bugs backups/008, ssl/007 filed f1a6d790
• Fixed Security ADR 0018 hardening — system_calls authoritative for every nested system call incl. event/schedule handlers (finding 006, high), owner hints only where declared, audit rows bound to the call token and elevated refused on retained tokens (finding 007) fc4a7051
• Fixed Test lab Pinned labs are never garbage-collected (a gc run removed the owner's demo); demo seed, in-place redeploy and smoke test in the repo; PUBLIC_EDITOR=0; bug mail/013 7ef5d42b
• New Core Team — users invite and manage sub-users (scoped grants capped at the inviter's, expiry with immediate effect, per-user limit, single-use email invitation, /team screen) (core/003); fix: foreign account ids answer 404 across modules, sub-user Protection, admin-only mail server page for non-admins, backups picker names, sub-user dashboard wording (w10-fix-7b) fa8053eb
• Fixed Cdn W10-fix-7a — edges install the njs package matching the installed nginx (no apt conflict on ubuntu 24.04/26.04), PowerDNS allows Lua record updates and GeoDNS restores the previous record on failure, port clash pre-check with the holder named and no restart loop, per-port edge probes, region note without GeoIP, custom-hostnames column 47b8936f
• New General Review part 2 — DB import no longer runs customer dumps as root (finding 004, critical); CDN origin SSRF via hex/decimal IP spellings closed (finding 008, high; QA cdn/001); findings 005/006/007/009 proposed 20e30e3b
• Fixed Security ADR 0018 module call identity (finding 001, high) — the host decides who a nested module call runs as (per-invocation call tokens), system calls only for actions a module declares in system_calls, caller stamped + audited, mail.sso.prepare only for webmail; retained calls for the AI turn, elevated calls for billing integrations 3303a300
• Fixed Security Ownership checks — branded panel hosts must belong to the brand owner's tenant (finding 003); certificates refused for names another account holds, wildcards refused over other tenants' names (finding 002, SSL side) ac190146
• Fixed General W10-fix-4 — local-root hidden, one icon per nav entry, domains badge at 390px, suspension email carries reason + message, plain not-installed messages (SSH/web/databases/mail/dns as states), Store Installed filter offline, empty app ids refused, job dialog without log lines, SSL plan warns before retiring a wildcard 2758a43a
• New General Review part 1 (auth, privilege separation, tenant isolation) — 3 high findings; domains refuse a parent of another account's domain (finding 002) f1f5b236
• Fixed General W10-fix-3a — mail aliases/forwards listed + editable, host name change re-issues the cert and republishes DNS (with a UI), Dovecot 2.4 quota root, webmail trusts the panel's own mail cert (pin) with plain TLS errors, audited step-up SSO into mailboxes for staff; lab: mta.lab.test, Mailpit on :25, lab-dns-pdns.sh cdffd0fb
• New SSL Certificate screens (list, detail, get/upload/CSR/self-signed sheets, settings + CAs), wildcard certificates via DNS-01 with ownership rule, ssl settings schema; fix(software): PHP/Runtimes pages make no admin-only calls for resellers and users (w10-fix-3b) cf96d643
• Fixed General W10-fix-3c — firewall UI changes apply (stored view normalised), schema errors as sentences in one place, Stacks table at 390px, reseller Protection picks an account, hardening/malware/CrowdSec wording, plain restic errors, backup run history 46306a8a
• Fixed General W10-fix-2a — admin can create admin, breached/username passwords refused (embedded list), public panel address instead of loopback (RC_PUBLIC_URL), passkey on IP hosts, lockout duration, readable refusals, param aliases, unknown asset owner, OpenAPI without CSRF, webhook errors, audit names + hide system ticks, a11y labels, no 401s on sign-in 690848d7
• Fixed General W10-fix-2b — importer prerequisites listed up front + failed commit keeps the dry run, wizard at 390px, rollback preview, required modules cannot be removed + remove preview, calm offline Store, capacity planner counts hosting accounts only, PHP default never a missing version, config pages show not-installed 16bd1577
• Fixed Agent Apply /home 0711 when the agent starts, so existing servers get it too e9f49adc
• Fixed General W10-fix-1a — DNS zone hijack closed (ownership over every account, public suffixes, no domains under another account), failed account create rolls back, reseller plan assign, suspend reason/message/schedule, readable refusals, DNS not-installed message, zones for earlier domains, nav/overview/phone layout 94965d3e
• Fixed General W10-fix-1b — apps deploy list 500, human errors (apps/web/databases), /home not listable (0711), step-up refusal says how to enrol, editor wording + chat off, sizing preview, DataTable keeps open row 2a156c3f
• New Shell Assistant on every page (Ctrl/Cmd+J, Ctrl K ask), compact licence notice (grace/degraded), route/nav collision guard, shell initial load 246 -> 191 KB gz with a build-time budget check c48f5345
• Fixed Test lab Pebble validates on 80/443 and unknown lab names resolve to cp1 (IPv4 only) — HTTP-01 orders work in every lab adcdc3c1
• New Hostnames Panel + mail hostnames with SSL end to end (owner requirement #16, w9-23) f1e0a4f2
• New Design system Importers wizard (source, pre-flight report, mapping, dry run, commit, rollback, past imports), Plans and sizing (plan editor with apply modes + exceed preview, presets, delete-with-migrate, export/import, capacity planner + what-if, overselling, server profile + re-tune), Integrations (webhooks with deliveries/dead-letter/replay, billing connectors, sign-in links, API, settings) abee4308
• New Mobile Capacitor app + server side (system-browser PKCE sign-in with passkeys/TOTP/SSO, rotating refresh tokens with reuse sign-out, device registry + revoke, min app version, Mobile app screen with QR, licence-authenticated push relay), APK with no source maps 172c91f7
