✨ New

• Step execution detail in the run view. Click a step in any run, live or finished, to see when it started and finished, where and as whom it ran, the platform's failure reason in full, and the result it produced (size report, headroom findings). A step can be opened by its own link (?run=…&step=…), so you can share exactly what you were looking at.
• Refreshed canvas design:
  • A global top bar and a dedicated flow bar.
  • A clearer empty canvas.
  • A palette you can collapse.
  • The Task catalog and the Overview now point you to what needs attention first.
• Ready-made demo flows. The image now comes with a weekly maintenance window flow and failure scenarios, such as a check that fails inside the window and a security posture report with findings. You can see how a failed step stops the steps after it at an ALL_MUST_SUCCEED join without building anything first.

🐛 Fixes

• A 401 that came in before a token renewal no longer signs you out of the session. Before, this could freeze the live run view during long runs.
• Accessibility: each screen now has exactly one main landmark and one h1. Long class names in the palette now wrap at the dots instead of overflowing.

📚 Docs

• A "For judges: two minutes" quick path at the top of the README: what makes SentaiTask different, and a 90-second Docker quickstart.
• Fixed the description of what happens to downstream steps when a disk check fails: they are stopped at the join, not skipped.
• A demo video is now in the repository (sentai-demo.mp4 / .webm).

🧪 Quality

• The e2e suite is green again. Three failures came from outdated tests, not from the product.

IRIS Relay 0.5.0 installs the full Relay UI through IPM and serves it directly from IRIS at /relay/index.html. No Node.js or Python server is needed outside IRIS. Relay Lite remains available at /relay/lite.html.

The IRIS-served UI includes management views, the 28-operation REST explorer, reviewed configuration changes, scheduled tasks, log paging and similarity search, audit summaries, baseline comparison and Markdown/JSON handover export. Changes use review, fresh-state checks and readback. IRIS authorization still governs each operation. HTTPS is required for remote use; HTTP is allowed only on loopback. The README documents operator roles, SQL grants, shared-origin risks and the tested Normal security configuration.

Reviewed source: 89b9d525f30c61c93ed294f1fe8c7d979df6c4bc. Codex independently ran 64 JavaScript and 29 Python tests on the isolated VPS checkout, with zero skips; GitHub CI and Pages succeeded on this commit. Claude's isolated-cloud validation passed 158 end-to-end checks using local IPM load, including 112 browser checks of the IRIS-served UI. Public registry installation will be verified independently after this release.

AI disclosure: Claude implemented and tested the IRIS-served UI; Codex reviewed, integrated and published it.

v1.0.3: added the AI-Powered Instance Monitor feature (Community Opportunity idea DPI-I-512).

Relay Lite is now served directly by IRIS after installing iris-relay 0.4.1 from IPM: open /relay/index.html over HTTPS (HTTP is allowed only on loopback). It lists log sources, pages through messages.log and rotations, and provides lexical similarity search over a bounded IRIS Vector Search index. The Lite UI needs no Node.js or Python server; the full management UI remains available through the existing Compose/Node setup.

The page requires an IRIS user with %Admin_Operate:U; search SQL permissions and index limits are documented in README. Credentials are blocked outside HTTPS or loopback, stale requests cannot overwrite a newer session, and /relay serves static files with CSP/automatic compilation disabled.

Reviewed source: 34ed98984f15fec85d54036104f1c93d9cdd474d. GitHub CI: 46 JavaScript and 29 Python tests passed. Claude tested local IPM load/uninstall and 15 browser groups in an isolated cloud IRIS; public registry installation will be checked independently after this release. The existing public demo is unchanged.

AI disclosure: Claude implemented and tested Relay Lite; Codex reviewed and published the change.

• Added the online demo link (hosted on Oracle Cloud with HTTPS).
• Added the YouTube demonstration video.
• Enabled publishing to the IPM/ZPM Package Manager registry.

• Every screen fits a phone and a laptop. The dashboard's upcoming tasks keep their status inside the card, with the time under each name: on a 1280-pixel laptop the status badges used to sit 92 pixels outside the card, and on a phone the page scrolled sideways. A database's volumes, the license servers and the connections now scroll sideways inside their card on a phone, as the other tables do.
• A browser test keeps it that way. It opens every screen at 360 and 1024 pixels wide and fails when anything scrolls the page sideways or leaves its card.

The image: docker pull ghcr.io/mxsalata/aperture:1.3.0

Changed container repository to the public one so that everyone can see it.

