sporades 0.9.30 → 0.9.32

package/CHANGES.md

@@ -1,17 +1,55 @@
 # Changes
 
-## Unreleased - 2026-09-24
+## Unreleased - 2026-10-13
 
-Changes since v0.9.29.
+Changes since v0.9.31.
+
+### 🚀 Features
+
+- Add pinned monitoring release acceptance verifier (#229) (872f33866).
+- Add admission lifecycle proof harness and human verification handoff (#221) (9e4608535).
+- Add resource and API-performance alerts (#222) (0dc656b53).
+- Add inventory-driven availability alerts and recoveries (#204) (803ca6060).
+- Support validated Auto-Submitted on send (#220) (40d3317ec).
+- Add safe monitoring maintenance and fresh restore (#213) (6542368d1).
+- Add bounded telemetry outage recovery and pipeline visibility (#207) (fc04b41b3).
 
 ### 🐛 Bug Fixes
 
-- Refresh only live queries that read a written table (6942754d).
-- Detect Promise combinators from call sites, not formatted stacks (a55a4fd3).
+- Bump for vulns (f68221783).
+- Prevent favicon 404s in new scaffolds (#219) (d44aa0970).
+- Offer only supported OAuth sign-in actions (#215) (1977b8e49).
+- Cache hashed public assets immutably (#186) (871540c2f).
 
-### 📦 Packaging
+### 📝 Documentation
 
-- Regenerate runtime artifacts for scoped live query refresh (14235222).
+- Complete admission lifecycle evidence and restore Hosted stats (#227) (ffa5eb6d5).
+- Preserve Collector asset modes under systemd umask (#224) (c3a6e6e65).
+- Diagnose and migrate Host monitoring connections (#212) (e9c635e6f).
+- Expose bounded, redacted admission evidence (#218) (4ac66e837).
+- Stabilize public-tree staging and PDF deadline tests (#217) (7753267cd).
+- Apply admission before WebSocket upgrades (#214) (1897d6932).
+- Stabilize Dev ClamAV framed readiness on macOS (#216) (312e55e26).
+- Scope Postgres and libsql live query refreshes by table (#202) (e23007e82).
+- Complete canonical non-address HTTP admission matching (#210) (bdfe6d872).
+- Enforce bounded fixed-window quotas for trusted admission clients (#211) (b7bbd3f13).
+- Rotate and revoke per-sender telemetry credentials (#203) (789b4862a).
+- Establish trusted Hosted client-address admission (#209) (b274551d2).
+- Trace outbound fetch dependency time (#199) (d243884f2).
+- Enforce exact-path HTTP denial before Capsule routing (#193) (3e59f8862).
+- Trace individual WebSocket operations and connection activity (#198) (4473caeac).
+- Complete malformed request liveness coverage (#201) (2e8c02038).
+- Automatically synchronize Host lifecycle inventory (#195) (f7b35cbbc).
+- Trace durable Job attempts and queue pressure (#200) (b4042ce8d).
+- Trace authentication and File operations within HTTP requests (#197) (d37a224fd).
+- Trace database time within Capsule requests (#196) (9e92f0fa0).
+- Publish deployer-owned read-only admission policy generations (#189) (45066b7a2).
+- Support project public assets across Capsule sessions (#188) (de6806ed3).
+- Verify multipart limit diagnostics over real HTTP (#185) (1b8dfd77f).
+
+### 🧪 Tests
+
+- Make the connection-lost screen clear and actionable (#226) (6cf8993a9).
 
 ## v0.9.11 - 2026-09-02
 
@@ -113,5 +151,3 @@ generated artifacts, and documentation.
 
 
 
-
-

package/README.md

@@ -217,6 +217,10 @@ Sporades currently includes:
 - Local Docker Container sessions for production-like staging tests.
 - Hosted Capsules on SSH-reachable Host servers, routed through Caddy and run in
   hardened Docker containers.
+- A [standalone trace stack](monitoring/trace/README.md), generated by `sporades monitoring stack init --dir <path>`, with authenticated
+  OTLP/HTTP ingestion, persistent Jaeger storage, and protected trace UI.
+- Opt-in Dev and local Container HTTP request tracing through [operator Telemetry profiles](https://mgscox.github.io/sporades/reference/projects-and-configuration#local-http-tracing), with bounded route labels and no Capsule instrumentation import.
+- Native fetch dependency spans within active HTTP requests, with operator-approved origin propagation and bounded, redacted outcomes. See [supported paths and limits](https://mgscox.github.io/sporades/reference/projects-and-configuration#outbound-http-time).
 - Runtime-owned auth with anonymous sessions, email auth, Google OAuth,
   Microsoft OpenID Connect, Sign in with Apple, Facebook Login, and
   local identity simulation for tests and agents.