• New Design system Software (OS packages with plans + holds + fingerprint-confirmed repos + allow-list + update policy; PHP versions, per-scope extensions, PECL with live logs, php.ini forms, FPM/opcache status; runtimes + tools with requests and EOL report) and Panel extensions (signed install with per-capability approval, developer mode, rollback, uninstall) 6d3d0890
• New Branding White-label brands (contrast-checked accents, sanitised SVG uploads, 20 versions), per-host branding of sign-in + shell + documents, reseller isolation on branded hosts, passkeys with the branded host as RP ID, panel hostnames (DNS verify + ssl order), private nameservers, branded email templates and customer pages, no-leak crawler a6a00157
• New Design system AI assistant (page + Ctrl+J side panel, streamed answers with sources, plan cards with per-step diffs, approve/reject/undo, providers, policy, kill switch, services), Store (catalogue, plan-first install/update/rollback/remove as jobs, trials), Licence (state, activate, add-ons, grace/degraded banner), Versions (catalog, follow-latest/pin, upgrade findings) 92fb508f
• Fixed Install,lab Ship UI-only built-in modules (core, store) — stage dirs with ui/dist, plugin host skips dirs without bin/; docs: cards w9-20/21/22, w9-10 follow-ups eb85f268
• New Software Runtimes + global tools wired into the software module — catalog lines with EOL, streamed mise installs, detection from version files, select with on-demand cap + admin requests, removal refused while used, pinned tools on cron PATH, usage/EOL report; runtime op types moved to sdk/agentop a67664a1
• New Design system Backups (targets, schedules, live runs, restore wizard with previews), Storage (buckets, keys, 12 connection kinds, built-in S3), Containers (Compose stacks, revisions, catalog, registries), CDN (zones, rules, purge, signed URLs, edges, external CDNs) 6b4d2dc7
• New Design system Configuration screens (drift diffs, keep/restore/reset, found outside the panel, undo, history, server reset wizard), Protection (score fixes, firewall with keep/roll-back countdown, CrowdSec, scans), Logs (live tail, audit chain verify), Cluster (constellation, drain, pools, VIP failover, moves), Stats, Providers cd54a4ae
• Fixed Test lab Labs install every module (RC_PROFILE=standard by default; SIZING=micro proves Micro on purpose) cd9473db
• New Software OS packages (allow-list, real apt/dnf plans, streamed apply + health watch, holds, signed third-party repos with fingerprint confirmation, queue) and PHP (versions with EOL, per-scope extensions, sandboxed PECL from an allow-list, validated php.ini, defaults per server/account/site) b2fb2de7
• Fixed Agent Heartbeat facts report cgroup-limited CPUs and memory (containers/slices), not the host's b495757d
• New Extensions,software Sandboxed WASM panel extensions (wazero; per-capability host calls checked against the calling user, no fs/net/clock beyond grants, fuel/memory/time caps, auto-disable on violations, signed or dev self-signed only) + runtimes via mise in a shared read-only store with version detection and admin-pinned global tools a0c611fc
• New Apps Dockerfile and Compose deploy modes (BuildKit secrets never in layers or logs, per-release images, auto-revert, rollback, strict compose validation incl. build contexts), signed app templates from the Store 7dbe9f73
• Fixed Merge The test gate could never fail (go test | grep under pipefail inverted it); fix(apps): result schemas for the 10 actions that pushed the schema count past its baseline 8c349f92
• Fixed Installer An upgrade is never a fresh install — Micro's module trim only applies to brand-new servers 61ea3180
• New Apps Every field customizable (runtime/custom mise spec, commands, hooks, env scopes, limits, restart policy), templates (versioned, scoped, YAML export/import), respirecloud.yaml/Procfile overrides with preview, per-app nginx snippets through web's validated layers 3518afbc
• New Sizing Install profiles from cgroup-aware hardware (Micro idles at 582 MB with web + PHP 8.5 + MariaDB), re-tune with per-value diff + dry-run plan, capacity planner + what-if + export, plan presets, overselling off/warn/allow, plan apply modes, delete-with-migrate, strict export/import, audited changes 117a42ad
• New Contracts Accounts.cron.create + robust account delete/re-create, mailbox and DB-user password hashes (originals keep working), domains.create skip_auto, wildcard event subscriptions (integrations uses '*'), firewall ip_proto (VRRP 112), 20 more result schemas 16bafeae
• New Integrations Per-caller OpenAPI 3.1, signed webhooks, integration tokens, SSO links, WHMCS/Blesta/HostBill, rate limits, idempotent replay, batch 65f5a7ee
• New Importers CPanel, Plesk, DirectAdmin, Hestia, FastPanel importers — hardened archive layer (traversal/links/devices/bombs/XXE refused, fuzzed), neutral model, pre-flight report, dry run + commit through the owning modules' actions, full rollback 0ff46905
• New Jobs Jobs and live progress everywhere (ADR 0016, owner requirement #22, w9-05) 0ddd1c9f
• New Versions One signed version catalog — newest stable by default (w9-03, owner requirement #21) 9ee9850e
• New Cluster Account moves finish end to end (accounts.set_node + web/ssl/dns/databases/mail followers, retry on failure, drain completes), pooled sites rendered on every backend, certificates mirrored to LB nodes and re-copied on renewal, cluster firewall needs applied through security's auto-rollback 0cef634d
• New Design system Editor screen (Open VS Code, folder, extensions with policy verdicts, packs; admin install/settings/policy/instances) and Apps screen (30 presets + detect, deploy history/logs/rollback, runtime/commands, masked env, Git deploy key/webhook, workers/cron, Open in VS Code); module CSS compiled once by the shell; keyboard-friendly comboboxes; make web builds module UIs fbd58da8

