RespireCloud changelog

Milestone 11: Milestone 11

2026-10-11T12:00:00Z

New (Site): A provider-style home page (hero, real screenshots, three steps, migration, comparison, FAQ), Cloud, Kubernetes, Load balancers and Providers pages marked 1.1 until they ship, pricing from one data file, and respirecloud.com as the main address
New (Test lab): Real-server showcase seeder and starter projects (static, PHP+MariaDB, PHP+PostgreSQL, WordPress, Node, Python, Docker app, cron, worker, mail, backups) with a live start page; the lab's test mail is well formed
Fixed (Ai): Tool data that describes the assistant's data fence (any nonce) or its note is defanged before wrapping, so the panel's own docs no longer stop a question as fence forgery (w11-149, found on the real test server)
Fixed (Design system): The mouse wheel over a table scrolls the page once the table is at its end; CLI changes show one toast per burst that counts up instead of one per change
Fixed (Release): The customer-docs guard checks the allowed set instead of names (the security module's guide blocked every release build)
Fixed (Security): Releases ship only customer docs to the assistant's corpus (module guides, install, updates, feature specs) — never the internal security notes, which every installation carried and indexed; a build with security or findings paths fails; an updated installation forgets removed documents (w11-145, found on the real test server)
Fixed (Ai,mail): Tool results carry facts only (the hub's injection check rightly refused "Tell the user ..." inside a tool message); the hub's guardrail verdict is kept on safety events (codes only); DNS blocklist error answers (Spamhaus 127.255.255.25x) are no longer reported as listings
New (Panel): Projects — one plain-language page for a hosting customer's work: starters, Messages (webmail inbox and compose, mailboxes, aliases, deliverability), domains and data, and Keep it stable (releases, workers, cron, stats, logs, TLS, backups, mail delivery, protection, updates); shown by permission
Fixed (General): After the real-server re-test — every module, web package and the phone app at 1.0.0 (first stable version); RespireSoft AI works with the real hub (no consent push, per-locale model names, pinned aliases); booleans no longer redacted; Postfix restarts instead of a racy reload and listens on IPv6 where the server has it; Go back survives an automatic rollback; installer fixes (bus on 127.0.0.1, purge drops module roles, 10-minute start wait); the demo redeploy ends on a signed release (w11-138, w11-139, w11-140)
New (General): Wave 11 finish — seamless updates (ADR 0019), licence-bound distribution (ADR 0020), the guide (ADR 0021), PIN and trusted browsers (ADR 0022), AI with the licence (ADR 0023), scoped denies enforced, the panel on 443, the phone app download and QR, the Store's add-ons, the product site rewrite and the batch fix after the final lab run (w11-116 to w11-137)
New (General): Wave 11 finished — the last build cards, one test phase, one batch fix, one re-test (the owner's rule of 2026-10-16)
Fixed (Pluginhost,web,ui): W11-100 — a change that has started finishes when the person who asked goes away (web/103: closing the browser during a site creation cancelled the module's database writes and answered 500 while the agent finished the work unrecorded, leaving the site 'provisioning'); a mutating call keeps its caller's deadline but not its cancellation, a read still stops with its caller (both tested); creating a site runs as a job with named steps (lab: through the screen and the CLI on a loaded node, no 500, the site active); the 'you will be asked for your password' notice shows as soon as a restore dialog opens, in the backups and the containers kits.
New (Cdn,agent,catalog): W11-98 — CDN image optimisation with imgproxy (pinned by digest, run on each edge through the panel's own container runtime, read-only, all capabilities dropped, signed URLs only, reachable only from the edge's nginx): w, h, fit, q and fmt (webp, avif, jpeg, png, auto from Accept), automatic WebP, originals untouched, invalid parameters 400, size / pixel / time caps 413 / 422 as administrator settings, resized images cached (a second request is a HIT) and purged with their original; large uncached files cached in 1 MB slices (a 200 MB object: the origin saw one request for the slice); the edge firewall for zone names over 36 characters through a short stable id. Each lab-proven with the real imgproxy.
Fixed (Store,webmail,web,panel): W11-96 — batch fix 9, each lab-proven: installing a Store add-on no longer deadlocks the Store (store/010: the name resolver read the catalogue inside an install step while the install held the manager's lock; it now reads once when the job starts; a test that waited forever now passes; lab: an add-on installed and upgraded with named steps while the Store kept answering); the webmail calendar fits at 1440 px (webmail/101: the date picker was wider than its sidebar); internal settings never reach a site's Config tab (web/102); a direct visit to an add-on the licence does not cover says so, with the Store and the licence one click away; the database screens walked with real MariaDB and PostgreSQL (databases/005–010, no change needed).
New (Auth,backups,dns,agent,install,jobs,panel,ui): W11-97 + w11-99, merged together after one check
Fixed (Backups,databases,containers,terminal,ai,importers,store,host,site): W11-94 + w11-95 + w11-93, merged together after one check
New (Web,wafd,cdn,agent): W11-92 — directory passwords and the firewall's last gaps: protect a path of a site with people and a realm (cPanel's Directory Privacy, AC-security-24): bcrypt hashes only, in files the web server reads and no other account can (lab: the other account and the site owner refused, www-data reads), an nginx auth_basic per path (a path and everything below it, longest wins), actions with dry runs and the Protection tab's card; lab: no or a wrong password 401, the right one 200 for static and PHP, the rest of the site open, protection kept through updates, reconcile, rollback, the firewall and the bot challenge; no clear password in the database, journal, logs or history. The uninspected requests during a firewall restart: one copy not bound yet and the other stopping let a request fall through to the backup; each copy is now listed twice (before 22 of 33,723 passed, after 0 of 32,628). The CDN edge's firewall runs as the same pair (stand-in proof: 11.5 % -> 0 of 16,388).
New (Editor,extensions,wasmext,cluster,dns,web,wafd,apps,install): W11-57 + w11-58 + w11-91 + w11-64, merged together after one check
New (Backups,containers,accounts,importers,host,databases,dns): W11-62 + w11-85 + w11-75, merged together after one check
Fixed (Pluginhost,natsbus,core,files): W11-90 — the panel stops answering after a long action (cluster/124, major): every module schedule held a pooled core database connection for its whole run while its own audit row waited for another, so on a loaded box overlapping scheduled runs took the whole pool and nothing recovered until a restart (lab evidence: 8 of 8 sessions idle on the schedule lock, a goroutine dump with 8 runs blocked in pgxpool.Acquire under writeAudit). Schedule locks now live on one dedicated session outside the pool; audit writers queue in the process instead of on pool connections; an agent op never outlives its caller's deadline and inherits the caller's time when it sets none (the lost write after op ok, and the fixed 60 s that cut installs mid-way); the files module's ssh key expiry no longer keeps rows open across host calls. Lab: a full web server install and a database engine install with 655 short reads alongside, median 2 ms, none failed; 219 scheduled runs ok.
Fixed (Web,core,software,webmail,logs,ssl,lab): W11-84 — batch fix 5, what filling a server like a real one exposed, each proven in the lab: protection settings work on sites with a certificate (web/100: Block set through the screen on an HTTPS site, attack-shaped requests refused with the block page and searchable on Logs; web/005 Allow through the screen); the Websites list reads each certificate's real state (web/101: six sites Valid, counter 6); a reseller sees the administrator's plans by their visibility (core/101, saved through the plan editor); PHP versions the distribution's sources cannot provide are not offered, with the reason (software/100, partly: a second version on a distribution that has one is not proven); webmail sessions listed and closed by their owner, gone browsers dropped, the limit says what to do (webmail/100); the Logs page says when the log store is not answering and offers Set up logs; the lab authority validates DNS-01 through the lab resolver so a wildcard certificate issues (ssl/100). Filed: core/102 (no page for past jobs or old notices).
