https://aitoolchain.io/tools/emisar New releases and features in emisar, tracked by The AI Toolchain. en Wed, 26 Aug 2026 01:18:04 GMT https://github.com/AndrewDryga/emisar/releases/tag/v0.43.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.43.0 Wed, 26 Aug 2026 01:18:04 GMT emisar v0.43.0 binds role and runner-access mappings to immutable directory-group IDs, with a one-way migration required on upgrade. • Role and runner-access mappings now bind to emisar's immutable directory-group ID, so same-name groups stay distinct, renames preserve grants, and delete/recreate never inherits old access. • Okta groups without an external ID can now be mapped directly. • OIDC convergence for Okta and Microsoft Entra ID now accepts only the exact active SCIM identity under the provider's configured identifier claim; unverified email claims are denied. • Provider setup guides for Okta, Entra, JumpCloud, Google Workspace, and Keycloak are updated to match current screens and document which OIDC and SCIM paths were live-tested. • Approval override flow now collects the audited reason once and clearly states which approval count is being bypassed and which policy and runner checks still apply. • Transactional emails now surface the next action first, link account context when available, express approval state in words as well as color, and keep HTML and plain-text variants aligned. Breaking changes: • v0.43.0 includes a one-way authorization-mapping migration: stop SSO/SCIM and mapping writes, drain every v0.42 Portal node, run the migration once, then start only the v0.43 image. After the migration commits, v0.42 is not a rollback candidate and the migration must not be run down; rollback requires an image that understands immutable directory-group mappings. https://github.com/AndrewDryga/emisar/releases/tag/v0.42.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.42.0 Tue, 25 Aug 2026 05:03:08 GMT emisar v0.42.0 adds PKI-backed signed dispatch, MCP bridge commands, `emisar pack diff/verify`, and Windows ARM64 support • Adds `emisar pack diff` to show upgrade changes between pack versions. • Adds `emisar pack verify` to prove pack setup is correctly configured. • Extends `pack suggest` to accept a registry catalog URL as a source. • Signed dispatch now accepts certificates issued from your own PKI, with each certificate naming the runners it may target and runners verifying the chain against configured trust anchors. • Every MCP tool is now available as a bridge command, enabling scripts and clients without MCP support to invoke them directly. • The MCP Bridge now owns client connect and disconnect lifecycle, drains runbook output automatically, and returns actionable validation errors. • Windows support added to the MCP Bridge, including VS Code integration, native ARM64 binaries, direct authentication, and safer client-config replacement with symlink-safe backups. • Nomad namespaces are now supported in packs, with setup requirements surfaced in both the console and CLI. • Owners and administrators gain an audited break-glass override for unreachable approval quorums. • MFA, SSO, email, invitation, device-grant, session-revocation, and SCIM decisions are now rechecked within the transaction that commits the resulting authority. • Replaying a still-valid spent OAuth refresh token now revokes the backing connection and its active successors, requiring reconnection. • SCIM DELETE now retires the directory resource and its independent OIDC authority; an exact later POST revives only the directory resource. • Metrics, logs, and process diagnostics now carry explicit cost and disclosure bounds; the Redis Sentinel down-state probe is structurally read-only. https://github.com/AndrewDryga/emisar/releases/tag/v0.41.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.41.0 Tue, 18 Aug 2026 02:17:43 GMT emisar v0.41.0 adds role-scoped consoles, live session reconnection on permission changes, and 100-pack catalog with new GCP, Consul, and HCP Terraform actions. • Role and scope changes (member role, runner access, pack access) now take effect immediately in open web sessions, reconnecting the session before stale authority can be exercised. • Billing managers receive a finance-only console; operators can manage agents, approvals, and runbooks without gaining team or policy administration rights. • Scoped admins are blocked from delegating more reach than they hold or triggering account-wide pack cleanup. • Reads that expose every pack version or an exact run command now require a checked subject rather than relying on already-filtered callers. • The read-only staff console now requires MFA proof tied to the current enrollment. • Console navigation, actions, filters, and empty states adapt to the member's role and access; billing managers no longer see a dead Dashboard link, and absent runner access is surfaced as a permission state. • Restricted pack and action views now explain why results are limited. • SSO group mappings now paginate in both directions. • Pack catalog expands to 100 packs and 1,689 actions. • Consul pack gains the ability to snapshot registration churn; the debugging pack adds bounded process context, environment-key, argv, and connection reads. • GCP Monitoring pack adds Cloud Logging name and entry reads. • HCP Terraform pack exposes replacement paths in plan summaries. https://github.com/AndrewDryga/emisar/releases/tag/v0.41.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.41.0 Tue, 18 Aug 2026 02:17:43 GMT emisar v0.41.0 adds role-aware console, new pack catalog entries, and immediate session enforcement on permission changes. • Role, runner, and pack scope changes now take effect in open web sessions immediately, reconnecting the session before stale authority can be acted on. • Billing managers now receive a finance-only console; operators can own agents, approvals, and runbooks without gaining team or policy administration rights. • Scoped admins are blocked from delegating more reach than they hold or arming account-wide pack cleanup. • Reads that expose every pack version or an exact run command now require a checked subject rather than relying on already-filtered callers. • The read-only staff console now requires MFA proof tied to the current enrollment. • Console navigation, actions, filters, and empty states now adapt to the member's role and access — billing managers no longer see a dead Dashboard link, and missing runner access is surfaced as a permission state. • Restricted pack and action views now explain why results are limited. • SSO group mappings now paginate in both directions. • The pack catalog grows to 100 packs and 1,689 actions. • Consul gains the ability to snapshot registration churn; the debugging pack adds bounded process context, environment-key, argv, and connection reads. • GCP Monitoring adds Cloud Logging name and entry reads. • HCP Terraform plan summaries now expose replacement paths. https://github.com/AndrewDryga/emisar/releases/tag/v0.41.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.41.0 Tue, 18 Aug 2026 02:17:43 GMT emisar v0.41.0 adds role-aware console, new pack catalog entries, and immediate session enforcement on permission changes. • Role, runner, and pack scope changes now take effect in open web sessions immediately, reconnecting the session before stale authority can be acted on. • Billing managers now receive a finance-only console; operators can own agents, approvals, and runbooks without gaining team or policy administration rights. • Scoped admins are blocked from delegating more reach than they hold or arming account-wide pack cleanup. • Reads that expose every pack version or an exact run command now require a checked subject rather than relying on already-filtered callers. • The read-only staff console now requires MFA proof tied to the current enrollment. • Console navigation, actions, filters, and empty states now adapt to the member's role and access — billing managers no longer see a dead Dashboard link, and missing runner access is surfaced as a permission state. • Restricted pack and action views now explain why results are limited. • SSO group mappings now paginate in both directions. • The pack catalog grows to 100 packs and 1,689 actions. • Consul gains the ability to snapshot registration churn; the debugging pack adds bounded process context, environment-key, argv, and connection reads. • GCP Monitoring adds Cloud Logging name and entry reads. • HCP Terraform plan summaries now expose replacement paths. https://github.com/AndrewDryga/emisar/releases/tag/v0.40.