• New Core AI wiring — /ai/v1 gateway proxy, core.action.list, nested idempotency keys, shared ext schema (pgvector), docs shipped for the assistant; deterministic-preview rule 254b11b4
• Fixed Audit Secrets masked by value inside free text; feat(licence): per-action editions 4294f12d
• New Cdn Own edge network (per-zone nginx edges, pull + storage zones, purge by url/prefix/tag/all, signed URLs with rotation, hotlink, stale-on-error), GeoDNS steering with health failover, Cloudflare/Bunny integrations, customer API + snippets in 8 languages, stats and usage 39ce567b
• New Ai Ops assistant (permission-filtered action tools, plans from the host's dry-run with approval bound to the plan hash, step-up for high risk, re-preview before each step, verify + undo), injection quarantine + redaction + full audit, providers (Anthropic with caching, every OpenAI-compatible, local), RAG (heading-aware chunks, hybrid search, abstention, per-model indexes), customer OpenAI-compatible gateway with metering + knowledge bases 3ed6423f
• New Consistency Changes made outside the panel are discovered and adoptable (Linux users, cron lines, MariaDB/MySQL/PostgreSQL databases + users, hand-written nginx/php/postfix files, mail dirs); reset per service and per server with dry-run plans, snapshots + one-click undo, config history restore and automatic rollback on failed health checks; database config drift; hand-written web files survive generation swaps db77b1f2
• New Webui Serve Store-installed module UIs (installed wins, like the plugin host); backlog: w8-04 follow-ups 3cba59cf
• New Store,licence Signed modules (Ed25519 k-of-n envelopes, TUF-style roles/channels, tar.zst packages), lifecycle (install/upgrade with auto-rollback, rollback, remove, sideload, channels, staged rollout), plugin-host verification, signed licences (2-of-3 fingerprint, active/grace/degraded, revoke), entitlement gate for paid add-ons + trials, RespireSoft-hosted store/licence server + release CLI 1cf175fc
• New Editor Browser gateway for VS Code — separate editor origin (port mode: own account; subdomain mode: per-account origins), one-time claim + grant cookie, panel-session revalidation, Origin rules, cookie/header stripping; bus tunnel (internal/tunnel) relayed by the root agent with SO_PEERCRED + unit-cgroup check; reserved core.* agent ops; node-scoped PTY/tunnel bus subjects (security fix); lab E2E 94527155
• Fixed Cli A control socket that can't be created no longer stops the panel from starting 0fbddb0b
• New Cli Respirecloudctl on the action registry (friendly verbs, --dry-run plans, table/json/yaml, completion), root-only local socket with SO_PEERCRED as local-root, via:cli audit + changes.cli events, live UI query sync with 'changed via CLI' toasts 06a6d5ae
• New Cluster Node roles/labels/cordon/drain, placement policies with simulate, HAProxy pools (health checks, sticky, TLS termination, graceful drain, rollback on failed reload), keepalived floating IPs, site sync, account migration up to the switch 880e109c

