Standby

Changed

• Calls to Zephyr are signed with a stronger scheme. Requests Standby makes to a paired Zephyr now carry a timestamp and a signature covering the method, the path and query, and the body, so a captured request can't be replayed or altered in transit. This requires Zephyr v1.371.0 or later.

Fixed

• The Zephyr roster is fetched again. Standby was asking for the directory at an address Zephyr doesn't answer on, so the roster never arrived. It now pulls as intended.

Added

• Public page views can report to Zephyr's analytics. Sign-in, invite and status pages now send page views to the paired Zephyr's first-party analytics, so visits to the pages your customers and colleagues actually land on are counted alongside the rest of your Zephyr traffic. What gets reported is yours to set on the Zephyr card under Integrations: public pages only, all pages, or off.

Added

• DNS nodes stand on their own. Minting a nameserver used to require an Enhance cluster, even though everything downstream already read the fleet without caring which cluster a node belonged to — creation was the last thing still gated. A node can now be minted with no cluster at all, and what it follows is stated explicitly: its primary kind, its cluster where it has one, its image and its PowerDNS version.
• Attach a DNS node to kstack in one call. Attaching adds kstack's nameservers to the box as autoprimaries and pushes the box's address back to kstack, in a single step.

Changed

• Minted DNS nodes run PowerDNS 5.1. They install a pinned 5.1 from the upstream PowerDNS repository rather than the 4.9 that Debian 13 and Ubuntu 26.04 ship. PowerDNS 5 renamed every administrative command, so scripts dispatched to the fleet send both spellings and work against nodes on either version.

Fixed

• The link checker no longer fails the release gate on working links. A link to a static file was being reported as a broken route, which took down the gate over two perfectly good links added in v0.9.554.

Changed

• Standby now has a tab identity of its own. Until a workspace stored its own branding, the on-call console had no favicon at all — a blank tab on a fresh install, on the login page, and on the white page a stale build leaves behind. The Standby mark now ships as the default and adapts to light and dark system themes. Where custom branding is configured it still takes over, so white-label deployments look exactly as they did.
• Status pages keep their status-coloured dot. The favicon there reflects overall state and is often the only outage read available on a narrow pinned tab, so it is unchanged.

Fixed

• Push notifications no longer arrive with missing artwork. The notification icon and badge had been referenced but never shipped, so every push fetched two dead files.
• The desktop client ships with the real Standby icon. Its bundled icon had been a blue "S" placeholder.

Added

• kstack gets its own desk at /kstack/, separate from the Enhance-branded hosting group. A peer running kstack no longer reads its own estate through a page named after somebody else’s panel.
• Pushed compliance verdicts appear on that desk, covering the ground the pull cannot reach.

Fixed

• A count the key may not read now shows as unknown, not zero. If a pairing token lacks the scope for a figure, the desk says so. Rendering it as 0 is worse than rendering nothing — it reads as a fact.
• The incidents list says which machine, not only how many. The host was already known; the list simply never carried it, so every triage began with a detail fetch.
• The status-page link is one a customer can actually open. It is used verbatim as the peer supplies it, and omitted entirely when absent, rather than constructed from parts and hoped over.
• An empty maintenance-window list cannot reach the date arithmetic. It was computing a range from nothing and failing on the result.

Added

• Availability for a hosting peer. A peer can ask what its uptime was, and — importantly — a peer that does not support the question gets a clear unsupported rather than a number invented to fill the field.
• A hosting peer’s own measurements arrive as facts, not as incidents. A peer’s outside probes and compliance verdicts are recorded as sources. Feeding them into the alert ingest would have opened an incident for a site that is perfectly fine.
• Bulk per-monitor uptime, so a peer can be told the whole picture in one call instead of one per monitor.

Security

• Signature pinning now checks against the peer’s own vector, not only against ours. Verifying a signature against a key you generated proves only that you can still do arithmetic.

Changed

• The installation guide has been rewritten around the current edge and licence-key flow, which it had never documented, and the obsolete push-token and MySQL sections are gone.
• Installation is now checked on Debian 13 in addition to Ubuntu 26.04 and Alpine 3.24.

Fixed

• The release gate can no longer report green without a database. The boot check had two ways to pass while the application could not actually start, so a first-boot crash shipped in the previous release. Both now fail. Running without a database is possible only by setting CHECK_BOOT_ALLOW_NO_DB=1 yourself; the release gate never sets it.
• MySQL-era defaults removed from the on-call app. The same wrong defaults had been fixed in status in June and never reached on-call. Worth stating because that is the shape of most surviving bugs in a two-app product.

Security

• Dependency updates: Next.js (two unauthenticated remote-code-execution advisories, both requiring a running Next server — production serves a static export), nodemailer (a denial of service plus two domain-validation bypasses that could deliver mail to an attacker-controlled domain), sharp and js-yaml. Lockfile only, so upgrading brings no configuration change.
• One low-severity advisory in the WebAuthn server library is deliberately not taken: its fix is a major version that would stop every registered security key working.

