Release notes 0.1.89 to 0.1.99

Archived release notes, newest first: 0.1.99 (28 September 2026) back to 0.1.89 (22 September 2026).

Release notes · Updated 2026-10-28 · Describes release 0.1.164

0.1.99 — 28 September 2026

Compliance: findings can be filtered by source. Missing Defender subscriptions are named; exclusions and older analysis are displayed consistently. Partial fixes require re-analysis and are not reported as verified recovery (32263a98, ccdff382, ef1cf910, 1542ba2c, 692c2fdf, 4bb8af5b, 2c466e05).
Changes: the execution-plan step cap increases to 16 (88a2406e).

Security: runner-token minting requires a workspace seat, a reserved provisioner-token name is protected, SSO bearer validation checks client and domain, and invitations cannot target another organization's SSO account. Network-device read commands are allowlisted, and GCP token caching includes the service-account key (db90a6eb, 61c5ddaf, 1bac7d4f, 12a78a10, 10bd399b, 9e32616a).
Security / platform: workspace PII patterns are bounded and timed-out patterns fail closed. Password checks and PDF extraction move off the event loop; budgets are checked again after queueing, disabled workspaces cannot start runs, and estate scans enforce tenant run guards (c8ea7e96, 150746fd, 538102d5, a8d331ef, 7fd4b04c, fe52093b, 9e0b2b69).
Changes: manual rollback verdicts enforce risk tiers; webhook detail alone cannot establish a last-known-good Git restore range (a5b150e5, 2c1748b0, dbec2b73).
Platform / install: artifacts gain a portal navigation entry; immutable release tags and chart publication support first customer installs (2020032f, 1ee94fee, 6622323c).

Changes: every command of a plan made stale by an exclusion is hidden; the portal clarifies the exclusion hint and status (6710e376, ff70b1c2).

Compliance / changes: typed remediation covers Azure Blob public access. Plans naming excluded resources are refused, partial exclusions trigger re-analysis and only executable plans offer a fix. Scanner findings show source/resources in one table; frameworks become a read-only report (5df81fe4, b95aebc0, 41e5f076, 44b07bc0, 6a827b35, 6c40889d, 9d3fe4a3, 3c9ed0a7).
Incidents: escalated rows are labeled Needs attention and historical change lists use Last known changes, without claiming those states were good. Resolved incidents are not marked with a stale plan (a2dd0399, 8d2197f2, 7e7cff97).
Security / install: Azure writer scope can patch storage; finding-origin execution respects exclusions. Runners receive region and auto-triage settings (6af2fa77, 29aa25f0, 2cb1d015, 6dfc6b7f).

Compliance: operators can accept risk on the platform's own control findings and flagged resources. Decisions validate the newest observed exposure, expire, and distinguish accepted risk from a fix that held. Later releases label these decisions exclusions (51c7b91d, e8aa22b6, 36530b36, 3ea8a2fa, 534fb015, f77909b1).
Knowledge: a risk-accepted closure does not draft a skill claiming a successful repair (4a37415d).
Changes / platform: revert drafts compile their own plan; security groups are keyed by ARN. Test Lab adds a last-known-good lane and strengthens its access, cleanup and scoring checks (b05c422b, 1152c24e, 0f4c35e2, e07afbc3, 7a5557c2, 84663f18).
Security: Chaos Mesh updates to 2.7.3 with its control server disabled (0df729ee).

Compliance / changes: typed posture operations cover account-wide S3 public-access blocking (S3.1) and IAM password policy (IAM.7). Detective-service controls route as posture; account-setting fixes cannot weaken the estate (10a2e7e6, b33204d3, df6e8e8c).
Security: password-policy fields remain readable through PII scrubbing (e1eb4627).

Changes: rollback paths are restored and merge evidence is optional (4a34c5fa).
Compliance: Azure reads are scoped; Security Hub coverage is reported per region (ba11da5b).
Incidents: change-card and correlation labels more accurately describe their evidence (27297222, f36901b7).

Changes: Azure network security group execution and rollback edge cases found in resource verification are corrected (7421b999).

Changes: dependent services are checked after a change, without letting their result replace the changed resource's verification verdict (3ddcb4a5).
Compliance / platform: Test Lab adds a cloud-account compliance lane (1ebdb852).

Changes: compiled execution captures pre-change state per step and derives restore information from that evidence (0ba1a1ed). Missing or unusable pre-state is recorded honestly; it is not a guarantee that every change has an automatic inverse.

Baseline for this release series (d1d48e18).

Compliance: expanded resource coverage, finding suppression and reduced CloudTrail noise (8452ed21). Suppression evolved into the resource decision and exclusion workflow described in later entries.
Install: initial dedicated customer-account deployment path and offline licence support (4dfe7b1f).