Software

Standby

**865 features shipped** — including `Email + password login (argon2id) — `oncall/src/routes/auth.js``, `Account lockout (5 strikes / 15 min) — `oncall/src/routes/auth.js``, `TOTP 2FA — `oncall/src/lib/totp.js``.

latest v0.9.543

Read the docs

Features

Email + password login (argon2id) — `oncall/src/routes/auth.js`
Account lockout (5 strikes / 15 min) — `oncall/src/routes/auth.js`
TOTP 2FA — `oncall/src/lib/totp.js`
Email MFA codes — `mfa_email_codes` table
Magic-link login — `magic_link_tokens` table + `lib/emails.js`
WebAuthn / passkeys — `oncall/src/routes/webauthn.js`
OIDC SSO — `oncall/src/routes/oidc.js` + `oidc_providers`/`oidc_links`
SCIM 2.0 provisioning — `oncall/src/routes/scim.js`
Service accounts / API tokens — `oncall/src/routes/service-accounts.js`
RBAC roles + permissions — `lib/rbac.js`
Per-user IP allowlist — `lib/ip-allow.js`
User invitations — `user_invitations` table + `/invite` UI
User avatars — migration `user_avatar`
CSRF protection — `oncall/src/plugins/csrf.js`
Security headers (helmet-style CSP/HSTS/COOP/CORP) — `plugins/security-headers.js`
Audit log with hash chain — `lib/audit.js`
Encryption-at-rest helpers — `lib/crypto-at-rest.js`

Features

**Change management depth (v0.9.202)** — change calendar + conflict detection (vs maintenance windows + coverage gaps),
**Public-status monitoring soak + honest public state (v0.9.275/277)** — resolving an incident published "Resolved" inst
Service Desk / ITSM (tickets) — INTERNAL staff queue (status/priority/assign/comments); public submit removed — `routes/
Service Request Catalog (ITSM) — request types + form schema → opens a ticket — `routes/catalog.js` + `request_catalog`
Service Portfolio (ISO 20000 §8.2.1/8.2.2) — every service across its lifecycle (proposed→catalogue→retired), owner/crit
Supplier Management (ISO 20000 §8.2.3/8.3.4) — supplier register (auto-seeded from cloud/dns/ai providers), underpinning
Service Catalogue (ISO 20000 §8.2.4) — published, consumable slice of the portfolio with resolved SLAs/suppliers/request
Problem Management (ITIL) — root-cause records linking incidents/tickets → known-error/workaround/fix — `routes/problems
SLA policies — response/resolution targets per priority; breach flag on tickets — `routes/sla.js` + `sla_policies` migra
Internal Knowledge Base — engineer runbooks/how-tos; **rendered markdown** (GFM tables/code via `components/Markdown.jsx
**Getting-started onboarding (launch prep)** — dashboard getting-started checklist (`GET /api/setup/checklist` computes
**Admin-editable help tips (white-label)** — DB-backed per-page guidance callouts managed from **Settings → Help tips**
**Desktop multi-window** — Tauri client (`desktop/`, v0.3.10) `open_new_window` command opens a second window on the sam
**Sidebar rebalance (v0.9.101)** — the 23-page Security group split into **Security ops** (overview / auto-remediation /
**DCIM power & environmental telemetry (DCOM)** — live PDU power draw + temperature / humidity / smoke / fire / water /
**License feature packages (entitlement gating)** — the Zephyr-issued license's `features` array now actually gates capa
**Meetings system** — a dedicated Operate → Meetings hub: start ad-hoc meetings (subject + type), see all live + recent
**Content-width toggle** — a persisted top-bar toggle (next to the theme toggle) switches all pages between a comfortabl
**War-room visibility** — the incidents list flags incidents with an open video war room (badge + one-click "Join"); the
**White-label meet branding** — meet servers auto-brand with the platform logo + brand colour (Branding tab) + admin-upl
**Shared meet rooms — Zephyr integration (CROSS_PROJECT_CONTRACT §13 / Zephyr §J)** — `POST /api/admin/meet/rooms` mints
**CVE bulk-fix deduped** — `POST /api/cve-findings/bulk-fix` collapses N CVEs against the same (host, package) into ONE
**Mint a meet server (self-hosted Jitsi for the war-room)** — one-click provision of a Jitsi video server on an enrolled
**Starter operational content auto-seeds on boot** so a fresh install isn't empty — 7 runbooks + 3 runbook-routes + 6 in
Incidents CRUD + lifecycle — `routes/incidents.js`
Incident notes — `incident_notes` table
Incident tags — `routes/tags.js`
Per-incident counters — `incident_counters` table
Client-side silence — `incident_client_silence` migration
Postmortems — `routes/postmortems.js` + `services/postmortem.js`
Handoff page — `routes/handoff.js` + `/handoff` UI
Per-incident chat — `routes/chat.js` (`chat_channels`/`chat_messages`/`chat_memberships`)
Standby Comms (SSE, markdown, mentions, threads, reactions, attachments, DMs, presence, search, slash commands, webhooks
**Incident bulk actions (v0.9.232)** — row checkboxes + select-all + Ack / Resolve / Mark false-positive / Delete (super
**Incident recycle guard (v0.9.237)** — `createIncidentFromAlert()` was an unconditional INSERT, so a re-breach minted a
**"One investigation" report (v0.9.242)** — assembles what fired, what CHANGED (deployments), autopilot findings, RCA, a
**Change/deploy correlation (v0.9.238/243)** — `deployments` table + dual-authed ingest (signed HMAC webhook or token),
Response templates — `routes/response-templates.js`
Saved views — `routes/saved-views.js`
Incident Observability v2 (default) — per-incident scope endpoint, per-source lead panels (anomaly baseline band, backup
Cross-host incident storm rollup — one grouped incident per shared-cause event ("N hosts affected"), page-once, per-host

Features

Escalation chains — `routes/chains.js`
Escalation steps + worker — `workers/escalation.js`
Label-based chain routes — `routes/chain-routes.js`
Integration overrides — `routes/overrides.js`
Alert silences — `alert_silences` table
Severity chain routing — `services/severity-chain.js`
Pager intelligence UI — `/pager-intelligence`
**Heartbeats / inbound liveness monitors (v0.9.327)** — the inverse of a probe: notices when something STOPS reporting (
**Multi-target escalation steps + paging strategies (v0.9.327)** — a step could name exactly ONE target, so "wake the wh
**Repeat-until-answered (v0.9.327)** — a chain whose last step went unanswered simply ended, in silence. `escalation_cha

Features

Schedules CRUD — `routes/schedules.js`
Schedule members + shifts — `services/schedule.js`
Swap requests — `routes/swaps.js`
iCal export — `routes/ical.js` + `lib/ical.js`
Override coverage — `routes/overrides.js`
Compensation tracking — `services/compensation.js`
**Solo-operator coverage (v0.9.131–133)** — per-role staffing expectation (`coverage_roles.expected_coverage` none|24x7)
**Unified coverage system (v0.9.111)** — one `coverage` model + role-lane board for ALL DC-ops personnel (on-site NOC/sm

Features

Workflow automation (event→condition→action rules over the notify() stream; actions: webhook / create_ticket / notify) —
**External alerts actually page on-call (v0.9.423)** — `ingestExternalAlert` opened the incident, the chat channel, the
Alerts table + dispatch — `channels/dispatch.js`
Native alert rules engine — `routes/alert-rules.js` + `workers/native-alert-eval.js`
**Anomaly-mode alert rules (v0.9.171)** — per-rule `mode` threshold|anomaly: rolling robust-z of the recent window vs a
**Alert-rules console (v0.9.225)** — writable `labels` (the column existed since Wave D but no route ever accepted it, s
**First-class `host_cpu_busy_pct` metric (v0.9.232)** — synthetic percentage metric (100×(1−idle/total)) so a CPU rule r
**Alert-fatigue closed loop / `/alert-health` (v0.9.241)** — rules ranked worst-noise-first (pages 7d, ack + suppressed
Generic webhook integrations — `routes/integrations.js`
Push subscriptions (web push) — `push_subscriptions` table
Flood control — `services/flood.js`

Features

**⛔ A PAGER THAT COULD NOT PAGE, AND NEVER SAID SO (v0.9.484)** — INC-2026-0684 was a CRITICAL telemetry blackout on `up
**Repeat notifications actually collapse now (v0.9.365)** — `notify()`'s `group_key` deduplicated nothing: it only colla
**No worker registers a clock-derived jobId (v0.9.365)** — `jobId: boot-${Date.now()}` makes every restart a *new* job,
Email channel — `channels/email.js`
SMS channel — `channels/sms.js` (via MessageBird)
Voice channel — `channels/voice.js` (via MessageBird)
MessageBird/Bird.com client + webhooks — `channels/messagebird-client.js`
Admin SMTP config — `routes/admin-smtp.js`
HTML email templates — `lib/email-template.js` + `lib/emails.js`
Unified notification log — `routes/notification-log.js`
Per-user notification preferences — `routes/notification-prefs.js`
In-app notifications (bell + /notifications page) — `services/notifications.js` + `routes/notifications.js` + `component
Agent self-update notification — heartbeat detects an `agent_version` change (autonomous self-update / dispatched update

Features

Morning + ad-hoc digest — `services/digest.js` + queue `digest-mail`
Extras digest pipeline — `services/digests-extra.js`

Features

**25 white-label starter runbooks (v0.9.239)** — 8 existing slugs rewritten + 17 new, seeded edit-safely via the shared
**Runbook governance fields (v0.9.242)** — owner, status, last_reviewed_at, review_interval_days, service, severity, tag
Automated IT documentation — living PDFs auto-generated from live data (infrastructure register, 90-day change log, vend
Runbooks CRUD — `routes/runbooks.js`
Runbook versions — `runbook_versions` table
Runbook runs + step runs — `services/runbook-orchestrator.js`
Runbook routing rules — `services/runbook-routes.js`
Runbook automation hooks — `routes/runbook-automation.js`
Markdown / content-type support — `runbook_content_type` migration
Evidence pack generation — `services/evidence-pack.js`
Control-linked evidence — `routes/compliance-evidence.js` + `control_evidence`
Evidence live-link tokens — `evidence_live_link` migration

Features

**Reporting / BI egress (v0.9.202)** — `reporting` schema (9 stable views) + read-only Postgres role (`scripts/create-re
SLOs — `routes/slos.js` + `/slos` UI
System status / health page — `routes/admin-system-status.js` + `/system-status`. Install-type aware (VPS / Edge-managed
Admin queue inspection — `routes/admin-queues.js`