• New Core Dry runs pass through cross-module calls (callee previews), reads run normally inside a preview 7c4bcb5b
• New Dns,providers External-DNS delegation (records, ACME challenges), delete-first replace import, 22 libdns providers (26 native total), Hostinger/GoDaddy mock tests 7d1090ca
• New Providers Registrar/DNS-host connections with API keys (Cloudflare, Hostinger, GoDaddy, Porkbun + custom REST adapters with SSRF guard), import, external DNS push, NS switch, DS publish, expiry events 37029bf4

• New Pluginhost Built-in actions can be previewed (pluginhost.IsDryRun) when their manifest declares dry_run 1619618c
• New Mail,webmail Mail admin (deliverability ring + record-preview fixes, DMARC/MTA-STS, DKIM rotation, mailboxes, aliases/catch-all, server self-test + queue) and the three-pane webmail client (live updates, search, labels, shortcuts, rules, out-of-office, identities, sandboxed HTML); Sieve keeps webmail rules + vacation on every sync 0eaf7c6a
• Fixed Merge Auto-resolved go.sum/pnpm-lock conflicts went on to roll the merge back; now they proceed to the gates d5084e64
• New Site Respirecloud.respiresoft.com — 47 pages, 15-step guided tour, docs generated from module manifests, changelog from git, Lighthouse 95–100; scripts/deploy-site.sh eb79d551
• Fixed Panel The account's 2FA page is "Sign-in security" in the nav (the Security module kept its name) 041be276
• Fixed Design system Disabled list items for both cmdk (data-disabled=true) and Radix menus (data-disabled="") 6319c434
• Fixed Design system Command/combobox options were unclickable — cmdk sets data-disabled="false" on enabled items 72d8baec
• Fixed Panel 2FA grace period — remind until the deadline, lock to Security only once enrol_enforced 2a44b8f9
• New Distros Ubuntu 22.04/24.04/26.04, Debian 12/13, AlmaLinux 9/10, Rocky 9/10 dae127bf
• New Databases Bring-your-own servers (MySQL/MariaDB/PostgreSQL/ClickHouse/Valkey), on-demand engines (MySQL 8.4, PGDG 14–18, ClickHouse, Qdrant, FerretDB), snippets, clean import, Adminer SSO fc004852
• Fixed General SPA routes with dots, Input icon padding, large audit values summarised; feat: public Git webhook route for apps a6f4b140
• New Apps,editor Runtimes via mise, 30 framework presets, Git deploy with atomic releases + webhook + rollback + auto-revert, workers/cron; code-server per account on a unix socket with Open VSX policy 6a09cc4e
• New Design system Accounts, domains, dns zone editor, web site workspace — inline editing, plan previews, health chips, batch DNS apply a5caa112
• Fixed Panel Step-up dialog uses POST /api/v1/auth/stepup (rotating cookie + CSRF); cache lazy module routes so suspended loads resolve 0af8b720
• New Design system Databases, file manager (uploads, CodeMirror editor, trash, SSH page) and browser terminal (xterm, splits, root frame, recordings) b30d7263
• New Platform Managed files with drift detection + adopt/reapply/reset/unmanage (web, mail, dns), slugs for accounts/domains/sites 659d7534
• New Core Module settings at runtime — core.module.list/settings.get/settings.set, schema-validated, secrets masked, Reconfigure RPC (no restart) 6d042ba8

• New Core Host.AgentTimeout (<=30 min) for long ops; panel HTTPS uses the ssl-deployed certificate when present (hot reload) b2fc8ac0
• New SSL ACME via lego — HTTP-01, wildcard DNS-01, node-generated keys, auto-SSL, ARI renewals, uploads, revoke, deploy to web/mail/panel 5f13f7ae

