// what's new

What's new

Every release, newest first. The notes are in English, as the repository is. Each version links its GitHub release, where the binaries, the images and the Helm chart are.

v0.37.0

No user-facing changes in this release.

v0.36.0

Features

  • api: delivery=email on invite and reset, mail error codes, features on /api/me, rate limit on link redemption (a7cf94b)
  • auth: e-mail delivery of invite and reset links, revoked when the send fails (bf52ba4)
  • config: KUBELATCH_RESEND_API_KEY and KUBELATCH_MAIL_FROM, and mail.from in the chart (42c64f1)
  • edition: per-feature gating with email_links as the first Pro feature (5173328)
  • mail: invite and reset e-mail (template B) in en and es, logo inline (e87c120)
  • mail: stdlib Resend client with inline images and a fixed endpoint (1a952e5)
  • server: wire Resend link e-mails when configured (23470a6)
  • store: account link delivery, single-link revoke and control event counts (fd29b20)
  • web: choose e-mail or link for invitations and resets (ca086da)

Bug Fixes

  • auth: count the hourly e-mail limits inside the issuing transaction (7e84e0a)
  • auth: issue and send an e-mailed link detached from the request (654c6ce)
  • httpapi: an empty chunked reset-link body is the default, not a 400 (3f9d76d)
  • httpapi: say when Resend did not answer and when a reset closed sessions (172f06b)
  • mail: the footer names the configured base URL (00b36cf)
  • web: describe the create sheet as a single-use invitation, which may never be shown (f6e286c)
  • web: Spanish text of subject.bad_delivery says correo, not email (e811b69)

v0.35.0

Features

  • agents: a repeated held write returns its pending request, the retry waits for the decision, and an executed approval says so (32930a3)
  • config: KUBELATCH_AGENT_APPROVAL_WAIT, how long a held write's retry waits for the decision (bd9a9f1)
  • helm: config.agentApprovalWait sets how long an agent's call waits for a held write's decision (2eb0b3d)
  • httpapi: follow in the consent answer and the session views, source on each consent grant (90bfccd)
  • mcp: approvals over multi round-trip requests, a retry that waits for the decision, and one tool list for every caller (152a947)
  • oauth: the consent chooses what the session takes of later grants (follow) (32ffbbe)
  • rbac: sessions that follow their person derive from each grant they receive (5842939)
  • store: agent_sessions.follow and the live sessions that follow a subject (3c7d542)
  • web: consent merges rows per cluster, scope and role and asks what to do with later permissions (f27b79a)

Bug Fixes

  • apierr: an expired approval no longer says it may have been used, now that a run approval has its own code (8ca955e)
  • mcp: a waiting retry answers approval_pending when the server shuts down (c728a02)
  • mcp: cap the retries of one credential that wait for a decision (bba1c49)
  • rbac: a following session derives nothing for a permission the person held at the consent (a6c1f9d)

v0.34.1

Bug Fixes

  • web: keep the activity and the credentials current with their page open (7ff6df4)
  • web: keep the agent pages and the pending count live (2fc7f1f)
  • web: refresh the grants after approving an agent's access request (1bfa002)

v0.34.0

Features

  • edition: check for a new version now, from the Version row (3fe74eb)

v0.33.0

Features

  • web: fold each cluster of My access, as Permissions does (4e1eade)

v0.32.1

Bug Fixes

  • web: Home's connection card takes the full width, compact, with the command beside its copy button (89c787c)

v0.32.0

Features

  • api: grant rows carry their cluster's name, so a member's Home can name the clusters it lists (4344f68)
  • web: an access directory grouped by cluster, on the grouped table without folding (f10a3de)
  • web: Edition lists the installation's health, each check with its state and where to fix it (8f20871)
  • web: Home leads with what needs attention, names the connection in its header and lists access as a directory by cluster (68f21c5)
  • web: Home's attention items and access directory as pure helpers (f7d614f)