Updated the details in the deployment process

Added: Manage and monitor several IRIS instances from one interface

New editors

• Services: edit a service's enabled state, its allowed IP addresses, its roles and its authentication methods.
• LDAP and Kerberos: create, edit and delete configurations, set the search password, and run a test sign-in that keeps no password.

Clearer screens

• Each agent turn shows which model provider and host its data went to.
• The New Namespace form keeps what you typed when you create a database from it.
• The integrity check's log has its own entry in the side bar.
• Logs you may not open are listed on one line, with what they need.
• A database's volume files show in a proper table.

Safety

• An installed OcuPilot carries no test code. Updating removes the test classes earlier releases installed, and the start log says how many.
• A screen action and a confirmed agent change on the same item no longer run at the same time: the second waits up to 10 seconds, then says the item is busy.
• Removing all of a process's or a remote client's locks checks the list again before each removal.

Requires InterSystems IRIS or IRIS for Health 2026.2 or later. Upgrading from 1.0.4 keeps your agent definitions, conversations, settings and audit records.

OpsDeck 0.2.0 delivers the native IRIS-hosted operations console with responsive, available-width layouts.
Highlights:

• Native /opsdeck application served by IRIS without a Node runtime.
• Read-only Overview, Applications, Access, Security, Tasks, System, Logs, and Evidence views.
• Authoritative application read-back and session-safe sign-out behavior.
• Compact navigation, vertically stacked inspectors, reflowing lists, and wrapped tabs at constrained widths.
  Qualification: local-source load, operational checks, uninstall/removal, unrelated-state preservation, and clean same-source reload were reproduced on IRIS 2026.2 Build 221U. The installed native browser and 82/82 product tests passed.
  Scope: exact core IPM version, fresh public-checkout installation, and public-registry availability/installation remain unverified. M1 is partial; audit asynchronous result retrieval, Messages, and System Monitor are not qualified. No ObjectScript execution bridge or CallIn is claimed.
  Source and full scope: https://github.com/KennethJSmithDev/OpsDeck/releases/tag/v0.2.0

fix: pass ISCAgent startup flag to IRIS

Update on the deployment issues

Key Enhancements:
🧩 Closed Capability Catalog
A single allowlist of approved AI operations. The Copilot cannot invent or execute arbitrary operations.
📋 Rich Capability Metadata
Each capability declares examples, constraints, verification, and undo information, while privileges and risk come from the existing operation registry.
⏱️ Task Catalog
Ask natural-language questions about live IRIS tasks, including suspended tasks, errors, schedules, and run-as users — completely read-only.
🔎 Capability Discovery:
A read-only API exposes the currently approved capabilities and their metadata without exposing handlers or implementation details.
🧵 Structured Execution Trace
Planning and execution produce linked copilot. plan and copilot. execute traces connected to the underlying operation trace.
🛡️ Structured Failure States
Rejections and failures use machine-readable codes such as authorization_failed, resource_protected, verification_failed, and issue_still_detected.
🔐 Defense in Depth
AI output is only a proposal. Parameters are rebuilt server-side, authorization is rechecked, explicit confirmation is required, and every mutation is verified.

Disks and system operation

• Mount, dismount, truncate, compact, defragment, expand and grow a database, with progress for the long-running ones.
• A three-step integrity check with its own log.
• External language servers: see their status, start and stop them, read each one's activity log, and create, edit and delete them.
• Suspend and resume the Task Manager, with a warning that no scheduled task runs until it is resumed.
• Remove a lock, all of a process's locks, or all of a remote client's.
  Easier to start
• Windows: a Git for Windows clone could not start the container, because the start scripts arrived with Windows line endings. They now always check out correctly. A clone made before 1.0.4 needs one command after git pull, given in the README under Troubleshooting.
• With no model configured, the model form opens on the first sign-in only, and Cancel takes you to Home. Every screen works without a model.
  Better answers
• Explain this entry reads the chosen log entry together with the rest of the page.
• An area opens when you may use any of its screens; each screen still checks your own privileges.
• Try it in the REST API explorer explains, in a plain sentence, a request the browser could not complete.
• A proposal card keeps its privilege warning current after its turn has ended.
  Safety
• The agent's eight disk operations start switched off. Turn them on under Agent co-pilot → Governance policy; the screens themselves do all eight.
• Adding a privileged role to the authorization server's customization role is now treated as a privilege grant.
• Creating or editing a task checks the task type's privilege again when you confirm.
• The nightly retention clean-up no longer raises the instance's state to Warning.
• A new-volume threshold that would put database volumes in the manager directory is refused.
  A refreshed README with retaken screenshots, and many small fixes.
  Requires InterSystems IRIS or IRIS for Health 2026.2 or later. Upgrading from 1.0.3 keeps your agent definitions, conversations, settings and audit records.

fix: resolve IRIS compilation and installer errors

Add community articles

Migration of administrative areas (Processes, Users and Roles, Tasks, Web Applications, and Security) to the official InterSystems SysAdmin v2 API. Includes a new automated test suite validating read operations and actual mutations via the official API.