• New Containers Docker + Compose with a strict canonical validator, signed one-click catalog (10 apps), stacks in the account slice, upgrades with snapshot + auto-rollback feda3afc
• Fixed General Resolve conflict markers committed with the webmail merge; add guarded merge script 43695f05
• New Webmail IMAP/SMTP/ManageSieve gateway, threads, search, send with undo, rules, IDLE events, strict HTML sanitiser 32c4cba8
• Fixed Installer Write the HTTPS listener settings into respirecloudd.env 777ad833
• Fixed Agent Rename security's diff/health helpers that clashed with web's after merge ba3d3d6d
• New Security Nftables firewall with auto-rollback, CrowdSec, ClamAV/YARA quarantine, integrity, hardening, score 3f579804
• New Storage and backups Rclone connections, built-in S3 (SeaweedFS), restic backups + restores e14a4f95
• New Stats and logs Agent collectors, VictoriaMetrics/VictoriaLogs, per-account tenants, scoped PromQL/LogsQL, alerts, audit verify + tamper check 6a0b454d
• New Terminal Browser terminal gateway — cookie + Origin + single-use session-bound ticket, caps, revalidation, root step-up, audit 3ddaf3e5

• New Panel HTTPS listener (RC_TLS_LISTEN, internal-CA cert) + lab PUBLIC=<port> to open a lab panel by IP:port 7a8d3318
• New Panel The RespireCloud SPA — passkey/password/TOTP sign-in, setup, security page, nav from modules, generic action pages, Ctrl K, plan previews, step-up, module UI runtime; embedded in respirecloudd 3052b720
• New Sign-in One impersonation flow, initial passwords, suspension revokes access, session rotation on step-up/password change, 2FA required for admin+reseller 6f965017

• New Websites Nginx + PHP-FPM sites, layered configs with validate/swap/health/auto-rollback, HTTP-01 + cert install contract f0646725
• New Files and terminal File ops as the account user (openat2 BENEATH), SSH keys/modes, SFTP chroot, hardening, PTY sessions over the bus f1719a00
• Fixed Installer Wait for the API before enrolling the local agent (race once several modules load) b04d0d91
• New Mail Postfix + Dovecot + Rspamd — domains, mailboxes, aliases, forwarders, DKIM/ARC, DMARC, MTA-STS, queue d5cc98b7
• New DNS PowerDNS zones, records, templates, DNSSEC, import/export, history, reconcile, ACME hooks ff58a652
• New Core Manifest schedules (system-actor internal actions, advisory-locked), Host.Limit read, account deletion stops the account slice first 54b8280b
• New Databases MariaDB/MySQL, PostgreSQL, per-account Valkey — dbs, users, grants, remote, quotas, dump/restore 83bc6952
• Fixed Identity The bootstrap admin always holds the built-in admin role 9900801b
• New Test lab Multi-instance lab (LAB=<id>, <=3 concurrent, FAKENET=min|full, lab-ps, lab-gc) 5f52d54e

• New Design system RespireCloud glass design system @rc/ui + gallery 1d622ab6
• New Sign-in Passwords (Argon2id), passkeys, TOTP, recovery codes, sessions + CSRF, step-up, API tokens, login protection 98e533f1
• New Agent Driver registry (init-registered module drivers) and allow-listed system.apt.ensure 66192abb
• New Identity Roles, scoped grants, plans, impersonation, rbac.Service wired into startup a654f09d
• New Security Per-node NKey enrolment, internal CA + TLS 1.3 bus, per-node NATS permissions 49a4c25e
• New Domains Domains module — IDNA, dry-run plans, scoped grants, durable accounts.deleted subscription 44fc5c8e
• New Test lab Lab v2 — Valkey, cluster profile, fake internet (Pebble, CoreDNS, Mailpit, SeaweedFS) fd976ded
• New Agent Per-account slices (cgroup v2 limits), quotas, allow-listed service control c69e919a
• New Core Durable cross-module events (JetStream RC_EVENTS), manifest subscriptions, internal actions 21e4bf62
• New Module SDK Dry-run plans + inverse actions; docs(adr): 0013 platform decisions f02143d3
• New Module SDK Scoped grants (Actor.scoped, Call.Can), manifest resources, rbac.Resolver contract 442f2530
• New Test lab Docker lab v1, Makefile, systemd units, install skeleton 96022054
• New Accounts Reference module end to end; built-in core module; create rollback on refusal 0ddcb4d4

Planning and design work for this milestone.