Bug Fixes

  • web: Needs attention drops a credential already reissued with the same name and cluster (3795328)
  • web: the health list words a failed GitHub sync by its cause, as Users does (7e38ae8)
  • web: the issue sheet opened from the command palette gives focus back to Home's issue button (2ec92fc)

v0.31.2

Bug Fixes

  • updatecheck: check within 30 s of starting and retry a failed check after an hour (068d6c0)

v0.31.1

Bug Fixes

  • web: role fields stay aligned, and a cap of 0 says the edition does not include it (2d11d04)

v0.31.0

Features

  • audit: filter requests by outcome (denied, error, write) (91141bc)
  • ci: a trust rule names its repository, resolves it through the GitHub App and knows its last redemption (f4f4106)
  • cli: the approval pages learn whether the CLI asked from the browser's network (aee3250)
  • clusters: the enrollment status reports its last refused post, and a cluster says since when it fails (a858aa6)
  • config: KUBELATCH_ACCESS_CONTACT and the update check variables, exposed to the SPA and the chart (8228ed9)
  • credentials: look a whole token up by its hash, and a CI credential names its rule (56e9dfb)
  • edition: a daily check for a newer kubelatch, reported by GET /api/edition (254288f)
  • httpapi: an account's detail says when it linked GitHub and changed its password, and a member's groups carry that membership (e21659e)
  • httpapi: an agent request names the agent that asked, from its session's client name (2c732fd)
  • httpapi: GET /api/edition says the audit retention in force, in hours (74b567f)
  • httpapi: GET /api/subjects/{id}, and the pending link and last activity of every account (5ba6ee3)
  • httpapi: the invite and reset link answers say when the link expires (152a2a0)
  • kubeconfig: a downloaded kubeconfig names its contexts kubelatch-<cluster>, as the CLI does (193e81d)
  • store: last_error_at, enrollment failures, a CI token's rule and a rule's repository label (9691ac7)
  • web: /activity holds my whole activity with its pager, discovery and detail, under Home in the breadcrumb (e384edf)
  • web: a card per cluster with its context, the expired card, ask-for-access through the operator's contact, and my credentials with last use and issue-a-matching-one (f9b6cca)
  • web: a CLI session or CI token wears an outline pill with its word, not a warning (cfabb3b)
  • web: a cluster is Not enrolled, Ready or Error, and a v1 cluster asks to be re-enrolled (530855c)
  • web: a figure can apply its segment, and the figures scroll in one row on a phone (9da0e21)
  • web: a group opens from its name in the groups list, as an account does in Users (37baa03)
  • web: a link opens the grant sheet with the account, the cluster or the namespace already chosen (f312216)
  • web: a list row can be muted, and a submit button keeps its reason under it (3a1e52e)
  • web: a separator in row menus, a large account cell and the missing-webhook notice in the bell (6495f95)
  • web: a trust receipt for the pages that answer a request, with a live clock and the time since it was asked (c1171fd)
  • web: a trust rule read as a sentence, the ref a condition writes, the CI figures and a snippet filled for one rule (eecca77)
  • web: a write's diff says what it changes in one line and knows the metadata the server manages (a06befd)
  • web: Agents shows two cards, approvals first while one waits, with figures that apply their segment and rows on a phone (ce65ec1)
  • web: an account combobox grouped Bots and People, the login in mono with the name as the hint (a7190c7)
  • web: an agent request as a sentence, its outcome and segments, a session's name and role, its tool calls, and the consent's choices (9b3ad32)
  • web: an agent session is named after its agent, lists what waits on it, and reads its timeline by tool call (a1adb8f)
  • web: an agent's consent asks its question over a trust receipt, with chips per permission grouped by cluster and a live summary (21fbb51)
  • web: an object page names itself in the breadcrumb, and the navigation toggle is 36 px (1da488b)
  • web: approve a pending approval from its Agents row, after the decision page's confirmation built from the loaded approval (d445af8)
  • web: audit filters gain period, result and verb chips and a Reset beside Apply (65b9483)
  • web: audit helpers say a request in one line and one sentence, fold bursts, name groups and days, and the summary says the result (fe51a5c)
  • web: CI rules read as sentences, created repository first, with a connect step that fills the workflow for the rule (a918fe5)
  • web: each account has its own page, with its sign-in, access, credentials, CI rules, AI agent and activity (2ac6d51)
  • web: each cluster has its page, with its figures, its enrollment and health, and the bell leads to it (9b02aad)
  • web: Edition says its status in a sentence, the key timeline, the version, and Free beside Pro (8dcacda)
  • web: Empty says the way forward, Pager hides without pages and names its snapshot, Notice can take focus (62eb335)