New (Apps,software,editor,containers,install): W11-67 — the app builder without privileges: BuildKit in its rootless mode, no --privileged and no host user namespace, root in a build step an unprivileged uid of the node (lab, by hand on the node: uid_map 0->101000, a 1 GB step killed inside a 192 MB cap with the builder up), refused where the engine does not remap ids or the kernel forbids user namespaces (named), the installer's preflight warns; the privileged builder only behind the administrator's explicit risk switch, never a silent fallback; idle builders stop after 15 min and start on the next build; the server restart refuses against a live job and names it (tests); PHP Other directives shows a refused directive's reason next to the field; the editor's gallery tunnel refuses paths outside it, climbing paths and unserved methods at the gateway; the container runtime install gets its 20 min instead of the agent call's default 60 s. Not done -> w11-91: the deploy through the panel, the screens in a browser.
Fixed (Cluster,cdn,dns,accounts,web,mail,ui): W11-87 — batch fix 6, several servers: the Cluster page no longer goes blank on an unusual record (pool answers never null, every tab guarded, the same guard in the CDN and DNS pages; cluster/120); Move to another server on an account, a site and a mailbox (servers that can take it and why the others cannot, the plan, a fresh sign-in check, a job with named steps; lab: an account and a site moved with a probe running, nothing lost; cluster/122) and the Moves tab's states; placement rules out a server without the web server and says why, account creation refused when no server can take it (cluster/123, lab-proven); Enable an edge picks a server (cdn/120); the confirm button's label (cluster/121); a secondary that does not answer says so (dns/120). Not done: the mailbox move with a mail client connected, the CDN walk. Found: cluster/124 (the panel stops answering after a long action; card w11-90). The panel's browser test harness closes its server's connections and has 60 s to shut down.
New (Cdn,geoip,agent): W11-89 — CDN rules at the edge: country allow / deny per zone from the country database, expanded to address blocks on the edge (lab: allowed and refused by country; with no database the controls say why); a rate limit per client address with a burst, answered 429 with Retry-After (lab); the web firewall at the edge through a second instance of the same firewall service, blocked requests on the zone's Security tab (lab: XSS and SQL injection refused, a normal request still a cache HIT, byte ranges through it); Brotli and gzip with a size minimum, zstd only where the distribution ships it and the Caching tab says so per edge; ranges on a 200 MB object. Image optimisation evaluated, not built (owner decision: imgproxy or a libvips service).
Fixed (Ai,egress,api,agent,site): W11-88 — batch fix 7, the security review's AI findings: the local model runtime fenced to the panel's own user (ai/162, lab-proven); local means the address really dialled, not the kind chosen (ai/160); a stream the client leaves is still metered (ai/161, lab-proven: 50 cut streams, counters exact); consent checked on every provider path with sent-log rows for the gateway, embeddings and knowledge answers (ai/168); every read carries a consent category, deny by default (ai/163); the redactor as a table of named patterns with hosting's real secret shapes (ai/165); a Team member sees only their own sent rows (ai/164); forwarded addresses believed only from the panel's proxy (ai/169); untrusted marks survive into the next turn and labels are fenced (ai/166, ai/167); tool errors and previews fenced, approve and undo re-check the deny rules and kill switch, the gateway forwards only known fields. docs/security/ai.md and three sentences of the AI page follow.
Fixed (Auth,apps,web,files,mail,software): W11-83 — batch fix 4, the security review's findings: "this was not me" inside the panel needs the person's own browser session, never an API token (auth/140); a container build's Dockerfile is held inside the release, links included (apps/140); each account's web log folder is closed to other accounts and corrected at agent start (lab-proven from another customer's shell); folder share links refuse dot files by name unless the link includes hidden files (files/140); the mail antivirus socket is 660 with the spam filter in its group (mail/150); the php.ini deny-list completed and the decision written down (software/140); an OIDC test sign-on needs the provider's owner and never signs anyone in (auth/141). Not changed: archive extraction as root (GNU tar's defaults hold; needs a cluster lab). Lab-proven: the web logs only
New (Databases): W11-61 — the database tool (Adminer 6.1.1, pinned by checksum and verified before every start), built and OFF by default: one process per account as the account's own user in its slice with no network, reachable only through a root-owned socket and the editor's isolated origin and single-use ticket, an ephemeral database login with the chosen user's rights only; isolation of the running tool proven in a lab (user, slice, namespace, socket, refusals); a real sign-in against MariaDB and PostgreSQL NOT proven (the lab had no engine), so the setting stays off until w11-85
Fixed (Auth,ssl,sizing,install,lab): W11-77 — batch fix 3: the single sign-on provider's Remove shows a plan and removes (it relied on a browser confirm box); a provider on a private address can be allowed by an administrator — one host and port, through the egress guard, never link-local or cloud-metadata addresses —, a provider whose test failed is not offered on the sign-in page, plain http refused, the server's own pages get the panel's look; the installer always sets a default certificate authority for customer certificates and labs pass their own, and screens that depend on a certificate show its real state instead of On; the recommended sizing profile takes what is in use into account and a profile that would stop webmail or the spam filter names who is affected and asks again; small texts. Not attempted: webmail/060; a sign-in through the provider to the end is covered by tests only
New (Lab,site): W11-71 — a showcase install: lab/tools/showcase-seed.sh fills a lab like a small hosting business through public actions only (services, a reseller with its brand and five customers, six sites with content and certificates, eleven mailboxes with real threads, a calendar and contacts, backups with a restore, traffic, the assistant on the lab's stand-in model with a plan waiting, a Store with an update), idempotent (second run 33 s, nothing changed); site/scripts/panel-shots.mjs photographs it (92 files). Bugs found by seeding: web/100 (protection settings rejected on any site with a certificate), web/101, core/101, software/100, webmail/100, ssl/100. Left out: one PHP version only, no wildcard certificate, the webmail, assistant-conversation, detail, Store and Logs photographs
Fixed (Core,auth,accounts): W11-73 — "Sign in as this customer" acts as the account's own person, resolved on the server (the dialog sent the account's creator: a reseller's client opened as the reseller); password reset counts every request against its client and accepts the email field (a body naming the address "email" arrived empty and was never counted, refused or answered with mail); one audit verdict for the page and the CLI (intact / gaps / broken), an open incident shown with its missing ids; the tampering alert email proven in a lab and the notice says when it could not be emailed; a terminate plan that says what is kept; no "Write to ." without a support address; store job steps name the add-on. Sign-in throttling did not share the reset fault
New (Site): W11-76 — the product site, finishing: every "coming" line checked against STATUS (the security page, DNS, mail, apps, CDN, the API and reseller guides), five feature areas of their own (single sign-on, white label, sizing, whole-server recovery, the mobile app), the home page lays out below-the-fold sections lazily (mobile blocking time 420 / 200 / 630 ms before, 200 / 50 / 0 ms after, three runs each on a busy machine), application screenshots in the structured data, the admin, reseller and user guides follow today's navigation
