After a refused execution, cancellation or reconciliation, Change history checks current read access to the same receipt once. A permitted read retains the receipt and refusal message; a denied or missing read clears protected cached data.
If the check is temporarily unavailable, the receipt details, list summary and export remain hidden. Retry record access identifies the original record and restores it only after a successful read. List refreshes and other records cannot bypass this check. The pending lock stays in place throughout; no action is automatically repeated.
Validation: production build, 319 Node tests, 21 actual-component refusal/recovery checks, 12 existing access checks, and desktop/390px temporary-failure recovery passed. Synthetic transport only; no native or applied writes. Rebuild only the portal service, preserving data volumes and instance ID. No migration is required.

Change history now removes a cached receipt and its export when a fresh read is denied or the record is missing. A denied list clears protected cached records; an authorized list closes a selection that is no longer returned. Another authorized selection remains available.
Temporary read failures and explicitly unreadable listing entries preserve previously received evidence. Uncertain execution still requires a successful read of the same receipt before another action; no native request is replayed. Operator instructions now explain access recovery, with historical test notes moved to the verification record.
Validation: production build, 319 Node tests (including 13 execution-recovery tests), 12 actual-component browser regressions, and desktop/390px checks passed. Synthetic transport only. Rebuild only the portal service while preserving data volumes and instance ID; no migration is required.

The investigation-profile editor now asks before discarding unsaved fields, checklist changes or a revision reason when closed with Escape, Cancel or the close button. Keep editing receives focus and restores the same draft; unchanged or fully reverted forms close immediately.
Pending saves block duplicate submission and dismissal. Current-access denial still removes protected drafts immediately. No autosave, browser persistence or backend changes.
Validation: production build, 319 Node tests, 16 actual-component draft checks, the existing 23 access checks, and desktop/390px verification with actual Escape. Synthetic transport only. Rebuild only the portal service while preserving data volumes and instance ID.

New screens for journal records, audit maintenance, language servers, backups, Interoperability productions, the REST APIs of the instance and status checks with a fix for each. A change log with the read-back outcome of every change, a list of who loses access before a role change, background operations in the top bar, accessibility, a prebuilt image on ghcr.io and a demo sandbox you can change. Full list: https://github.com/DawidKrynski/iris-admin-deck/blob/main/CHANGELOG.md

Saved investigation profiles now clear their cached details, exports and related forms when a read is denied or the record is missing. Temporary read failures hide protected data until an explicit retry succeeds, preserving the draft and its original revision.
Refused edits, archive changes and investigation starts check current read access without repeating the write. Delayed responses cannot restore a denied record; unrelated authorized profiles and independent new drafts remain available. A successful save is still reported as saved if the following list refresh fails.
Validation: production build, 319 Node tests, 23 actual-component access regressions, and desktop/390px browser checks passed. Synthetic transport only; no native or durable writes. Rebuild only the portal service and preserve the data volumes and instance ID. No migration is required.

Closing an edited procedure with Escape, Cancel or the close button now asks whether to keep editing or discard the draft. Every field and the version note remain intact while this choice is open. Unchanged or fully reverted forms close immediately. A pending save cannot be dismissed or submitted again.
Current-access checks still clear denied or deleted records without retaining protected drafts. Draft revisions remain bound to the version originally opened. No data migration or native API changes.
Validation: production build, 236 Node tests, 41 actual-App navigation/discard checks, ten editor ownership checks, and desktop/390px browser verification passed with synthetic transport. The article now links to the current walkthrough.
Rebuild only the portal service, preserving existing volumes and instance ID. Save before reload or logout; drafts are held only in browser memory.

Switching from Procedure library to another tool no longer discards an open procedure draft. Returning restores its name, steps and version note after checking current read access. A temporary read failure preserves the hidden draft for an explicit retry; a denied or missing record clears it. The original edit revision remains bound to the draft, and a pending save is never repeated by navigation. Its failure message remains visible after return.
Validation: production build and 236 tests, 23 actual-App navigation checks, 19 existing access checks, 10 editor ownership checks, and desktop/390px browser QA passed. All navigation scenarios used synthetic transport and made no native or durable writes.
Rebuild the portal service while preserving the existing volumes and instance ID. No native class or data migration is required. Save before reload or logout; unsaved drafts are not persistent.