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.40.0 Thu, 13 Aug 2026 21:44:31 GMT emisar v0.40.0 adds self-updating runners, paginated MCP responses, and 5 new catalog integrations • Adds `emisar update` subcommand for installer-managed runners to self-update, verifying release checksum and GitHub build attestation before executing stop, swap, restart, and rollback. • `emisar pack update --json` now emits its partial report before returning a post-update validation error, preserving machine-readable output for automation pipelines. • `wait_for_run` now pages large terminal runbook results as ordered 64 KiB chunks via an opaque continuation token when a result exceeds one MCP response, with small executions still completing in a single call. • Expands the catalog to 100 packs and 1,682 actions, adding JFrog Artifactory, Databricks, Sentry, Symbolicator, and NTPsec, with expanded Cassandra and Cloudflare coverage. • Runner, pack, action, approval, and audit discovery now enforces the member's current runner and pack scope across both the console and MCP. https://github.com/AndrewDryga/emisar/releases/tag/v0.40.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.40.0 Thu, 13 Aug 2026 21:44:31 GMT emisar v0.40.0 adds self-updating runners, paginated large runbook results, and 100-pack catalog coverage. • Adds `emisar update` subcommand for installer-managed runners to self-update, with release checksum and GitHub build attestation verification before executing stop, swap, restart, and rollback. • Adds `--json` flag to `emisar pack update` that now emits a partial machine-readable report before returning a post-update validation error, preserving automation output on failure. • When a terminal runbook result exceeds one MCP response, `wait_for_run` now returns the summary in the first response and an opaque continuation token for ordered 64 KiB pages, removing the previous arbitrary total-step ceiling. • Catalog expands to 100 packs and 1,682 actions, adding JFrog Artifactory, Databricks, Sentry, Symbolicator, and NTPsec integrations, with expanded Cassandra and Cloudflare coverage. • Runner, pack, action, approval, and audit discovery now enforces the member's current runner and pack scope across both the console and MCP. • Catalog rows now require deployment on a runner the member can see, and malformed cross-account associations fail closed. https://github.com/AndrewDryga/emisar/releases/tag/v0.40.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.40.0 Thu, 13 Aug 2026 21:44:31 GMT emisar v0.40.0 adds self-updating runners, paginated large runbook results, and 100-pack catalog coverage. • Adds `emisar update` subcommand for installer-managed runners to self-update, with release checksum and GitHub build attestation verification before executing stop, swap, restart, and rollback. • Adds `--json` flag to `emisar pack update` that now emits a partial machine-readable report before returning a post-update validation error, preserving automation output on failure. • When a terminal runbook result exceeds one MCP response, `wait_for_run` now returns the summary in the first response and an opaque continuation token for ordered 64 KiB pages, removing the previous arbitrary total-step ceiling. • Catalog expands to 100 packs and 1,682 actions, adding JFrog Artifactory, Databricks, Sentry, Symbolicator, and NTPsec integrations, with expanded Cassandra and Cloudflare coverage. • Runner, pack, action, approval, and audit discovery now enforces the member's current runner and pack scope across both the console and MCP. • Catalog rows now require deployment on a runner the member can see, and malformed cross-account associations fail closed. https://github.com/AndrewDryga/emisar/releases/tag/v0.39.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.39.0 Mon, 10 Aug 2026 06:45:19 GMT emisar v0.39.0 overhauls runbook versioning into a publish/release model with diff-on-confirm, MCP slug-keyed drafts, and broader secret redaction. • Adds `get_runbook` and `update_runbook_draft` MCP surface keyed by slug, so an agent replaces the single unpublished draft under the hash it read; publication remains human-only. • Runbook publishing now renders a line-level diff of what changed from the live release before confirming, using the canonical content hash as the definition's identity. • Introduces a single-draft model per runbook: only one unpublished change can exist at a time; the history list labels the live release on the Run button itself (e.g. `Run v3`) and marks a waiting draft with a dot. • Running an older release now returns `not_live` instead of silently dispatching current content; running an unpublished draft requires explicit consent plus the hash of exactly what was read. • Each execution snapshots the definition and release number it dispatched, making audit history immutable to later edits, publishes, or deletes. • Runner `v0.19.0` expands secret redaction to cover connection strings, database URLs, key-derivation inputs (salt, pepper), cookie and session signing keys, and passphrase spellings — acting as a safety net beneath action-level redaction declarations. • pfSense pack gains resolver, NTP, and WireGuard peer reads (secrets excluded), plus a DHCP reservation write staged for operator approval. • Behavior harness in Packs now exercises a real service manager booted as PID 1, a per-case Docker daemon, iptables inside its own namespace, and a real dpkg database for install, remove, and autoremove scenarios. Breaking changes: • The portal migration collapses all per-save version rows into a single runbook record, renumbers published versions into releases, and repoints execution history — this runs automatically before the instance serves traffic on upgrade. https://github.com/AndrewDryga/emisar/releases/tag/v0.39.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.39.0 Mon, 10 Aug 2026 06:45:19 GMT emisar v0.39.0 overhauls runbook versioning to track decisions not saves, adds MCP draft API, and broadens secret redaction. • Adds `get_runbook` and `update_runbook_draft` MCP endpoints keyed by slug, letting agents replace the single unpublished draft under the exact hash they read while keeping publication human-only. • Publish confirmation now renders a diff of changed lines against the canonical text whose hash defines the release, so reviewers see exactly what will move the hash before approving. • Running an older (non-live) release now returns `not_live` instead of silently dispatching current content; running an unpublished draft requires explicit consent plus the hash of the draft as read. • Each execution snapshots the definition it dispatched, making the audit record immutable to later edits, publishes, or deletes. • The Run button in the history list names the live release directly (e.g., `Run v3`) and marks a waiting unpublished change with a visual indicator. • Runner `v0.19.0` expands automatic secret redaction to cover connection strings, database URLs, key-derivation inputs (salt, pepper), cookie and session signing keys, and passphrase-pattern field names — acting as a safety net when actions omit their own redaction declarations. • pfSense pack gains resolver, NTP, and WireGuard peer reads that never expose private keys, plus a DHCP reservation action staged for operator approval. • pfSense certificate reads no longer emit the certificate's private key. • The fleet installer no longer places the reusable enrollment key on the process command line. • Behavior harness for packs now runs against a real service manager booted as PID 1, a per-case Docker daemon, iptables inside its namespace, and a real dpkg database for install, remove, and autoremove scenarios; uncovered cases are recorded with an explicit reason. Breaking changes: • The portal migration collapses each runbook's per-save version rows into a single runbook record, renumbers published versions into releases, and repoints all execution history — existing version numbers will change. The migration runs automatically before the instance serves traffic on upgrade. https://github.com/AndrewDryga/emisar/releases/tag/v0.39.