Changed

• Supported distributions are now Ubuntu 26.04, Debian 13 and Alpine 3.20 or later, and the installer refuses anything else. The dropped targets ship a Redis at or below end of life and below the version BullMQ recommends; every supported target carries Redis 8. Set ALLOW_UNSUPPORTED_DISTRO=1 to install anyway.

Fixed

• A first boot could fail outright. Two start-up paths and two service units could each try to create the agent-channel signing keypair at the same time, and the one that lost the race aborted the boot. Present since v0.5.9, and masked on most installs because the service simply restarted. Whichever path gets there second now adopts the stored keypair.
• An agent channel can no longer be left holding a mismatched key. The same race had a quieter mode in which a caller could end up with a public key that did not match the stored private one. Closed by the same fix.

Changed

• Vendor positioning is gone from the product text. The integrations catalogue blurb, the Integrations header and the kstack panel no longer compare Standby to other vendors or name them as rivals; they describe what the thing in front of you does.
• Vendor names you need are untouched. Delivery channels, webhook setup and migration importers still name the services they connect to, because that is the name you are looking for when you configure them.

Added

• Rotate a cluster's DNS transfer key (TSIG) on demand. The cluster DNS card now carries a "Request/Rotate transfer key (TSIG)" action, behind a confirmation step so it cannot be triggered by accident. Each rotation is recorded in the audit log as dns_tsig_minted.
• Routine DNS pushes never mint a new key. A new transfer key is issued only when you ask for one, so ordinary record updates leave your existing key in place.

Fixed

• The TSIG key is stored when it arrives. A paired peer reveals the zone-transfer key exactly once, at the mint. It was being discarded, so signed transfers could never be enabled without re-pairing.

Security

• That response is no longer handed to the browser. The payload carrying the key was reaching the client. It is consumed server-side now.

Added

• A peer can now ask what it is. GET /api/v1/partner/whoami returns the calling peer's live scopes and its path fence, so an integration no longer has to infer its own permissions from which calls fail. Partner contract v11.

Fixed

• Every peer call was refused. The lookup from token to pairing was reading an empty identifier, so authenticated partner requests came back 403 across the board. They now resolve as intended.
• Re-issue audit entries named the wrong scopes. When a token was re-issued, the audit record captured the scopes belonging to the other kind of peer. The record now reflects the scopes actually granted, so past entries can be read at face value.

Added

• A hosting.security scope for hosting peers. Grant it and a paired peer can run a report-only antivirus scan, read the scans it has run and the detections they turned up, and tag a detection so the tag comes back on the next read. The scan is fenced to the path allow-list already set on that pairing — nothing outside it is ever looked at, and nothing is quarantined, moved or deleted.

Fixed

• The pairing list now tells you what kind of peer each entry is. The peer kind was never read back, so every pairing looked alike in the list.

Added

• The log collector reports its status on OpenRC hosts. Asking a host running OpenRC whether its collector is up now returns a real answer, the same as on every other init system.

Changed

• Log data is labelled with the host's agent name. The host label came from the kernel hostname, which on some hosts was unset and arrived as : — leaving those hosts indistinguishable in search and dashboards. The label is now the name the host is registered under.
• The log collector starts itself on Windows hosts. New Windows installs set the collector to start automatically with the machine, and existing Windows hosts are corrected on their next reconcile, so a reboot no longer leaves them silently not shipping.

Fixed

• Missing scan results are no longer recorded as failed scans. An unreadable or absent results file is the absence of a result, not a compliance failure. Scheduled scans that produced no artefact were being filed as failures, adding thousands of junk rows on a single host in one pass. Such debris is now discarded at the agent and rejected at the server.
• Scans that evaluated no rules no longer count as 0%. These uploaded as completed scans scoring 0.00%, dragging the fleet average down and moving hosts into Failing — and the fleet summary feeds the public trust page, so it published a worse compliance posture than the fleet actually has. Zero-rule evaluations are now marked as such, with a reason and no score. A genuine 0% backed by rule results still counts: the check tests the evidence, not the number.
• Existing bad data is corrected on upgrade. Rows with no results artefact are removed, and zero-rule evaluations are marked rather than deleted — an evaluation did run, and the fix for a compliance surface is never to make an inconvenient row disappear.
• Scan uploads and the fleet summary are working again. Real scans upload, and the fleet summary shows live data instead of a stale snapshot. Worth deploying promptly.

Changed

• Every agent task that runs detached is now held to the same rule: it either reports its results back or states plainly that it does not. Windows Update checks now declare that they report nothing, instead of being silent by accident.
• Update your agents to pick this up, then run a scan to start the evidence trail.
• The Windows executable ships unsigned, as before.

