[github-actions]

🤖 I have created a release beep boop

0.1.0-rc.1 (2026-10-31)

Features

• audit: add event emitter with fail-closed default and stub JSONL sink (2d42f9b)
• audit: durable segmented spool and shipping consumer loop (37912b2)
• audit: Grafana dashboards, alert rules, and a Trino stand-in for Athena (e7f6a9f)
• audit: Grafana panels and schemas for actor_type and the CI run (people vs bots, bot sessions by repository) (76a9b35)
• audit: S3 and Datadog sinks with signed, hash-chained batches (aa9c99f)
• audit: ship events and recordings to the control plane (8639342)
• bots in audit events and the console (actor_type and the CI run on sessions, a Bots page, run links) (437f135)
• ca: bot certificates carry a marker and the CI facts; people can't use the bot: prefix (3dfbbf3)
• ca: issue and verify user and component certificates (c32ee9c)
• ca: SSH user and host CAs; worker labels in component certificates (f5cf87b)
• changes held for approval, and server-side guardrails (#195) (4f5e26f)
• cli: colour, glyphs, aligned tables, spinner, and tidy errors (4e0116b)
• cli: limen login --bot for GitHub Actions, GitLab, and any OIDC provider (442552a)
• cli: limen manage, the client guide, and the Phase 14 stage 1 demo (#193) (b9340b6)
• cli: limen ssh, ssh-proxy, and config ssh (e74591e)
• cli: login (PKCE and device), logout, status, ls, and admin commands (c61f76f)
• cli: resource filters, show/connect/conns, --detach, completions; console label filter (#89) (e770b1d)
• cli: scripts/install-cli.sh builds limen and installs it to ~/.local/bin (#24) (72de08c)
• cli: show a small logo on top-level help, --version and login (#165) (cea4fb2)
• component: shared identity storage, enrollment, and renewal (4ced612)
• compose: the kube stack's cluster is a Compose service (k3s) (#38) (3727817)
• console: audit trail page, outstanding join tokens, and an optional Grafana link (54acee5)
• console: auto-refresh list pages (#90) (94596eb)
• console: browser sign-ins last LIMEN_CONSOLE_SESSION_TTL (default 8h), separate from the CLI certificate (59f345c)
• console: built-in dashboards drawn as server-side SVG; drop the Grafana link (Grafana stays optional) (a574851)
• console: dashboards split people and bots and rank bot sessions by repository (7a60ded)
• console: edit what the console owns, and decide held policy changes (#198) (2f51326)
• console: pickable dashboards with drill-down and richer audit filters (#104) (2d8c142)
• console: redesigned console with light and dark themes, sign-in page, themed Dex (0b730cf)
• console: resource icons and colour, sign-out page (111c402)
• console: resources page (6d6c434)
• console: web console, worker revoke, and shared admin operations (f550c20)
• control-plane: bot login with workload identity tokens (GitHub Actions, GitLab, generic OIDC): exact matching, one use per token, audited with the CI run (28a3bcd)
• control-plane: labels on static join tokens (762c0c2)
• control-plane: list live tunnels for proxy peering (5a81c24)
• control-plane: OIDC login, policy admin, enrollment, and registry (6317df3)
• control-plane: one write path for policy, with an owner per document (#190) (31db9fe)
• control-plane: serve limen.manage.v1 for admins and bot writers (#191) (e0f5ec7)
• control-plane: serve signed policy snapshots and SSH session certificates (a19c080)
• control-plane: user certificates last 1 hour by default, set with --default-cert-ttl (#166) (1a49aeb)
• core: add secret wrapper, identity URIs, and jittered backoff (5bac19e)
• every kind through the management API, and writers' roles and mappings (#197) (3622490)
• lock users and kill sessions (7521aca)
• metrics reference, CA signing metrics, and alert examples (#102) (e5f55a4)
• Phase 10, OpenSearch and Elasticsearch access (ADR-0036) (#35) (38ec584)
• Phase 11, RabbitMQ and Kafka access (ADR-0037) (#33) (5a742cf)
• Phase 12 internal web SSO and TCP access (ADR-0022) (#47) (5f89d63)
• Phase 13 access workflows and insight (#124) (c07a5ac)
• Phase 4 demo, development fake CI issuer, bots guide, policy reference, threat model TB8, ADR-0019 accepted, ADR-0032 (agents) (63357fa)
• Phase 5, scale-out (ADR-0020) (#26) (fbc66c4)
• Phase 6, SQL database access: PostgreSQL, MySQL, Aurora, Redshift (ADR-0033) (#27) (7f31576)
• Phase 7, Redis and Valkey access (ADR-0034) (#29) (38b653f)
• Phase 8, Kubernetes access by impersonation (ADR-0038) (#28) (7025475)
• Phase 9, MongoDB, Atlas, and DocumentDB access (ADR-0035) (#34) (6ccc62e)
• planned integrations as data: policy kinds, grants and examples, console listing with the command and phase, and a CLI command for each (none implemented) (7ad15dc)
• policy,tunnel: worker selector matching, session TTLs, stream framing (e0661e2)
• policy: kind: bot documents with a strict validator and exact claim matching (ADR-0019) (fa461a5)
• policy: parse YAML roles, mappings, and resources; evaluate access (ea14a91)
• policy: resource profiles and writer grants for delegated writes (#189) (da56eb9)
• proto: define phase 1 control plane API (ee68bc5)
• proto: limen.manage.v1, the management API contract; accept ADR-0042 (#185) (4846807)
• proxy: authorize SSH sessions and relay them through worker tunnels (441e6b8)
• proxy: open sessions through peer proxies (ADR-0004) (eed62f0)
• proxy: public listener with ALPN routing, API relay, worker tunnels (3447d29)
• session: signed session grants and policy snapshots (b20fdd7)
• telemetry: OTLP trace export and propagation to the worker (#122) (3a0fda7)
• terraform: audit store (S3, Glue, Athena, IAM) and Datadog monitors (fd479f3)
• tunnel: add TLS configs, HTTP/2 serving, and the reverse tunnel (ae73b15)
• website: a Limen 404 page, and /docs working without the trailing slash (#144) (5d9ac0f), closes #143
• website: homepage and documentation site (ADR-0021) (#137) (cc120e8), closes #130 #131 #132
• worker: enroll through the proxy and hold reverse tunnels (6061384)
• worker: never dial forbidden addresses for resources from profiles (#192) (9159156)
• worker: SSH sessions with recording and command audit (90f2917)

Bug Fixes

• audit: create the ship error counter at 0 (#106) (71d2353)
• audit: the ci column lists every fact a GitHub or GitLab bot login records (24e22a9)
• bots: address review of PR 22 (1c8338c)
• bots: second review (336a5a6)
• ci: audit-trail race in phase13, aws-sigv4 bump, accept RUSTSEC-2026-0387 (#150) (36daf61)
• cli: don't print "Press Ctrl-C to stop" for detached connections (#91) (f3d56c3)
• cli: explain untrusted proxy certificates (352072f)
• cli: list ready-to-run SSH logins and hide OpenSSH's closing noise (92cda6c)
• cli: ssh-proxy exits when the proxy ends the session (92fcc76)
• console: phone layout, keyboard access and AA contrast (#145) (#147) (306723d)
• control-plane: compute policy applies against the latest version in the database (#188) (8628f52)
• website: tables scroll inside their own box on phones; correct ADR-0021 issue numbers (#146) (adf72dc)

---

This PR was generated with Release Please. See documentation.