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.39.0 Mon, 10 Aug 2026 06:45:19 GMT emisar v0.39.0 overhauls runbook versioning to track decisions not saves, adds MCP draft API, and broadens secret redaction. • Adds `get_runbook` and `update_runbook_draft` MCP endpoints keyed by slug, letting agents replace the single unpublished draft under the exact hash they read while keeping publication human-only. • Publish confirmation now renders a diff of changed lines against the canonical text whose hash defines the release, so reviewers see exactly what will move the hash before approving. • Running an older (non-live) release now returns `not_live` instead of silently dispatching current content; running an unpublished draft requires explicit consent plus the hash of the draft as read. • Each execution snapshots the definition it dispatched, making the audit record immutable to later edits, publishes, or deletes. • The Run button in the history list names the live release directly (e.g., `Run v3`) and marks a waiting unpublished change with a visual indicator. • Runner `v0.19.0` expands automatic secret redaction to cover connection strings, database URLs, key-derivation inputs (salt, pepper), cookie and session signing keys, and passphrase-pattern field names — acting as a safety net when actions omit their own redaction declarations. • pfSense pack gains resolver, NTP, and WireGuard peer reads that never expose private keys, plus a DHCP reservation action staged for operator approval. • pfSense certificate reads no longer emit the certificate's private key. • The fleet installer no longer places the reusable enrollment key on the process command line. • Behavior harness for packs now runs against a real service manager booted as PID 1, a per-case Docker daemon, iptables inside its namespace, and a real dpkg database for install, remove, and autoremove scenarios; uncovered cases are recorded with an explicit reason. Breaking changes: • The portal migration collapses each runbook's per-save version rows into a single runbook record, renumbers published versions into releases, and repoints all execution history — existing version numbers will change. The migration runs automatically before the instance serves traffic on upgrade. https://github.com/AndrewDryga/emisar/releases/tag/v0.38.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.38.0 Sat, 08 Aug 2026 23:56:01 GMT Emisar v0.38.0 adds policy override validation warnings and fixes session disconnect and runbook size reporting. • Adds a live validation warning when a policy override glob pattern cannot match any action ID — for example, regex-style patterns like `cassandra\.drop_*` — so deny rules that silently protect nothing are caught while writing, not after deployment. • Session termination now disconnects the active console session immediately, not only the backing cookie, so administrators ending sessions during an incident actually cut access. • Runbook size failures now report the actual size rather than appearing as a missing record, and character-limit bounds on title and description fields are now derived from the byte budget rather than assumed, preventing multibyte-encoded descriptions from silently vanishing from `list_runbooks` and `get_runbook`. https://github.com/AndrewDryga/emisar/releases/tag/v0.38.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.38.0 Sat, 08 Aug 2026 23:56:01 GMT emisar v0.38.0 flags unmatched policy overrides, fixes session disconnect, and corrects runbook size reporting. • Policy overrides that cannot match any action ID — such as regex-style globs like `cassandra\.drop_*` — are now flagged with a warning while you write them, surfacing deny rules that silently protect nothing. • Runbook projection failures now report the actual size rather than returning a not-found response, so oversized runbooks are no longer silently dropped from `list_runbooks` or denied in `get_runbook`. • Ending a member's sessions now disconnects the live console session immediately, not only the cookie, closing the window where an active console remained usable after an administrator ended sessions mid-incident. • Character limits on runbook title and description now carry byte bounds derived from the projection budget, preventing multibyte-encoded descriptions (e.g. Japanese or accented Latin at the documented 4,096-character limit) from causing runbooks to vanish. https://github.com/AndrewDryga/emisar/releases/tag/v0.38.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.38.0 Sat, 08 Aug 2026 23:56:01 GMT emisar v0.38.0 flags unmatched policy overrides, fixes session disconnect, and corrects runbook size reporting. • Policy overrides that cannot match any action ID — such as regex-style globs like `cassandra\.drop_*` — are now flagged with a warning while you write them, surfacing deny rules that silently protect nothing. • Runbook projection failures now report the actual size rather than returning a not-found response, so oversized runbooks are no longer silently dropped from `list_runbooks` or denied in `get_runbook`. • Ending a member's sessions now disconnects the live console session immediately, not only the cookie, closing the window where an active console remained usable after an administrator ended sessions mid-incident. • Character limits on runbook title and description now carry byte bounds derived from the projection budget, preventing multibyte-encoded descriptions (e.g. Japanese or accented Latin at the documented 4,096-character limit) from causing runbooks to vanish. https://github.com/AndrewDryga/emisar/releases/tag/v0.37.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.37.0 Sat, 08 Aug 2026 10:28:58 GMT emisar v0.37.0 adds 90-day self-refreshing runner tokens, no_new_privs process isolation, multi-arch container images, and 95 packs with 1,498 actions. • New `EMISAR_GROUP` and `EMISAR_RUNNER_ID` environment variables let operators relabel a fleet without editing configs on each host. • Official multi-architecture container image published at `ghcr.io/andrewdryga/emisar-runner` with build provenance and an SBOM. • Runner tokens now carry a 90-day bounded lifetime and self-refresh two-thirds of the way through over the existing connection, with no host access required; expired tokens are refused at connect. • Action children now start with `no_new_privs`, preventing `execve` inside a pack from picking up setuid or file-capability privileges the runner does not already hold. • Reads that can return credentials are now approval-gated; sensitive run values are masked in a single pass so one match cannot rewrite another's marker. • MFA enrollment and recovery-code regeneration now require proof of the current inbox; credential step-up codes are rate-limited across the cluster rather than per node. • Every pack's `curl` is confined to an explicit protocol with