  • web: every control-plane event reads as one sentence, with its target's page or the word deleted, and its family (d17c750)
  • web: Home's connection as a «Tu conexión» card with a status pill, a list of computer, session and contexts, and its actions in the footer (10966f7)
  • web: Home's pure helpers: cards per cluster, recent expiries, setup steps, the inbox, CLI sessions, days and kubeconfig names (f5e7ee4)
  • web: Home's Status as compact notice rows with a tone icon, the edition caps folded, and each notice's link named by what it does (7685f1e)
  • web: Home's strips (needs you today, setup, status), the connection line with its CLI session, and the recent activity grouped by day (4e2faff)
  • web: how an account gets in, as one pill with its word, and the Users figures that count it (fc0e3c8)
  • web: hunt a leaked token down to its credential, read a credential in a sheet, and revoke from the row (592ea1a)
  • web: in English an agent request is an approval, and a request is a request to a cluster (fdd0c66)
  • web: issuing asks for a name, defaults to the shortest duration, takes a note, says what it will issue, picks the account from a grouped combobox and hands a bot its token first (e29a979)
  • web: ListRows, a list page's rows under md with the action in view (4f947cd)
  • web: LoadFailure, a routed page's load error that keeps its h1 and its way back (e1baa19)
  • web: login offers GitHub alone and moves the password to a step of its own (ed056e4)
  • web: My account is Account with its sessions, Security and Preferences, closes the other CLI sessions and says why the password cannot change yet (12a4e96)
  • web: one Home for everyone: the admin strips, the connection line, a card per cluster, my credentials with their own issue action, and the recent activity (a1478c5)
  • web: PageHeader takes a row of facts under the title (2c0fece)
  • web: sheets take a phone's width with bodies that shrink, and every tab list wraps, guarded (aaa8083)
  • web: SubmitButton keeps focus and says why it cannot submit yet (efba102)
  • web: the account link welcomes by name, sums the link up in a short list, and ticks each password rule as it is met (779ef58)
  • web: the account page's CI rules, AI agent and activity cards (642082c)
  • web: the account page's sign-in and access cards, and the add-to-group sheet pinned on its own (4c28aa1)
  • web: the admin credentials table with reach, issuer and Revoke in view, and a credential's detail in a sheet (bde8915)
  • web: the API types, client methods and fixtures of the views redesign contract (d79c963)
  • web: the audit incident bar keeps account, cluster, period and result in view, with the rest in More filters and the result in the URL (98700d6)
  • web: the audit log pivots from each row to only its account, cluster or credential, and its detail links what it names (a2d25c9)
  • web: the audit log table heads each day, says What in one line, folds bursts and opens a row anywhere (9cb67c6)
  • web: the bell counts decisions only, lists the notices and a new version, and links a single request (9cee3f7)
  • web: the CLI sign-in asks its question over a trust receipt that warns when the CLI is on another network (bcdedbd)
  • web: the cluster helpers say its health, its figures, its grant link and why an enrollment failed (f714367)
  • web: the cluster summary card, whole-card link to its page with three linked figures (17dd352)
  • web: the cluster's access by scope and its namespaces, each with a preset grant (431f774)
  • web: the cluster's last requests and its details, each in its card (2a6eba8)
  • web: the Clusters list is summary cards that lead to each cluster page, where registering lands (6fa33bd)
  • web: the control-plane log reads one sentence per event, links its targets or says they are gone, and opens each event with its JSON in a sheet (ce7b7e8)
  • web: the decision page is titled by the change, counts down, sums up the diff, folds the server's metadata, and confirms Approve with the sentence (6f17234)
  • web: the edition helpers say the status in a sentence, the key timeline, the retention and where to upgrade (d018ccd)
  • web: the enrollment and health card polls its link, says the last failure and never closes by itself (215970e)
  • web: the one-time link dialog guards an uncopied link and says until when it works (0ca5e24)
  • web: the palette groups by entity, offers each account and cluster its ways in, and gives a member their own things (4dac5c9)
  • web: the request detail opens on its title with a sentence, copies the Audit-ID and the request, says the groups in words and links what it names (9c641d6)
  • web: the sidebar orders Access by daily use, rules its groups on the rail, and leaves Edition to the pill and the person menu (8ac1bea)
  • web: the Users list is a directory of five columns leading to each account's page, with the sign-in pill and the help in three lines (096da7b)
  • web: what a credential reaches, its kind line, its use from the audit and the whole-token check (0a301d6)