Switching tools from the runbook chooser or an open run dialog no longer leaves an invisible modal blocking the new workspace. Returning to Runbooks restores the same dialog, keyboard focus and in-memory form values, including the title and selected sources of an observation plan. Navigation does not create a run or execute a step.
Validation: production build and 236 tests passed, plus 15 actual-App browser regressions and desktop/390px checks. All 14 existing handover draft checks also passed after the shared modal lifecycle change. All navigation checks used synthetic transport; no native actions or stored-data changes occurred.
Rebuild only the portal service using the README instructions. Preserve IRIS and run-store volumes and the configured instance ID. No native class or data migration is required. Save before signing out or reloading the browser; unsaved drafts are not persistent.

Switching from an access-review report preview to another tool with Ctrl/Cmd+K no longer leaves an invisible modal blocking the application. Review dialogs are suspended while their workspace is hidden, and returning restores the same preview and in-memory note. Nested modal boundaries preserve both workspace and authorization suspension. The tool finder now recognizes SQL and grant keywords.
Validation: production build and 263 tests passed. Actual application components with production styles were checked on desktop and at 390px, including navigation to Logs, returning by the main navigation and tool finder, restored keyboard focus, and unchanged reviewer notes. Synthetic transport only; no native grants, saved campaigns or IRIS data changed.
Upgrade only the portal gateway using the README instructions. No native class or data migration is required. Keep the existing volumes and configured instance ID. Unsaved drafts still do not survive sign-out or browser reload.

Capture comparisons now show the existing chronological warning directly beside the Earlier/Later selectors when finish times are reversed or equal. The warning is no longer hidden inside collapsed limits. Selection order, subtraction direction, saved reviews and exported evidence remain unchanged. The first-investigation guide explains the direction.
Validation: production build, 319 tests and 11 actual-component browser regressions; desktop and 390px/dark checks with synthetic captures. No native or saved-record writes. Rebuild the portal service; no new native class or data migration is needed from 1.0.2.

Recorded procedure checks now show Check passed, Check failed or Result unknown in the step list and selected result. Failed and unknown checks use distinct warning icons; completing the steps no longer visually implies that every check passed. Existing execution states and assertion evaluation are unchanged.
Read-only checkpoint prompts ask for the operational decision and follow-up. The first-run guide now points to Runs / Runbooks, where New run is located.
Validation: production build, 236 tests and 14 actual-component browser regressions. Desktop, dark theme and 390px checks verified mixed outcomes, completion messaging and required checklist/note behavior with synthetic observations. No native writes. Rebuild the portal service while preserving existing IRIS and run volumes.

The campaign header now counts the same overdue follow-ups as the report, including scheduled reviews of accepted findings, certification exceptions and unreviewed subjects with a scope deadline. Refresh dates, opening the report and exporting fresh evidence synchronize the evaluation time, including across UTC midnight. Decisions and deadlines are unchanged.
The SQL evidence guide clarifies when an in-memory capture is replaced or cleared.
Validation: production build and 261 tests, including six actual-component regressions, plus desktop and 390px report checks with synthetic evidence. Rebuild only the portal service; preserve existing IRIS and campaign volumes. No native changes are required.

Runs and procedures recheck read access after a refused change. An allowed read preserves the draft; a forbidden or missing record removes its details and exports. Temporary failures hide evidence until a successful read, including open handover and procedure editors. Changes are never automatically replayed.
Confirmed saves remain reported as saved if the subsequent list refresh fails. Newly created or duplicated procedures are rechecked by their returned identifier.
Validation: production build, 236 tests, 19 access, 15 dispatch recovery and 10 editor browser regressions, plus desktop/390px checks with synthetic transport. Rebuild only the portal service; no native class or data-volume changes are required.

Campaigns now recheck read access after a refused change. Forbidden or missing records clear cached evidence and exports; temporary recheck failures hide the workspace and dialogs while preserving drafts. An allowed read restores the draft without replaying the change. A newer saved revision requires an explicit reload before retrying.
A forbidden campaign list clears the selected workspace. Successful saves followed by a list refresh error remain reported as saved, including remediation results.
Validation: production build, 255 tests, and desktop/390px checks using actual components with synthetic transport. No native API or stored-data changes. Rebuild the portal service to update; preserve the existing IRIS and campaign volumes.