What's new

• Public demo ready — least-privilege demo account, daily reset, and a warning before a cancel that makes IRIS raise an alert.
• Semantic step search — the palette finds step types by intent ("check disk space"), not just by name.
• In-process embeddings — the search model runs inside IRIS through Embedded Python (CPU-only, offline, no second service).
• Run log & history — every run records its own log (steps, durations, the platform's failure reasons verbatim); a Runs screen finds past runs; any run exports to a file.
• Report steps — security posture, web application inventory, system alerts and secrets inventory as flow steps, locally or on target servers.
• Scheduled runs that execute — one native task per flow, running as a run-as account whose password is kept in the IRIS Wallet.
• Instance overview API — processes (suspend/resume/terminate), locks, shared memory, activity, devices, licenses and web sessions, as the platform reports them.
• Overview screen — the new landing screen: live cards for each area, detail views, and area reports run from a card.
• Security inventory — certificate-expiry-check (schedule it to be warned before a certificate expires), permissions-inventory and oauth-inventory. Read-only; no secret is ever read.
• Docs — README and known limitations brought up to date.

Databases and namespaces

• Local databases: a three-step Create wizard, a properties editor with the volume files, and delete by typed name, optionally with the files. A new database always needs its own directory.
• Namespaces: create, edit and delete, with what a delete would take with it shown first.
• Global, routine and package mappings, and copying mappings from one namespace to another.
  New screens
• A unified log hub: every log in one list, and one timeline merging them newest first.
• License usage and the full dashboard.
• Web sessions, listed and ended.
• Background tasks: pause, resume and cancel.
• Broadcast a message to terminal sessions.
• Task export and import.
• A user's effective privileges, and Check permission for any user or role.
• The agent audit ledger: each model call, tool call and confirmed write.
• Allowed directories, and Copy as curl beside the try-it console's Send.
  Safety
• Four agent actions start switched off: deleting a local database, deleting a namespace, importing tasks and purging the audit database. Turn them on under Agent co-pilot → Governance policy; the screens themselves still do all four.
• Images in agent replies show as their text description only.
• Routine "not found" answers no longer raise the instance's alert state.
  A refreshed README with new screenshots, and many small fixes.
  Requires InterSystems IRIS or IRIS for Health 2026.2 or later. Upgrading from 1.0.2 keeps your agent definitions, conversations, settings and audit records.

1.2.0: opening an entry of the Messages log now says how often its message was logged and since when, found with IRIS Vector Search, and Show similar entries lists them (nothing is indexed until you ask); in the online demo the index is ready from the start. Dependency updates now arrive monthly and each merged batch is a patch release of its own (1.1.1 was the first). The README links the video walkthrough and names every contest bonus.

1.2.0: opening an entry of the Messages log now says how often its message was logged and since when, found with IRIS Vector Search, and Show similar entries lists them (nothing is indexed until you ask); in the online demo the index is ready from the start. Dependency updates now arrive monthly and each merged batch is a patch release of its own (1.1.1 was the first). The README links the video walkthrough and names every contest bonus.

A regular app, easy to find. On macOS the app now has a Dock icon, so it can't get lost behind the notch any more.

• Clicking the Dock icon, or opening the app again, shows the Profiles window.
• The menu bar has File → Profiles… (Cmd-,) and Quit (Cmd-Q).
• Starting the app a second time on any platform brings up the running app's Profiles window.
• Windows, the Dock and the Windows taskbar show the ValhallISC logo.

Windows installer. ValhallISC-0.9.3-windows-x86_64-setup.exe installs per user without administrator rights. It adds a Start menu entry, an optional desktop icon and an uninstaller in Installed apps. The standalone executables are still available.

Source control. In namespaces under IRIS source control (for example git-source-control or CCR), checked-out classes and routines are marked:

• macOS: Finder tags, green "Checked out" (by you) and orange "Checked out by ";
• Linux: user.xdg.tags attributes (shown by KDE Dolphin), plus _CHECKED_OUT.txt in each folder;
• Windows: _CHECKED_OUT.txt in each folder.

Documents you can't edit are read-only. Check-out, check-in and commit stay in your usual tools; importing a file still goes through the server's source control hooks.

Profiles window, reviewed.

