bump v0.2.1.0 -> v0.2.1.1, add CHANGELOG.md

.gitignore

@@ -16,6 +16,7 @@ docs/
 *.md
 TEST-CLONE.md
 !README.md
+!CHANGELOG.md
 !AUDIT_TASKS.md
 !THIRD_PARTY_LICENSES.md
 !LICENSE
@@ -404,6 +405,7 @@ secrets/
 # =============================================================================
 # Include essential documentation files
 !README.md
+!CHANGELOG.md
 !THIRD_PARTY_LICENSES.md
 !LICENSE
 !.env.example
@@ -448,6 +450,7 @@ docs/
 *.md
 TEST-CLONE.md
 !README.md
+!CHANGELOG.md
 !THIRD_PARTY_LICENSES.md
 !LICENSE
 !.env.example

CHANGELOG.md

@@ -0,0 +1,103 @@
+# Changelog
+
+All notable changes to RedFlag are documented here.
+
+Format: version, date, then grouped by category (Added, Changed, Removed, Fixed, Security).
+
+---
+
+## v0.2.1.1 (May 2026)
+
+### Added
+- Agent self-upgrade via helper: the privileged helper now performs agent binary swaps
+  (backup, install, chmod, systemctl restart) under an `agent-self` capability token.
+  The agent stages the verified binary; the helper re-verifies the hash before installing.
+  No agent sudo for cp/chmod/systemctl.
+- OSV.dev supply-chain checks at discovery time: async, deduped per server lifetime.
+  Results written to `current_package_state.metadata` for immediate UI visibility.
+- OSV.dev startup backfill: unchecked packages get queried on server boot (best-effort).
+- apt and dnf added to OSV.dev ecosystem mapping (Debian, AlmaLinux).
+- Docker handler uses dedicated `DockerQueries` with proper image/container separation.
+- Staging page: LiveOperations renamed to Staging, shows packages awaiting dependency
+  review alongside in-flight operations. Loading and error states added.
+- Server-side status filter for the Updates package list (HAVING clause on aggregation).
+- Docker severity displayed from actual data instead of hardcoded "medium".
+
+### Changed
+- apt discovery runs unprivileged: sandbox opts redirect lists/cache/state/log to an
+  agent-writable temp dir, matching dnf's model. No apt sudo grants in sudoers.
+- Docker commands no longer prefixed with `sudo` (agent uses docker group membership).
+- Sudoers template: removed all Docker grants (docker group), all self-update grants
+  (helper does it), and apt discovery grants (unprivileged). Agent's only sudo is the
+  single `systemd-run --pipe` helper invocation line.
+- Polling loop recalculates interval after processing commands, not before (rapid-polling
+  takes effect in the same cycle it's enabled).
+- `UpdateCurrentStateInTx` exported for single-row writes outside batch transactions.
+- Update result values normalized: `updated` -> `success`, `rollback` -> `success`.
+- Drift-to-update bridge writes `UpdateEvent` via `UpsertCurrentState` instead of the
+  removed `UpsertUpdate`/`UpdatePackage` path.
+- `AgentDockerImage` model fields aligned with agent's `DockerReportItem` JSON tags.
+
+### Removed
+- `UpdatePackage` model and its `UpsertUpdate`/`ListUpdates` query methods (dead code
+  from the pre-state-table era).
+
+### Security
+- Agent holds zero sudo for self-upgrade, Docker, and apt discovery. The helper is the
+  only privileged path and it verifies capability-token signatures and artifact hashes
+  before every operation.
+
+---
+
+## v0.2.1.0 (May 2026)
+
+### Added
+- Helper privilege split: `redflag-helper` invoked via `sudo systemd-run --pipe` as its
+  own transient service, escaping the agent's `ProtectSystem=strict` sandbox.
+- Token-is-the-command: all package-manager operations routed through discovery
+  (`DiscoveryRunner`) or mutation (`consumer.go -> systemd-run -> redflag-helper`).
+- `EcosystemConfig` registry: adding a new ecosystem means one config entry + discovery
+  interface. Mutation is automatic via the token path.
+- Hash verification fail-closed: empty expected hash returns error.
+
+### Changed
+- `Installer` interface shrunk from 7 methods to 4: `IsAvailable`, `GetPackageType`,
+  `DryRun`, `VerifyHash`.
+- `apt-get` replaced with `apt` throughout.
+- Sudoers narrowed: agent can only run discovery commands + helper invocation.
+
+### Removed
+- `SecureCommandExecutor` (replaced by `DiscoveryRunner` + helper).
+- Direct mutation methods from `DNFInstaller` and `APTInstaller`.
+
+---
+
+## v0.2.0.7 (May 2026)
+
+### Security
+- Refresh-token rotation with accept-previous-once crash-recovery grace.
+- Machine-bound renewal: stolen `config.json` replayed from another host -> 403.
+- Typed sentinel errors for auth failures in polling loop.
+- Revoked refresh tokens and machine-ID mismatches surface as critical events.
+- Signing-disabled path removed from orchestrator; unsigned fallback removed.
+
+---
+
+## v0.2.0.6 (May 2026)
+
+### Added
+- Agent cold-start trust root: signed release manifest verified before first execution.
+- Supply-chain hash registry (Layer 1): expected SHA-256 stored server-side, verified
+  by agents before install.
+- Drift-to-UpdatePackage bridge: drifted bindings automatically create pending updates.
+- Upstream tracking UI with release-source adapters (GitHub, Gitea, GitLab, Bitbucket).
+- Attention panel: surfaces offline agents, failed updates, EOL drift, upstream movement.
+
+---
+
+## v0.2.0.0 (May 2026)
+
+### Added
+- Maintenance windows for scheduling/gating installs.
+- Docker image scanning and update management.
+- Multi-agent fleet overview dashboard.

README.md

@@ -2,7 +2,7 @@
 
 **Self-hosted update management for operators who own their stack.**
 
-`v0.2.1.0` — May 2026 · MIT License
+`v0.2.1.1` — May 2026 · MIT License
 
 > **NOT YET ANNOUNCED** — Tags do not imply stability. Massive flux. Use at your own risk.
 

server/internal/version/versions.go

@@ -12,8 +12,8 @@ import (
 
 // Build-time injected version information (SERVER AUTHORITY)
 var (
-	AgentVersion    = "0.2.0.7"
-	ConfigVersion   = "0.2.0.7"
+	AgentVersion    = "0.2.1.1"
+	ConfigVersion   = "0.2.1.1"
 	MinAgentVersion = "0.1.22"
 )