Sencho exits public beta after a clean v0.92.0 QA pass. Replace the global
"public beta on the path to v1.0" callout with scoped maturity language across
the README, KNOWN_LIMITATIONS, quickstart, troubleshooting, upgrade, and the
security-architecture reference. The copy stays honestly pre-1.0 and avoids a
blanket "stable" claim.
Reframe the Scale limitations to credit QA, audit, and end-to-end validation
while keeping the honest caveat that large-scale performance is not yet
benchmarked.
Fold the new v0.92.0 capabilities into the README sections: Compose Doctor
preflight checks, health-gated updates with stalled-update recovery, file
move/rename in the explorer, ordered multi-file Compose for Git sources, the
Security overview, on-demand node-wide scans, the Compose network inspector
with an exposure-intent guard, scan policy packs, documentation-drift flags,
and configurable image-update cadence with registry/source links.
Update tier mentions for the capabilities now available on Community:
- Trivy managed auto-update, single-scan SBOM export, node labels, and the
fleet topology layout modes are present-tense Community features.
- The audit log documents a 14-day recent-activity window on every tier, with
CSV/JSON export, anomaly detection, and configurable retention as Admiral.
- Private registries split Docker Hub / GHCR / custom (every tier) from AWS ECR
(Admiral). SARIF export and deploy enforcement stay Admiral.
Also removes two fence-spec phrasings (per-tier label cell and 'visible on
Admiral' for the audit tab) in favor of stating each requirement once.
* refactor(settings): split System Limits and regroup the hub
System Limits had grown into a grab-bag of host alert thresholds, Docker
cleanup, and mesh data-plane controls under one mislabeled section. Split it
into Host Alerts, Docker & Storage, and Fleet Mesh, and split Developer into
Developer Diagnostics and Data Retention. Reorganize the sidebar into ten
domain groups: Personal, Access, Infrastructure, Monitoring, Notifications,
Automation, Organization, Security, Operations, Help.
Each section now saves only its own keys, so a concurrent edit in one section
no longer clobbers another. Data Retention sends the audit-log window only on
a paid plan, matching the field's existing visibility, so a Community save no
longer fails on a key the operator cannot set. NumberChip moves to a shared
module and the toggle reuses the existing shared component. The /settings API
is unchanged.
* test(settings): cover registry structure and per-section save payloads
Add structural invariants for the ten-group registry (every item maps to a
real group, ids are unique, the System Limits and Developer splits land in the
right groups with the right gates, renamed labels and the Registries paid gate
hold) and per-section payload tests asserting each split section patches only
its own keys, including the Community path where Data Retention omits the paid
audit-log key.
* docs(settings): document the regrouped settings hub
Rewrite the settings reference for the ten-group layout, replace the System
Limits page with Host Alerts, Docker & Storage, and Fleet Mesh, and document
the prune-on-update, reclaimable-space banner, and mesh auto-recreate settings
that were previously undocumented. Update the Settings navigation breadcrumbs
across the feature docs and refresh the affected screenshots.
* fix(settings): show Access sections as instance-global, not operator-scoped
License, Users, SSO, and API Tokens are instance-global settings but the
masthead scope label rendered them as operator-scoped because it keyed off the
old Identity group. Only Personal sections (account, appearance) are
operator/browser-scoped now; everything else reads as global.
Also add a compile-time exhaustiveness guard to the section switch so a future
SectionId added without a matching case fails the build instead of silently
rendering a blank panel.
* docs(settings): remap remaining settings breadcrumbs to the new groups
Update the navigation breadcrumbs that still pointed at the removed Identity,
Alerts, and Advanced groups: API Tokens and Users now sit under Access, Webhooks
under Automation, Labels under Organization, App Store under Infrastructure,
Appearance under Personal, and scan policies under Security > Vulnerability
Scanning. Correct the settings reference scope note so Access reads as global.
* docs(settings): remap renamed-section breadcrumbs across feature docs
Sweep every feature, operations, getting-started, and reference page for
navigation paths that still named the renamed settings sections, and point them
at the current ones: Security becomes Security > Vulnerability Scanning,
Notifications becomes Notifications > Channels, Routing becomes Notifications >
Notification Routing, and Developer becomes Operations > Developer Diagnostics
(with its retention windows under Operations > Data Retention). App Store moves
under Infrastructure and the four-group overview in the getting-started intro is
rewritten to the ten groups. Separators each page already used are preserved.
* feat(pricing): collapse to two tiers (Community + Admiral)
Collapse Sencho's pricing from three tiers (Community / Skipper / Admiral)
to two: a generous free Community tier and a single paid Admiral tier. The
Skipper tier is removed.
Now free in Community: auto-heal, auto-update, scheduled operations,
webhooks, notification routing, Fleet Actions and bulk operations, SSO
preset providers (Google / GitHub / Okta), unlimited users with admin and
viewer roles, and deploy safety (atomic deploys, auto-rollback, and
one-click rollback).
Admiral (paid) is focused on running and governing a fleet: blueprints,
Fleet Secrets, deploy enforcement, vulnerability report export, audit log,
host console, private registries, mesh networking, node cordon, managed
cloud backup, LDAP / Active Directory SSO, and the advanced RBAC roles
(deployer, node-admin, auditor) with per-resource scoped assignments.
Internally the license variant distinction is removed so tier is binary
(community / paid). License validation still verifies the Lemon Squeezy
store and product before granting paid status.
Docs and the contributor guide are updated to the two-tier model.