Features

**Compliance evidence must be operation, not design (v0.9.528)** — `monitoringConfigured()` counted enabled alert rules
**Privileged sessions scored from the recording that already existed (v0.9.529)** — the brokered terminal has written an
**A gate that never ran, hiding a break that had been real since May (v0.9.512)** — of 41 `check:*`/`verify:*` scripts,
**A blank Metrics tab reads as a quiet host, not a dark one (v0.9.512)** — the empty state was gated on `!data`, a FALSY
**An upstream error code is not an explanation (v0.9.512)** — the Logs tab rendered the whole failure as the word `click
**Billable-device metering — the number Zephyr bills from (v0.9.512)** — pricing is per-device and nothing could count.
**Allow rules were swept by NOTHING, so a whitelist target failed forever (v0.9.509)** — `retireSupersededTargets()` ret
**⛔ The IP-control retry loop and hard-failure sweep were block-only too (v0.9.519)** — the same `list_type = 'block'` f
**Engine stderr was deciding dedupe identity (v0.9.509)** — the raw `last_error` from a firewall engine was interpolated
**Agent failures were cut at 56 characters, losing the half that names the fix (v0.9.509)** — two of the four live IP-en
**agentd 0.121.0 — Windows has its own `sudo.exe`, and IP Control called it (v0.9.509)** — `handlers/ipcontrol.rs` ran `
**EU AI Act as the 16th framework — the regime we could not put a number against (v0.9.508)** — Standby measured AI gove
**Art. 4 AI literacy is the duty already live, so it is the one measured hardest (v0.9.508)** — in force since **2 Feb 2
**AI conversation retention shipped 90 days under a 180-day statutory floor (v0.9.508)** — EU AI Act Art. 26(6) requires
**Art. 73 is one report with three possible deadlines, not three reports (v0.9.508)** — the first regime in the reportin
**The model card the provider owes you had nowhere to live (v0.9.508)** — Art. 53(1)(b) and the GPAI Code of Practice pu
**A.5 scored zero on every fresh install, and seeding it would have been worse (v0.9.508)** — the impact register derive
**An ISO 42001 control scored `met` off a table that has never existed** — `aiPolicyCurrent` queried `policy_acknowledge
**The installer runs on Alpine — all nineteen phases, proved by running it (v0.9.504)** — `scripts/lib/platform.sh` dete
**⛔⛔ A runlevel guard whose verdict depended on ALPHABETICAL ORDER (v0.9.504)** — `svc_enable` verified membership with
**⛔ The OpenRC launcher would have started Node with no configuration (v0.9.504)** — the first translation of systemd's
**`oncall/src/lib/service-control.js` — and the vendor updater that SUCCEEDED, emptily (v0.9.504)** — eleven bare `syste
**`check:heredocs` — a comment that executed itself as root (v0.9.504)** — the nginx site body is written with an *unquo
**`check:install-e2e` — the installer, run to completion, then interrogated (v0.9.504)** — `check:install-matrix` grades
**⛔⛔ A fail2ban jail naming a filter that exists on NEITHER platform (v0.9.504)** — found on Alpine, where `nginx-noscri
**⛔ VAPID pre-generation ran BEFORE the migrations, so it failed on every fresh install (v0.9.504)** — "phase 7c" needed
**⛔⛔ The host Overview panel read the capability NAME as the answer and bypassed the platform matrix (v0.9.504)** — it s
**⛔⛔ `installedVersion()` answered differently depending on the working directory (v0.9.504)** — step 2 read `path.resol
**⛔⛔ The Vector upload form could never store the row Alpine asks for (v0.9.505)** — `musl` is a contract across THREE l
**⛔⛔ The Vector config template was Debian-shaped, so Alpine could never ship telemetry (agentd 0.118.0)** — with the mu
**⛔⛔ The tarball wrapper validated its staged config as TOML, so a musl host could NEVER install Vector (agentd 0.119.0)
**⛔⛔ The OpenRC self-update cron was written and never scheduled (agentd 0.119.0)** — `openrc.rs` writes `/etc/periodic/
**⛔⛔ `check:vector-config` was WEAKER than the check the host already runs (v0.9.506)** — it validated with `--no-enviro
**`check:install-matrix` — the reboot failure a running box cannot show you** — runs the real `platform.sh` inside a rea
**`check:crlf` — no committed script may carry a carriage return** — a CRLF shell script does **not run on Linux at all*
**Node 26 — targeted AND verified (v0.9.502)** — `.nvmrc` 26, installer default `NODE_MAJOR=26`, and CI runs a `[24, 26]
**Dependency modernisation — 8 advisories (6 high) → 0 (v0.9.502)** — fastify 5.12, knex 3.3, pg 8.23, react 19.2.8, und
**A succeeded package upgrade was rendering as a warning (v0.9.502)** — `UpgradeRow` had two `if/else` chains setting th
**`check:icons` — the failure a build cannot see (v0.9.502)** — a named import a package does not export is NOT a build
**RepoMade compliance connector — pairing + signed signal pull (built 23/08/26, unreleased)** — RepoMade had been comput
**A.8.20 firewall evidence names the engine the host actually runs (v0.9.444)** — a **true verdict with false evidence**
**Control crosswalk — one canonical check, many frameworks (v0.9.367)** — `canonicalId`/`crosswalkRows`/`expandFramework
**NIST SP 800-171 Rev 2 (v0.9.368–370)** — the eleventh framework. All **110** practices across 14 families, `nist800171
**NIST CSF 2.0 (v0.9.369)** — the twelfth framework. **106** subcategories across the 6 functions (GV/ID/PR/DE/RS/RC), 2
**NCSC Cyber Assessment Framework 4.0 (v0.9.370)** — the thirteenth framework. 4 objectives / 14 principles / **41** out
**CMMC 2.0 Level 2 (v0.9.370)** — the fourteenth framework. All **110** practices, `CMMC id → 800-171 practice` twins so
**Def Stan 05-138 Issue 4 — UK defence suppliers (v0.9.372)** — the fifteenth framework, the control set behind **DEFCON
**Framework scores disclose what they are a percentage OF (v0.9.370–371)** — `not_assessed` controls are excluded from t
**Audit-ready exports cover every framework automatically (v0.9.371)** — the SoA / signed evidence-pack card carried a *
**Attested controls have a re-attestation cadence (v0.9.371)** — 26 attested/questionnaire controls had no `re_attest_da
**Training question banks — sampled, shuffled, server-scored (v0.9.365)** — modules can hold a bank larger than the quiz
**ISO/IEC 42001 AI Management System (v0.9.328)** — the tenth framework. 49 control rows (11 Annex SL clauses + all 38 A
**AI governance register + derived AI system inventory (v0.9.328)** — ISO 42001 A.5. The inventory is DERIVED from `ai_u
**AI Use Policy + AIMS Scope Statement (v0.9.328)** — two seeded documents (policy library 35 → 37). The scope statement
**Vendor trust dossier (v0.9.202)** — `TRUST.md` + `docs/trust/*` (architecture, supply chain, agent security, tokens, d
Secrets vault — store/retrieve scoped secrets encrypted at rest, reveal-audited, access-counted — `routes/vault.js` + `v
Compliance controls + state machine — `routes/compliance.js`
SOC 2 framework — `compliance_framework_soc2` migration
PCI DSS framework — `compliance_framework_pci` migration
ISO 27001 / CE+ / NIS2 / DORA / GDPR seeded controls — `services/compliance-controls.js`
ISO/IEC 20000-1:2018 (service management) framework — SMS clauses wired to the ITSM surfaces (service catalogue, SLAs, i
Per-control overrides + rationale templates — `routes/compliance-overrides.js`
Compliance evidence exports — `routes/compliance-exports.js`
**Certification marks on the trust page (v0.9.475)** — the badge an auditor issues, shown publicly with issuer, scheme,
**Company document store (v0.9.475)** — legal, insurance, certificate, contract and policy documents, versioned (so "the
**Physical access control is measured (v0.9.476)** — the Physical family was 45 controls and ONE automated check (2%). `
**Asset classification — owner, criticality, environment, data class (v0.9.478)** — `fleetAssetInventory` backed **14 co
**Training is a course, not a five-question quiz (v0.9.481–483)** — `trainingCompliance` carries **41 controls across 13
**Training certificates are actually verifiable (v0.9.482)** — the PDF printed `sha256(email|module|date|v1)` under the
**Resumable training modules (v0.9.482)** — section position lived in React state alone, so a refresh returned a learner
Auditor evidence-pack handoff (CFE partnership) — `routes/auditor-pack.js` + migration `20260820100000_auditor_pack_toke
`auditor` RBAC role (external, read-only) — `lib/rbac.js`. Narrower than `observer`: audit/status/host/security-event re
Compliance check engine — `services/compliance-checks.js` + `workers/compliance-worker.js`
Compliance questionnaire — `compliance_questionnaire` migration
OpenSCAP host scans — `routes/oscap.js` + `workers/oscap-scheduler.js`
OSCAP AI explainer — `routes/oscap-ai.js`
OSCAP profile overrides + skip rules — migrations `oscap_profile_override`/`oscap_skip_rules`
OSCAP remediation auto re-scan (partial scan flag + full follow-up dispatch) — migration `20260521140000_oscap_remediati
OSCAP per-rule re-check after remediation (immediate pass/fail overlay from the `--remediate` partial result, before the
OSCAP failing-rules filter pills + live remediation progress card + per-rule re-check badges — `ui/app/compliance/oscap/
GDPR subject-rights requests — `services/subject-rights.js`
Breach incidents (72h tracker + art. 33 report) — `routes/breach.js`
Retention policies + nightly purge — `workers/retention-worker.js` + `workers/data-retention.js`
Subprocessor registry — `routes/subprocessors.js`
Vendor risk register — `routes/vendor-risk.js`
Vendor feedback — `routes/vendor-feedback.js`
DPA management — `routes/dpa.js`
Legal & privacy surface — `routes/legal-privacy.js`
Public trust data — `routes/trust.js`
Penetration tests + findings + PDF reports — `services/pentest/*`
Training catalog + assignments + completions + attempts — `services/training.js`
Deployment records — `routes/deployment-records.js`
Risk register — `routes/risks.js`
Asset register with cost — `routes/assets.js`
Change records — `routes/change-records.js`
Approved software baselines — `routes/approved-software.js`
Default-password findings — `default_pwd_findings` table
Policies + versions + user acks — `routes/policies.js`
SBOM — `routes/sbom.js` + `scripts/gen-sbom.js`
Mitigation plans — `services/mitigation-plan.js`
CRA (Cyber Resilience Act) framework — 28 controls incl. automated `sbomCurrent`/`signedUpdatesConfigured`/`cvdPublished
Signed conformity packs (CRA vendor pack; pluggable regime cover for SSDF) — token-gated public HTML/JSON/PDF, admin min
Regulator reporting clocks — NIS2/DORA/GDPR/CRA qualifying wizard on incidents, armed deadline countdowns w/ T-50/T-90 r
Reporting-clock Arc 2 leftovers — NIS2 Art.23/DORA Art.19 controls score off real clock cadence (`reportingClockCadence`
SBOM shipped inside release artifacts (CycloneDX) + `/api/v1/sbom` — `scripts/gen-sbom.js` fail-open in release pipeline
RFC 9116 security.txt (oncall + status) + seeded CVD policy — `routes/security-txt.js`-style handlers + policy library (
AI compliance gap-fill drafts — per-framework "Fill gaps with AI", structural draft-kind matrix (attestation never on au
compliance_manager role (full GRC write, zero fleet/security mutations) — `lib/rbac.js` (v0.9.174)
Trainings engine correctness — lifecycle worker (annual re-assign + T-30/T-7 reminders), honest role-bound compliance ch
Phishing awareness content pack (8 modules w/ quizzes) + report-phishing intake/triage loop feeding security_events — `r

Features

**⛔ Every log line carried the time we READ it, not the time it happened (v0.9.491 / agentd 0.110.0)** — `logs_shape` se
**⛔⛔ `vector validate --no-environment` does not compile VRL (v0.9.491)** — Vector's own help says that flag disables en
**Rows stored before v0.9.491 keep their wrong timestamps.** The fix corrects ingest, not history. A backfill-repair wou

Features

**⛔ Why `/cve` read zero, and it was never about VIR (v0.9.488 / agentd 0.107.0)** — the only live detection path was *"
**Findings can only be closed by the pass that found them (migration `20270314100000`)** — `cve_findings.detected_by`. E
**A stale package inventory is refused, not matched (agentd 0.107.0)** — `dpkg_inventory_at` rides beside the array as a
**A fleet-wide zero is a failed run, not a clean fleet** — plus `POST /api/cve/vir-ecosystem-probe`, which asks the live
**CVEs for RHEL, SUSE and Windows (v0.9.489 / agentd 0.108.0)** — PASS 1 has always read `meta.updates.packages[].cves`
**Windows reports the KB, because it cannot report a CVE (agentd 0.108.0)** — measured on `DESKTOP-A7V81S2`: the local W
**Findings with no CVE id are counted, not hidden (v0.9.489)** — `COUNT(DISTINCT advisory_id)` **skips NULL**, so every
**Ubuntu CVE breadth still depends on one operator action.** The correlate path is built, guarded and probeable, but dis
**A KB→CVE mapping for Windows.** The join key now ships; the mapping does not. MSRC is the source and it is off-host, s
CVE findings store — `routes/cve.js`
CVE AI explainer — `routes/cve-ai.js`
CVE agent-verify workflow — `routes/cve-agent-workflow.js`
CVE workaround tracking — `cve_workaround` migration
CVE → mitigation linkage — `cve_mitigation` migration
CVE regression detection — `cve_regressions` migration
CVE vendor data enrichment — `cve_vendor_data` migration
VIR ingest (single CVE source: NVD + USN + CISA KEV + Ubuntu Tracker + GHSA normalised by VIR) — `workers/vir-ingest-wor
**VIR CVE sync/correlate — advisory→host correlation (`CROSS_PROJECT_CONTRACT.md` §11) NOT BUILT** (real open gap, code-
Per-host package security — `workers/host-pkg-security-worker.js`
Managed packages tracking — `host_managed_packages` table
npm dependency upgrade orchestrator — `workers/npm-upgrade-worker.js` + `services/upgrade-runner.js`
Feed ingest progress tracking — `feed_ingest_log`/`feed_ingest_progress`
GreyNoise IP enrichment — `routes/greynoise.js` + `greynoise_ip_cache`
In-UI CVE data-source config (VIR) — DB-backed source (base_url/token/Ed25519 pin) + Test, replaces env-only; 402/403 →
**CVE exploit-attempt detection — "Attempt Intelligence" (v0.9.142, E0–E7)** — detect exploit *attempts* against CVEs (e
**Attempt Intelligence — UI loop closed (v0.9.150)** — signatures management surface (`routes/exploit-signatures.js` + S