New (Dns,security): W11-66 — a zone transfer needs the key AND a listed address: transfers move to their own port answered by a second name-server process that checks the key, opened by the firewall module only to the secondaries' addresses (lab: the right key from an unlisted address times out, the listed one transfers, port 53 refuses both); a secondary's address moves in one action; this server as a secondary of an outside primary proven (a wrong key shows refused, not an empty zone; edits refused with the reason); promote a secondary with a plan, the old primary fenced until it follows (lab: primary stopped, promoted, edited, old primary came back as a secondary). Also fixed: the firewall rules for file transfer were never opened by their event. Not built: the screens for all of this; unit tests for promote and set_address
New (Site): W11-74 — the product site's second half: moved addresses answer 301 (/features/assistant/ to /ai/), the download page and install guide follow the real installer (Simple and Advanced, footprints, nine distributions, unattended, upgrade, uninstall; tables read from docs/install.md), pricing checked against the licence code, comparison pages for cPanel and Plesk with every outside fact read on the vendor's own page on 12 October 2026 and cited, a tour of twelve steps on today's panel. Left: areas of their own, application screenshots in the structured data, the home page's blocking time, the guides
Fixed (Design system): W11-65 — phone widths: a 390 px check that sees inner panes (every route and tab of every role: 26 views with something past the screen edge before, 0 of 393 after), fixed in the shared pieces (grid items shrink with their track, card headers keep their buttons on screen, tables stop cutting cells and titles on phones, declared sideways scrollers); security/013 the Protection page, ssl/011, web/009, ui/008, mail/016 and mail/015 (every CLI group lists its commands). Not fixed: a refusal inside the mail job (mail/015 step 4), tight pills on Protection at 390 px
New (Site): W11-70 — the product site true to today and findable: one page registry behind every head (titles, descriptions, canonical, the full Open Graph and Twitter sets), one linked JSON-LD graph per page, a sitemap with dates and images, an Atom feed, a manifest, llms.txt, a social card per page and a check that fails the build; AI as a headline (/ai/: 24 built-in jobs, plan and approve, your own model key, several providers with a model per job and a fallback order, a model on your own server with its limit stated) and as the home page's second section; every feature area moved from coming to built with its limits, new areas for apps, CDN, several servers, migrations and integrations; new panel screenshots. Left: comparison pages, the installer and download pages, the tour
New (Cdn): W11-55 — the CDN's screens for what w11-26 built: a certificate state per custom host name (waiting for DNS, being ordered, active with its renewal date, failed with the reason) with Order again, private / public bucket origins, delete now or mark stale, purge when a site deploys (lab-proven: HIT, change, purge, MISS), edge logs under the customer's own account without query strings; two w11-26 faults the lab exposed fixed (deploy events arrived empty, a certificate never counted as covering its host names). Not built: rules at the edge, image optimisation; app-deploy purge unit-tested only
Fixed (Licence): W11-72 — no false "licence check overdue": the check-in loop follows the licence's own refresh window (a quarter of it early, every minute once overdue) instead of retrying only every quarter of the 24 h period; a licence that asks for a refresh after an hour was in grace five hours out of six while its service answered (seen on the demo)
New (Mail): W11-60 — app-password sign-ins carry the real client address (believed only from the panel's own proxy; forgery refused in a lab), so bans hit the offender, and last use is recorded for contacts and calendar; sender reputation (reverse name, blocklists) in the mail set-up check with a score per domain. Not done: parts 3-6 of the card, browser walks, a RHEL-family node
New (Sign-in): W11-63 — SAML single sign-on: signed responses validated against the pinned provider certificate (subject and attributes read only from the verified element), redirect request and POST response, metadata import and download, certificate rollover, a Test sign-on, the SAML form on the single sign-on screen; 24 attack replays refused in a lab (the replay of a valid response by unit test only). Not built: encrypted assertions, signed requests, single logout
New (Software,apps,editor,extensions): W11-30 + w11-56 — free-form php.ini directives with an administrator-only list, a server restart with a plan, the OS package list cached, workspace trust as an editor policy, dry runs for panel extensions; app image builds run inside the account's own limits (proven in a lab: slice, memory cap with a plain out-of-memory message, CPU throttling, a cache per account); the editor reaches the policy-enforcing extension gallery through its own origin (search proven in the real editor; install from the view and a denial by id not re-proven)
New (DNS): W11-59 — secondary name servers: a transfer key per pair kept in the vault, a change reaches the secondary within seconds, a transfer without the key or with a wrong one is refused, per-zone state (in step / behind / down with the lag) that recovers when a secondary returns, a Secondaries tab and a Name servers page
Fixed (Test lab): A pinned lab upgraded in place stays offline for the country database unless GEO_OFFLINE=0
New (Security): W11-50 — the per-site firewall proven on AlmaLinux 10 with its events in the Logs page under the site's account, an offline country database for sign-in alerts (new country and impossible travel now fire; licence and status on a Licences page), an off-server copy of every audit checkpoint by syslog or signed webhook with a screen to compare a copy against the log
New (General): W11-49 — import archives uploaded in the wizard (resumable, checksum shown, removed afterwards, hostile archives refused), plans say who may be given them and which modules they include with the host refusing what a plan leaves out, WHMCS / Blesta / HostBill modules as checksummed downloads with an end-to-end connector test, the recovery scripts placed on the server by the installer
New (Mail): W11-48 — a guard in front of the contacts-and-calendar service (repeat rules that never end or cost minutes are refused in milliseconds, body and rate limits, its own resource slice), the service on the standard HTTPS port with a real certificate and nothing else exposed, app passwords for phones that the webmail's own sign-in refuses; a renewed certificate for a panel host name is now actually served
New (Cdn): W11-26 — certificates for custom hostnames issued at the edge and renewed on every edge, soft purge with stale-while-revalidate, purge on deploy, private bucket origins signed by the edge, customer API examples run for real; ssl renewals started by a person now reach the other servers
New (Backups): W11-46 — whole-server recovery run for real: a server with sites, MariaDB and PostgreSQL data, a mailbox, DNS, a certificate, people and vault secrets was backed up, destroyed and rebuilt on a blank node from the backup and the recovery bundle in 312 s, every item verified identical; eleven faults in the scripts and document fixed (the customer PostgreSQL restore would have dropped the panel's own database, module schemas got the wrong owner, services were not installed, file owners by name, the relay login file, S3 credentials in the bundle, a hung first backup); what does not come back is listed; wrong passphrase, missing bundle, newer backup and a node with accounts are refused plainly; the PostgreSQL backup / console / maintenance paths proven; a restore compares row counts per table and cleans up; the backup screens walked
New (Webmail): W11-36 — a calendar that syncs with a phone: month / week / day / agenda, time zones per event, repeating events with this / following / all edits, reminders as one bell notice, CalDAV proven both ways, invitations end to end (accept sends the standard reply, updates and cancellations apply only from the organiser), .ics import and export; hostile invitations and repeat bombs are bounded (expander limits, nothing fetched, text only); 32 isolation attempts refused; the mail gateway now holds one session per mailbox per panel session (three tabs: 2 connections, was 6) with a budget and parked idle connections
