From dfce1b252b3fe978a5beb1a699c12778b56edfb6 Mon Sep 17 00:00:00 2001 From: Luxit Date: Mon, 12 Oct 2026 12:21:47 +0200 Subject: [PATCH] Sync the self-hosting stack --- CHANGELOG.md | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 588c070..bd3fe41 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,55 @@ one of them changed. An entry says which artefact and which version, so `web 0.1 Every version published to a channel appears here. Nothing is written from memory afterwards: a build cannot be published without its entry. +## 2026-10-12 — One line answers who can do what, and where `api 0.138.0` `web 0.168.0` + +**Access needed two locks open at once, and only one of them was visible.** Giving somebody the +terminal permission did nothing unless a grant reaching the machine also carried `terminal` — it was +the documented behaviour, and it is the shape of "I gave them the right and it does not work". The +two are now one. A shell, the remote screen, taking control of it, and revealing a credential are +permissions like any other, and **a profile posed on a node** is the whole answer: who, which +profile, posed where, what that confers there, and until when. + +- **A profile can be posed on an organization, a folder, a machine, a credential folder or a single + credential**, for a person or for a team. The most specific line that says anything still decides; + that part has not changed. +- **Pages are offered on what you hold anywhere, objects answer on the descent.** Somebody whose only + line is on one folder is offered the pages that line reaches, and sees that folder in them. +- **Taking the mouse and keyboard is a named right.** It was the one capability of the product that + could not be read in a role. Control without the screen is refused when the profile is written, + rather than quietly corrected afterwards. +- **"Visible but not revealable"** is now the view right without the reveal right at that node, in the + vocabulary everything else uses, instead of a flag on a table of its own. +- **The member list stops implying the profile is the whole answer**: a name carries "+2 exceptions", + which open the access page. +- **Three rights say how far they reach, where you hand them out.** A shell is administrative and is + not bounded by the assistant's risk ceiling; the remote screen is the whole screen on every monitor + the machine has, narrowable only by which machines; control is not watching. + +**What the assistant may do in your name is a separate question with its own name.** Connector +domains, the risk ceiling, autonomy and the unbounded flag are the **assistant ceiling** — the same +layering and the same places to write it, but no longer sharing a row with what a person may do, and +the screens say which of the two they are about. + +**The Admin Center is an app with its own rail.** Inside it the sidebar lists its own pages instead of +the RMM's, the top bar stops naming a customer where the scope is the whole instance, and the page +title and the breadcrumb name the page you are on. On a phone the drawer follows. + +Update the API and the web image. No agent update is required. The API applies an **additive** schema +update — profiles, authorizations, and a column on each membership — and then translates what you +already have: each role becomes a profile, each grant and each credential row becomes an authorization +or an assistant ceiling, and a profile it has to invent is named as a sentence, "Terminal only +(migrated)", rather than as a combination. It is idempotent and reports what it moved. + +Two things are worth knowing about that translation. **A team holding both a machine grant and a +credential grant organization-wide, with different expiry dates, cannot become one line**: the row +written first stays, the other is named in the log with both dates and left for you to pose by hand, +because choosing for you would either revoke an access somebody still has or extend one whose end +somebody wrote on purpose. The count is reported at the end of the run. And **nothing is dropped +here**: the old columns and the vault grant table are still present, no longer read and no longer +written. A later release removes them in one go and will ask for `SCHEMA_ACCEPT_DATA_LOSS=true` for +that one run — announced here when it comes. + ## 2026-10-10 — Rights you can read, and an Admin Center that means one scope `api 0.137.0` `web 0.167.0` **Settings meant three different scopes at once** — your own account, the customer selected in the top