Features

**A Windows endpoint named an AV product removed years ago (v0.9.503)** — the endpoints overview showed a long-uninstall
**`check:platform-caps` — what each platform actually gets, and where a tool is a dead end (v0.9.503)** — capability adv
**agentd 0.117.0** — carries the OpenRC reconcile fix; all three targets rebuilt, and the musl binary self-verifies on *
**✅ A Windows endpoint ships metrics AND logs — the first telemetry of any kind from Windows in this product (agentd 0.8
**Metrics and logs surfaces enabled for Windows — after they were proven, not before (v0.9.445)** — `platform-matrix.js`
**Windows out-of-binary state is reconciled, so a fix reaches the hosts that already exist (agentd 0.87.0 / v0.9.444)**
**Vector's service teardown can remove a wedged service, and says what it did (agentd 0.87.0 / v0.9.444)** — 0.85.0 got
**Remote Desktop on a Windows endpoint — one button (agentd 0.86.0 / v0.9.443)** — a server is supported through a shell
**Windows backup actually completes — the repo was never created (agentd 0.82.0 + 0.84.0)** — the 0.53.0 entry below shi
**The platform scope is enforced at dispatch, not only at advertisement (agentd 0.83.0)** — registration is unconditiona
**cPFence is detectable after all — the gate believed the blind detector (agentd 0.82.0)** — `caps_facts.cpfence` was `f
**Endpoints get their own detail surface, and hosts a non-enumerable id (v0.9.437)** — the endpoint/server split was don
**Windows agents restart themselves (agentd 0.85.0)** — a Windows agent that died **stayed dead until reboot**: the Linu
**Windows self-update applies (agentd 0.79.0)** — it never had. `INSTALL_PATH` is a POSIX const used on both platforms,
**Host containment on Windows — isolate an endpoint, and let it back out (agentd 0.54.0)** — all five capabilities again
**Backup and restore on Windows — "back up a folder from my desktop" (agentd 0.53.0)** — `backup.run` was advertised on
**⛔ A WINDOWS DESKTOP WAS ADVERTISING THE ENTIRE LINUX SERVER SURFACE (agentd 0.52.0)** — live 10/08/26, `DESKTOP-A7V81S
**⛔ ENHANCE WENT DARK FOR THREE DAYS — the heartbeat RESPONSE carries config and agentd threw it away (agentd 0.51.0)**
**`db_dumps` — databases are in a backup snapshot for the first time on agentd (agentd 0.51.0)** — the preset was recogn
**Every root wrapper is now checked to be valid bash (agentd 0.51.0)** — ~2,000 lines of shell live inside Rust string l
**All seven capabilities the agentd migration dropped are restored (agentd 0.44.0–0.50.0)** — `svc.config.apply` (Servic
**Windows endpoints: enrol, report, patch (agentd 0.48.0–0.49.0 / v0.9.401–403)** — a real PowerShell installer behind t
**Endpoints — workstations and mobiles as their own surface (v0.9.404)** — own nav group and page, with the posture an a
**⛔ FLEET BACKUP OUTAGE — agentd never implemented preset paths (agentd 0.42.0)** — `backup-scheduler.js` splits a polic
**IP Control exception counts stop being an artifact of the page size (v0.9.394)** — `/api/ip-control/exceptions` comput
**`oscap.pam_repair` — undoing the PAM collision our own remediation wrote (agentd 0.41.0)** — SSG's pwquality rules ins
**agentd loop-task parity COMPLETE — the port list is empty (agentd 0.40.0 / v0.9.392)** — all nine of the Python agent'
**Support-session audit trail actually reaches the server (agentd 0.37.0 / v0.9.389)** — `shell.session.open` is REFUSED
**Suricata alerts read from a cursor, with rule identity (agentd 0.38.0 / v0.9.390)** — replaces `tail -n 500` + server-
**Phased-deferred packages render as deferred, not pending (agentd 0.39.0 / v0.9.391)** — the Updates tab gives them the
**Batch upgrade falls back to per-package (agentd 0.31.0 / v0.9.383)** — `apt-get install` is all-or-nothing, so one unr
**Phased updates no longer report as failures (agentd 0.28.0 / v0.9.380)** — Ubuntu rolls an update to a PERCENTAGE of m
**agentd reports whether it can actually act (agentd 0.26.0 / v0.9.377)** — `reconcile_host_state()` WRITES the systemd
**agentd ships detached backup results (agentd 0.25.0 / v0.9.376)** — `backup.run` acks a STARTED job and the work detac
**Backup scheduler no longer stacks runs on a host with one in flight (v0.9.376)** — an hourly policy over 19 hosts with
**Silent-freeze detection reads the right field per agent (agentd 0.24.0 / v0.9.375)** — `updates.checked_at` tracks the
**agentd migrate-repair installs all three out-of-binary artifacts (v0.9.366)** — **version parity is not artifact parit
**`/hosts/` can no longer render a dead backend as a healthy fleet (v0.9.366)** — a failed fleet API resolved to empty a
**Orphaned enrolment placeholders are reaped (v0.9.371)** — a `pending-*` row is created when an enrolment token is mint
**Unroutable `last_ip` can no longer reach public DNS (v0.9.371)** — the naming orchestrator would publish a host's `las
**Fleet stuck-uninstall lifecycle fix + sdb data-disk visibility (v0.9.205, agent 1.108.0)** — unstick hosts wedged mid-
**Correctness sweep — stop surfaces lying green/empty (v0.9.208, commit `03ba489`)** — security-posture false-green fixe
RMM fleet automation (script library + run-on-hosts + software install/remove) — agent 1.38.0 caps script.run / pkg.inst
Python host agent (16,503 LOC, v1.132.0, stdlib-only) — `oncall/agent/standby-agent.py`
**Rust host agent `standby-agentd` (v0.19.0) — the replacement for `standby-agent.py`** — static musl/Windows binary (2.
**Rust agent capability slice 1 — `svc.health.probe` + `net.probe`** — the first dispatched capabilities on `standby-age
**Service Health custom checks could never fire (fixed)** — `ingestHealthProbeResults` filtered `status='succeeded'`, bu
**agentd Linux installer + hardened systemd unit + per-target binary delivery** — `GET /install-agentd.sh` (enrollment-t
**agentd config hardening + path separation** — the temp file is now created ALREADY restricted (0600 / protected DACL)
**agentd self-update — the prerequisite for replacing the Python agent** — before this, moving an ENROLLED host to a new
**agentd self-generated sudoers grant** — the agent renders `/etc/sudoers.d/standby-agentd` from its own handler modules
**agentd UFW subsystem (7 capabilities)** — `firewall.ufw.status`/`allow`/`deny`/`delete`/`set_default`/`enable`/`disabl
**agentd IP Control (10 capabilities)** — fail2ban `ban`/`ban_many`/`unban`/`reload` and cPFence `block_ip`/`block_many`
**`no_apply_path` — a WAF present on a host that cannot remediate it** — an engine reported present with no successful `
**agentd ops core — `pkg.*`, host identity/power, `svc.config.read` (10 capabilities)** — apt verify/upgradable/upgrade/
**Every agentd exec is bounded by a deadline** — agentd dispatches commands from the same single thread that sends the 6
**agentd host containment (5 capabilities)** — `host.contain.{isolate,quarantine,evidence,release,status}`, held back un
**Host containment actually contains** — two independent defects meant it had never worked on any host while the UI repo
**agentd sshd + kernel-module posture (5 capabilities)** — `secure_config.sshd.{inspect,apply_hardening}` and `kmod.{che
**agentd root helper wrappers — the pattern that unblocked ~30 capabilities** — a whole class of capabilities must write
**agentd bounded detached execution — oscap, restic and AV scans** — an evaluation or a backup runs for minutes to hours
**agentd handlers can reach the agent config** — `caps::Handler` is `fn(&Value) -> Result<String, String>` and carried n
**The systemd unit is reconciled on every update, not only at install** — a live 0.18.0 host answered a real dispatched
**Gate: `check:agentd-manifest`** — agentd has no release of its own; it rides inside the Standby zip as committed binar
**Gate: the agent unit may not forbid the privilege its modules declare** — reads the Rust source for `pub const SUDOERS
**FIDO/security keys are visible to the authorized-keys inventory** — the fingerprint parser matched ssh-keygen's type w
**Evidence capture produces parseable evidence** — `host.contain.evidence` built ~10 sections of up to 20,000 characters
Windows agent config ACL — protected DACL (SYSTEM + Administrators + caller SID) via `SetNamedSecurityInfoW`; `%ProgramD
Agent enrollment tokens — `routes/agent-install.js` + `enrollment_tokens`
Host agents registry — `routes/agents.js` + `host_agents`
Capability registry + advertised caps — `agent_capabilities` table
Agent commands queue — `services/agent-commands.js`
Agent self-update — caps `agent.update_self` / `agent.refresh_install`
Agent code signing — `lib/agent-signing.js`
SSH host-key cache — `ssh_hostkey_cache` migration
Authorized keys management — `routes/authorized-keys.js`
Temporary support SSH access — `routes/support-access.js` + queue `support-access-expiry`
Support-vendor keys — `routes/support-vendor-keys.js`
Security events ingest — `security_events` table
Host bans — `host_bans` table
Credential rotation policies + scheduler — `routes/credential-rotations.js` + queue `rotation-scheduler`
Phase-4 agent reconcilers — `workers/phase4-reconcilers.js`
Fleet compliance evaluator — `workers/fleet-compliance-evaluator.js`
Fleet update detector + auto-window — `workers/fleet-update-detector-worker.js`
Fleet updates admin UI — `/admin/fleet-updates`
Host clusters — `host_cluster` migration
Host services tracking — `host_services` table
Ubuntu Pro attach/detach + services — agent caps `ubuntu_pro.*`
cPFence firewall + AV control — agent caps `firewall.cpfence.*` / `av.cpfence.*`
UFW policies + assignments — `routes/ufw.js` + `ufw_policies`/`host_ufw_assignments`
UFW drift state — `ufw_drift_state_widen` migration
Firewall drift UI — `/firewall-drift`
Firewall AI assist — `routes/firewall-ai.js`
fail2ban install/control — agent caps `firewall.fail2ban.*`
SSHd hardening (inspect + apply) — agent caps `secure_config.sshd.*`
ClamAV scans + policies + assignments — `routes/av.js`
Per-scan AV path picker — `ui/components/HostAvBlock.jsx` `ScanModal` (presets: agent default / from assigned policy / w
EICAR test (host Security tab) — drops the harmless EICAR pattern + scans it to prove the detection path end-to-end into
ClamAV scan self-heal — freshclam preflight (bootstraps an empty signature DB), clamd auto-start, `--fdpass` (root-owned
Unified AV detections (cross-engine ClamAV + cPFence, cPGuard/SentinelOne plug-in slots) — migration `20260803100000_av_
Hostname / timezone set — agent caps `host.hostname.set`/`host.timezone.set`
Hosts inventory UI + detail — `/hosts`, `/hosts/detail`; redesigned `/hosts` (v0.9.100): KPI strip (online/agents-curren
Approval requests workflow — `routes/approvals.js`; decisions audited + executed-vs-deferred correctly + failures surfac

