Commit Graph

301 Commits

Author SHA1 Message Date
rcourtman 9c8387be6f Export restricted outbound HTTP security helpers 2026-04-22 10:05:57 +01:00
rcourtman de99fcb1f0 Restrict purchase return HTTP callbacks to loopback 2026-04-22 09:49:36 +01:00
rcourtman 2806cc6c9e Split audit log access into dedicated token scope 2026-04-22 07:59:12 +01:00
rcourtman a44cde6b92 Gate licensing test helpers out of release builds 2026-04-22 06:18:40 +01:00
rcourtman 9c4bb4a90e Fail closed on auth env hashing and TLS floors 2026-04-22 05:53:02 +01:00
rcourtman 14fc2bd4f0 Fail closed on wildcard trusted proxy configuration 2026-04-22 04:23:23 +01:00
rcourtman f7c1d9b629 Require accepted org invitations and stable runtime capabilities 2026-04-22 03:06:22 +01:00
rcourtman 70acd663bd Strengthen export and license persistence encryption 2026-04-22 01:03:10 +01:00
rcourtman 513399b004 Harden hosted signup and audit webhook trust paths 2026-04-22 00:54:49 +01:00
rcourtman 586473ee31 Bind recovery and bootstrap auth to direct loopback 2026-04-22 00:39:53 +01:00
rcourtman 360d08104e Compile out release env guardrail bypasses 2026-04-22 00:05:57 +01:00
rcourtman d8d94c48e1 Expose local commercial funnel diagnostics 2026-04-20 22:27:34 +01:00
rcourtman c20766b7b8 Instrument self-hosted billing conversion stages 2026-04-20 21:46:59 +01:00
rcourtman 61430703b2 Reframe self-hosted paid value around operator outcomes 2026-04-20 17:30:52 +01:00
rcourtman c4a4d175ce Fix v6 dry run backend contract regressions 2026-04-20 14:57:49 +01:00
rcourtman 29d96aec33 Reduce metrics store transaction churn
Refs #1124
2026-04-19 17:11:14 +01:00
rcourtman 9e60f2aec6 Scrub stale community billing caps
Refs #1429
2026-04-19 12:17:20 +01:00
rcourtman e6b0d47bd6 Gate Docker mutations on authz-plugin posture 2026-04-18 10:45:25 +01:00
rcourtman 943389827f Scrub stale monitored-system caps on self-hosted uncapped tiers
v5-migrated installations can persist a legacy max_monitored_systems value
(e.g. Community=1) in the license claims. After 5914a4127 made all
self-hosted tiers uncapped, EffectiveLimits() only scrubbed Lifetime and
v5-grandfathered Pro, so migrated Community / Pro / Relay installs kept
emitting the old cap and the "Over plan" banner still rendered on rc.2.

Extend the scrub to every self-hosted tier whose TierMonitoredSystemLimits
entry is 0, and stop monitoredSystemContinuityStatusLocked() from falling
back to the grant's plan limit when the license says uncapped. 0 is now
a first-class "unlimited" signal, not a missing-data sentinel.

The grandfather-floor continuity is still captured for audit, but no
longer enforces on self-hosted tiers. Cloud and MSP limit resolution is
untouched.

Refs #1429
2026-04-17 13:52:02 +01:00
rcourtman 9855973e5b Fix non-root storage hardening for Helm startup 2026-04-16 21:26:02 +01:00
rcourtman 5914a4127d Make self-hosted core monitoring uncapped
Refs #1409
2026-04-16 01:21:57 +01:00
rcourtman 7e5971a3ee Allow local mergerfs mounts in disk metrics
Stop treating every fuse.* filesystem as a remote mount in the shared disk filter so local user-space filesystems such as mergerfs remain visible to host disk stats and alerts while explicit remote fuse types like sshfs still stay filtered.

Refs #1419
2026-04-15 20:11:25 +01:00
rcourtman 31315fb594 Normalize Proxmox special ZFS groups
Refs #1413
2026-04-15 16:40:43 +01:00
rcourtman 6d65571105 Preserve grandfathered recurring billing baselines 2026-04-15 14:32:46 +01:00
rcourtman bd8b2efd1b Add monitored-system admission extension hook 2026-04-15 14:04:21 +01:00
rcourtman 8d703f2371 Explain monitored-system over-plan legitimacy 2026-04-15 13:38:57 +01:00
rcourtman 6c1364ef54 Clarify monitored-system admission freeze posture 2026-04-15 13:15:10 +01:00
rcourtman 84943907af Port v5 Ceph and Podman runtime compatibility 2026-04-15 12:32:05 +01:00
rcourtman f3c4d4d83d Grandfather active v5 Pro customers as uncapped 2026-04-15 00:35:24 +01:00
rcourtman b84e4067e8 Uncap grandfathered lifetime entitlements 2026-04-14 23:34:37 +01:00
rcourtman 7cac04e2ff Track v6 install version through licensing runtime 2026-04-14 11:44:59 +01:00
rcourtman 58e67c7b19 Canonicalize usage-data telemetry reporting 2026-04-14 11:05:10 +01:00
rcourtman a928cce126 Add hosted-runner budget for metrics query SLO 2026-04-11 19:57:49 +01:00
rcourtman 11f9ea4479 Rebaseline concurrent metrics CI SLO 2026-04-11 19:30:09 +01:00
rcourtman 166b4768db Fix grant refresh callback race test 2026-04-11 19:15:27 +01:00
rcourtman fb4fb55461 Adjust metrics query SLO for GitHub runners 2026-04-11 17:02:07 +01:00
rcourtman 6372eccbf4 Rebaseline metrics store SLO envelopes 2026-04-11 15:23:02 +01:00
rcourtman 347a013e79 Stabilize RC release proof contracts 2026-04-11 14:51:10 +01:00
rcourtman 4ca488101e Optimize compact storage summary chart path 2026-04-10 19:09:12 +01:00
rcourtman b846d66fd0 Gate release mock fixtures behind demo entitlement 2026-04-10 12:33:57 +01:00
rcourtman cebf97f3b4 Calibrate metrics batch-query RC envelope 2026-04-09 23:43:36 +01:00
rcourtman b4199a4b96 Fix remaining RC backend proof drift 2026-04-09 23:06:49 +01:00
rcourtman a6ba806af9 Stabilize remaining RC dry-run proofs 2026-04-09 22:43:09 +01:00
rcourtman 6af7c18936 Calibrate remaining metrics CI SLO envelopes 2026-04-09 21:50:38 +01:00
rcourtman 0ec2dec65e Calibrate RC CI SLO envelopes 2026-04-09 21:27:03 +01:00
rcourtman 81fef82bdd Restore RC backend proof regressions 2026-04-09 20:15:17 +01:00
rcourtman 46a262f19d Require canonical monitored-system usage availability 2026-04-09 11:15:56 +01:00
rcourtman 5567fd1b80 Stabilize commercial activation continuity ownership 2026-04-09 08:07:34 +01:00
rcourtman f03c8d3441 Make billing recovery route-owned and unblock governed commits 2026-04-08 22:11:10 +01:00
rcourtman 9e83d0862d Tighten self-hosted purchase return binding 2026-04-08 20:21:36 +01:00