Bug Fixes

  • apierr: the English texts of an agent approval say approval, never request (c11655c)
  • audit: a credential revoke names its kind, so an agent credential revoked after a lookup never reads as deleted, and a group target reads as a group (20c3bec)
  • ci: a renamed repository and a missing installation are 400s, and a label next to the ids must name them (94e0b5d)
  • ci: the per-rule workflow snippet quotes the environment, so a colon or a # in its name cannot change which environment it names (cae257f)
  • clusters: the enrollment's last failure carries its code and params, so the SPA can translate it (cb7ee7e)
  • config: count the access contact in characters and keep a mirror URL's credentials out of the startup error (07d6860)
  • credentials: a token lookup that matches nothing leaves a credential.lookup event too (3ee7506)
  • credentials: the Spanish credential.unknown says no credential matches the token (2efaf63)
  • helm: the chart refuses an update-check mirror URL with credentials, which would sit in plain text in the ConfigMap (3dc9653)
  • httpapi: a malformed subject id is a 404 subject.not_found, as every other id (25d9681)
  • httpapi: same_network is false when the browser came through a forwarding hop we do not trust (c78ee97)
  • httpapi: the consent says whether this request's answer leaves the person's computer (afc1d3d)
  • mcp: a Secret value a held write changes to one of the same size reads as changed in the preview (f70c101)
  • oauth: consent and approval re-check the redirect, so an authorization made before its scheme was denied never gets a code (1d62ea1)
  • oauth: every redirect but loopback http(s) raises the consent's alarm, and browser schemes are refused (aafd8e3)
  • store: index credentials by subject and last use, built concurrently, and compute one subject's extras for its detail (3540d21)
  • store: migration 00023 drops a leftover index before building it, so an interrupted build never stays invalid for good (a01babc)
  • updatecheck: a checked version is the version alone, so no sentence rides along into every admin's bell (4ecb619)
  • updatecheck: a failed check never repeats the user of the mirror URL, only the host and the error (6ab3c2d)
  • updatecheck: follow two redirects and none from https to http, keep only a link on the check host, and keep credentials out of errors (f7f1022)
  • web: a disabled administrator can still be demoted (44a7e4e)
  • web: a figure toggles its segment off again, says its number and shows focus on the whole card (44b78b0)
  • web: a figure's focus ring shows whole on a phone, and an unnamed hash target announces the page (49bdc49)
  • web: a grant preset drops a namespace the cluster does not list, which had no checkbox to clear it (16379f3)
  • web: a grant preset from a link drops a disabled account and a pending or missing cluster, which the pickers do not offer (69590b6)
  • web: a held write's dry run never names its tool call, and reads as a dry run in its requests (89063ed)
  • web: a pasted AI-agent token opens a sheet that names its kind instead of reading undefined (4d41f6c)
  • web: a pasted token with capitals finds its credential (a21109b)
  • web: a request's what reads the same on Home, the cluster, the agent session and my activity, as it does in Audit (get pods/web (shop)) (3dc6bf8)
  • web: a revoke from the credential detail gives its announcement the focus once the sheet has gone (30221b0)
  • web: a Secret write never reads as no change or metadata alone on the decision page (8991bbf)
  • web: a status read asked before a new enrollment command cannot land over it and hide it (f641d95)
  • web: a whole pasted klt_ token finds its credential by its visible prefix (1d4c643)
  • web: an agent's delete reads «Elimina el objeto», and the term guard catches «borra» (a618ce1)
  • web: an audit burst never folds a failure, another credential, another address or another day under one row (2e4b2d1)
  • web: choosing all clusters for a preset cluster without a grant says the one cluster left, which is what it sends (f9ba2de)
  • web: closing the credential detail by hand gives the focus back from onCloseAutoFocus, once its trap has let go (88ed5ea)
  • web: closing the other sessions tries every one, counts an already-closed session as closed and ignores a second request while pending (f4c96de)
  • web: every way of opening the issue sheet starts a new generation, so a late answer of a closed sheet never lands in the next one (b5abb1a)
  • web: Home's access row names what its role includes, as the old card did (ce5fe70)
  • web: Home's Spanish ask-for-access link reads as its sibling, in the infinitive (e9ea1ff)
  • web: issuing another like an expired credential never widens its cluster: the select waits for a choice and the submit says why (5536b77)
  • web: open a column gap between a card header's text and its action, with a design guard (df814d3)
  • web: sheet forms stay inside a phone and the Users segments wrap (d888da9)
  • web: signing out of the CLI session ignores a second request while the first is pending (377ca14)
  • web: stack the cluster page's Access and Namespaces cards so the namespaces table is not cut off (53d18e6)
  • web: the account card counts CLI sessions open by their own expiry and revocation, not by the server's stale active flag (e5b729c)
  • web: the admin switch of a disabled account is off and says why (68f757c)
  • web: the audit detail links only a credential the Credentials page can open and says any other by its plain id (5c51a52)
  • web: the CI form offers the numeric ids with the GitHub App too (2102997)
  • web: the connection line stops loading when my credentials fail to load and draws no session line, keeping the agent link (6be607a)
  • web: the consent raises its alarm when the answer goes to an app, naming the scheme that app claims (d31e76a)
  • web: the consent's alarm follows where this answer goes, not every address the client registered (425a392)
  • web: the control log reads a deleted target in its noun's gender, an approval gone with its cluster, and an agent credential as plain text (356b1fa)
  • web: the control log says an administrator closed a person's web sessions, not every session (4a1898b)
  • web: the delete hint and the token rotation say «elimina», as the term guard asks (d66536d)
  • web: the Edition promise names the daily version check and KUBELATCH_UPDATE_CHECK=false (1f9e9ef)
  • web: the enrollment card claims nothing about a link made elsewhere, and offers no Cancel while its command is being created (576678f)
  • web: the enrollment card describes the command it shows, not the re-enrollment the menu asks for now (599b71c)
  • web: the focus ring of a list row is drawn inside the row, not 4 px past it (ce64e7b)
  • web: the manual cleanup after a cluster delete also removes custom roles' ClusterRoles, as the server's cleanup does (b288e98)
  • web: the namespaces table fits its half of the cluster page: a short count header, names that wrap, a narrow action column (097e54b)
  • web: the pasted tokens JSON goes with its box: on cancel, when the steps close and when a keep-tokens command swaps it (da2ea46)
  • web: the route announcer finds a section whose id needs percent-encoding in the hash (1ee888e)
  • web: the route announcer names a section and ignores the skip link (a62e7ee)
  • web: the searches of MultiSelect and the rule editor's group picker carry an accessible name (7a6e3fd)
  • web: the sessions button, its confirmation and its notice say web sessions, since a CLI session stays open (e6aab52)