Features

**Logs and Metrics could not show data they already had (v0.9.484)** — three defects, one shape: the store held it, the
**Vector running but NOT enabled — green now, gone at the next reboot (v0.9.484)** — `vector.status` has reported `enabl
**The host detail page was dead for any Windows host — a missing import (v0.9.446)** — v0.9.443's Remote Desktop confirm
**The Logs histogram was returning 502 for every host on the fleet (v0.9.445)** — `toStartOfInterval` returns a **DateTi
Vector install/uninstall pipeline — `routes/vector-releases.js`
Vector safe auto-heal (v0.9.121, agent 1.97.0) — if Vector is installed+enabled but down, the agent self-recovers each l
OSCAP umask-risk detector + runbook (v0.9.120) — CIS `accounts_umask_etc_login_defs` (UMASK 077) is applied by `pam_umas
**Log-rule engine actually evaluates + self-watch rules (v0.9.273/274)** — every seeded rule filtered on `standby.logs.l
Telemetry install + proxy routes — `routes/telemetry-install.js`, `routes/telemetry-proxy.js`
Telemetry versions, templates, rollouts — `telemetry_versions`/`config_templates`/`rollouts`
Telemetry sink config on host agents — `telemetry_sink_on_host_agents` migration
Metrics query proxy — `routes/metrics-query.js`
PromQL helper — `lib/promql.js`
Log collection routes + retention — `routes/log-collection.js` + `log_retention_policies`
Host log lines ingest — `host_log_lines` table
Log buffer lib — `lib/log-buffer.js`
Per-host shipping-health detector (v0.9.63) — flags an active host (fresh heartbeat) that stopped shipping metrics to VM
Telemetry credentials self-heal (v0.9.68) — one-click "Sync credentials from sink" repairs drifted `app_settings.telemet
Telemetry creds AUTO-heal (v0.9.70–71) — the sync now needs no operator action: agent 1.79.0 fixes the `telemetry.sync_c
Telemetry / Metrics / Logs UIs — `/telemetry`, `/metrics`, `/logs`
Log collection admin UI — `/admin/log-collection`
Create incident from a log line (manual) — `POST /api/logs/create-incident` (dedupes by normalized line+host) + Create-i
**/logs live tail + saved queries (v0.9.171)** — SSE tail (`GET /api/logs/tail` inside metrics-query.js, canRead-gated;

Features

**A Windows backup can finally be proven intact — the third verb had no Windows arm (agentd 0.101.0 / v0.9.483)** — `bac
**The backup checking half reaches hosts (v0.9.473–474 · agentd 0.98.0/0.99.0)** — backups worked; everything that CHECK
**Cancel actually stops the backup (v0.9.474 · agentd 0.99.0)** — the button set the row to `failed / cancelled by opera
**Restore drills resolve a snapshot without a button (v0.9.473)** — the drill read `backup_snapshots`, a cache only the
**Restore drills stop starving, and "never proven" says why (v0.9.453)** — `restore_proven: 0, restore_never: 20` on a f
**High availability — "mint an HA standby" (v0.9.202)** — Postgres streaming replica via the mint pattern (existing enro
**Enterprise ops handbook (v0.9.202)** — `docs/OPERATIONS.md` (architecture, port + egress matrices, air-gap degradation
Mint a backup host (restic + REST server) — `routes/backup-install.js` + `scripts/setup-backup-host.sh`
Backup policy builder (folder presets + cron) — `routes/backup-install.js` + `backups` migration
Backup scheduler worker (cron-match → per-host `rest:` repo → dispatch) — `workers/backup-scheduler.js`
Agent detached restic run + kind-aware collector — agent caps `backup.*` (`standby-agent.py`)
Snapshots list / restore / verify (DR) — `routes/backup-install.js` + agent `backup.restore`/`backup.verify`
**The engine installs itself on policy assignment (v0.9.418)** — being placed in a backup policy is where the operator e
**restic installs on Windows without a package manager (agentd 0.61.0)** — `backup.install` shelled out to winget, which
Install backup engine on hosts (restic) — `POST /api/admin/backups/install-engine` + "Install engine on hosts" button (t
Full restore toolkit — file restore, cross-host migration, and full-server / bare-metal DR via a source+target split (`s
**Control-plane self-backup + recovery** — daily `pg_dump` of oncall's OWN DB (the platform backed up customers but not
**Dead-man's switch** — `workers/heartbeat-worker.js` pings an external uptime monitor every 5 min (`deadmans.url`) so a
**Migration safety** — `npm run check:schema` (static baseline-gap guard, no DB) + `npm run verify:migrations` (proves b
Backups admin UI (ECharts) — `/backups`: capacity + outcome charts, clickable runs (failure reason + retry/cancel) and b
Backup-sink self-diagnostics — **Test connection** (`POST /api/admin/backups/repos/:id/test`: probes the rest-server wit
Granular restore — snapshot file browser (`backup.ls`, lazy per-directory) + single-file download (`backup.dump`, base64
Backups rock-solid — fail-loud failure alerting (run/dispatch/8h-stuck → deduped incident), staleness alerting (policy-t
**Backup-sink capacity verdict (v0.9.526)** — the sink raises its own incident as it fills (WARN 80 / HIGH 90 / CRITICAL
Secrets encrypted at rest — `status.bearer` (and the at-rest helper) AES-256-GCM via `lib/crypto-at-rest.js` across all
Sidebar "Pulse" widget — bottom-left 14-day incident sparkline + open-count + live on-call — `GET /api/me/pulse` + `comp

Features

**Native Network hub (v0.9.126)** — Standby is its own vendor-agnostic network controller; the read-first UniFi/net-cont
**Integrations catalog (v0.9.125)** — single registry-driven page under **Platform** (killed the bogus Integrations side
CMDB — unified configuration items (hosts/switches/datacenters/IPs) with relationships derived from live inventory + ope
Cloud integrations (provider abstraction; **five live adapters: Hetzner Cloud, DigitalOcean, Proxmox VE, OpenStack, AWS
Colocation access — operational + capacity (v0.8.16, DC-provider) — gate-controller **ingest webhook** (`POST /api/dc-ac
Colocation physical access control (v0.8.15, DC-provider) — `access_persons` (customer staff/vendor/operator + badge) +
Colocation customers + space assignment (v0.8.14, DC-provider) — `colo_customers` tenant register (contact, status, powe
Data halls / blocks (v0.8.13, Virtual-DC) — `datacenter → block → rack` tier for modular DCs: `dc_blocks` (hall/suite/po
Virtual-DC reconciliation + unified machine plane (v0.8.17, Phase 2) — `lib/machine-reconcile.js` auto-fills `server_ass
Agent hardware inventory (v0.8.12, Virtual-DC Phase 1) — agent `hw.inventory` cap: `snapshot_hardware()` harvests CPU (l
Cloud cost per VPS (v0.8.11) — Hetzner adapter surfaces per-location monthly/hourly pricing (EUR); live instances show c
Provisioning host roles + naming + DNS auto-map — auto-derived host roles (web/db/dns/mail/…) from detected services + m
Network overview — `/network` (v0.9.117: fixed "0/N hosts reporting" reading from the scale-stripped hosts list → dedica
Connectivity-quality anchor pills (UniFi-style) — agent `net.probe` measures RTT + loss to Microsoft/Google/Cloudflare p
IPAM (subnets + IPs CRUD) + live reconciliation vs agent-discovered IPs — `routes/ipam.js` + `ipam` migration
Agent network discovery (interfaces/IPs in heartbeat meta) — `snapshot_network()` in `standby-agent.py`
Multi-provider DNS (Cloudflare / Bunny / PowerDNS / deSEC / Gandi LiveDNS / **Route53** — doc reconciled 2026-06-11, Sig
Standby MCP server — `oncall/src/routes/mcp.js` exposes platform tools over the Model Context Protocol for external AI c
Hetzner rDNS + IP import + push-rdns — `services/dns/hetzner.js`
Edge firewall mint (WireGuard hub + nftables + Suricata) — `routes/edge-install.js` + `scripts/setup-edge-firewall-host.
Inline edge WAF (Caddy + Coraza, agent ≥1.76.6) — make the edge a real inline ingress: per-route hostname→origin over th
Edge reinstall/update in place (agent ≥1.76.0) — `edge.reconcile` re-applies nftables/Suricata/wg0/proxy without re-keyi
WireGuard peer enrollment (overlay-IP allocator + agent hub_add_peer) — `routes/edge-install.js` + agent `wg.*`
Suricata IDS alerts (eve.json tail → ingest, sha1 dedup, 30d retention, ECharts timeline) — `routes/agents.js` `/suricat
Suricata → ClickHouse long-term retention (mirror to telemetry `standby.logs`) — `lib/clickhouse.js`
Edge traffic telemetry (v0.8.91→0.8.98) — agent (≥1.49.0, fixed 1.52.0) ships `/proc` counters (default-route iface thro
Edge volumetric DDoS detection + mitigation (v0.8.91) — `workers/edge-ddos-worker.js` baselines conn/s+pps and raises a
Edge management — edit/delete edge + manual host-link dropdown (fixes hostname↔agent mismatch) + one-click "migrate all
**Edge enterprise UI + honest peer health (v0.9.135–137)** — the single stacked page rebuilt into a fleet **index → per-
Suricata alert shipping fix (1.53.0) — read `eve.json` via an allow-listed `sudo tail` (the prior `sudo bash -c` was den
Datacenters + physical switches + SNMP polling — `routes/datacenters.js` + agent `snmp.poll`
Switch-port ↔ host/IP correlation — agent 1.36.0 `snmp.poll` also walks bridge-MIB FDB (dot1q/dot1d MAC→port) + dot1dBas
Per-port VLAN discovery (dot1qPvid) — agent 1.36.0 walks the native/untagged VLAN per port → `switch_ports.vlan`, shown
Network topology graph (datacenter → switch → host, force-directed) — `GET /api/admin/network/topology` (links from `swi
Unified switch management v1 (port enable/disable) — agent 1.37.0 `snmp.set` (vendor-universal via ifAdminStatus SNMP SE
Server locations world map (ECharts geo) — `/datacenters`
Server hardware lifecycle (specs/cost/warranty/renewal, ≤90d due alerts) — `routes/datacenters.js` server-assets + `serv
Component health → spares → field replace (PLAN_HW_LIFECYCLE.md) — component-agnostic model (`hw_components` + `hw_compo
**Procurement / Zephyr ordering (PLAN_HW_LIFECYCLE.md Phase 6, CROSS_PROJECT_CONTRACT §12 / Zephyr §I)** — operator can
Uplink / transit provider management — circuits (transit/peering/ix/wave/darkfibre/crossconnect) linked to supplier + da
Uplink bandwidth utilization + saturation — live in/out Mbps from switch-port SNMP HC counters, % of capacity, ECharts h
Generic network devices (router/firewall/PDU/UPS/LB/console) + manual topology links — appear in the topology graph + ra
LLDP/CDP neighbour discovery → auto switch↔switch/device topology links — agent 1.40.0/1.40.1 walks `lldpRemTable` with
Passive LAN discovery — agent 1.40.0 `net.scan` reads the kernel ARP table (`ip neigh`); unmanaged devices flagged for a
**Persisted machine identity layer (Track A0/K1)** — `machines` + `machine_links` keyed serial→MAC→IP→name unify host_ag
**Cloud adopt-to-fleet + scheduled sync (Track A1)** — one-click adopt of a discovered cloud instance (mint enrol token
**Fleet enterprise-naming orchestrator (Track A2/K2)** — dry-run diff then apply an enterprise hostname to the whole fle
**⛔ Fleet naming can no longer rename a nameserver to `web-*` (v0.9.366)** — the dry-run sitting in the UI read `18/18 c
**PowerDNS zone creation (v0.9.371)** — nothing in the codebase could *create* a zone, only records inside an existing o
**DCIM commercial layer (Track B)** — DCs linked to their colo **operator + contract** (reuse ISO-20000 `suppliers`); pe
**IPAM depth (Track C)** — owned-vs-rented tenure + lessor + lease expiry + cost, parent/child prefix hierarchy + next-f
**Transit carrier / circuit / BGP-session model (Track D1)** — `transit_providers` + `circuits` (LOA/demarc/A-Z) + `bgp_
**Arista eAPI driver + VLAN/PoE Safe-Ops writes (Track D2)** — server-side eAPI (HTTPS JSON-RPC) implementation of the n
**Switch fabric / MLAG / LAG model (Track D3)** — `fabrics` + `fabric_members` (spine/leaf/mlag-peer roles) + `lags` (po
**Out-of-band BMC/Redfish power (Track D4)** — power state + on/off/graceful/cycle/reset over the BMC, works with the OS