globbing off, preventing URLs arriving in API responses from expanding into extra transfers or exfiltrating credentials. • Signed MCP dispatch now signs the narrative a human approver actually reads (attestation v5), and the bridge verifies that narrative rather than a reconstruction of it. • MCP bridge signing key now comes from a pinned credential directory instead of the environment. • Runbook targets can name a runner group in the model contract, and an agent can revise and test a runbook draft before a human publishes it. • Catalog now carries 95 packs and 1,498 actions, adding Apache Airflow, Spark, Google Cloud billing, and BunnyCDN. • Console runbook target selection adds a stable trigger naming chosen targets, a searchable roster of dense one-line rows, and scope icons encoding cardinality. • Backlogged run output ships as one frame instead of one per line, and the connection lease renews at half its life instead of on every heartbeat. Breaking changes: • Action children now start with `no_new_privs`, so a setuid or setgid helper in a runner's process tree no longer elevates. For example, `postqueue` (setgid `postdrop`) can no longer grant access to the Postfix queue — the runner user must own the queue directly or be a `postdrop` member. https://github.com/AndrewDryga/emisar/releases/tag/v0.37.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.37.0 Sat, 08 Aug 2026 10:28:58 GMT emisar v0.37.0 adds 90-day auto-rotating runner tokens, `no_new_privs` enforcement, multi-arch container image, and 95 packs with 1,498 actions. • Adds `EMISAR_GROUP` and `EMISAR_RUNNER_ID` environment variables to relabel a fleet runner without editing per-host configs. • Publishes an official multi-architecture container image at `ghcr.io/andrewdryga/emisar-runner` with build provenance and an SBOM. • Runner tokens now carry a 90-day bounded lifetime and self-refresh two-thirds of the way through over the existing connection, with expired tokens refused at connect. • Action children now start with `no_new_privs`, preventing `execve` inside a pack from gaining setuid or file-capability privileges the runner does not already hold. • Every pack's `curl` is confined to an explicit protocol with globbing disabled, blocking URL expansion or credential exfiltration from API-supplied URLs. • MFA enrollment and recovery-code regeneration both require proof of the current inbox; credential step-up codes are now rate-limited cluster-wide rather than per node. • Credential-returning reads are approval-gated rather than classified low risk; sensitive run values are masked in a single pass so one match cannot rewrite another's marker. • MCP signed dispatch now signs and verifies the narrative a human approver actually reads (attestation v5) rather than a reconstruction of it. • MCP bridge signing key is now sourced from a pinned credential directory instead of the environment. • Runbook targets can now name a runner group in the model contract, and agents can revise and test a runbook draft before a human publishes it. • Catalog now carries 95 packs and 1,498 actions, adding Apache Airflow, Spark, Google Cloud billing, and BunnyCDN. • Each pack's structured output is bounded to fit the runner's cap at its advertised worst case; jq filters are restricted to core builtins for compatibility with minimal hosts. • Runbook target selection in the console scales to large fleets with a stable trigger, a searchable dense roster, and cardinality-encoding scope icons. • Backlogged run output now ships as one frame instead of one per line, and the connection lease renews at half its life instead of on every heartbeat. Breaking changes: • Action children now run with `no_new_privs`, so any setuid or setgid helper in a runner's process tree no longer elevates. For example, `postqueue` (setgid `postdrop`) can no longer grant access to the Postfix queue — the runner user must own the queue directly or be a `postdrop` member. https://github.com/AndrewDryga/emisar/releases/tag/v0.37.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.37.0 Sat, 08 Aug 2026 10:28:58 GMT emisar v0.37.0 adds 90-day auto-rotating runner tokens, `no_new_privs` enforcement, multi-arch container image, and 95 packs with 1,498 actions. • Adds `EMISAR_GROUP` and `EMISAR_RUNNER_ID` environment variables to relabel a fleet runner without editing per-host configs. • Publishes an official multi-architecture container image at `ghcr.io/andrewdryga/emisar-runner` with build provenance and an SBOM. • Runner tokens now carry a 90-day bounded lifetime and self-refresh two-thirds of the way through over the existing connection, with expired tokens refused at connect. • Action children now start with `no_new_privs`, preventing `execve` inside a pack from gaining setuid or file-capability privileges the runner does not already hold. • Every pack's `curl` is confined to an explicit protocol with globbing disabled, blocking URL expansion or credential exfiltration from API-supplied URLs. • MFA enrollment and recovery-code regeneration both require proof of the current inbox; credential step-up codes are now rate-limited cluster-wide rather than per node. • Credential-returning reads are approval-gated rather than classified low risk; sensitive run values are masked in a single pass so one match cannot rewrite another's marker. • MCP signed dispatch now signs and verifies the narrative a human approver actually reads (attestation v5) rather than a reconstruction of it. • MCP bridge signing key is now sourced from a pinned credential directory instead of the environment. • Runbook targets can now name a runner group in the model contract, and agents can revise and test a runbook draft before a human publishes it. • Catalog now carries 95 packs and 1,498 actions, adding Apache Airflow, Spark, Google Cloud billing, and BunnyCDN. • Each pack's structured output is bounded to fit the runner's cap at its advertised worst case; jq filters are restricted to core builtins for compatibility with minimal hosts. • Runbook target selection in the console scales to large fleets with a stable trigger, a searchable dense roster, and cardinality-encoding scope icons. • Backlogged run output now ships as one frame instead of one per line, and the connection lease renews at half its life instead of on every heartbeat. Breaking changes: • Action children now run with `no_new_privs`, so any setuid or setgid helper in a runner's process tree no longer elevates. For example, `postqueue` (setgid `postdrop`) can no longer grant access to the Postfix queue — the runner user must own the queue directly or be a `postdrop` member. https://github.com/AndrewDryga/emisar/releases/tag/runner-v0.17.2 https://github.com/AndrewDryga/emisar/releases/tag/runner-v0.17.2 Fri, 07 Aug 2026 02:34:35 GMT emisar runner 0.17.2 adds BunnyCDN operations, explicit runbook targets, and zone-aware MIG rollout placement. • Adds BunnyCDN operations and explicit runbook targets. • Allows production MIG rollout placement in available zones. https://github.com/AndrewDryga/emisar/releases/tag/runner-v0.17.2 https://github.com/AndrewDryga/emisar/releases/tag/runner-v0.17.2 Fri, 07 Aug 2026 02:34:35 GMT emisar runner v0.17.2 adds BunnyCDN operations, explicit runbook targets, and production MIG rollout zone placement. • Adds BunnyCDN operations and explicit runbook targets. • Allows production MIG rollout placement in available zones. https://github.com/AndrewDryga/emisar/releases/tag/runner-v0.17.2 https://github.com/AndrewDryga/emisar/releases/tag/runner-v0.17.2 Fri, 07 Aug 2026 02:34:35 GMT emisar runner v0.17.2 adds BunnyCDN operations, explicit runbook targets, and production MIG rollout zone placement. • Adds BunnyCDN operations and explicit runbook targets. • Allows production MIG rollout placement in available zones. https://github.com/AndrewDryga/emisar/releases/tag/v0.36.