2026-05-16 21:28:11 +00:00
|
|
|
# Changelog
|
|
|
|
|
|
2026-05-18 20:24:30 +00:00
|
|
|
## v0.3.0 — Phase 1b (2026-05-18)
|
|
|
|
|
|
|
|
|
|
Operator console. FastAPI + Jinja2 + Pico + HTMX. Self-hosted,
|
|
|
|
|
Tailscale-gated by default, no application-level auth beyond
|
|
|
|
|
the operator session.
|
|
|
|
|
|
|
|
|
|
### Added
|
|
|
|
|
- Operator console (`central-gui` systemd service on port 8000)
|
|
|
|
|
- Login + session auth (argon2id, 90-day DB-backed sessions)
|
|
|
|
|
- Dashboard: events 24h by adapter, stream sizes,
|
|
|
|
|
last-poll-time per adapter
|
|
|
|
|
- Adapters list and edit page (cadence + per-adapter settings),
|
|
|
|
|
with Leaflet region picker and click-to-draw rectangles
|
|
|
|
|
- Streams view with retention chips (1d / 7d / 14d / 30d /
|
|
|
|
|
365d / custom)
|
|
|
|
|
- API keys management (list / add / rotate / delete,
|
|
|
|
|
encrypted at rest via `crypto.encrypt`, plaintext never
|
|
|
|
|
logged or stored)
|
|
|
|
|
- First-run wizard (5 steps: operator, system, keys, adapters,
|
|
|
|
|
finish) with deferred-commit pattern — no DB writes until
|
|
|
|
|
Finish runs as a single transaction
|
|
|
|
|
- Events feed page (`/events`) — paginated, filterable by
|
|
|
|
|
adapter / category / time range / map viewport, with
|
|
|
|
|
color-coded geometry overlay, click-to-popup, and
|
|
|
|
|
expandable row details showing full event payload
|
|
|
|
|
- Paginated events JSON API (`/events.json`) — cursor-based
|
|
|
|
|
pagination, same filter surface as the HTML feed
|
|
|
|
|
|
|
|
|
|
### Changed
|
|
|
|
|
- CSRF tokens are now session-bound (synchronizer token
|
|
|
|
|
pattern), replacing the previous fastapi-csrf-protect
|
|
|
|
|
library. Eliminates a rotation race that broke first-load
|
|
|
|
|
submissions
|
|
|
|
|
- First-run wizard is a single atomic transaction at Finish,
|
|
|
|
|
not per-step DB writes. Back navigation works; abandoned
|
|
|
|
|
wizards leave no orphan rows
|
|
|
|
|
|
|
|
|
|
### Fixed
|
|
|
|
|
- Adapter editor's JSONB double-encoding bug (write path
|
|
|
|
|
called `json.dumps` before asyncpg's codec, corrupting
|
|
|
|
|
the settings column)
|
|
|
|
|
- Dashboard polls card was reading from the wrong NATS
|
|
|
|
|
subject and using a durable consumer instead of
|
|
|
|
|
`get_last_msg`, leaking zombie consumers
|
|
|
|
|
- Browser-noise paths (/favicon.ico, /apple-touch-icon.png,
|
|
|
|
|
/robots.txt) return 204 directly, preventing parallel
|
|
|
|
|
requests from racing the CSRF cookie on first page load
|
|
|
|
|
- SubResource Integrity hashes for leaflet-draw assets
|
|
|
|
|
corrected (previous values were fabricated and silently
|
|
|
|
|
blocked by browsers)
|
|
|
|
|
|
|
|
|
|
### Infrastructure
|
|
|
|
|
- New `config.sessions` column: `csrf_token` (per-session
|
|
|
|
|
synchronizer)
|
|
|
|
|
- Composite index on `public.events (time DESC, id DESC)`
|
|
|
|
|
for cursor pagination
|
|
|
|
|
- `central-gui` systemd service
|
|
|
|
|
|
2026-05-16 21:28:11 +00:00
|
|
|
## v0.2.0 — Phase 1a (2026-05-16)
|
|
|
|
|
|
|
|
|
|
Three live data sources, configurable infrastructure, hot-reload
|
|
|
|
|
everywhere.
|
|
|
|
|
|
|
|
|
|
### Added
|
|
|
|
|
- FIRMS fire hotspot adapter (VIIRS_SNPP_NRT + VIIRS_NOAA20_NRT)
|
|
|
|
|
- USGS earthquake adapter (GeoJSON feed)
|
|
|
|
|
- Operational config in Postgres `config` schema
|
|
|
|
|
(adapters, api_keys, streams) with LISTEN/NOTIFY hot-reload
|
|
|
|
|
- Per-stream retention management (config.streams)
|
|
|
|
|
with supervisor-managed max_bytes auto-tuning
|
|
|
|
|
- Unified region selection (bbox) across all adapters
|
|
|
|
|
- Adapter registry pattern for one-line addition of new sources
|
|
|
|
|
- `apply_config()` per-adapter for generic hot-reload of settings
|
|
|
|
|
|
|
|
|
|
### Changed
|
|
|
|
|
- NWS adapter migrated from `states` list to bbox region filter
|
|
|
|
|
- Polygon-vs-bbox intersection (shapely) replaces centroid filter
|
|
|
|
|
- CloudEvents protocol constants moved from operational config
|
|
|
|
|
to code constants
|
|
|
|
|
- Operational config retired from `central.toml` to Postgres
|
|
|
|
|
(`config.adapters`, `config.api_keys`); TOML removed
|
|
|
|
|
|
|
|
|
|
### Fixed
|
|
|
|
|
- Cadence-decrease hot-reload (AsyncLimiter inside NWS adapter
|
|
|
|
|
removed; supervisor is single owner of cadence)
|
|
|
|
|
- `last_completed_poll` preserved across adapter enable/disable
|
|
|
|
|
cycles to honor the rate-limit guarantee
|
|
|
|
|
|
|
|
|
|
### Infrastructure
|
|
|
|
|
- CENTRAL_FIRE stream (7d default retention)
|
|
|
|
|
- CENTRAL_QUAKE stream (7d default retention)
|