Features

Service config READ (v0.9.118, Phase 0) — agent `svc.config.read` parses NGINX / Apache / LiteSpeed-OLS / MySQL / MariaD
Tuning advisor (v0.9.118, Phase 2) — deterministic MySQLTuner/PGTune/Apache-docs-class rules evaluated against the host'
Service config APPLY — Safe-Ops (v0.9.118, Phase 3) — agent `svc.config.apply`: per-service key allowlist + value saniti
DB deep-dive (v0.9.118, Phase 4) — agent `svc.db.stats` runs FIXED agent-baked queries (no server SQL): pg connections/c
Fleet tuning rollouts (v0.9.119, Phase 5) — apply one change-set across many hosts: canary of 1 → waves of `wave_size` →
**Per-service engineer console (v0.9.127–129)** — a rich per-`(host,service)` console: Overview (KPIs + ClickHouse trend
Service-KPI standing alert rules (v0.9.129) — create a rule from any console KPI (metric/op/threshold/window/severity);
nginx stub_status enablement — Enhance-safe (v0.9.129) — `svc.nginx.enable_status` writes a **dedicated localhost:9145 s
**Fleet Service Tuning console (v0.9.143, T3)** — `/service-tuning` aggregates every host's advice into "N hosts need X"
Tuning Apply value-prefill fix + Enhance-managed gating (v0.9.143, T1/T2) — `advise()` emits an explicit `apply_value` (
**Service-console consolidation (v0.9.150)** — the generic `/service-console` reached PowerDNS parity: per-service host
OBSERVE trends + per-database workload (v0.9.147–148, T4 + db.perstats) — server-global db-stats persisted with workload
Service tuning — effective-runtime READ (SHOW VARIABLES / pg_settings live values vs the current file-level parse) + ano
Service tuning APPLY + fleet rollout — real apply/auto-rollback still lab-unverified (dry-run validates); verify single-

Features

**Service up/down alerting (v0.9.218)** — debounced (180s, configurable), self-resolving, pages on-call for the critical
**Built-in per-family threshold checks (v0.9.218)** — auto-seeded on a service's first detection from already-sampled me
**Unified `/service-health` console (v0.9.218)** — per-service cards with live values green/red, inline threshold + seve
**ClamAV signature freshness (v0.9.218)** — `clamav.sig_age_hours` powers a freshclam-stale check (agent 1.110.0, read-o
**Custom app health probes (v0.9.218)** — operator-defined checks for ANY app: HTTP endpoint (status/body), TCP port, sy
⚠ Agent 1.109.0/1.110.0/1.111.0 need a one-host lab-verify before fleet rollout.

Features

**Operational health scorecard `/ops-health` (v0.9.240)** — MTTA/MTTR trend, load per responder, noise ratio, auto-resol
**Desk Insights + Today bulletin (v0.9.228/235)** — ECharts incident-volume / MTTA-MTTR / severity-mix panels and a one-
Dashboards (rebuilt) — canvas editor (react-grid-layout), quick-start templates, `$host` template variables, timeseries/
AI panel builder — natural language → panel (metric/chart/unit) via the AI provider abstraction — `POST /api/dashboards/
Dashboard auto-versioning + restore — `dashboard_versions`
Dashboard playlists (wall-display rotation) — `dashboard_playlists` + `/dashboards/playlist`

Features

**Auto-block announces itself, and can cover the estate (v0.9.457–v0.9.459)** — detection always worked; `notify()` was
**Fleet-wide IP intel + `<IpAddress>` hover (v0.9.325)** — hover any IP anywhere and see whether the fleet actually bloc
**Enforcement-target retirement (v0.9.325)** — a target on a layer the server no longer selects for that host (UFW after
Autonomous infra remediation control plane (v0.9.96) — a unified detect→fix lifecycle over the whole estate: `remediatio
CVE-KEV → package-upgrade remediation loop (v0.9.126) — the 2nd flagship detect→fix pair: open KEV findings with a fix r
Threat feed SecOps surface — triage (ack/assign/resolve/false-positive + bulk), stat cards, filters/search/pagination, d
One-click response actions — block IP / quarantine file / run AV scan (signed agent commands) + open-incident-from-threa
Auto-response automation — `ban_ip`/`quarantine`/`av_scan`/`create_incident` actions + `severity_min`/IN-list/`__not` co
All threat sources wired to alerting/automation — fail2ban/SQLi/webshell now `notify('security.event')` (high/crit) or f
IP Control — managed blocklist/allowlist with per-host, per-layer **on-box confirmation** (cpfence/fail2ban): `managed_i
IP Control — security control plane, single pane for the estate (v0.9.64): surfaces ALL blocks not just operator rules —
IP Control — Allowlist as estate-wide allow pane + cluster protection (v0.9.65–67): attacks-over-time chart as adaptive-

Features

**⛔ A glob IS an include — the drift that was never drift (v0.9.472, agentd 0.97.0)** — hosts applied successfully and t
**⛔ The fleet was blocking 1,006 attacks a week and every counter read 0 (v0.9.467)** — the Python agent wrote `waf_bloc
**A WAF apply can no longer start a webserver (v0.9.469, agentd 0.95.0)** — the apache reload chain ended in `apachectl
**`waf.apply` is advertised only where the adapter can actually run (v0.9.468/v0.9.470, agentd 0.94.0/0.96.0)** — the ga
**The threat feed stopped counting our own monitoring as attacks (v0.9.467)** — 280,374 of 290,179 WAF events in 7 days
**Fleet apply — the button the remediation linked to but did not exist (v0.9.452)** — `apply-fleet` had shipped months e
**WAF coverage is pushed, not just rendered (v0.9.451)** — `security-queue.js` computed `waf_never_applied` correctly an
**cPFence WAF rule exclusions (v0.9.456, agentd 0.91.0)** — cPFence hosts sat under "Standby cannot manage this engine"
**cPFence WAF config found where it lives (v0.9.455, agentd 0.90.0)** — `configured` probed `/opt/cpfence/etc/modsec`, a
**W1 — "is our policy in effect" is read back, not inferred (v0.9.424, agentd 0.69.0)** — `meta.waf.managed` was HARDCOD
**cPFence is detected again, and honestly (agentd 0.64.0–0.65.0)** — Phase 1 gated the ten cpfence capabilities on the C
**Root-owned WAF configs are readable (v0.9.330, agent 1.132.0)** — `mode` and `crs_version` were null on 10 of 10 hosts
**Drift check searches every engine directory (v0.9.330)** — `_waf_managed_state()` took `candidates[0]`, a LiteSpeed pa
**Engine pill tells three states apart (v0.9.330)** — was unconditionally green with `mode` hidden when null, so "module
WAF policy library + per-host assignment — named OWASP-CRS policy tiers (mode/paranoia/anomaly/rulesets/exclusions), bui
WAF detection (agent ≥1.67) — `snapshot_waf()` detects the existing engine per host (ModSecurity-nginx/apache, LiteSpeed
**Detected ≠ configured (v0.9.326, agent 1.131.0)** — the nginx badge fired on `nginx -V` containing "modsecurity" (i.e.
WAF tuning / "Managed WAF" standard tier (agent ≥1.69) — `waf.apply` writes a Standby-managed include (SecRuleEngine mod
WAF hit ingestion + dashboard (agent ≥1.71) — agent tails modsec/litespeed audit logs → `security_events` (`modsec_nginx
Coraza default WAF (B1, agent ≥1.73) — install Coraza-as-Caddy on no-WAF hosts (preflight/install/uninstall, detect-firs
Campaign-only WAF incidents — WAF blocks page only on a campaign (exploit rule, or one IP hitting ≥3 hosts / ≥200 blocks
WAF-typed incident observability — WAF incidents show attacker-IP intel instead of "no host label" — `incidents/detail`
IP intel lookup — search any IP → WHOIS/RDAP owner + AbuseIPDB + reverse DNS + 90d in-house events, one-click block; dee
**WAF Apache adapter + running-engine selection (v0.9.275/276, agent ≥1.125)** — `modsec-apache` was never wired, and `w
**WAF config-drift detection (v0.9.271, agent ≥1.120)** — applying a policy was a one-shot push nothing re-checked, and
**WAF two-adapter model — panel API for Enhance hosts (v0.9.271)** — Enhance exposes ModSecurity as a first-class API (`
WAF premium tier — Coraza **edge gateway** (B2): one Coraza in front of fleet ingress (offload/consistency/virtual-patch
WAF addon commerce — Zephyr entitlement (customer buys + self-manages; Standby enforces) — PLAN_WAF.md

Features

**Colleagues directory + one-tap call (v0.9.237)** — ops roster with role + live on-call dot and a "Call" that mints a m
**Presence (v0.9.240)** — 60s shell heartbeat (`POST /api/me/heartbeat`) + online/idle dots derived from `users.last_act
**Start a team meeting from a task (v0.9.236)** — `POST /api/staff-tasks/:id/meeting` mints a room named after the task
**Shift-handover pack (v0.9.243)** — `GET /api/handoff/pack?hours=12`: coverage, open incidents with holders, what chang
Staff task management — assign remote/physical-DC/onboarding/hygiene tasks (location + host link + checklist), worker "m
IT-hygiene task templates — 7 seeded recurring practices (daily alerts/backups, weekly patch/capacity/access, monthly DR
Daily/weekly operational digest — per-worker email + bell of open/overdue tasks + hygiene checklist — `services/staff-di
Staff shifts + roster — weekly grid, copy-week, templates, PTO, hours/CSV, on-call reconciliation, per-skill coverage ru
DC physical-staff shifts (site + department) — staff/shifts/coverage-rules scoped by datacenter + department (security/f
**People/Workforce suite on the coverage spine (v0.9.112)** — everything hangs off `staff_members` (+ optional login lin

Features

Brokered web terminal — browser ↔ oncall ↔ agent PTY (no inbound SSH); xterm.js multi-host tabs + Termius-style snippets
Session recording (compliance evidence) — every byte recorded to `terminal_chunks`, replayable session log — `terminal_s
**Privileged-session governance (v0.9.529)** — the recording is now a *control*: mandatory justification to open a root