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.36.0 Fri, 31 Jul 2026 20:58:14 GMT emisar v0.36.0 adds staged runbooks with typed inputs and parallel execution, MCP 2026-07-28 routing support, and hardened OIDC/SCIM identity controls. • Adds staged runbooks where typed inputs bind once, stages run sequentially or in parallel against selected runner groups, and steps can extract named outputs, test success conditions, and wait within explicit bounds. • Adds a single pre-execution approval that freezes the complete runbook execution plan before work begins; Canonical JSON uses the same definition shape across the console and MCP. • Adopts the 2026-07-28 MCP routing headers and dual-era endpoint in the bridge and portal, including OAuth Client ID Metadata Documents. • Expands the action catalog to 91 packs and 1,386 actions, adding bounded diagnostics for GCP, Pure FlashArray, Terraform, Nomad, OIDC/JWKS, nftables, TCP, and Docker Compose. • Adds a unified bounded address policy covering OIDC discovery, JWKS refresh, and redirects that rechecks the response actually received; changing an issuer now clears credentials tied to the old one. • Adds atomic wire-order application of SCIM group patches with body bounding before authentication; disabling a SCIM connection now retires the sessions and pending identity links it vouched for. • Missing source commands and HTTP error responses now fail pack actions instead of silently reporting empty success through a downstream pipe or successful transport. Breaking changes: • Disabling a SCIM connection retires all sessions and pending identity links it vouched for, which will terminate active sessions for affected users on upgrade. https://github.com/AndrewDryga/emisar/releases/tag/v0.36.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.36.0 Fri, 31 Jul 2026 20:58:14 GMT emisar v0.36.0 adds staged runbooks with typed inputs and parallel execution, MCP 2026-07-28 routing, and hardened OIDC/SCIM identity controls. • Runbooks now support typed inputs bound at declaration time, with stages that run sequentially or in parallel against selected runner groups, and steps that extract named outputs, test success conditions, and wait within explicit bounds. • A single approval freezes the complete runbook execution plan before any work begins; execution pages show attempts, outputs, waits, and terminal causes in order. • Canonical JSON for runbook definitions uses the same shape across the console and MCP, enabling programmatic construction and review of execution plans. • The MCP bridge and portal adopt the 2026-07-28 MCP routing headers and dual-era endpoint, including OAuth Client ID Metadata Documents. • The action catalog expands to 91 packs and 1,386 actions, with new bounded diagnostics for GCP, Pure FlashArray, Terraform, Nomad, OIDC/JWKS, nftables, TCP, and Docker Compose. • Missing source commands and HTTP error responses now fail pack actions instead of silently passing through an empty success via downstream pipes or successful transport. https://github.com/AndrewDryga/emisar/releases/tag/v0.36.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.36.0 Fri, 31 Jul 2026 20:58:14 GMT emisar v0.36.0 adds staged runbooks with typed inputs and parallel execution, MCP 2026-07-28 routing, and hardened OIDC/SCIM identity controls. • Runbooks now support typed inputs bound at declaration time, with stages that run sequentially or in parallel against selected runner groups, and steps that extract named outputs, test success conditions, and wait within explicit bounds. • A single approval freezes the complete runbook execution plan before any work begins; execution pages show attempts, outputs, waits, and terminal causes in order. • Canonical JSON for runbook definitions uses the same shape across the console and MCP, enabling programmatic construction and review of execution plans. • The MCP bridge and portal adopt the 2026-07-28 MCP routing headers and dual-era endpoint, including OAuth Client ID Metadata Documents. • The action catalog expands to 91 packs and 1,386 actions, with new bounded diagnostics for GCP, Pure FlashArray, Terraform, Nomad, OIDC/JWKS, nftables, TCP, and Docker Compose. • Missing source commands and HTTP error responses now fail pack actions instead of silently passing through an empty success via downstream pipes or successful transport. https://github.com/AndrewDryga/emisar/releases/tag/mcp-v0.5.0 https://github.com/AndrewDryga/emisar/releases/tag/mcp-v0.5.0 Fri, 31 Jul 2026 20:57:06 GMT Emisar mcp-v0.5.0 expands its infrastructure diagnostics catalog. • Expands the infrastructure diagnostics catalog with additional checks. https://github.com/AndrewDryga/emisar/releases/tag/mcp-v0.5.0 https://github.com/AndrewDryga/emisar/releases/tag/mcp-v0.5.0 Fri, 31 Jul 2026 20:57:06 GMT Emisar mcp-v0.5.0 expands its infrastructure diagnostics catalog. • Expands the infrastructure diagnostics catalog with additional checks. https://github.com/AndrewDryga/emisar/releases/tag/mcp-v0.5.0 https://github.com/AndrewDryga/emisar/releases/tag/mcp-v0.5.0 Fri, 31 Jul 2026 20:57:06 GMT Emisar mcp-v0.5.0 expands its infrastructure diagnostics catalog. • Expands the infrastructure diagnostics catalog with additional checks. https://github.com/AndrewDryga/emisar/releases/tag/v0.35.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.35.0 Mon, 27 Jul 2026 17:36:52 GMT Runner identity now derives from hostname; pack retention protects versions active runners still advertise. • A runner with no explicit `runner.id` now presents its hostname as its identity, so a rebooted host reconnects as the same runner and a replaced ephemeral host auto-enrolls as a new one — no generated identity file required. • Pack retention no longer sweeps a version that a connected runner still advertises, preventing dispatch from failing with `pack_untrusted` during quiet weeks of inactivity. • The hosted admin runner bootstraps from a version-pinned release download with retries instead of querying the GitHub API, preventing anonymous rate limits from blocking control-plane VM startup. • Every high or critical pack action now requires either a successful behavior case or a machine-readable risk exception (`requires_cluster`, `requires_external_service`, …), enforced by CI on every change. • The snmp pack's OSPF adjacency fixture now builds its network namespace on AppArmor-confined hosts. • Behavior matrix reporting now completes in less than half the previous wall-clock time via pre-pulled images, slow-suite sharding across CI rows, and concurrency caps on heavyweight services. https://github.com/AndrewDryga/emisar/releases/tag/v0.34.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.34.0 Sun, 26 Jul 2026 15:52:05 GMT emisar v0.34.0 adds streaming run output via `wait_for_run` cursor paging and authoring-time enforcement of pack argument substitution bounds. • Adds `wait_for_run` MCP call that accepts an output cursor and returns the next one, reading the event log forward; supports paging a finished run's trimmed output and fragments oversized events. • Pre-run dispatch rejections (contract changes, refusals, rate limits) now log bounded, allowlisted fields, making rejected calls visible in operations without writing model input to the log. • Pack-trust conflict UI now names the specific runners that disagree about an action instead of failing generically. • Adds an `llms.txt` index and a Keycloak setup guide to the documentation site. • Operator input (approval notes, grant scopes, policy overrides) now survives a console re-render triggered by a co-approver broadcast or a refused submit. https://github.com/AndrewDryga/emisar/releases/tag/v0.34.