New (Importers): W11-28 — live transfer from another server: connect over SSH (credentials in the vault, the host key pinned and confirmed, outbound only through the egress guard), discover its accounts, a plan per account, a first copy while the source stays live, a final incremental pass and a per-domain DNS checklist; everything from the source is treated as hostile (escaping links, device files and setuid bits dropped, a dump loaded as the account's own database user); a changed host key stops the transfer; nothing on the source is changed. Lab-proven from a plain Linux server; cPanel / Plesk / DirectAdmin discovery against fixtures only
New (Sizing,core,dns): W11-29 — sizing is applied, not only recorded: web, database, cache and mail tune actions take the profile's numbers through each module's managed files with validation, a health check and rollback, keep values an administrator pinned, and are applied from the Sizing screen with a before / after plan (a 1 GB and a 4 GB lab node now run different nginx, MariaDB and PHP settings); an account's memory and CPU slice follow its plan and creating one warns when the plan oversells; modules can be switched on and off at runtime through the normal load and verification path (dependents refuse, data stays, no supervisor restart); panel hosts can front an allow-listed local service; a per-zone DNS record limit; replace-mode import order. Not built: DNS secondaries with TSIG
New (Containers,terminal,storage): W11-47 — a recorded shell inside a container of your own stack (a fixed unprivileged docker exec built by the agent, a grant per stack, never another account's container or a server shell) and bounded live logs with search (escape sequences neutralised); the terminal survives a reload or a dropped connection for five minutes (only the same panel session can re-attach, signing out ends it at once), per-person snippets (inserted, never run) and settings; buckets list folders, access plans say in plain words what becomes public (private / one folder / everything, no raw JSON), lifecycle rules with a preview; stack names beginning app- are reserved. Adminer is not built
New (Mail): W11-45 — deliverability: a mailbox that suddenly sends a flood is held (queued, never bounced; owner and administrator told once; release or discard with a plan; a bursts-allowed switch) with per-hour and per-day limits enforced; DMARC aggregate reports received, parsed as hostile input (size and expansion caps, no entities, nothing fetched, stored only for hosted domains) and shown per domain with plain findings and DNS fixes to approve; reverse-name and blocklist checks through the egress guard (public addresses only, cached, switchable) with a daily notice. Lab-proven: a 70-message flood held within a minute, 12 held messages delivered intact after release, a decompression bomb and a foreign report refused
New (Ai): W11-44 — local models: an administrator enables a model runtime on the server (a container on loopback only, its own network, no capabilities, limits from the sizing profile; enable / start / stop / remove as jobs), pulls models from an allow-list with the size confirmed first and a fit check against memory and disk, and uses them as a provider that needs no consent; air-gapped mode is enforced in the egress layer (a request to a remote provider fails before any connection opens); a Local models screen. Isolation proven from another container and from a customer's own stack. Proven with a stub standing in for the runtime's API — the first run on real hardware has a checklist in modules/ai/docs.md
New (Sign-in): W11-25 — single sign-on with OIDC (authorisation code + PKCE; discovery, keys and token endpoint through the egress guard; state and nonce bound to the browser and single-use; full ID-token validation with an algorithm allow-list; a person is found by provider + subject, never by email; just-in-time creation only by policy with a mapping whose default is no access; an administrator role never from a claim without an explicit switch; the panel's own second factor still applies unless the provider's is trusted by policy; administrators always keep a local way in), login-anomaly alerts (new device, failure burst, country / travel through a hook) with a this-was-not-me action that ends every session, a cookie-only session read so the SPA keeps the CSRF token in memory; 14 attack tests against a lab identity provider. SAML is not built
New (Backups,databases): W11-27 — scheduled dumps per database and restore to a new database by default (plan, named steps, table count checked), one-mailbox backup and restore into a Restored folder through the mail stack's own tools, a query console (read-only by default, 500 rows / 15 s, never a superuser, a write needs a switch and a plan and is audited) and maintenance actions, Backups / Query / Maintenance tabs; whole-server recovery scripts and docs/disaster-recovery.md WRITTEN but never run (the vault key stays out of the repository, in a passphrase-protected recovery bundle); the Sharing page no longer asks for a folder that may not exist. Lab-proven through the CLI on MariaDB; screens not yet walked
Fixed (Ui,store): W11-43 — a Store rollback shows a plan first (which version returns, that data written since is lost) and runs as a titled high-risk job (store/005); a job keeps its own title when saved and the dialog lists every step; the Home search finds every example its placeholder shows (cron, php.ini, mx …) with a test; breadcrumbs on every page; a Team member's role reads Team member; Templates opens without an account; Versions says Not installed; module states on Store and Versions; the webmail reflows when the assistant narrows the page, a reply draft renders as a card, the mailbox's own refusal is shown; the lab helper keeps its session after a step-up; the 390 px dark smoke for five people
Fixed (Files,web,ssl,databases): W11-41 — findings of walk w11-38: FTP users can overwrite a file (files/003); the FTP ban is by address only, never by user name or successful logins (files/004); one Allow on a blocked request covers every rule it matched, never the score rule (web/005); the account's security score reads the websites' protection (security/012); an Install button with a plan and named steps on the Engines tab, and messages that know who reads them (databases/003); a certificate order that issues nothing ends failed with the authority's reason (ssl/010); nine minor and cosmetic fixes (File transfer switches, real example folders, SSH not installed said up front, plain plans, a page for a refused visitor)
Fixed (Core): W11-42 — the audit anchor no longer forgets: the root agent accepts a checkpoint only when it extends the previous one (it recomputes every hash link from the last checkpoint and requires the row count to grow by exactly those rows), a failed checkpoint opens an integrity incident that persists across restarts and later checkpoints until an administrator acknowledges it with step-up and a reason (the acknowledgement becomes part of the chain), verification lists every missing id, one bell notice and an email at once, a standing banner on the Audit page, the watch runs every minute (core/014: a deletion was forgotten after one minute); the Team picker pages through every list (core/015); a Sign in as this customer action for staff (core/012); plain invitation and reset messages; empty per-account folders removed on termination; the CLI lists a group's commands, suggests the closest command and parses false
New (Mail): W11-23 — the Mail server screen shows and edits what was command-line only (relay with a test, spam filter and antivirus, the default DKIM selector, the contacts and calendar service switch, module states), each change with its plan; app passwords for a mailbox (generated by the server, shown once, stored hashed, labelled, individually revocable — revoking ends open sessions; accepted by IMAP and submission on Dovecot 2.4, lab-proven; 2.3 rendered and unit-tested)
Fixed (Ai,web,logs): W11-34 — the assistant and the AI services walked end to end in a lab, with eight fixes: site-health notices were refused silently (the notice schema lacked the level field), a site with a certificate from the ssl module reported none (an expired one is now named), a down site is no longer counted as running, the server-data refresh was refused every five minutes, AI services fit a phone, site logs are rotated; site logs proven per customer with secrets masked and a per-site filter; every assistant entry point passes against seeded failures (21 entries), incl. deploy, file, terminal and webmail summary / draft; customer AI services proven (key limits answer 429, PDF / DOCX uploads, vector collections, isolation); a PostgreSQL slow-statement reader; GPU detection and the model fit list for local models (the runtime itself is not built)