Features

Multi-provider AI layer — `services/ai/index.js`
Anthropic provider (with prompt caching) — `services/ai/anthropic.js`
OpenAI provider — `services/ai/openai.js`
Llama / Ollama provider — `services/ai/llama.js`
AI providers admin — `routes/ai-providers.js` + `/ai-providers` UI
AI conversations + messages — `services/ai/conversations.js`
Per-user AI budget enforcement — `services/ai/budget.js`
AI usage logging — `ai_usage_log` table
AI chat (streaming) — `routes/ai-chat.js`
AI write-assist — `routes/ai-write-assist.js`
Agentic loop with tool dispatcher — `services/ai/agentic-loop.js`
AI tool registry + implementations — `services/ai/tools.js` + `tool-impls.js`
PII redaction layer — `services/ai/redact.js`
AI conversation retention — `workers/ai-retention-worker.js`
AI spend admin — `/admin/ai-spend`
On-call AI hook — `routes/oncall-hook-ai.js`
AI features metadata + `/ai-tools` UI — `routes/ai-features.js`
AI persistent memory (user / team / global scope, importance, auto-summary) — `services/ai/memory.js` + `routes/ai-memor
AI embeddings (semantic search foundation, in-process cosine) — `services/ai/embeddings.js` + `ai_embeddings` table
Per-conversation cost ceiling — `services/ai/budget.js` (`ai.per_conversation_usd_cap`)
AI provider failover (5xx/429/timeout → next enabled) — `services/ai/index.js`
Tool-result PII redaction — `redactValue()` in `services/ai/redact.js`
Conversation export for SOC2 evidence — `/api/ai/conversations/:id/export`
Alert-noise classifier (6h cron, scored fingerprints + cached explanations) — `workers/ai-noise-classifier.js` + `alert_
Runbook freshness reviewer (weekly cron) — `workers/ai-runbook-freshness.js` + `runbook_freshness`
Post-incident learning loop (action items + candidate rules + lessons → memory) — `services/ai/postmortem-learning.js` +
Incident co-pilot panel (similar incidents, postmortems, CVEs, on-call) — `routes/ai-incidents.js` (`/api/incidents/:id/
"Why is this firing?" agentic RCA — `routes/ai-incidents.js` (`/api/incidents/:id/why`)
Pager voice → structured incident extraction — `services/ai/pager-voice.js` + `/api/ai/pager-voice/extract`
Compliance Q&A with citations — `routes/ai-features.js` (`/api/ai/compliance/ask`); UI: "Explain this control" card in t
`diff_against_canonical_schema` diagnostic tool — introspects a table's live columns to catch schema drift / partially-a
Vision: screenshot → alert rule / incident — `routes/ai-vision.js`
Slash commands in chat composer (/incident /host /runbook /cve) — `ui/components/AssistantDrawer.jsx`
Streaming write-assist (SSE) — `routes/ai-write-assist.js` (`/api/ai/write-assist/stream`)
AI-originated approvals filter (`?via=ai`) — `routes/approvals.js` + payload tag in `tool-impls.js`
Confirm-first AI action tools — `propose_action` tool returns a proposal (RBAC-checked, not executed); operator confirms
AI Staff "talk to a colleague" — Assistant drawer defaults to a named engineer (General Assistant + SRE/Security/Network
Central PII redaction + budget metering for ALL features (not just the co-pilot); no-user worker traffic capped via a sh
CVE "Discuss with AI" — multi-turn Q&A grounded in the CVE context payload — `routes/cve-ai.js` (`/api/cve/:id/ai-mitiga
"Ask the colleague" shims — incident→SRE, CVE/OSCAP→Security, firewall→Network, compliance→Compliance route into the AI
AI Staff delegation everywhere (v0.9.72–74) — the "delegate a task" verb on every surface: a **delegate box** on `/ai-st
AI Staff cross-device continuity (v0.9.75) — colleague conversations (`/converse`) are now PERSISTED (was ephemeral/clie
Log-rule engine — classify recurring log errors into incidents (rate spike) / problems (known-error) / ignore; reads Cli
Capacity & anomaly forecasting — linear-regress disk/inode/mem fill ETAs + robust-z load anomalies from the ClickHouse r
AI incident autopilot — background investigations (read-only signed diagnostics + log search, budgets), AI fix proposals
Prompt-injection fence on all AI surfaces — `sanitizeUntrustedForPrompt`/`sanitizeDeep` + `[untrusted]` framing — `servi
AI security-event triage — deterministic clustering → campaign verdicts/narratives, /threats "Triaged (AI)" lens, approv
"AI-generated, human-reviewed" provenance labels on every AI surface + auditor/evidence exports (EU AI Act Art. 50) — `c

Features

**Scheduled-meeting shadow copy (v0.9.242)** — idempotent `PUT /api/admin/meet/scheduled/:zephyr_meeting_id` (§17.2) beh
**Directory federation (v0.9.243)** — `GET /api/admin/directory` serves the ops roster to Zephyr (§17.4), backed by a sh
**Zephyr-side blocker:** their inbound `IntegrationHmacGuard` verifies a bodyless GET over `"{}"` instead of `""`, so St
**Payroll source feed (§A producer side)** — Zephyr's payroll import calls a Standby payroll-source endpoint that was ne

Features

**Enhance collection is dispatched now that the agent no longer self-schedules (v0.9.366)** — "0 healthy clusters" was n
**Enhance 12.25 catch-up (v0.9.203)** — vendored orchd **12.25.0** spec (full client re-verify = zero drift); phpMyAdmin
**Enhance DNS-hook integration — inbound event-driven zone sync (v0.9.203–204)** — Enhance pushes zone changes to a **pu
**Enhance API coverage → 88.7% of the core operator surface (v0.9.270–277)** — 73 → 346 of 482 operations (346/450 in sc
Enhance clusters + servers + websites + mailboxes + DBs — schema in `enhance_*` tables
Enhance API client — `services/enhance-api.js`
**Enhance panel SSO (v0.9.130)** — "Open panel" on the Enhance desk mints a one-time login URL (`POST /orgs/{org}/member
Admin enhance-clusters — `routes/admin-enhance-clusters.js`
**Enhance per-server component-health KPI (v0.9.143)** — `/enhance/servers` shows each daemon (appcd / orchd / panel / b
**Enhance per-entity detail consoles (v0.9.146)** — unified mailbox / database / website / domain drill-in consoles on o
**Enhance entity consoles — full approved mockup + sites merge (v0.9.150)** — the four consoles rebuilt to the complete
**Per-mailbox mail activity (mail.stats, v0.9.148)** — agent parses postfix/dovecot/rspamd logs per address → sent / rec
Enhance identity grant — already-org-member fix (v0.9.145) — granting Enhance access to a login already in the org (e.g.
Per-site cgroup metrics (agent capability) — `enhance.collect`
Enhance Operator Desk (v0.8.0) — own sidebar group split into sub-pages (Overview / Clusters / Servers / Websites / Mail
Per-cluster trend graphs (v0.8.0) — `enhance_metrics` rollup written on every agent enhance-report (`routes/agents.js`);
Enhance websites + sites UI — `/enhance`, `/enhance/sites`
Enhance health monitoring + auto-scale (v0.8.19) — `lib/enhance-health.js` evaluated per cluster on each enhance-report:
Enhance auto-deploy server (v0.8.18) — `POST /api/enhance/actions/deploy-server`: pulls the cluster's Enhance `install-c
Enhance operate layer (v0.8.2) — Phase 3 reversible write actions against the live panel, verified against the Enhance O
Enhance operate — destructive actions (v0.8.4) — soft-delete website, delete mailbox, delete MySQL DB, behind type-to-co
Enhance per-cluster DNS (v0.8.5, Phase 4 slice 1) — `enhance_clusters.dns_mode` (`none`/`powerdns`/`external`) + `dns_pr
Enhance DNS zone/record browser (v0.8.6, Phase 4 slice 2) — built-in PowerDNS records for a website's primary domain: `G
Enhance Phase 2 — pg case-sensitivity fix (v0.8.7): control-panel-host binding lookups in `admin-enhance-clusters.js` us
Enhance AI co-pilot — advisory reads (v0.8.7, Phase 5 slice 1): assistant tools `query_enhance_clusters` / `query_enhanc
Enhance external-DNS bridge (v0.8.20, item #3) — for clusters with `dns_mode = external`, the desk's DNS records page re
Enhance bulk migration / importer (v0.8.20, item #4) — pull cPanel/Plesk accounts onto a cluster from the desk: scan dro
Enhance backup-staleness watcher (v0.9.116, ROADMAP v2 R1) — hourly server-side worker polls per-website backup listings
**Hosting/Enhance audit + P0 correctness (v0.9.191)** — three-audit sweep against the newly vendored OAS3 spec (`docs/en
**Track M slice 1 — management surface (v0.9.192)** — Standby now manages the panel, not just watches it: **website crea
**Suspension-enforcement detector (v0.9.192)** — a site suspended in the panel that still serves means the customer keep
**DNSSEC + DANE/TLSA (Track D — backend; released v0.9.195, migration ran with 193/194)** — answers the long-unanswered
**DNSSEC + DANE UI (v0.9.195)** — the Track D backend shipped with zero pixels; this is the surface. **DNSSEC card** on
Enhance Operator Desk — Phase 5 slice 2: expose write actions (suspend/SSL/DNS/etc.) as approval-gated AI tools — `PLAN_
**Customers console (operator UI) — NOT BUILT** (confirmed open gap @ v0.9.208; the missing half of §16 hosting-provisio
**Zephyr → Standby hosting provisioning (v0.9.193, `CROSS_PROJECT_CONTRACT.md` §16)** — Zephyr sells the hosting account
**kstack registers as a hosting cluster and Standby watches it (v0.9.515, `CROSS_PROJECT_CONTRACT.md` §20)** — kstack is
**§16 provisioning executor, kstack backend (v0.9.515, §20)** — the same Zephyr request provisions on kstack when `plan.
**Enhance → kstack migration: Standby is the extractor (v0.9.516, §20; kstack plan #61's missing half)** — kstack has ha
**kstack's measured controls as evidence, not a 17th framework (v0.9.516, §20)** — the poller pulls `GET /v1/accounts/{i
**Peer pairing knows two kinds — a kstack pairing IS registration (v0.9.517, `CROSS_PROJECT_CONTRACT.md` §20.1/§20.4/§20
**The kstack overview, one call, shape pinned on both sides (v0.9.518, §20.3)** — kstack v1.59.1 serves `GET /v1/partner
**kstack's nameservers become masters on Standby's DNS secondaries (v0.9.519, §20.4 the other direction)** — Standby's m
**kstack is its own connector on /integrations/ (v0.9.520)** — Kosta opened Integrations and asked where kstack was: it
**⛔ THE FIRST LIVE POLL OF testing.lbreeze.net WENT RED FOR THE WRONG REASONS (v0.9.521)** — Kosta paired it (05/09/26 0
**⛔ …and the whoami I blamed was never kstack's (v0.9.522)** — the kstack session confirmed `/v1/whoami` is deliberately
**A paired peer may read the CVE inventory; a person still needs the role (v0.9.523, contract §20.3.1)** — kstack v1.61.
**Per-site traffic history (v0.9.196)** — the website console's Bandwidth/Hits charts were blank and month-to-date read
**WAF coverage gaps surfaced, not rendered as zero (v0.9.199)** — a bare "0 blocks" reads as "nothing got through" when

Features

**The uptime commitment became verifiable in both directions (v0.9.484 · Zephyr v1.213.0)** — Zephyr publishes `legal.up
**`announced_at` — the field the whole notice check rests on (v0.9.484)** — Zephyr computes hours of notice as `starts_a
**Not yet reachable by Zephyr** — `PAIR_SCOPES` gained `sla.read` but that constant is read at MINT time, so the existin

