Sync the self-hosting stack

2026-10-12 12:21:47 +02:00
parent bc5d305fd8
commit dfce1b252b
1 changed files with 49 additions and 0 deletions
@@ -9,6 +9,55 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 ## 2026-10-12 — One line answers who can do what, and where `api 0.138.0` `web 0.168.0`
 **Access needed two locks open at once, and only one of them was visible.** Giving somebody the
 terminal permission did nothing unless a grant reaching the machine also carried `terminal` — it was
 the documented behaviour, and it is the shape of "I gave them the right and it does not work". The
 two are now one. A shell, the remote screen, taking control of it, and revealing a credential are
 permissions like any other, and **a profile posed on a node** is the whole answer: who, which
 profile, posed where, what that confers there, and until when.
 - **A profile can be posed on an organization, a folder, a machine, a credential folder or a single
  credential**, for a person or for a team. The most specific line that says anything still decides;
  that part has not changed.
 - **Pages are offered on what you hold anywhere, objects answer on the descent.** Somebody whose only
  line is on one folder is offered the pages that line reaches, and sees that folder in them.
 - **Taking the mouse and keyboard is a named right.** It was the one capability of the product that
  could not be read in a role. Control without the screen is refused when the profile is written,
  rather than quietly corrected afterwards.
 - **"Visible but not revealable"** is now the view right without the reveal right at that node, in the
  vocabulary everything else uses, instead of a flag on a table of its own.
 - **The member list stops implying the profile is the whole answer**: a name carries "+2 exceptions",
  which open the access page.
 - **Three rights say how far they reach, where you hand them out.** A shell is administrative and is
  not bounded by the assistant's risk ceiling; the remote screen is the whole screen on every monitor
  the machine has, narrowable only by which machines; control is not watching.
 **What the assistant may do in your name is a separate question with its own name.** Connector
 domains, the risk ceiling, autonomy and the unbounded flag are the **assistant ceiling** — the same
 layering and the same places to write it, but no longer sharing a row with what a person may do, and
 the screens say which of the two they are about.
 **The Admin Center is an app with its own rail.** Inside it the sidebar lists its own pages instead of
 the RMM's, the top bar stops naming a customer where the scope is the whole instance, and the page
 title and the breadcrumb name the page you are on. On a phone the drawer follows.
 Update the API and the web image. No agent update is required. The API applies an **additive** schema
 update — profiles, authorizations, and a column on each membership — and then translates what you
 already have: each role becomes a profile, each grant and each credential row becomes an authorization
 or an assistant ceiling, and a profile it has to invent is named as a sentence, "Terminal only
 (migrated)", rather than as a combination. It is idempotent and reports what it moved.
 Two things are worth knowing about that translation. **A team holding both a machine grant and a
 credential grant organization-wide, with different expiry dates, cannot become one line**: the row
 written first stays, the other is named in the log with both dates and left for you to pose by hand,
 because choosing for you would either revoke an access somebody still has or extend one whose end
 somebody wrote on purpose. The count is reported at the end of the run. And **nothing is dropped
 here**: the old columns and the vault grant table are still present, no longer read and no longer
 written. A later release removes them in one go and will ask for `SCHEMA_ACCEPT_DATA_LOSS=true` for
 that one run — announced here when it comes.
 ## 2026-10-10 — Rights you can read, and an Admin Center that means one scope `api 0.137.0` `web 0.167.0`
 **Settings meant three different scopes at once** — your own account, the customer selected in the top