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.34.0 Sun, 26 Jul 2026 15:52:05 GMT emisar v0.34.0 adds streaming run output via `wait_for_run` cursor paging and authoring-time enforcement of pack argument boundaries. • Adds `wait_for_run` MCP call that accepts an output cursor and returns the next one, reading the event log forward; fragments oversized events, wakes on new progress, and can page a finished run's trimmed output back to the caller. • Pre-run dispatch rejections (contract changes, refusals, rate limits) now log bounded, allowlisted fields so rejected calls are visible in operations. • Curl-backed API actions now fail on 4xx and 5xx responses instead of reporting transport success. • Device grant claiming writes an audit row per minted key, naming the approver. • Adds an `llms.txt` index to the website. • Console operator input (approval notes, grant scope selections, policy overrides) now survives re-renders caused by co-approver broadcasts or refused submits. • Pack-trust conflict messages now name the specific runners that disagree about an action instead of failing generically. https://github.com/AndrewDryga/emisar/releases/tag/v0.34.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.34.0 Sun, 26 Jul 2026 15:52:05 GMT emisar v0.34.0 adds streaming run output via `wait_for_run` cursor paging and authoring-time enforcement of pack argument boundaries. • Adds `wait_for_run` MCP call that accepts an output cursor and returns the next one, reading the event log forward; fragments oversized events, wakes on new progress, and can page a finished run's trimmed output back to the caller. • Pre-run dispatch rejections (contract changes, refusals, rate limits) now log bounded, allowlisted fields so rejected calls are visible in operations. • Curl-backed API actions now fail on 4xx and 5xx responses instead of reporting transport success. • Device grant claiming writes an audit row per minted key, naming the approver. • Adds an `llms.txt` index to the website. • Console operator input (approval notes, grant scope selections, policy overrides) now survives re-renders caused by co-approver broadcasts or refused submits. • Pack-trust conflict messages now name the specific runners that disagree about an action instead of failing generically. https://github.com/AndrewDryga/emisar/releases/tag/v0.33.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.33.0 Tue, 21 Jul 2026 05:31:35 GMT emisar v0.33.0 adds uninstall/reset runner identity flags, trust-gated action dispatch, and a new incident-response skill. • Adds `--uninstall` flag to `install.sh` to remove the cached token, legacy token file, and generated runner identity while preserving configuration, local evidence, and logs. • Adds `--reset-identity` flag to `install.sh` for unattended runner identity resets when supplying a different enrollment key. • Adds `--purge` flag to `install.sh` that extends `--uninstall` by also removing the retained configuration, evidence, and log files. • MCP catalog, search, exact lookup, runner inspection, and runbook recovery now filter out pending, rejected, revoked, retired, hash-mismatched, and incomplete pack versions from model-visible results. • Runner UI locks the **Run** button and surfaces a diagnostic explanation when an advertised action's pack is untrusted or retired; dispatch revalidates the contract so stale pages or tool calls cannot execute after trust changes. • Runbook recovery now fails closed if trust changes between action inspection and execution, preventing hidden pack version leakage through recovery results. • ChatGPT tool annotations now distinguish read-only calls from mutations, and domain verification accepts OpenAI's text challenge. • Adds a new public `respond-to-production-incidents` skill providing customer agents a bounded observe-diagnose-act-verify workflow. • The Packs page now follows the live catalog and gives unadvertised versions one day to disappear before cleanup. • OAuth return targets now preserve their original local query string through SSO and registration flows. https://github.com/AndrewDryga/emisar/releases/tag/v0.33.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.33.0 Tue, 21 Jul 2026 05:31:35 GMT emisar v0.33.0 adds `--uninstall`, `--reset-identity`, and `--purge` runner lifecycle flags plus trust-gated action dispatch and ChatGPT/Claude MCP conformance. • Adds `--uninstall` flag to `install.sh` to remove the cached token, legacy token file, and generated runner identity while preserving configuration, local evidence, and logs. • Adds `--reset-identity` flag to `install.sh` for unattended runner identity resets when supplying a different enrollment key during reinstall. • Adds `--purge` flag to `install.sh` to remove all retained files including those preserved by `--uninstall`. • MCP catalog, search, exact lookup, runner inspection, and runbook recovery now exclude pending, rejected, revoked, retired, hash-mismatched, and incomplete pack versions from model-visible results. • Dispatch revalidates the action contract at execution time so a stale page or tool call cannot execute after trust changes — runner UI also locks the Run button for unavailable actions with an explanation. • Runbook recovery fails closed if trust changes between action inspection and execution, preventing hidden pack version disclosure through recovery results. • ChatGPT tool annotations now distinguish read-only calls from mutations, and domain verification accepts OpenAI's text challenge. • Claude conformance evals select MCP authentication by mode and skip interactive permission prompts during headless runs. • Adds a new public `respond-to-production-incidents` skill giving customer agents a bounded observe, diagnose, act, and verify workflow. • The Packs page now follows the live catalog and grants unadvertised versions one day to disappear before cleanup. • Interactive reinstall with a different enrollment key prompts whether to preserve the existing external identity or reset it. https://github.com/AndrewDryga/emisar/releases/tag/v0.33.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.33.0 Tue, 21 Jul 2026 05:31:35 GMT emisar v0.33.0 adds `--uninstall`, `--reset-identity`, and `--purge` runner lifecycle flags plus trust-gated action dispatch and ChatGPT/Claude MCP conformance. • Adds `--uninstall` flag to `install.sh` to remove the cached token, legacy token file, and generated runner identity while preserving configuration, local evidence, and logs. • Adds `--reset-identity` flag to `install.sh` for unattended runner identity resets when supplying a different enrollment key during reinstall. • Adds `--purge` flag to `install.sh` to remove all retained files including those preserved by `--uninstall`. • MCP catalog, search, exact lookup, runner inspection, and runbook recovery now exclude pending, rejected, revoked, retired, hash-mismatched, and incomplete pack versions from model-visible results. • Dispatch revalidates the action contract at execution time so a stale page or tool call cannot execute after trust changes — runner UI also locks the Run button for unavailable actions with an explanation. • Runbook recovery fails closed if trust changes between action inspection and execution, preventing hidden pack version disclosure through recovery results. • ChatGPT tool annotations now distinguish read-only calls from mutations, and domain verification accepts OpenAI's text challenge. • Claude conformance evals select MCP authentication by mode and skip interactive permission prompts during headless runs. • Adds a new public `respond-to-production-incidents` skill giving customer agents a bounded observe, diagnose, act, and verify workflow. • The Packs page now follows the live catalog and grants unadvertised versions one day to disappear before cleanup. • Interactive reinstall with a different enrollment key prompts whether to preserve the existing external identity or reset it. https://github.com/AndrewDryga/emisar/releases/tag/v0.32.