Features

**⛔ One stale capability gate cost four platforms their metrics (v0.9.490 / agentd 0.109.0)** — `caps.rs` carried `("vec
**An unknown distribution is refused, not handed a `.deb` (agentd 0.109.0)** — the fallthrough returned `deb`, so openSU
**Four families, one product — the multi-distro program (agentd 0.102.0–0.105.0 / v0.9.486)** — Standby managed one dist
**⛔ `dnf check-update` exits 100 when updates are available (agentd 0.103.0)** — zero means none pending, 100 means upda
**⛔ apk cannot classify security updates, and says so (agentd 0.104.0)** — Debian answers "is this a security update" fr
**⛔ A.8.8 graded a host "Fully patched" from data it did not have (v0.9.485)** — `ok: upd ? (upd.security || 0) === 0 :
**The Firewall tab knew about two engines and there are three (v0.9.486)** — the renderer was a two-way branch: `windows
**Windows could be watched and it could be locked down; it could not be given a rule (agentd 0.105.0)** — `winposture` m
**Vector reaches Alpine — the musl tarball, under OpenRC (agentd 0.105.0)** — `resolve_pkg_target()` returned `apk` and
**Alpine's firewall — built, and the safety is the feature (agentd 0.106.0 / v0.9.487)** — Debian had ufw, RHEL had fire
**⛔ Executing the wrapper found two defects that reading it could not (v0.9.487)** — the nftables wrapper was run agains
**⛔ `firewall.win.open_port` / `close_port` had a 0% success rate (agentd 0.106.0)** — shipped in 0.105.0, never dispatc
**The Windows firewall feature had no way in (v0.9.487)** — three agent verbs, three server routes, and **not one button
**All five package managers, and two traps that reading the manual would have got wrong (agentd 0.106.0)** — zypper and
**⛔ An unprivileged `zypper list-updates` reports ZERO on a host with 22 pending (v0.9.487)** — it does not warn and it
**⛔ `Fact::JobRunner` — nine wrapper branches exec `systemd-run` and one checks for it (agentd 0.106.0)** — `backup.run|
**The 4,446-line wrapper audit, gated (v0.9.487)** — `every_wrapper_parses.rs` only proves the bash parses. `wrapper_por
**An OpenRC host can back up, and containment there has a dead man's handle (agentd 0.113.0 / v0.9.494)** — `Fact::JobRu
**`check:job-detach` — the detach path is RUN, not read (v0.9.494)** — the fallback is bash, it is copied into three wra
**`Fact::Systemd` — the verbs whose requirement was never "detach a job" (agentd 0.113.0)** — widening `Fact::JobRunner`
**A source-scanning guard matched its own prose again, and the fix was the sibling test's (v0.9.494)** — `every_systemd_
**`surfaceMatrix` has a third state: "applies but is not built" (v0.9.493)** — `applies` was doing double duty as *shoul
~~**`surfaceMatrix` needs a third state: "applies but is not built".**~~ Two Windows Server surfaces are named and empty
**⛔ `check:agentd-meta-parity` — three keys in three days, all found by accident (v0.9.493)** — a heartbeat `meta` key t
**The last four frozen meta keys, and `KNOWN_MISSING` is empty (agentd 0.114.0 / v0.9.495)** — `network` (11 readers — t
**A successful upgrade left its packages on screen as pending (agentd 0.115.0 / v0.9.497)** — live on `lbreeze.cloud` 21
**The auto-block dedupe was applied to one arm of the `if` and not the other (v0.9.498)** — found auditing the live noti
**Two `partial` inputs produced `not_met` — seven controls, five frameworks, one briefly-unreachable host (v0.9.499)** —
**The white page on first load — a stale build, and nothing in the app could recover (v0.9.500 / agentd 0.116.0)** — rep
**58 tables could not scroll on a phone, and the first count was wrong by 3× (v0.9.500)** — a `<table>` with no scroll c
**A firewalld host reported no firewall at all, capping 15 controls across 5 frameworks (agentd 0.116.0)** — `fleetFirew
**Settings: 13 tabs in declaration order, and a mobile wall (v0.9.500)** — grouped into Appearance / Delivery / Security
**`check:swallowed-errors` — a ratchet, not a ban (v0.9.500)** — most of the empty catch handlers are deliberate and doc
**A cross-host roll-up no longer titles itself with one host (v0.9.499)** — `notify()` refreshes a collapsed row's title
**`"signed": false` was in the manifest for eleven releases and nothing read it (v0.9.496)** — `publish.sh` records an u
**Boards lie, and an asset register believes them (agentd 0.114.0)** — "To Be Filled By O.E.M.", "System Serial Number",
**The pure decision helpers are deliberately not `cfg`-gated (agentd 0.114.0)** — this project builds Linux with `cargo
**⛔ `meta.ubuntu_pro` — the product could drive Ubuntu Pro against months-stale posture, and the sudo grant was never th
**⛔ Four verbs dispatched to every host that could never run there — 15% of all fleet command traffic, failing daily (ag
**⛔ Un-banning an IP had never worked on ufw (agentd 0.111.0)** — the wrappers `delete` branch accepted a rule **number*

Features

**Alpine host enrolment: sudo, the community repo, and the OpenRC reconcile** — found on a real Alpine 3.22 box. Enrolme
**The Vector codename fallback no longer crosses the musl/glibc boundary** — `resolve_pkg_target` uses the codename slot
**Alpine is a supported platform — an agent that installs, supervises and updates itself under OpenRC (agentd 0.102.0 /
**`Fact::Apt` — the third axis of the capability scope (agentd 0.102.0)** — the OS axis (`WINDOWS_CAPABILITIES`) separat
**`check:alpine-install` — the Alpine path is executed, not reasoned about (v0.9.485)** — the port was reasoned through
**~~Still Debian-only on Alpine~~ — closed, and most of it was already stale (v0.9.494)** — this entry named four blocke

Features

Maintenance windows CRUD — `routes/maintenance-windows.js`
Maintenance check service + scheduler — `services/maintenance-check.js` + `lib/maintenance-window-scheduler.js`
Maintenance runner worker — `workers/maintenance-runner-worker.js`
Maintenance hook — `routes/maintenance-hook.js`
Admin maintenance UI — `/admin/maintenance-windows`

Features

**⚠ The 17-day maintenance latch, and kernel versions on a public page (v0.9.365)** — audited live on status.lbreeze.com
**A component with zero monitors still renders** — auto-provisioned host components (one per host, every 15 min) occupy
**Mobile header (status 0.3.46)** — logo, theme toggle and Subscribe stay on one line at every width; below 640px the pa
**Public-status accessibility — WCAG 2.1 AA pass (v0.9.202)** — skip link, nav/main landmarks, visible focus rings, `pre
Core status schema — `status/migrations/20260422100000_status_core.js`
Public status JSON + HTML — `status/src/routes/public.js`
RSS feed — `status/src/routes/feed.js`
Subscribe endpoint (double opt-in) — `routes/subscribe.js`
Subscriber category prefs — `subscriber_category_prefs` migration
Audience-scoped components — `components_audience` migration
Auto-detected incidents — `services/incident-detector.js`
Component SLAs — `component_sla` migration
Component roll-up engine — `services/component-roll-up.js`
Component dependencies (fixed-point propagator) — `services/dependencies.js`
Component metadata — `routes/admin-component-meta.js`
Monitor geolocation — `lib/geo-lookup.js`
Monitor admin + detail — `routes/admin-monitors.js`, `routes/monitor-detail.js`
Probe-protocol endpoint — `routes/probe-protocol.js` + `lib/probes.js`
Probe node management — `routes/admin-probe-nodes.js`
Multi-region voting — `services/multi-region.js`
External-feed polling (Statuspage/AWS/generic) — `services/external-feeds.js` + `workers/external-poller.js`
Admin: incidents / maintenance / components / subscribers / SMTP / branding / ping
Self-update endpoint — `routes/self-update.js`
**Pre-maintenance reminder emails (v0.9.161 / status 0.3.34)** — subscribers now get an "upcoming" heads-up (1h–24h befo
**Subscribe + live auto-refresh on all themes (v0.9.161)** — the subscribe modal/button + SSE live-refresh were aurora-o
**Staleness banner + honest "unknown" state (v0.9.161)** — public page shows an amber "may be out of date" bar when the
**T2 status-system enterprise hardening (v0.9.161–164)** — full 3-audit security/correctness pass: stored-XSS serializer
**Admin default light/dark mode + lockable toggle (v0.9.169 / status 0.3.42)** — operators pick the public page's defaul
**Enterprise rack/node accent — public page (v0.9.169)** — a rack-server brand-mark (no-logo fallback) + a static node-r
**Status Page admin consistency + rack/node accent (v0.9.170)** — the 14 STATUS PAGE admin pages (`oncall/ui/app/status-
**HTTP assertion checks (v0.9.171 / status 0.3.43)** — http monitors gain AND-combined assertions on top of expected_sta
**Multi-step transaction monitors (v0.9.171 / status 0.3.43)** — new `transaction` kind for black-box application testin
Themes — `services/themes.js` (standby · aurora · operational · minimal · hero · dark · radial)
"Standby" theme as default (status v0.3.11) — the public page in the product's own admin-desk look: `#0b0d14` canvas, `#
Monitor detail: latency min/avg/p95/max chips on Recent probes (status v0.3.11) — stats strip over the table's OK probes
SSE live updates — `services/sse.js`
Snapshot worker — `workers/snapshot-worker.js`
Email worker — `workers/email-worker.js`
Monitor worker — `workers/monitor-worker.js`
Probe-stall self-alert (status v0.3.14 / oncall v0.8.31) — process-local watcher (independent of BullMQ's failure domain
War-room automation (v0.8.43) — per-incident self-hosted Jitsi rooms grew an auto-start policy (`video.warroom_auto`: of
License packaging tiers (v0.8.45, hosting arc #1) — zlic licenses may carry `tier` (enterprise/pro/solo) + `limits` (hos
Fleet overview + version drift (v0.8.46, hosting arc #2) — `/fleet/` landing page: hosts online/stale KPIs, agent-versio
Cluster-wide DNS zones + global record templates (v0.8.47, hosting arc #3) — `/enhance/dns/zones/`: every zone in the cl
Mail delivery telemetry (v0.8.48 + agent 1.44.0, hosting arc #4) — Delivery section on /email-security: Postfix sent/def
Cross-cluster Enhance migration — Phase 1 single-site workflow (v0.8.49 + agent 1.45.0, hosting arc #5 flagship) — `/enh
Pen-test sudoers-audit accuracy fix (v0.8.50 + agent 1.45.1) — the audit substring-matched shell binaries and flagged th
Security overview + AbuseIPDB enrichment (v0.8.51, hosting arc #6) — `/security/`: one org-wide posture dashboard compos
DNS SOA-serial drift monitoring (v0.8.52, hosting arc #7) — the "Standby watches all 4 nameservers" half of the 4-NS top
Service → logs deep-linking (v0.8.53, hosting arc #8 Tier 1) — each service row on /services/ links its log files straig
DNS secondaries minting — 4-NS topology (v0.8.54, hosting arc #7b) — `/enhance/dns/secondaries/`: Standby mints ns2-ns4
External DNS secondaries — CentralNIC/third-party AXFR providers (v0.8.58) — register a managed-AXFR provider (NS hostna
DNS BIND zone import/export (v0.8.59, hosting arc #7c) — Export any built-in-PowerDNS zone as an RFC 1035 master file; I
Service detail dashboards (v0.8.59, hosting arc #8) — clickable service in the portfolio → health rollup (healthy/degrad
IP commerce — floating IPs (v0.8.59, hosting arc #10 Phase 1) — buy/assign/unassign/release routable floating IPs on IP-
Service-centric status page (v0.8.73 / status 0.3.25) — the default public status page is now a proper, industry-standar
Revert status-app host-once rework — restore the original status page (v0.8.72 / status 0.3.24) — the v0.8.66 "host-once
Per-host detail: one combined graph, SSL as cert-expiry (v0.8.71 / status 0.3.23) — the `/component/:slug` page was 5 se
Fix Hot sites Memory/vCPU column alignment (v0.8.70) — the metric cell used `inline-flex justify-end` with a fixed-width
IPDB / Network / DNS auto-population (v0.8.69) — three empty pages filled from data the agents/APIs already collect. **I
Enhance Hot sites: both Memory+vCPU columns + real Disk (v0.8.68) — `top-websites` now returns BOTH memory and vCPU per
Enhance Hot sites table rework + SSL tracking (v0.8.67) — the Overview "Hot sites" table dropped the always-empty Cap/%-
Status app: host-once listing + per-host detail with per-check graphs (v0.8.66 / status 0.3.22) — the public status page
Hosts table: Kernel column + reboot-needed signal (v0.8.65) — new `Kernel` column on `/hosts` shows the running kernel (
Internal status board + live host status button (v0.8.64) — (1) `/status-admin/board/` — engineer-facing live board pull
Status probes: IPv4-first with IPv6 fallback (v0.8.63 / status 0.3.21) — `status/src/lib/probes.js` now resolves every t
Zephyr ↔ Standby peer pairing — Standby (receiving) side (v0.8.62, CROSS_PROJECT_CONTRACT §H) — Settings → Integrations
Hotfix: BOM-free oncall/package.json (v0.8.61) — v0.8.60's version bump was written by PowerShell `Set-Content -Encoding
Provisioning SSH keys + audit fixes (v0.8.60) — cloud providers carry default `ssh_keys` (comma-separated names/IDs) att
Cloud-aware Network page — Hetzner Cloud Firewalls (v0.8.55, hosting arc #9) — on VPS fleets the switch/LLDP topology is
Email security auto-onboard — agent-proxied Rspamd (v0.8.56 + agent 1.46.0, email Phase 2) — "Detect from fleet" on /ema
Heartbeat (push) monitors (status v0.3.15 / oncall v0.8.32) — new monitor kind `heartbeat`: the watched job (cron/backup

Features

**⛔ Endpoints can never reach the public status page (v0.9.471)** — status.lbreeze.com was publishing `BOOK-L5DV4ES278`
Status-page push from oncall — `oncall/src/services/status-page-push.js`
Status admin proxy — `routes/status-admin-proxy.js`
Status connection settings — `routes/status-connection.js`
Status release publisher — `lib/status-release-publisher.js` + `routes/status-release.js`
Components shared between oncall + status — `status_page_component_id` + `status_page_groups_monitors` migrations
Status maintenance bridge — `services/status-maintenance.js`