After a refused investigation change, Harbor now checks current read access before retaining the evidence and exports. A denied or missing case is removed from the view. A temporary recheck failure hides evidence and exports while keeping the draft available for a successful retry. A refusal concerning a new linked change does not discard a case that remains readable.
Validation: production build and 319 tests passed, including five UI regressions. Desktop and 390px browser checks covered denied/missing reads, a still-authorized draft, temporary failure and recovery, and preservation of another case. Synthetic records only; no native permissions or data were changed.
This release also includes the first-investigation guide. Rebuild the portal gateway for this correction while preserving the workspace volume and instance ID. When upgrading from 1.0.0, also install the native log-reader update described in 1.0.1.

Closing an edited handover now asks whether to keep editing or discard the draft. Summary and follow-up actions remain available after a refused save, and a save in progress blocks duplicate submission and dismissal. Escape from the discard prompt returns to the editor. Drafts are not persisted across reloads or logout.
Validation: production build, 236 automated tests and 14 real-component browser regressions passed. Desktop and 390px checks included actual repeated Escape, preserved text, refused saves and explicit discard. Synthetic records only; no native changes or messages sent.
Rebuild the portal gateway using the README instructions. Preserve the run volume and configured instance ID. No native class or data migration is required. This release also includes the first-observation guide and current walkthrough link.

Next-period confirmation now applies to the source campaign ID and revision. If a reload brings changed settings, Atlas requires another review before creating the next campaign while preserving the entered title and description. The submit handler also rejects stale or missing confirmation.
Validation: production build and 244 tests passed, including three component regressions. Desktop and 390px browser checks confirmed stale acknowledgement is cleared, changed scope is displayed and renewed confirmation submits the current revision. Synthetic records only; no native changes.
Rebuild the portal gateway using the README instructions. Preserve the campaign volume and configured instance ID. No native class or data migration is required.

1.0.5: an About page that shows what the installation is (Aperture's version, the instance, the sign-in, the log reader); Docker Compose step by step in the README, with a compose file that comes back after a reboot; the Docker image applies IRIS_PASSWORD at the first start only, so a restart keeps passwords changed in IRIS; similar entries only read on a GET, and index refreshes take turns; a Content-Security-Policy on the portal IRIS serves and on the demo; a session IRIS revokes ends at once; a lighter first load.

Unsaved finding decisions and certification edits no longer disappear silently when switching campaign tools. Atlas asks whether to keep editing or discard the draft. Escape keeps it; moving to another access-review tool preserves the open campaign in memory.

Opening a different campaign also protects unsaved review and campaign-detail edits. A failed save or replacement read retains the draft. This does not store drafts after logout, session expiry or a browser reload, and does not change native access controls.

Validation: production build and 241 tests passed, including six component lifecycle regressions. Desktop and 390px browser checks covered scope and decision drafts, retained state across tools, refused saves, campaign replacement, Escape and explicit discard. The checks used isolated synthetic records and made no native changes.

Rebuild the portal gateway using the README instructions. Preserve the campaign volume and instance ID. No native class or data migration is required. Includes the SQL evidence review introduced in 1.1.0.

Access Atlas now has a separate SQL privilege review for a selected namespace and user or role. Object and administrative grants retain their own status, scope, read times and limits. Operators can filter the displayed records and export all captured evidence without changing grants or impersonating an account.

The view preserves a successful source if the other fails, distinguishes unknown flags from false, warns about column details and the 500-row cap, and clears stale evidence when the requested scope changes. It handles both documented Name/Privilege fields and the Object/Action fields observed on IRIS 2026.2. Resource-map completeness is not used to describe SQL results.

See docs/SQL_EVIDENCE.md for the workflow, API behavior and limits. This release also includes the API interpretation guide and the current YouTube walkthrough link.

Validation: production build and 235 automated tests; read-only native probes for both SQL sources; live browser capture of 500 object and 31 administrative rows; filtered export retaining all 531 rows; partial-error, unknown-flag, stale-response and 390px browser checks. No native grants, accounts, tables or data were changed.

Upgrade the portal gateway using the README instructions. No native class or data migration is required for this release. Preserve the existing campaign volume and configured instance ID.