And 25 more on the changelog page.

Milestone 9: Milestone 9

2026-10-10T12:00:00Z

New (Site): Serve the product site on a port (pm2 respirecloud-site, 127.0.0.1:7900) — the owner's FastPanel site is a reverse proxy; status
Fixed (General): W10-fix-20 — a stack-scoped Team member sees their stack (shared Visible helper), bell notices have a level (info/warning/failed), wrap and read in full, Team rows name resources and the invite dialog offers every kind, disabled New buttons give the reason, one state when certificates cannot load, AI plans mark only untrusted text
Fixed (Gate): A failed merge gate drops the squash (nothing stays staged); flaky token test fixed
Fixed (Cluster): W10-fix-18 — Linux user ids are allocated once, cluster-wide (cluster/013); a panel restart never breaks a move: steps are kept, the live node decides, unsure moves pause and can be continued or cancelled (011); database users move with their authentication strings and grants, MariaDB/MySQL and PostgreSQL, and PostgreSQL moves work (012)
Fixed (General): W10-fix-17 — mail held during a suspension is released on unsuspend, the public suspension page shows only the visitor message, suspend shows its plan and unsuspend asks first, the first cron job starts the cron service, web.sites.* accept slugs, scoped Team members see their buckets and get reasons on disabled buttons, plain scoped-grant refusals; accounts docs restored
Fixed (General): W10-fix-16 — pooling a site prepares the other node (the account's Linux user with the same ids, removed when its last site leaves) (cluster/010); creating things in a suspended account is refused, a suspension part that never answers is detected and retried, brand changes refresh the suspension page; the move's switch grace follows the DNS TTL and purge_source drops the old database copies
Fixed (Cluster): W10-fix-14a — DNS of an account points at the node it lives on, placement policies decide where a new account lands, moves use the installed database client names (MariaDB 13), the control node cannot be drained and roles in use cannot be dropped, a failed move leaves replicas and other moves alone, move back works, followers run in order (no 404s at the switch), constellation redraw
New (Accounts): Suspension really suspends (accounts/013) — sites serve a branded 503 with the reason and message, mailbox sign-in and submission refused, cron and the account's units held, terminal/editor/SSH (keys too) ended and refused; unsuspend restores everything incl. sites that were disabled before; itemised result, retries, plan
Fixed (SSL): A Team member scoped to one certificate cannot upload, self-sign, request or order another one; status (fix-14b merged)
Fixed (General): W10-fix-14b — a Team member scoped to one resource cannot create siblings (cdn, web, databases, mail, dns, storage, containers, domains, apps: account-wide grant required), CDN edges reload on a certificate change with roll back, scoped CDN numbers, bandwidth warnings at 80/95% with an owner notice
Fixed (General): W10-fix-13 polish — branded-host gate on SSO and mobile sign-in, BYO database servers on the egress guard (pinned), accounts.set_node only for cluster, branding nameserver lookup, Team scopes ownership-checked at invite, owner notice when staff open a mailbox, suspend dialog warns when email cannot leave, logs/cdn states instead of errors, audit system filter, stack names wrap on phones
Fixed (General): W10-fix-12 — the panel's own email leaves through the local mail server (loopback relay trusted, valid default sender) and a failed send is shown to administrators (bell + audit), found-outside page for accounts with adopt, event redelivery backs off and parks, backups.job.create has a plan, plain import refusals, readable Live activity, Team remove/limit fixes; audit rows no longer dropped for a wrong outcome word
Fixed (Security): One egress guard for every outbound request (internal/egress: resolve, check, pin, re-check redirects) — AI providers at run time (finding 005), storage connections checked at every use with rclone unprivileged behind an nftables fence (009), CDN edge workers fenced against rebinding (008 residual), webhooks, providers and Git deploy URLs on the same check; audited admin allow-list for private targets
Fixed (Module SDK): A malformed id reaching a uuid column answers invalid_params, not internal (modules and built-ins); scripts/test-all.sh runs the suite like the gate; status + backlog
Fixed (General): W10-fix-11 — backup job/target ids that are not ids answer not_found instead of internal (backups/008), an alias's certificate is ordered when web announces the alias (ssl/007), scheduled discovery and drift scans verified in a lab (core/004)
New (General): Review part 4 — the editor origin can no longer run a panel passkey ceremony (finding 013, high), sign-out-everywhere / password change / admin revoke also revoke paired devices' refresh tokens (014, high), rotated sessions keep their device link so a device revoke ends them (015)
Fixed (General): W10-fix-10 — catch-all no longer swallows mail for existing mailboxes/aliases, Sieve split (mail owns vacation, webmail owns rules; legacy files migrated), plan dialog buttons inside the dialog, CrowdSec fallback leaves no dead apt source + apt repairs broken third-party sources, restore of latest skips safety snapshots, mail server page state when mail is not enabled, account pickers show names, stack names readable at 390px, plain SSL plan lines; agent retries openat2 on EAGAIN
New (General): Review part 3 — PostgreSQL role takeover across tenants closed (finding 010, critical: one name, one owner; group roles never altered as users), socket peer auth only for the postgres OS user (011, high), BYO database servers refuse private addresses (012)
Fixed (Core): Scheduled actions with strict schemas run again — the scheduler sends scheduled_at only where the schema takes it (discovery, config-drift and sizing scans never ran); bugs backups/008, ssl/007 filed
Fixed (Security): ADR 0018 hardening — system_calls authoritative for every nested system call incl. event/schedule handlers (finding 006, high), owner hints only where declared, audit rows bound to the call token and elevated refused on retained tokens (finding 007)
Fixed (Test lab): Pinned labs are never garbage-collected (a gc run removed the owner's demo); demo seed, in-place redeploy and smoke test in the repo; PUBLIC_EDITOR=0; bug mail/013
New (Core): Team — users invite and manage sub-users (scoped grants capped at the inviter's, expiry with immediate effect, per-user limit, single-use email invitation, /team screen) (core/003); fix: foreign account ids answer 404 across modules, sub-user Protection, admin-only mail server page for non-admins, backups picker names, sub-user dashboard wording (w10-fix-7b)
Fixed (Cdn): W10-fix-7a — edges install the njs package matching the installed nginx (no apt conflict on ubuntu 24.04/26.04), PowerDNS allows Lua record updates and GeoDNS restores the previous record on failure, port clash pre-check with the holder named and no restart loop, per-port edge probes, region note without GeoIP, custom-hostnames column
New (General): Review part 2 — DB import no longer runs customer dumps as root (finding 004, critical); CDN origin SSRF via hex/decimal IP spellings closed (finding 008, high; QA cdn/001); findings 005/006/007/009 proposed
Fixed (Security): ADR 0018 module call identity (finding 001, high) — the host decides who a nested module call runs as (per-invocation call tokens), system calls only for actions a module declares in system_calls, caller stamped + audited, mail.sso.prepare only for webmail; retained calls for the AI turn, elevated calls for billing integrations
Fixed (Security): Ownership checks — branded panel hosts must belong to the brand owner's tenant (finding 003); certificates refused for names another account holds, wildcards refused over other tenants' names (finding 002, SSL side)
Fixed (General): W10-fix-4 — local-root hidden, one icon per nav entry, domains badge at 390px, suspension email carries reason + message, plain not-installed messages (SSH/web/databases/mail/dns as states), Store Installed filter offline, empty app ids refused, job dialog without log lines, SSL plan warns before retiring a wildcard