v0.30.0

Features

  • rbac: a module names the read capability a write one presumes (reads) (72d5d6e)
  • rbac: each violation names the field it points at (7539455)
  • rbac: the preview runs the in-use checks of an edit and reports scope changes in its diff (e736667)
  • web: a role page at /admin/roles/{id} with its actions, figures and what it grants (c0e81d4)
  • web: CapabilityGrid, the capability cards by domain with folds and the write-without-read advice (5175374)
  • web: helpers, texts and test viewport for the role builder redesign (0130973)
  • web: MultiSelect takes free text as chips (creatable) (29a83c4)
  • web: RuleEditor with a group combobox, chips, verb presets and suggestions from a cluster (9a6e01b)
  • web: ScopeChoice, the where-it-applies card of the role builder (ff58e20)
  • web: the role builder edits advanced rules with chips and suggestions; the API explorer is retired (fd46dff)
  • web: the role builder in the order of the decisions, with folds, a status line and a phone bar (211f352)
  • web: the role summary leads with problems and what it grants, folds the resources, and lists scope changes (c146409)
  • web: ToggleChip and the Start from chips of the role builder (a4e7545)
  • web: useMediaQuery and the phone summary bar of the role builder (ee810e6)

Bug Fixes

  • web: a late "start from" answer never replaces an edited draft (44bc225)
  • web: a rule added after "start from" gets a fresh key, and the summary sheet closes when the screen turns wide (deb8a9e)
  • web: multi-group rules are merged back on save (4145909)
  • web: the role builder's problem links always land, and a late start no longer wins (fb16125)
  • web: the summary sheet's problem links close the sheet and focus their control (d5d4937)

v0.29.0

Features

  • groups: extend a group permission (PATCH /api/groups/{id}/grants/{gid}) from the group page, with its derived rows and audit event (af04764)
  • web: Access column and Add to a group in Users, the origin on Home, a Permissions link per cluster (6b3475c)
  • web: audit log labels for the group actions and the grant expiry change (c17f24f)
  • web: grant several accounts and scopes in one batch (6ce81df)
  • web: group helpers, fixtures, dictionaries and the Groups nav item (f529cd8)
  • web: MultiSelect with chips, a shared ExpiryField and the origin pill (e28b024)
  • web: permissions by account, by cluster and as a list, with their origin (2481f84)
  • web: the group page with its members, permissions and details (8580e2c)
  • web: the Groups page, its creation sheet, delete confirmation and palette entries (d06fac6)