Fixed

• Compliance scan results now reach the server. OpenSCAP scans ran on the host and their results stayed there: nothing ever uploaded them, so the compliance evidence trail was empty for the whole period scans were running. The agent now collects each scan and ships it, and only clears it from the host once the server has confirmed receipt. Scans that cannot be shipped are set aside rather than discarded, so no evidence is lost while the upload retries.
• The scan directories were owned by the wrong user. The agent runs unprivileged and could not read its own scan output. Ownership is corrected as part of this upgrade rather than at the next hourly run, so the first scan after updating an agent is collectable.
• The compliance score you see is the score OpenSCAP produced. It is reported exactly as the scanner computed it, so it always agrees with the HTML report from the same scan.

Fixed

• A scan acknowledgement no longer promises a result that will never arrive. Starting an OpenSCAP evaluation used to reply that the outcome could be polled for shortly, on a channel that does not answer. The acknowledgement now says plainly that no result was collected, so a host with no evidence looks like a host with no evidence.
• "No score" and "never scanned" are not the same host. The compliance tiles counted a host whose last scan failed as one that had never been scanned, while the table beside them printed the failure and how long ago it happened for that same host. Hosts are now split into Scored and No score, with failing hosts counted in their own right.
• A release is now blocked when an agent acknowledges a task by promising something it cannot do. A check fails the release if an acknowledgement points you at a capability that is not there to answer. The previous gap is exactly how the acknowledgement above survived.

Changed

• Three OpenSCAP buttons are gone, because the work they did now happens on its own. "Repair agent permissions" re-applied nothing when pressed; the hourly update already re-applies the agent's unit, grant and wrappers to every host, converged or not. "Check PAM profiles" and "Repair PAM profiles" are replaced by a scheduled sweep.
• PAM collisions are now found on a schedule rather than when someone thinks to look. The read-only check runs on its own. A repair is sent only to a host whose own report asked for one, never fleet-wide, and is bounded at 8 hosts per sweep and 3 attempts per host per day. Where the collision is ambiguous, nothing is applied — there is no packaged profile to fall back on and a repair could not fix it — and the case is logged for a person to read.
• The PAM verdict sits on the coverage rows as a per-host state. Previously it appeared only as a transient pill while an operator watched a command they had just fired; now it is visible without clicking anything. Healthy hosts show nothing.
• "Rollback last fleet-wide" stays. It undoes a remediation an operator chose to run, which is a decision, not a workaround.

Fixed

• OpenSCAP had recorded no successful scan since 07/08/26. Scans now complete and report.
• Agent staging directory. Corrected. Supersedes v0.9.538.

Fixed

• Compliance scans were being killed before they could finish. Between 7 August and 9 September no OpenSCAP scan completed successfully: the background sweeper that clears up abandoned work treated every healthy in-flight scan as an orphan and stopped it, typically five to six minutes in. Scans now run deliberately at low priority and can take anywhere from under a minute to around twenty, so the sweeper's patience is now derived from the agent's own 75-minute scan timeout rather than an old five-minute figure, and is kept in step with it automatically.
• Hosts that had never been scanned were counted as scoring 0%. The summary tiles on the same page treated a missing score as a zero, so a fleet average was real scores diluted with a zero for every unscanned host, and a "never scanned 0" tile sat beside a table correctly printing never. Unscanned hosts are now excluded from the figures.
• Newly enrolled hosts could not use staged capabilities until their first self-update. The agent's staging directory was only created by an update, which could be up to 45 minutes away, so vector install, backup install, containment, host operations, Coraza, credentials, HA and IP control all failed with a permissions error on a fresh host. The installer now creates it, so these work from enrolment.

Changed

• Vector 0.58.0 is now the shipped collector. Packages for Debian, RPM, Windows and musl-based systems are all available, so every host in the fleet can move to the new version. None of the breaking changes in 0.58.0 affect the pipeline Standby renders, so existing configurations carry over untouched — there is nothing to rewrite before upgrading.
• Rolling it out is a single dispatch. The upgrade goes to the fleet from Hosts in one action, rather than host by host.

Fixed

• The retention-drift check now actually checks. It was reading the configured retention with credentials that are deliberately scoped to your log and rollup data only, so every read was refused and the verdict was permanently "unknown". A stated 90-day retention sitting over data that was really being kept for 365 days could not be reported. The check now reads that setting with the same credentials it already uses to change retention, and reports drift as intended.
• Missing credentials and refused reads are reported separately. A check that cannot run because nothing is configured needs a different fix from one that is being turned away, and the verdict now says which you have.

Added

• You can now check that your watchdogs actually ran. Until now the only uptime Standby could show you was the API's, while in production the schedulers run separately — so a check that had never run looked exactly like a check that had run and found nothing wrong. Workers now record a heartbeat on every tick, including failing ones, and a new admin endpoint, GET /api/admin/workers/health, reports what they are doing.
• Split-brain detection. If two units are running schedulers at once, Standby tells you.

Changed

• Staleness is judged against each worker's own schedule. A worker that ticks every minute and one that ticks every hour are held to different standards, with a floor beneath both. A worker that has never run is treated as the worst case rather than quietly skipped.
• The staleness check runs in the API process. A check living among the workers cannot report that the workers are dead.

Fixed

• Log-store checks now say when they cannot measure. They previously returned silently, which reads from the outside like a clean result.