Features

HTTP probe — `probe/src/checks.js`
TCP probe — `probe/src/checks.js`
ICMP probe — `probe/src/checks.js`
TLS / SSL certificate probe (with min-days-left) — `probe/src/checks.js`
DNS probe — `probe/src/checks.js`
Probe runner — `probe/src/index.js`

Features

Multi-tenant instance switching — `desktop/src/main.rs`
Tray icon + menu — `desktop/src/main.rs`
Custom audio alert pipeline (rodio) — `desktop/src/main.rs`
Bundled WAVs (critical / high / warn / info / ack / mention / dm) — embedded via `include_bytes!`, see `desktop/sounds/g
User sound overrides at `%APPDATA%/sounds/`
play_alert / play_kind / play_sound / stop_alert / list_sounds commands — `desktop/src/main.rs`
Cross-platform autostart — `tauri-plugin-autostart`
Taskbar flash command
Windows taskbar overlay badge with unread count — `set_unread_badge()` in `desktop/src/main.rs` + `desktop/icons/badge-d
Rust-side notification-action forwarding — `forward_notification_action()` re-emits OS toast clicks as Tauri events
On-demand updater — `/api/desktop/update` endpoint
SHA-256-verified in-app self-update — `download_and_verify_update` / `launch_installer` in `desktop/src/main.rs` (downlo
First-run instance probe via Rust reqwest (no CORS) — `probe_instance` in `desktop/src/main.rs`
Start minimized to tray on OS-login autostart (`--autostart`) — `desktop/src/main.rs`
Admin upload of desktop installers (.exe/.msi) — `routes/desktop.js` `/api/admin/desktop/releases` + `ui/app/downloads`
Deep-link `standby://<host>` — `tauri-plugin-deep-link`
First-launch onboarding — `desktop/dist-frontend/welcome.html`
App-version exposure
Ed25519 updater signing — `desktop/standby-updater.key.pub`
Server-side `/api/desktop` route — `oncall/src/routes/desktop.js`

Features

**`check:control-catalog` verifies a framework is STORABLE and NAMEABLE (v0.9.329)** — `compliance_controls.framework` i
**`check:columns` strict (v0.9.328)** — previously failed only on a column absent from the WHOLE schema and downgraded "
**Fail-closed release-signature verification + TOFU trust anchor (v0.9.106–108)** — self-update REFUSES to apply an unsi
**Verified manual `standby-update` (v0.9.109)** — `deploy/install.sh` replaces the legacy unverified `curl … /install/st
Auto-prune old release dirs after a healthy self-update (keep last 3) — `prune_old_releases()` in `scripts/standby-vendo
Desktop release runbook (RepoMade source release + local build) — `desktop/RELEASE.md`
Release build script — `scripts/build-deploy-zips.js` + `oncall/scripts/build-release.js`
Release signing keygen — `oncall/scripts/gen-release-key.js`
SBOM generator — `oncall/scripts/gen-sbom.js`
CVE scan script — `oncall/scripts/cve-scan.js`
Smoke test — `oncall/scripts/smoke-test.js`
Bootstrap / provision / setup-server — `oncall/scripts/bootstrap.js`, `provision.js`, `setup-server.js`
Admin CLI — `oncall/scripts/admin-cli.js`
MFA coverage diagnostic — `oncall/scripts/diag-mfa-coverage.js`
Fire test alert — `oncall/scripts/fire-test-alert.js`
Telemetry host setup — `scripts/setup-telemetry-host.sh` (VictoriaMetrics + ClickHouse + nginx + LetsEncrypt; Ubuntu 22.
**Production VPS installer (Ubuntu 22/24/26 + Debian 12/13)** — `scripts/install-standby-production.sh` + `VPS_INSTALL.m
**CLI admin seed (unattended)** — `oncall/scripts/seed-admin.js` + `npm run seed-admin`
**Curl-installable bootstrap** — `oncall/src/routes/production-install.js` serves `/install-standby-production.sh` (with
**Headless workers entrypoint** — `oncall/scripts/workers.js` + `oncall/src/workers/index.js`. Set `WORKERS_DISABLED=1`
**In-app auto-update from RepoMade** — `oncall/src/workers/release-poller.js` polls `<your-repomade>/api/v1/repos/standb
**Smart install (auto-detect extracted source)** — `scripts/install-standby-production.sh` v0.3.1+ checks if it's runnin
**`.repomadeignore`** — whitelists operator-facing docs (`VPS_INSTALL.md`, `CROSS_PROJECT_CONTRACT.md`, `PLAN_LICENSING_
**CROSS_PROJECT_CONTRACT.md** — binding spec for the Standby ↔ RepoMade ↔ Zephyr integration (Zephyr=licensing authority
**Pager noise guardrails (v0.3.2)** — `pager_source_config.min_severity_to_page` floor (default 'high') prevents warning
**Voice-then-context-SMS workflow (v0.3.3)** — for chain steps with both voice+sms channels, voice fires first, SMS foll
**Role-based package auto-update policies (v0.3.4)** — operator enables seeded built-in policies (PowerDNS, BIND9, nginx
**Canary safety gate for auto-update (v0.3.5)** — `oncall/src/workers/maintenance-runner-worker.js#firePolicyWindow` det
**`service.healthcheck` agent capability (agent 1.21.0)** — composite probes (`systemctl_active`, `tcp`, `http`, `dig`,
**Edge-installer hook + curl one-liner (v0.3.8)** — `deploy/install.sh` is the contract RepoMade's edge installer (`<you
**Zephyr license + edge auto-update (v0.3.7)** — full cutover from the legacy `rmt_` push-token flow to the production l
**Self-contained self-update subsystem (Zephyr-style, polkit-dispatched, fully autonomous as of v0.6.20)** — `scripts/st
**Permissions-Policy header** (helmet onSend hook; configurable) — `oncall/src/plugins/security-headers.js`
**BullMQ Redis socket fix** — `oncall/src/queue.js` + `status/src/{queue,redis}.js` now spread the full `config.redis` s
**Node 24 LTS verified live** — `upgrade-node.sh` handles deb822 `nodesource.sources` (Ubuntu 24.04+/26.04); ran clean o
**One-shot Node-24 + dependency upgrade scripts** (snapshot + auto-rollback, per-app reinstall, `npm rebuild argon2` for
**Hardened `.npmrc`** (audit-level=moderate, save-exact, strict package-lock, fetch retries) — `.npmrc`
**Node 24 LTS target** (engines widened to `>=22`, `.nvmrc`→24, installer `NODE_MAJOR=24`) — `package.json` engines + `.
**Platform license encrypted at rest** (AES-256-GCM, decrypt on read; legacy plaintext passthrough) — `routes/admin-rele
**Platform-update audit** (signature-verification gap, edge trust, contract drift; ranked findings) — `AUDIT_PLATFORM_UP

Features

[x] **291 confirmation/alert/prompt gates fixed for the desktop client (v0.9.374)** — `window.confirm/alert/prompt` are
**Per-page browser tab titles (v0.9.331)** — all 206 admin pages shipped the *same* title: the root layout's static `On-
`/`, `/activity`, `/incidents`, `/incidents/detail`, `/alerts`, `/alert-rules`, `/notification-log`
`/chains`, `/chat`, `/handoff`, `/pager-intelligence`, `/swaps`, `/schedules`, `/schedules/detail`
`/runbook`, `/runbook/edit`, `/runbook/run`, `/runbooks`, `/runbook-routes`, `/response-templates`
`/hosts`, `/hosts/detail`, `/approvals`, `/credentials`, `/services`, `/changes`
`/compliance`, `/compliance/drilldown`, `/compliance/oscap`, `/compliance/templates`
`/cve`, `/cve/detail`, `/cve/latest`, `/threats`
`/av-policies`, `/firewall-policies`, `/firewall-drift`
`/mitigations`, `/mitigations/plan`, `/pen-tests`, `/pentest`, `/breach`
`/risks`, `/assets`, `/policies`, `/retention`, `/audit`
`/subprocessors`, `/training`, `/trainings`, `/trainings/edit`
`/telemetry`, `/metrics`, `/logs`, `/slos`, `/system-status`
`/admin/log-collection`, `/admin/maintenance-windows`, `/admin/fleet-updates`
`/status-admin`, `/status-admin/components`, `/status-admin/component-meta`, `/status-admin/dependencies`
`/status-admin/external-sources`, `/status-admin/incidents`, `/status-admin/maintenance`
`/status-admin/monitors`, `/status-admin/monitors/detail`, `/status-admin/probe-nodes`
`/status-admin/subscribers`, `/status-admin/email`
`/integrations`, `/enhance`, `/enhance/sites`
`/ai-providers`, `/ai-tools`, `/admin/ai-spend`
`/login`, `/profile`, `/invite`, `/users`, `/teams`, `/sso`, `/access-keys`, `/service-accounts`, `/settings`
`/compensation`, `/downloads`

Features

**PostgreSQL only — MySQL fully dropped** — every runtime/CLI/script/bootstrap is pg-only; the `DB_CLIENT` dual-path was
**Portable SQL helpers** — `oncall/src/lib/db-portable.js` exporting `intervalAgo`, `jsonGetText`, `insertIgnore`, `upse
Cross-engine migrations — every `MODIFY COLUMN ENUM` widening, FULLTEXT index, and JSON manipulation runs on both MySQL
Redis unix-socket support — `REDIS_SOCKET=/var/run/redis/redis-server.sock` env var (`oncall/src/config.js` + `redis.js`

Features

24 BullMQ queues — `oncall/src/queue.js`
Redis client — `oncall/src/redis.js`
App settings store — `lib/app-settings.js`
Fingerprinting — `lib/fingerprint.js`
PDF generation — `lib/pdf.js`
SHA-256, ULID, reference data, storage abstraction — `lib/`
dpkg version comparator — `lib/dpkg-version.js`

Features

Zod schemas — `shared/src/schemas.js` (Severity, IncidentStatus, Channel, UserRole, E164)

Features

**agentd reaches parity — 132 of 137 capabilities (v0.9.359 / agentd 0.20.0, 07/08/26).** The port list is empty. The fi
**Fleet button: migrate all hosts to agentd (v0.9.360–364).** Preview-first: the dialog computes and names the capabilit
**agentd is the default agent (v0.9.361).** Enrolling a host installs `standby-agentd`; the Python one-liner moved to `i
**Fleet dispatch toasts report the reason the backend actually sent (v0.9.365).** "Dispatched to 0 agents · 18 skipped (
[x] **Audit reports live in the repo, excluded from customer archives (v0.9.365).** Dated HTML audit/plan reports go to
**Slack / Teams chat integration** — chat is internal-only via `chat_channels`/`chat_messages`. No `slack.js`/`teams-web
**PagerDuty / Opsgenie connectors** — no service files.
**Grafana poller** — no current `grafana-poll` worker or service. (Was planned earlier; appears to have been replaced by
**Twilio integration** — removed. SMS/voice now exclusively via MessageBird.
**Wazuh SIEM** — removed in migration `20260512190000_remove_wazuh.js`. Earlier docs claim it's done; it's not.
**Mobile app** — only Tauri desktop + web UI exist. No React Native / iOS / Android.
**Customer DMARC / deliverability API (`CROSS_PROJECT_CONTRACT.md` §14)** — proposed, NOT built (code-audited 2026-07-21
**Combined partner/oncall-overview endpoint (`CROSS_PROJECT_CONTRACT.md` §10)** — optional per the contract; not built.
~~Public API SDK / OpenAPI spec~~ — **DONE** (v0.6.70): OpenAPI 3 spec at `/api/v1/openapi.json` + Redoc docs at `/api/d
[x] ~~In-app backup/restore UI~~ — **DONE**: full `/backups` surface (mint host, policy builder, engine installer, sched

Features

CVE-fix bumps: postcss → 8.5.14, @fastify/jwt → 10, @fastify/static → 9, nodemailer → 8, fast-xml-parser → 5
Tier 2 majors: echarts → 6, @fastify/multipart → 10, pino-pretty → 13, lucide-react → 1.x
Tier 3 careful majors: zod → 4 (every route), tailwindcss → 4 (CSS-first @theme), next → 16