• Mount is the main button, bottom right; it reads Save & Mount when there are unsaved changes.
• The interface says Mount / Unmount / Mounted throughout.
• A mounted profile shows its state and folder in a two-line banner.
• Coloured state dots in the list and in the menu: grey not mounted, amber mounting or unmounting, green mounted.
• If the server can't be reached, a hint suggests the web server's port: IRIS 2023.2 and later have no built-in web server on 52773.
• In the menu bar menu, idle servers read "Name — Mount".
• Clearer dark theme; the locked password field no longer looks editable.

Harbor 1.1.0 adds IPM installation of the production frontend, bundled gateway dependencies and native extension. Node.js 22.12+ remains required; no npm or compiler is needed on the target host. Follow docs/HARBOR_IPM.md for installation, service setup and lifecycle operations.
The launcher requires explicit origin, cookie, instance and external data settings. It rejects relative or package-contained data locations, including symlinks. The extension installer refuses a route owned by another dispatch class or namespace. It creates no native accounts, credentials, grants or sample tasks. Package resources have application-specific names.
Validation: production build and 341 source tests plus two packaging tests. Isolated IRIS 2026.2/IPM 0.10.8 source and archive installations, native login and extension reads, retained records after uninstall/reinstall, conflicting-route refusal, desktop and 390px browser checks passed. External records remained byte-identical. Existing production data and earlier releases are unchanged.
IPM publication is requested through the existing Open Exchange application. Registry availability and bonus awards are separate from local package validation.

Waypoint 1.1.0 adds IPM installation of the production frontend, bundled gateway dependencies and native extension. Node.js 22.12+ remains required; no npm or compiler is needed on the target host. Follow docs/WAYPOINT_IPM.md for installation, service setup and lifecycle operations.
The launcher requires explicit origin, cookie, instance and external data settings. It rejects relative or package-contained data locations, including symlinks. The extension installer refuses a route owned by another dispatch class or namespace. It creates no native accounts, credentials, grants or sample tasks. Package resources have application-specific names.
Validation: production build and 257 source tests plus two packaging tests. Isolated IRIS 2026.2/IPM 0.10.8 source and archive installations, native login and extension reads, retained records after uninstall/reinstall, conflicting-route refusal, desktop and 390px browser checks passed. External records remained byte-identical. Existing production data and earlier releases are unchanged.
IPM publication is requested through the existing Open Exchange application. Registry availability and bonus awards are separate from local package validation.

Initial Release

Access Atlas can now be deployed through IPM with its compiled frontend, bundled gateway dependencies and native telemetry/log extension. Node.js 22.12+ remains a runtime requirement; npm and a build toolchain are not needed on the target host. Follow docs/IPM.md for installation, configuration and startup.
The launcher requires an explicit instance ID and an external campaign directory. Package uninstall preserves that directory. Installation refuses an existing /api/atlas route owned by a different class or namespace. No users, passwords, native grants or sample records are created by the package.
Validation: production build, 302 application tests and two packaging tests; clean Linux CI rebuild reproduces the committed payload. On isolated IRIS 2026.2/IPM 0.10.8: source and archive installs, native login and capture, telemetry/log reads, campaign save and reopening after uninstall/reinstall, route-conflict refusal, desktop and 390px layouts.
Download access-atlas-1.3.0.tgz for IPM archive loading or the ZIP for source/Docker installation. Community registry publication is requested through the existing Open Exchange application; registry availability and any contest bonus await the publishing process. Existing Docker deployments can remain on their current deployment method. Preserve instance ID and data volumes when upgrading.

Run creation now distinguishes 100 unarchived runs from 1,000 total records. Built-in plans and saved procedures explain when archiving can help and when it cannot. Storage limits, existing records and restoration obligations are unchanged.
Validation: production build and 257 tests passed, including refusal without native calls or writes and successful creation below both limits. The production frontend was checked at desktop and 390px widths using synthetic storage and the real creation guard.
Rebuild only the portal service, preserving the configured instance ID and existing run-data volume. No migration is required.

Latest Version

The interactive access example now follows a role reassignment through comparison and a downloadable training report. Removing SupportTeam leaves ReportingReader's read path visible, with an explicit owner follow-up instead of a claim that all access was revoked.

The new Review outcome view compares two supplied synthetic captures using the application’s graph and comparison functions. Add a reviewer note and export the remaining path, capture times and scope limitations. No IRIS connection, native change, live readback or saved campaign is simulated.

Historical technical-review documents now describe only this application's findings and verification.

Validation: production and example builds; 302 automated tests; 17 browser checks; manual 1280px and 390px layouts; downloaded training report checked. Existing connected workflows, storage and API behavior are unchanged.