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.32.0 Mon, 20 Jul 2026 23:22:26 GMT emisar v0.32.0 adds real-agent MCP conformance evals, symptom-language search, and a justification chain on `run_action`. • Extends `run_action` to accept optional `evidence` (observed state) and `expected` (predicted outcome) fields alongside a `reason` that now supports up to 2000 characters, surfacing the full justification chain on the approval screen and run details. • Paginated MCP reads now return a copy-ready `next` call object instead of a bare cursor, so an agent continues pagination by echoing a single object. • Adds `list_runners` to the MCP API, inlining each runner's dispatchable pack IDs so one call reveals what a named host can execute. • Actions can opt into typed JSON results dispatched against a pinned trusted descriptor. • Introduces real-agent conformance evals that drive live Claude Code and Codex CLIs through a fail-closed loopback relay — hard-failing on policy-blocked calls, invalid mutation arguments, a `run_action` without a prior `get_action` for the same action, placeholder reasons, and runs not driven to a terminal status. • Registry now serves the catalog compact and gzip-encoded behind a CDN, reducing transfer to roughly one-tenth of the previous size; pack tarballs remain unencoded to preserve content-hash pinning. • Runner access is now explicit: a member is scoped to only the runners and groups they are permitted to use. • A missing client binary is reported as separate host readiness evidence — the action stays advertised for manifest verification but is not offered for dispatch. https://github.com/AndrewDryga/emisar/releases/tag/v0.32.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.32.0 Mon, 20 Jul 2026 23:22:26 GMT emisar v0.32.0 adds real-agent conformance evals, symptom-language action search, and a justification chain for run_action. • Extends `run_action` to accept optional `evidence` and `expected` fields alongside `reason` (now up to 2000 characters), letting an agent carry its full reasoning chain; the approval screen and run details render evidence, expected outcome, and reason together for reviewers. • Adds paginated MCP reads that return a copy-ready `next` call (echoing one object) instead of a bare cursor, so agents can continue pagination without parsing a raw cursor value. • Adds `list_runners` to the MCP API, inlining each runner's dispatchable pack IDs so a single call reveals what a named host can do. • Enables actions to opt into typed JSON results, dispatched against the pinned trusted descriptor. • Introduces real-agent conformance evals: a scheduled workflow drives the live Claude Code and Codex CLIs through a fail-closed loopback relay against a live stack, hard-failing on policy-blocked calls, invalid mutation arguments, a `run_action` without a prior `get_action` for the same action, placeholder reasons, and runs not driven to a terminal status. • Serves the registry catalog compact and gzip-encoded behind a CDN, reducing transfer to roughly one-tenth of the previous size. • Makes runner access explicit: a member is now scoped to only the runners and groups they are permitted to use. https://github.com/AndrewDryga/emisar/releases/tag/v0.32.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.32.0 Mon, 20 Jul 2026 23:22:26 GMT emisar v0.32.0 adds real-agent conformance evals, symptom-language action search, and a justification chain for run_action. • Extends `run_action` to accept optional `evidence` and `expected` fields alongside `reason` (now up to 2000 characters), letting an agent carry its full reasoning chain; the approval screen and run details render evidence, expected outcome, and reason together for reviewers. • Adds paginated MCP reads that return a copy-ready `next` call (echoing one object) instead of a bare cursor, so agents can continue pagination without parsing a raw cursor value. • Adds `list_runners` to the MCP API, inlining each runner's dispatchable pack IDs so a single call reveals what a named host can do. • Enables actions to opt into typed JSON results, dispatched against the pinned trusted descriptor. • Introduces real-agent conformance evals: a scheduled workflow drives the live Claude Code and Codex CLIs through a fail-closed loopback relay against a live stack, hard-failing on policy-blocked calls, invalid mutation arguments, a `run_action` without a prior `get_action` for the same action, placeholder reasons, and runs not driven to a terminal status. • Serves the registry catalog compact and gzip-encoded behind a CDN, reducing transfer to roughly one-tenth of the previous size. • Makes runner access explicit: a member is now scoped to only the runners and groups they are permitted to use. https://github.com/AndrewDryga/emisar/releases/tag/v0.31.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.31.0 Sat, 18 Jul 2026 02:53:16 GMT emisar v0.31.0 adds browser-based device-flow agent connect, operator pack catalog controls, and 13 MCP clients out of the box. • Adds RFC 8628 device-flow browser approval for agent connect: the installer opens a consent page, mints per-client keys, and writes them directly into each client's config — no clipboard, shell history, or process-argument exposure. • Supports 13 MCP clients configured out of the box: Claude Code, Claude Desktop, Cursor, Gemini CLI, Codex CLI, OpenClaw, OpenCode, Windsurf, Pi, Copilot CLI, Zed, Hermes, and Goose, each in its own format. • Adds `emisar doctor` color output and a service-supervisor state check. • Adds operator pack catalog controls: delete a pack or a single version, revoke trust on a version, and auto-remove versions no runner has advertised for a configurable number of days. • Retired pack versions are now surfaced as 'retired' to lagging runners (with an upgrade pointer) instead of appearing as unknown packs — preventing inadvertent re-authorization of vulnerable bytes. • Adds Nomad 0.2.0 pack with deployment control (list, pause, resume, fail), metadata-filtered discovery, node-pool and CSI plugin reads, and a uniform TLS path for API calls. • Gates three container/process environment-dump actions — where secrets such as database passwords live — behind explicit approval. • Runner CLI now reloads the daemon automatically after a pack install, update, or uninstall. • Under-permissioned roles now receive a clean denial instead of a server error on detail routes. Breaking changes: • Self-hosted runners: the config key `auth_key_env` is renamed to `enrollment_key_env` — update your config and re-mint any enrollment keys that were never used. https://github.com/AndrewDryga/emisar/releases/tag/v0.30.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.30.0 Fri, 17 Jul 2026 00:35:47 GMT emisar v0.30.0 enforces tenant isolation in the database and adds signed-pack visibility over MCP • Signed-pack enforcement is now visible over MCP: a runner that requires signed packs announces that requirement to MCP clients. • Database-enforced tenant isolation: every runner-owned child row carries a composite foreign key to its account, so cross-tenant writes are refused at the database row level rather than only in application code. • CHECK constraints added for security-relevant enums so the database rejects out-of-range values that gate trust and dispatch, independent of the application layer. • Content-Security-Policy headers now applied to public unauthenticated pages and error responses, matching the rest of the site. • Sentry named as a subprocessor; events scrubbed of personal data before leaving the process. • Trigram index added to speed run search on large accounts, replacing three now-covered indexes. • Steadier dispatch: a runner at capacity redelivers refused dispatches, the stale-dispatch sweep drains oldest-queued entries first, and stuck pending runs advance instead of stranding. • Severe database and load-balancer conditions now page directly; point-in-time recovery drill measures actual RTO. https://github.com/AndrewDryga/emisar/releases/tag/v0.29.