Harbor now discovers and reads native IRIS messages.old_Date archives, including bounded paging and filtering. The log reader still enforces the configured log directory, refuses symbolic links and verifies file identity between pages.

Upgrade both the Harbor.LogReader class and the portal gateway. See the installation and upgrade instructions in README. Existing IRIS data and Harbor investigation records are preserved.

Validation: 314 TypeScript tests and production build; 8 native-reader Python tests on Linux; compilation in IRIS 2026.2; live log browsing and desktop/390px archive fixture checks.

Source and release notes: https://github.com/Igorandor/harbor/releases/tag/v1.0.1

[v0.0.2] - 2026-09-28

Fixed

• Quick Start fails on Windows (Issue #1) — the production compose file now maps host port 8080 to container port 80 instead of 80:80.
  • On Windows machines where port 80 is reserved at the kernel level by IIS / the http.sys driver (IIS's default site registers the full-port reservation http://+:80/), the Docker daemon (a user process) cannot bind port 80 and docker compose up failed with:
    listen tcp 0.0.0.0:80: bind: An attempt was made to access a socket in a way forbidden by its access permissions (WSA_EACCES / 10013).
  • 8080 is not an IIS/http.sys default, so the one-command run now works out of the box on every machine. The app inside the container is unchanged.
  • READMEs (EN + ZH) updated: Quick Start now opens http://localhost:8080/, with a note on how to use host port 80 instead (change the mapping to 80:80 and free port 80 first, e.g. stop IIS).
  • Root cause confirmed 1:1 by controlled experiment: with an HttpListener holding http://+:80/ (the http.sys kernel driver — the same mechanism IIS uses), docker run -p 80:80 fails with the identical error; a plain user-process socket holding 80 does not block Docker (SO_REUSEADDR coexistence), and the Windows firewall has no effect.

Restrain the agent your way

• Switch off individual agent writes without switching off the agent.
• A read-only toggle for your own session.
• Per-person turn limits, with a banner that says when you can send again. There is no limit until an administrator sets one.
• Ask the agent for the script instead of the change, and take it into your own change process.
• Conversations are kept, cleared on a retention schedule, and open to administrators.
• Content the agent reads is defanged before it reaches the model, and a seeded-injection test proves a log line cannot steer it.
  New screens
• A try-it console for any REST application's OpenAPI document.
• Six more logs: System Monitor, background task errors, xDBC errors, SQL diagnostics, the interoperability event log and the analytics log.
• Older messages.log files, from the portal (Community Idea DPI-I-966).
• Security and operations findings on Home, each with a fix you review and confirm.
• A Guardrails page: what the agent may never do, and what needs your confirmation.
  Conveniences
• After every write, the screen confirms the instance now holds the new value.
• Removals say what else depends on the item before you confirm.
• The instance's performance at a glance on Home.
• Any table downloads as CSV.
• Many small fixes.
  Requires InterSystems IRIS or IRIS for Health 2026.2 or later. Upgrading from 1.0.1 keeps your agent definitions, conversations and audit records.

Release of Aperture for the InterSystems contest entry.

Changelog — spec 010: Canvas onboarding and flow management usability

Branch feat/spec010 (uncommitted). Frontend only; nothing changed under src/ or in openapi.yaml.

Added

Flow management (US1, US2)

• Save as…: creates a new flow from the current canvas, including unsaved edits, under a new name. The original keeps its name, revision and contents. The address switches to the new flow, and Back returns to the original. If the name is taken, the dialog shows the platform's reason word for word and stays open.
• New flow: starts an empty canvas with a unique default name (Untitled flow YYYY-MM-DD HH:MM:SS, with (2), (3)… added on a clash) and removes the flow from the address.
• Rename notice: editing a saved flow's name shows "Renames this flow — use Save as… to keep a copy".
• Conflict hint: when Save flow hits a revision conflict, the platform's message is followed by "Use Save as… to keep your version."
• Unsaved-changes dialog (Save / Discard / Cancel): a single dialog guards New flow, Open flow…, Open example flow, and back/forward or links that change the open flow. A refused save keeps it open with the platform's reason.
• Open flow…: lists every saved flow with its name, revision and last-saved time, newest first. It has a case-insensitive name filter and marks the open flow. The list is read fresh on every opening. With 5,000 flows it opens in about 80 ms and filters in about 70 ms.
• Flow that can't be opened: if the address names a flow that can't be read, the canvas now opens with the platform's reason and offers Open flow… and New flow, instead of a blank error page.