* docs(pricing): correct licensing page to two-tier pricing and tidy stale tier wording
The licensing docs page kept the old Admiral pricing plus a Founder
Lifetime column and an Enterprise paragraph after the two-tier collapse.
Update it to $12/month or $99/year, drop the lifetime and Enterprise
content, and link to the pricing page for current pricing.
Also fix stale "Skipper" wording in CLA.md, SUPPORT.md, one test title,
and three test comments. Historical CHANGELOG entries and the
retired-Skipper license-guard test are intentionally left as-is.
* docs: align licensing and SSO pages with the two-tier model
Correct the SSO overview so the Google, GitHub, and Okta presets read as
available on every tier, matching the provider table; only LDAP and Active
Directory require Sencho Admiral. Remove the lifetime-plan references from the
licensing, settings, and troubleshooting pages so they reflect subscription-only
Admiral pricing.
* fix(rbac): omit scoped permissions from /me on the Community tier
Scoped role assignments only take effect on the paid tier, but GET /api/permissions/me returned them unconditionally, so a downgraded instance with leftover assignments rendered per-resource affordances the API then rejected with 403. The endpoint now mirrors the permission middleware and includes scoped permissions only on the paid tier. Adds a regression test covering the downgrade case.
* docs: use custom-pricing wording on the contact page
The two-tier model has no Enterprise tier; reword the contact page's enterprise pricing/deals to custom pricing/deals so it does not imply a tier that no longer exists.
Close the trust-blocking items from the pre-v1.0 readiness audit so the
repository is ready for the first public posting. No backend or
frontend code changes; no tier gates move.
README:
- Add a single beta-status GitHub [!NOTE] callout below the dashboard
image. Beta status also appears in selected install-flow docs
(Quickstart, Known Limitations, Security Architecture, Upgrade,
Troubleshooting) so install-flow readers are not surprised.
- Add a "Before you install" subsection that names the docker.sock
privilege model with the Portainer / Dockge / Komodo comparison.
- Fix the docker run example: add the missing /opt/docker:/opt/docker
mount that COMPOSE_DIR=/opt/docker depends on.
- Reword the two "no exposed Docker socket" sentences so the claim is
scoped to remote / cross-node exposure.
- Reword "transparent HTTPS proxy" to "authenticated HTTP and WebSocket
proxy" with a TLS / VPN reminder.
- Fix the RBAC bullet: the role set is admin, viewer, deployer,
node-admin, auditor. There is no "editor" role.
- Add tier markers to the Capabilities list (matrix sentence plus
per-bullet (Skipper) / (Admiral) markers), verified against the
route guards in backend/src/routes/.
- Fix the broken notification-routing link to point at the existing
alerts-notifications#notification-routing anchor.
- Soften the BSL paraphrase to point at LICENSE plus the license FAQ.
- Add a "Telemetry and data handling" section: no telemetry, no
analytics, no crash reports; license validation only when a paid key
is activated.
- Add a "What Sencho is not (yet)" section so the scope boundaries are
visible above Capabilities.
Templates:
- PR template: drop the contradictory CHANGELOG checkbox; release-please
owns CHANGELOG.
- Bug report template: update the stale 0.2.2 version placeholder to
0.86.6 and add fields for compose snippet, container logs, browser
console, and an involved-subsystems checkbox.
Docs:
- docs/operations/trivy-setup.mdx: replace both sencho/sencho:latest
occurrences with the published image saelix/sencho:latest.
- docs/reference/settings.mdx: rewrite the API Tokens Note (no tier
gate in code; admin role only) and the Stack Labels Note (basic
CRUD is free; only bulk actions require Skipper or Admiral).
- Add the shared beta-status Note callout to docs/getting-started/
quickstart.mdx, docs/operations/upgrade.mdx, docs/operations/
troubleshooting.mdx, and docs/reference/security.mdx.
CONTRIBUTING:
- Replace the public link to the in-repo coding-rules file with a
pointer to docs.sencho.io for architecture deep-dives.
- Fix the sample clone URL case (Sencho.git becomes sencho.git).
New files:
- SUPPORT.md: where to ask, response-time expectations, in / out of
scope.
- KNOWN_LIMITATIONS.md: scale, platform, architecture, and feature
limits documented for the beta audience; scale numbers marked "not
benchmarked yet" pending real benchmarking.
Restructures the Documentation tab so each group answers one operator
question.
- Split the 12-page "Stacks & Deployments" into Stacks (per-stack work)
and Deployment (the act of deploying); promote Resources Hub to a
standalone item.
- Dissolve the 2-page "Platform" junk drawer: Sidebar moves to Stacks,
Host Console moves to Fleet.
- Rename "Fleet & Multi-Node" to "Fleet"; absorb Node Compatibility
from Reference. Move Scheduled Operations from Fleet to Automation
(now a 4-page group covering Scheduled Ops, Auto-Update, Auto-Heal,
Webhooks).
- Clean up the Reference tab: drop misplaced node-compatibility, move
root-level security.mdx into reference/, delete the orphan
reference/verifying-images.mdx after porting its Available Tags
table into operations/verifying-images.mdx.
- Reorder top-level groups: Operations moves above Reference.
- Rename two misleading page titles: "Deploy Progress Modal" becomes
"Deploy Progress" (drops the UI implementation leak); "Auto-Update
Readiness" becomes "Auto-Update Policies" (matches filename and
sibling "Auto-Heal Policies").
Verified: docs.json parses as valid JSON, 59 disk .mdx files match
59 nav entries with zero orphans and zero broken refs.
Anso