New (General): Review part 1 (auth, privilege separation, tenant isolation) — 3 high findings; domains refuse a parent of another account's domain (finding 002)
Fixed (General): W10-fix-3a — mail aliases/forwards listed + editable, host name change re-issues the cert and republishes DNS (with a UI), Dovecot 2.4 quota root, webmail trusts the panel's own mail cert (pin) with plain TLS errors, audited step-up SSO into mailboxes for staff; lab: mta.lab.test, Mailpit on :25, lab-dns-pdns.sh
New (SSL): Certificate screens (list, detail, get/upload/CSR/self-signed sheets, settings + CAs), wildcard certificates via DNS-01 with ownership rule, ssl settings schema; fix(software): PHP/Runtimes pages make no admin-only calls for resellers and users (w10-fix-3b)
Fixed (General): W10-fix-3c — firewall UI changes apply (stored view normalised), schema errors as sentences in one place, Stacks table at 390px, reseller Protection picks an account, hardening/malware/CrowdSec wording, plain restic errors, backup run history
Fixed (General): W10-fix-2a — admin can create admin, breached/username passwords refused (embedded list), public panel address instead of loopback (RC_PUBLIC_URL), passkey on IP hosts, lockout duration, readable refusals, param aliases, unknown asset owner, OpenAPI without CSRF, webhook errors, audit names + hide system ticks, a11y labels, no 401s on sign-in
Fixed (General): W10-fix-2b — importer prerequisites listed up front + failed commit keeps the dry run, wizard at 390px, rollback preview, required modules cannot be removed + remove preview, calm offline Store, capacity planner counts hosting accounts only, PHP default never a missing version, config pages show not-installed
Fixed (Agent): Apply /home 0711 when the agent starts, so existing servers get it too
Fixed (General): W10-fix-1a — DNS zone hijack closed (ownership over every account, public suffixes, no domains under another account), failed account create rolls back, reseller plan assign, suspend reason/message/schedule, readable refusals, DNS not-installed message, zones for earlier domains, nav/overview/phone layout
Fixed (General): W10-fix-1b — apps deploy list 500, human errors (apps/web/databases), /home not listable (0711), step-up refusal says how to enrol, editor wording + chat off, sizing preview, DataTable keeps open row
New (Shell): Assistant on every page (Ctrl/Cmd+J, Ctrl K ask), compact licence notice (grace/degraded), route/nav collision guard, shell initial load 246 -> 191 KB gz with a build-time budget check
Fixed (Test lab): Pebble validates on 80/443 and unknown lab names resolve to cp1 (IPv4 only) — HTTP-01 orders work in every lab
New (Hostnames): Panel + mail hostnames with SSL end to end (owner requirement #16, w9-23)
New (Design system): Importers wizard (source, pre-flight report, mapping, dry run, commit, rollback, past imports), Plans and sizing (plan editor with apply modes + exceed preview, presets, delete-with-migrate, export/import, capacity planner + what-if, overselling, server profile + re-tune), Integrations (webhooks with deliveries/dead-letter/replay, billing connectors, sign-in links, API, settings)
New (Mobile): Capacitor app + server side (system-browser PKCE sign-in with passkeys/TOTP/SSO, rotating refresh tokens with reuse sign-out, device registry + revoke, min app version, Mobile app screen with QR, licence-authenticated push relay), APK with no source maps
New (Design system): Software (OS packages with plans + holds + fingerprint-confirmed repos + allow-list + update policy; PHP versions, per-scope extensions, PECL with live logs, php.ini forms, FPM/opcache status; runtimes + tools with requests and EOL report) and Panel extensions (signed install with per-capability approval, developer mode, rollback, uninstall)
New (Branding): White-label brands (contrast-checked accents, sanitised SVG uploads, 20 versions), per-host branding of sign-in + shell + documents, reseller isolation on branded hosts, passkeys with the branded host as RP ID, panel hostnames (DNS verify + ssl order), private nameservers, branded email templates and customer pages, no-leak crawler
New (Design system): AI assistant (page + Ctrl+J side panel, streamed answers with sources, plan cards with per-step diffs, approve/reject/undo, providers, policy, kill switch, services), Store (catalogue, plan-first install/update/rollback/remove as jobs, trials), Licence (state, activate, add-ons, grace/degraded banner), Versions (catalog, follow-latest/pin, upgrade findings)
Fixed (Install,lab): Ship UI-only built-in modules (core, store) — stage dirs with ui/dist, plugin host skips dirs without bin/; docs: cards w9-20/21/22, w9-10 follow-ups
New (Software): Runtimes + global tools wired into the software module — catalog lines with EOL, streamed mise installs, detection from version files, select with on-demand cap + admin requests, removal refused while used, pinned tools on cron PATH, usage/EOL report; runtime op types moved to sdk/agentop
New (Design system): Backups (targets, schedules, live runs, restore wizard with previews), Storage (buckets, keys, 12 connection kinds, built-in S3), Containers (Compose stacks, revisions, catalog, registries), CDN (zones, rules, purge, signed URLs, edges, external CDNs)
New (Design system): Configuration screens (drift diffs, keep/restore/reset, found outside the panel, undo, history, server reset wizard), Protection (score fixes, firewall with keep/roll-back countdown, CrowdSec, scans), Logs (live tail, audit chain verify), Cluster (constellation, drain, pools, VIP failover, moves), Stats, Providers
Fixed (Test lab): Labs install every module (RC_PROFILE=standard by default; SIZING=micro proves Micro on purpose)
New (Software): OS packages (allow-list, real apt/dnf plans, streamed apply + health watch, holds, signed third-party repos with fingerprint confirmation, queue) and PHP (versions with EOL, per-scope extensions, sandboxed PECL from an allow-list, validated php.ini, defaults per server/account/site)
Fixed (Agent): Heartbeat facts report cgroup-limited CPUs and memory (containers/slices), not the host's
New (Extensions,software): Sandboxed WASM panel extensions (wazero; per-capability host calls checked against the calling user, no fs/net/clock beyond grants, fuel/memory/time caps, auto-disable on violations, signed or dev self-signed only) + runtimes via mise in a shared read-only store with version detection and admin-pinned global tools
New (Apps): Dockerfile and Compose deploy modes (BuildKit secrets never in layers or logs, per-release images, auto-revert, rollback, strict compose validation incl. build contexts), signed app templates from the Store
Fixed (Merge): The test gate could never fail (go test | grep under pipefail inverted it); fix(apps): result schemas for the 10 actions that pushed the schema count past its baseline
Fixed (Installer): An upgrade is never a fresh install — Micro's module trim only applies to brand-new servers
New (Apps): Every field customizable (runtime/custom mise spec, commands, hooks, env scopes, limits, restart policy), templates (versioned, scoped, YAML export/import), respirecloud.yaml/Procfile overrides with preview, per-app nginx snippets through web's validated layers
New (Sizing): Install profiles from cgroup-aware hardware (Micro idles at 582 MB with web + PHP 8.5 + MariaDB), re-tune with per-value diff + dry-run plan, capacity planner + what-if + export, plan presets, overselling off/warn/allow, plan apply modes, delete-with-migrate, strict export/import, audited changes
New (Contracts): Accounts.cron.create + robust account delete/re-create, mailbox and DB-user password hashes (originals keep working), domains.create skip_auto, wildcard event subscriptions (integrations uses '*'), firewall ip_proto (VRRP 112), 20 more result schemas
New (Integrations): Per-caller OpenAPI 3.1, signed webhooks, integration tokens, SSO links, WHMCS/Blesta/HostBill, rate limits, idempotent replay, batch
New (Importers): CPanel, Plesk, DirectAdmin, Hestia, FastPanel importers — hardened archive layer (traversal/links/devices/bombs/XXE refused, fuzzed), neutral model, pre-flight report, dry run + commit through the owning modules' actions, full rollback