Sign-in across reloads (US3)

• Reload keeps the sign-in: the page returns to the same screen, flow and live run from the address, and the sign-in form never flashes during the reload.
• What is stored: only the refresh token plus a small "in use" flag, kept in the tab's own storage (sessionStorage). No password, access token, user name, role or permission is stored.
• Duplicated tab: it never reuses the copied token and asks for its own sign-in. Reusing it would make the platform sign the original tab out.
• Session ended: when the kept sign-in can't be renewed (expired after 15 minutes, revoked, IRIS restarted or unreachable), the sign-in form says "Your session ended — sign in again." After signing in, it returns to the place in the address.
• What ends it: sign-out, a rejected request, a failed renewal, or closing the tab.

Example flow (US4)

• "Example: storage health check": two read-only steps that run in parallel. Storage headroom check runs with minFreePercent: 10; Database size report has no parameters. It validates with 0 errors and completes in about 1.7 s, with no destructive confirmation.
• Where it's offered: on the empty canvas of an instance with no flows (next to Start from scratch), in Open flow… when the list is empty, and in the getting-started guide.
• Never duplicated: the example is identified by its name. If it already exists it opens; if creating it clashes on the name, the list is read again and the existing one opens.
• When it's hidden: if any step type it needs is missing, unavailable or destructive, or if the flow list can't be read.

Getting-started guide (US5)

• Six-step dialog: Welcome, Open the example, Build a flow, Validate and run, Save/Save as/Open, and Schedule and explore. It has Back/Next, "Step n of 6", and Close on every step.
• "Don't show this again": remembered per browser. If the browser blocks storage, the guide still works and simply appears again at the next sign-in.
• When it opens by itself: only after a sign-in typed with the password, not after a reload, and once per visit.
• Help → Getting started: on every screen.
• Accessible: a modal dialog announced with its title, fully keyboard-operable. Tab stays inside, Escape closes it, and focus returns to where it was.

Changed

• Top bar layout, so everything fits at 1440 px:
  • Open flow… is a visible button.
  • New flow and Save as… moved into a More ▾ menu.
  • The %SYS label and the revision/saved-time line sit under the flow name.
• Shared building blocks: Modal.svelte (the dialog frame, with focus handling and Escape), MenuButton.svelte (keyboard-accessible menu button) and dialog.css (shared dialog look, theme tokens only).

Fixed

• Focus leaving dialogs: Tab could leave the dialog for the browser's own toolbar; it now wraps inside the dialog.
• Guide preference lost on sign-out: signing out after a reload could erase the stored "Don't show this again" choice.
• Example step under the legend: the example's first step was placed under the canvas edge legend and couldn't be clicked.

Tests

• Unit tests: 89 → 145.
• End-to-end: 5 new spec files, us17–us21. The full suite has 64 passed, 1 skipped (the opt-in 900 s expiry test, which passed on its own), 0 failed.
• Existing tests updated on purpose:
  • us7-catalog: a reload and a same-tab navigation no longer need a new sign-in.
  • us15-targets: the "no credential left in the browser" check now targets target credentials specifically, allowing only the tab's own kept refresh token. It also registers iris-target itself, so it no longer depends on test order.
• Test helpers:
  • signIn can pre-dismiss the guide.
  • deleteFlowWithRuns deletes a flow and its runs. It refuses to run unless on the local dev instance, in the IRISAPP namespace, and on a flow whose exact name has a known test prefix.

Docs

• docs/limitations.md: new entries on sign-in across reloads (including that a browser crash requires signing in again) and on the example flow (its 10% free-space threshold).
• Spec 010 docs: the quickstart has a free-space check before the example run; evidence/ holds the test records, performance numbers and the Constitution review.

Environment notes

• Dev-only setting: ^sentai("config","allowInsecureTargets")=1 was set by hand on the dev instance. The running iris image predates the iris.script line that sets it, so it disappears if the container is recreated from this image.
• Test data: 134 of this feature's test flows (plus probe flow 5126) were deleted from the dev instance.

Initial Release

Initial Release

Initial Release

Initial Release

Initial Release