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.29.0 Thu, 16 Jul 2026 20:46:26 GMT Emisar v0.29.0 tightens MCP argument coercion, sharpens error messages, and trims run summary payloads. • MCP now coerces scalar arguments sent as canonical strings — e.g. `"limit": "50"` or `"dry_run": "true"` — instead of failing the call, while true type mismatches name the field and the JSON type it was sent as (e.g. `limit must be a JSON integer from 1 to 100; it was sent as a string.`). • MCP argument fault messages now name the offending field in every case: malformed refs advise copying the exact value from a prior tool result, enum faults list allowed values, and unknown arguments are spelled out against the allowed set. • MCP run summaries drop zero-information fields: streams with no bytes omit `stdout`/`stderr`, byte-count, and truncation fields; `output_complete` appears only when false; and per-stream SHA-256 digests are removed from the MCP projection (they remain on the run detail page and audit record), shrinking a typical terse summary by about a third. • Disabling two-factor authentication now requires a fresh step-up challenge, preventing a hijacked session from quietly weakening an account. • Production session cookies now always carry the `Secure` flag. • Secret-dense config and environment dumps — cloud-init user/vendor data and cloud-config, pm2 env, nginx and caddy config dumps — are reclassified from risk level low to medium, matching `linux.sudoers_dump`, so they no longer ride the ungated low-read path. • Redis ACL password hashes are redacted from `acl_list` and `acl_getuser` output, preventing ungated reads from leaking crackable material. • Exec-style arguments across docker, systemctl, podman, minio, and related tools now anchor their first character to an alphanumeric, blocking hostile values from being parsed as leading-dash flags. Breaking changes: • Per-stream SHA-256 digests are removed from the MCP run summary projection; any client parsing those fields from summary responses will find them absent (they remain on the run detail page and audit record). • MCP run summary response no longer includes `stdout`/`stderr`, byte-count, truncation, or `output_complete` fields when they carry no information; clients that treat the absence of these fields as an error condition will need to be updated. • Secret-dense config/environment dump packs (cloud-init user/vendor data and cloud-config, pm2 env, nginx and caddy config dumps) are reclassified from risk low to medium and no longer ride the ungated low-read path; workflows relying on ungated access to these dumps will require elevated authorization. https://github.com/AndrewDryga/emisar/releases/tag/v0.28.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.28.0 Thu, 16 Jul 2026 18:13:53 GMT emisar v0.28.0 adds dispatch-log verification, fleet diagnostics in MCP, SSO/MFA route coverage, SCIM rate-limiting, and GDPR erasure tasks. • Adds `QUARANTINE_DISPATCH_LOG=1` environment variable to `install.sh` to automatically quarantine an unreadable dispatch log during upgrades instead of leaving a host crash-looping. • `emisar doctor` now checks the dispatch log, reports degraded packs, and surfaces the last cloud rejection. • Adds `emisar state check-dispatch-log` subcommand for scripted dispatch-log verdict checks. • `install.sh` now verifies dispatch state with the staged binary before touching a running service, aborting with remediation options on failure. • Degraded packs now surface as named 'pack X failed to load on runner Y' entries in MCP `list_runners` output and as an amber notice with reinstall remedy on the runner detail page. • Denied runs now return a bounded policy reason in MCP summaries. • `find_actions` supports natural multi-term queries. • Console-created runbooks are now visible and executable over MCP. • Outbound connections now enforce a TLS 1.2 floor. • Sign-in enforcement for Require SSO and Require MFA now covers every controller route. • SCIM, audit-export, and runner-register endpoints are now rate-limited. • Account and user erasure (GDPR delete) is available as an operator-run release task. • Adds direct alerts for database-down, zero-healthy-backend, and portal VM saturation conditions. • `docs/COMPATIBILITY.md` now documents on-host runner state (dispatch log, installed pack trees) as a compatibility surface with migration rules. • Runner binary ships as `runner-v0.13.0` with SLSA-3 build provenance and `SHA256SUMS`. https://github.com/AndrewDryga/emisar/releases/tag/v0.27.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.27.0 Thu, 16 Jul 2026 10:28:48 GMT Runner v0.12.0 adds durable dispatch journaling, startup integrity checks, and clearer MCP failure reporting. • Corrupt durable dispatch state now halts the runner before it connects to the control plane, preventing split-brain dispatch records. • Failure causes redact sensitive action arguments before they reach local audit records or the portal. • MCP run summaries include a bounded terminal failure message when the runner provides one, surfacing failure detail directly in the portal. • OAuth consent now lets a person choose which account to connect during connector setup. • Key-bearing connector commands are kept out of shell history. • A newer non-destructive production plan supersedes an older pending plan, with Terraform confirmation as the single human apply gate. • Unsigned installations no longer open or lock signing nonce state during startup. Breaking changes: • Runner v0.12.0 starts a new durable dispatch journal and does not import older unacknowledged entries; upgrade directly to `runner-v0.12.0` with no pending dispatches in flight. • Downgrading to an earlier runner is unsupported once `runner-v0.12.0` has written new dispatch records. https://github.com/AndrewDryga/emisar/releases/tag/v0.26.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.26.0 Thu, 16 Jul 2026 08:43:16 GMT Emisar v0.26.0 recovers in-flight runs after runner reconnects and flags out-of-date MCP bridge versions in the console. • Control plane now recovers runs that were in-flight when a runner drops and reconnects, instead of stranding them. • LLM agents list in the console now groups connections by the operator behind each key, shows the `emisar-mcp` bridge version inline per connection, and flags an out-of-date bridge one step from the upgrade command. • Runner version-upgrade notice now scopes its count to the current page (e.g., '1 runner on this page is below the supported range') rather than implying a single runner across the whole list. • Runner binary `runner-v0.11.0` ships with SLSA-3 build provenance and `SHA256SUMS` published by its release workflow. https://github.com/AndrewDryga/emisar/releases/tag/v0.24.0 https://github.com/AndrewDryga/emisar/releases/tag/v0.24.0 Sun, 12 Jul 2026 18:51:52 GMT emisar v0.24.0 adds a pack registry at registry.emisar.dev, a public status page, and lists its MCP server in the official MCP registry. • Pack registry now serves from `registry.emisar.dev/v1/catalog.json` with anonymous access scoped to exact object reads and end-to-end tarball verification on publication. • Hosted MCP server (`dev.emisar/emisar`) is now listed in the official MCP registry. • Public status page at `status.emisar.dev` provides external availability monitoring with on-call escalation. • Portal releases are now pinned by digest with provenance and SBOM attestations; fixable HIGH/CRITICAL vulnerabilities block publication. • Binary releases are immutable and reproducible, with signed and verified release tags gating publication. • Production infrastructure plans queue in order and never replace a review an operator already has open.