And 4 more on the changelog page.

Milestone 8: Milestone 8

2026-10-10T12:00:00Z

New (Core): AI wiring — /ai/v1 gateway proxy, core.action.list, nested idempotency keys, shared ext schema (pgvector), docs shipped for the assistant; deterministic-preview rule
Fixed (Audit): Secrets masked by value inside free text; feat(licence): per-action editions
New (Cdn): Own edge network (per-zone nginx edges, pull + storage zones, purge by url/prefix/tag/all, signed URLs with rotation, hotlink, stale-on-error), GeoDNS steering with health failover, Cloudflare/Bunny integrations, customer API + snippets in 8 languages, stats and usage
New (Ai): Ops assistant (permission-filtered action tools, plans from the host's dry-run with approval bound to the plan hash, step-up for high risk, re-preview before each step, verify + undo), injection quarantine + redaction + full audit, providers (Anthropic with caching, every OpenAI-compatible, local), RAG (heading-aware chunks, hybrid search, abstention, per-model indexes), customer OpenAI-compatible gateway with metering + knowledge bases
New (Consistency): Changes made outside the panel are discovered and adoptable (Linux users, cron lines, MariaDB/MySQL/PostgreSQL databases + users, hand-written nginx/php/postfix files, mail dirs); reset per service and per server with dry-run plans, snapshots + one-click undo, config history restore and automatic rollback on failed health checks; database config drift; hand-written web files survive generation swaps
New (Webui): Serve Store-installed module UIs (installed wins, like the plugin host); backlog: w8-04 follow-ups
New (Store,licence): Signed modules (Ed25519 k-of-n envelopes, TUF-style roles/channels, tar.zst packages), lifecycle (install/upgrade with auto-rollback, rollback, remove, sideload, channels, staged rollout), plugin-host verification, signed licences (2-of-3 fingerprint, active/grace/degraded, revoke), entitlement gate for paid add-ons + trials, RespireSoft-hosted store/licence server + release CLI
New (Editor): Browser gateway for VS Code — separate editor origin (port mode: own account; subdomain mode: per-account origins), one-time claim + grant cookie, panel-session revalidation, Origin rules, cookie/header stripping; bus tunnel (internal/tunnel) relayed by the root agent with SO_PEERCRED + unit-cgroup check; reserved core.* agent ops; node-scoped PTY/tunnel bus subjects (security fix); lab E2E
Fixed (Cli): A control socket that can't be created no longer stops the panel from starting
New (Cli): Respirecloudctl on the action registry (friendly verbs, --dry-run plans, table/json/yaml, completion), root-only local socket with SO_PEERCRED as local-root, via:cli audit + changes.cli events, live UI query sync with 'changed via CLI' toasts
New (Cluster): Node roles/labels/cordon/drain, placement policies with simulate, HAProxy pools (health checks, sticky, TLS termination, graceful drain, rollback on failed reload), keepalived floating IPs, site sync, account migration up to the switch

Milestone 7: Milestone 7

2026-10-09T12:00:00Z

New (Core): Dry runs pass through cross-module calls (callee previews), reads run normally inside a preview
New (Dns,providers): External-DNS delegation (records, ACME challenges), delete-first replace import, 22 libdns providers (26 native total), Hostinger/GoDaddy mock tests
New (Providers): Registrar/DNS-host connections with API keys (Cloudflare, Hostinger, GoDaddy, Porkbun + custom REST adapters with SSRF guard), import, external DNS push, NS switch, DS publish, expiry events