Bug Fixes

  • web: arrow keys on the permissions view selector, and Add to a group waits for the memberships before offering groups (c175b92)
  • web: drop the refused-entry line when the batch changes and tidy the grant form (0f8c830)
  • web: group page findings of the milestone 3 review (blocked members, extend guard, limits, pending states) (bd2e5a7)
  • web: one copy of the group dictionary blocks, a 24 px chip target and the tinted hover of the group pill (931350e)
  • web: permissions overlap over the unfiltered set, guard-clean texts, detail and header coverage (a30d385)
  • web: permissions page findings of the milestone 3 review (header a11y, stale refusal, overlaps under a group filter, chip focus) (461569c)
  • web: quote logins and names with «» in the Spanish group texts, and cover every overlap rule (af9f91d)
  • web: refresh after a late add-to-group response, restore focus to the row menu, grants mock with a source (6533537)
  • web: refresh from the mutation hooks and restore focus on the group page (94e058c)

v0.28.0

Features

  • api: /api/groups, members and group permissions (e8d5569)
  • api: grant source and group filter, derived grants revoke from their group, grant batches, tier covers, subject access counts (e6f6ab6)
  • groups: agents ceiling regression, SPA API types and reference docs (18728e6)
  • groups: the group service, with derived grants synchronised in each transaction (10681d8)
  • rbac: tier covers, and deleting or narrowing a role sees its group permissions (f8bddf7)
  • rbac: ValidateTarget shared by direct grants and group permissions, and CreateBatch (7a564c3)
  • store: group reads, counts and the derived grant synchronisation (bd0bcc6)
  • store: groups, members, group grants and the origin of a derived grant (f3538a5)

Bug Fixes

  • api: name the batch index on every grant failure (6128e7a)
  • groups: prove the group lock with a removal race, event order in Delete, narrower reconcile on expiry updates (d7b0c7a)
  • groups: validate on the pool before locking, and re-validate permissions for new and revived members (f48eaed)
  • rbac: lock a deleted role's groups before revoking their permissions (31e1b11)
  • rbac: validate a grant batch before opening its transaction (ee85c1d)
  • store: give the group advisory lock its own class, 12 (575081c)
  • store: groups down migration with agent grants, and tests for the sync revoke paths (a4a859d)
  • store: pair a derived grant only within one group (28a172e)

v0.27.1

Bug Fixes

  • release: read the release notes with GITHUB_TOKEN so the public mirror carries them (d9dfab6)

v0.27.0

BREAKING CHANGES

  • edition: an instance that never had a license key keeps its audit 24 hours instead of 7 days; about a minute after the first start of this version the retention job deletes the older audit. Set KUBELATCH_LICENSE before upgrading, or install a key in Edition right after, to keep it. Nothing that exists is cut: an instance already past 2 clusters or 5 people keeps them and only new registrations are refused.

Features

  • edition: Free allows 2 clusters, 5 people and 24 hours of audit (e53bfdc)
  • legal: EULA as LICENSE and the terms, privacy and security pages in both languages (7b8eca9)
  • license: seed helpers and an exported CurrentKID for the licensing service (a2f6895)
  • public: the public repository tree and deploy/public/sync.sh (8d8fb10)
  • release: publish-public mirrors each release to picaportelabs/kubelatch; fixed image source (6eaf44a)
  • release: the EULA ships in the image and the chart (40f1311)
  • web: the sidebar says the edition beside the name (59b9cec)

Bug Fixes

  • helm: refresh the chart's EULA copy after the legal fixes (58c5f8b)
  • legal: bind trial users to the Pro Subscription Terms in EULA section 5 (d01e84d)
  • legal: Free limits per Instance, Pro Seats across Instances, trial customers and (a) clause markers (fe02836)
  • release: pass PUBLIC_REPO_TOKEN through workflow_call, sync the public tree for the latest release only and one at a time, mirror the root files with deletion, point the public changelog at the public repository (e569ce1)