Milestone 6: Product site, distributions and module screens

2026-10-09T12:00:00Z

New (Pluginhost): Built-in actions can be previewed (pluginhost.IsDryRun) when their manifest declares dry_run
New (Mail,webmail): Mail admin (deliverability ring + record-preview fixes, DMARC/MTA-STS, DKIM rotation, mailboxes, aliases/catch-all, server self-test + queue) and the three-pane webmail client (live updates, search, labels, shortcuts, rules, out-of-office, identities, sandboxed HTML); Sieve keeps webmail rules + vacation on every sync
Fixed (Merge): Auto-resolved go.sum/pnpm-lock conflicts went on to roll the merge back; now they proceed to the gates
New (Site): Respirecloud.respiresoft.com — 47 pages, 15-step guided tour, docs generated from module manifests, changelog from git, Lighthouse 95–100; scripts/deploy-site.sh
Fixed (Panel): The account's 2FA page is "Sign-in security" in the nav (the Security module kept its name)
Fixed (Design system): Disabled list items for both cmdk (data-disabled=true) and Radix menus (data-disabled="")
Fixed (Design system): Command/combobox options were unclickable — cmdk sets data-disabled="false" on enabled items
Fixed (Panel): 2FA grace period — remind until the deadline, lock to Security only once enrol_enforced
New (Distros): Ubuntu 22.04/24.04/26.04, Debian 12/13, AlmaLinux 9/10, Rocky 9/10
New (Databases): Bring-your-own servers (MySQL/MariaDB/PostgreSQL/ClickHouse/Valkey), on-demand engines (MySQL 8.4, PGDG 14–18, ClickHouse, Qdrant, FerretDB), snippets, clean import, Adminer SSO
Fixed (General): SPA routes with dots, Input icon padding, large audit values summarised; feat: public Git webhook route for apps
New (Apps,editor): Runtimes via mise, 30 framework presets, Git deploy with atomic releases + webhook + rollback + auto-revert, workers/cron; code-server per account on a unix socket with Open VSX policy
New (Design system): Accounts, domains, dns zone editor, web site workspace — inline editing, plan previews, health chips, batch DNS apply
Fixed (Panel): Step-up dialog uses POST /api/v1/auth/stepup (rotating cookie + CSRF); cache lazy module routes so suspended loads resolve
New (Design system): Databases, file manager (uploads, CodeMirror editor, trash, SSH page) and browser terminal (xterm, splits, root frame, recordings)
New (Platform): Managed files with drift detection + adopt/reapply/reset/unmanage (web, mail, dns), slugs for accounts/domains/sites
New (Core): Module settings at runtime — core.module.list/settings.get/settings.set, schema-validated, secrets masked, Reconfigure RPC (no restart)

Milestone 5: Certificates

2026-10-09T12:00:00Z

New (Core): Host.AgentTimeout (<=30 min) for long ops; panel HTTPS uses the ssl-deployed certificate when present (hot reload)
New (SSL): ACME via lego — HTTP-01, wildcard DNS-01, node-generated keys, auto-SSL, ARI renewals, uploads, revoke, deploy to web/mail/panel

Milestone 4: Storage, containers, security and observability

2026-10-09T12:00:00Z

New (Containers): Docker + Compose with a strict canonical validator, signed one-click catalog (10 apps), stacks in the account slice, upgrades with snapshot + auto-rollback
Fixed (General): Resolve conflict markers committed with the webmail merge; add guarded merge script
New (Webmail): IMAP/SMTP/ManageSieve gateway, threads, search, send with undo, rules, IDLE events, strict HTML sanitiser
Fixed (Installer): Write the HTTPS listener settings into respirecloudd.env
Fixed (Agent): Rename security's diff/health helpers that clashed with web's after merge
New (Security): Nftables firewall with auto-rollback, CrowdSec, ClamAV/YARA quarantine, integrity, hardening, score
New (Storage and backups): Rclone connections, built-in S3 (SeaweedFS), restic backups + restores
New (Stats and logs): Agent collectors, VictoriaMetrics/VictoriaLogs, per-account tenants, scoped PromQL/LogsQL, alerts, audit verify + tamper check
New (Terminal): Browser terminal gateway — cookie + Origin + single-use session-bound ticket, caps, revalidation, root step-up, audit

Milestone 3: Panel and sign-in

2026-10-09T12:00:00Z

New (Panel): HTTPS listener (RC_TLS_LISTEN, internal-CA cert) + lab PUBLIC=<port> to open a lab panel by IP:port
New (Panel): The RespireCloud SPA — passkey/password/TOTP sign-in, setup, security page, nav from modules, generic action pages, Ctrl K, plan previews, step-up, module UI runtime; embedded in respirecloudd
New (Sign-in): One impersonation flow, initial passwords, suspension revokes access, session rotation on step-up/password change, 2FA required for admin+reseller

Milestone 2: Hosting services

2026-10-09T12:00:00Z

New (Websites): Nginx + PHP-FPM sites, layered configs with validate/swap/health/auto-rollback, HTTP-01 + cert install contract
New (Files and terminal): File ops as the account user (openat2 BENEATH), SSH keys/modes, SFTP chroot, hardening, PTY sessions over the bus
Fixed (Installer): Wait for the API before enrolling the local agent (race once several modules load)
New (Mail): Postfix + Dovecot + Rspamd — domains, mailboxes, aliases, forwarders, DKIM/ARC, DMARC, MTA-STS, queue
New (DNS): PowerDNS zones, records, templates, DNSSEC, import/export, history, reconcile, ACME hooks
New (Core): Manifest schedules (system-actor internal actions, advisory-locked), Host.Limit read, account deletion stops the account slice first
New (Databases): MariaDB/MySQL, PostgreSQL, per-account Valkey — dbs, users, grants, remote, quotas, dump/restore
Fixed (Identity): The bootstrap admin always holds the built-in admin role
New (Test lab): Multi-instance lab (LAB=<id>, <=3 concurrent, FAKENET=min|full, lab-ps, lab-gc)

Milestone 1: Core platform, identity and design system

2026-10-09T12:00:00Z

New (Design system): RespireCloud glass design system @rc/ui + gallery
New (Sign-in): Passwords (Argon2id), passkeys, TOTP, recovery codes, sessions + CSRF, step-up, API tokens, login protection
New (Agent): Driver registry (init-registered module drivers) and allow-listed system.apt.ensure
New (Identity): Roles, scoped grants, plans, impersonation, rbac.Service wired into startup
New (Security): Per-node NKey enrolment, internal CA + TLS 1.3 bus, per-node NATS permissions
New (Domains): Domains module — IDNA, dry-run plans, scoped grants, durable accounts.deleted subscription
New (Test lab): Lab v2 — Valkey, cluster profile, fake internet (Pebble, CoreDNS, Mailpit, SeaweedFS)
New (Agent): Per-account slices (cgroup v2 limits), quotas, allow-listed service control
New (Core): Durable cross-module events (JetStream RC_EVENTS), manifest subscriptions, internal actions
New (Module SDK): Dry-run plans + inverse actions; docs(adr): 0013 platform decisions
New (Module SDK): Scoped grants (Actor.scoped, Call.Can), manifest resources, rbac.Resolver contract
New (Test lab): Docker lab v1, Makefile, systemd units, install skeleton
New (Accounts): Reference module end to end; built-in core module; create rollback on refusal

Milestone 0: Foundation

2026-10-09T12:00:00Z

Planning and design work for this milestone.