Release 8.0.0

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [8.0.0] - 2026-05-27
+
+* This release lands the matrix-deploy hardening pass, an interactive console for the CLI, the bundles workflow, a per-consumer Postgres builder, a shared Playwright persona library across every web role, a SPOT env pipeline under the `INFINITO_` namespace, and a new education-suite bundle (openwebui + mailu) alongside the KIX Service Management role.
+
+**Major Changes**
+
+* Promoted matrix-deploy to a full purge + full redeploy between rounds, taught the inventory validator to honour variants.yml keys, and split the variant runner into auth-isolated rounds so OIDC, LDAP, and native personas never share residual state
+* Replaced inline SQL task templates with a first-class database_query Ansible module that takes a caller-controlled mask_values parameter, and migrated every role to call it instead of templating ad-hoc psql/mysql commands
+* Rebuilt the env pipeline around a SPOT default.env at the repository root, retired the env/ subtree and the env.development marker, folded ci.env into default.env, and put every runtime knob under the `INFINITO_` namespace (BUILDKIT_ENABLED, OUTER_NETWORK_MTU auto-detected from the host route, CONTAINER_CA_ENABLED, and the path/image overrides)
+* Reworked the Make surface into domain prefixes (compose-, network-, clean-, container-), added comment-derived make help, parallel test/lint wrappers with per-target wall-clock, a default help target, a single make deploy router, a make console REPL, make compose-playwright, a test-signed pre-push gate, and a clean-container-owned target
+* Routed every role image reference through lookup(config, ...) so the GHCR mirror takes effect uniformly, and introduced a per-consumer Postgres image builder so shared:false rdbms consumers get the extensions and libraries they need via initdb.d
+
+**Added**
+
+* Added web-app-kix (KIX Service Management, req-015), the education-suite bundle wiring web-app-openwebui and web-app-mailu, the bundles deploy-bundles / redeploy-bundles flow, and a deploy verifier that walks required_by for every non-invokable role
+* Added an interactive CLI console with stateful navigation, ls, and modular subcommands; a meta roles applications complexity command with reverse direction, level filter, total column, ordering, and cli/json output; and a meta roles services called verifier hooked into dev-deploy
+* Added a shared Playwright persona library that now drives every web role, parameterized matomo tracker checks, web-svc-logout injection specs via roles_with_service, dashboard dropdown handling, iframe-aware deny checks, keycloak auth-provider exemption, the `PERSONA_*_BLOCKED` contract, a PLAYWRIGHT_KEEP_ALL artefact toggle, persisted artefacts per variant and pass, and a Time column in the summary table
+* Added lint guards: auth-isolation across variants.yml, variants-services-match with a nocheck opt-out, required_by on non-invokable roles (Bundle C), lint-playwright per-role spec parse, a raw-image ban in compose templates (and the eight existing violations fixed), expanded required_by[web] for the webserver and CSP infra, and a Python-ized lint installer with host/docker dispatch
+* Added a requirements archive CLI with a completeness lint, a live registry-reachability probe for pinned images, top-N Ansible role runtimes in the deploy job summary, Playwright JUnit reports rendered as a workflow step summary, an affected-roles filter that skips .md/.rst outside roles, and an update open-pr deduper that supersedes stale class siblings
+* Added native admin login for web-app-bluesky when oauth2 is disabled, native + LDAP + OIDC persona tests for web-app-openwebui, a multi-auth dispatcher for web-app-matrix (OIDC plus native/LDAP password), web-app-lam registered as a service provider with moodle v0/v1 opt-in, web-app-prometheus navbar logout injection, SMTP wiring for web-app-pgadmin, dynamic LDAP and Playwright LDAP coverage for web-app-opencloud, version-incompatible plugin tolerance for web-app-nextcloud, gated enable_local_logins for web-app-discourse, and biber+admin persona blocks for web-app-akaunting, web-app-bookwyrm, web-app-bluesky, and web-app-postmarks
+
+**Removed and Renamed**
+
+* Renamed deploy to compose-deploy across Make, `container-*` purges and refresh to `compose-*`, the legacy backup roles to `svc-bkp-*` with container/local-2-remote invokable entrypoints, lookup status to deployment with a runtime-aware deployed flag, `dmbs_*/dbms_base` templates to a container_depends_on lookup, INFINITO_CMD to a plain cmd parameter, and web-opt-rdr-www canonical to w3redirect with lookup-based mappings
+* Dropped the ci compose profile and its --profile ci arg, the run-once guard on web-opt-rdr-domains, the slim pkgmgr base image variant, requirement-file references from runtime code, and the inline XML payload duplication in web-app-xwiki
+
+**Contributors**
+
+* [Kevin Veen-Birkenbach](https://www.veen.world/)
+
 ## [7.0.0] - 2026-05-08
 
 This major release migrates every role to the new meta/ layout with explicit per-role networks, ports, run_after, and info.yml metadata, introduces a variant-aware matrix-deploy planner, ships a process-wide YAML / file / registry caching stack, promotes 13+ apps from alpha to beta, and adds a lint corpus that pins the new conventions in CI.

packaging/arch/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Kevin Veen-Birkenbach <info@veen.world>
 
 pkgname=infinito-nexus
-pkgver=7.0.0
+pkgver=8.0.0
 pkgrel=1
 pkgdesc="Meta package for Infinito.Nexus host dependencies (dev + CI)."
 arch=('any')

packaging/debian/changelog

@@ -1,3 +1,31 @@
+infinito-nexus-core (8.0.0-1) unstable; urgency=medium
+
+  * This release lands the matrix-deploy hardening pass, an interactive console for the CLI, the bundles workflow, a per-consumer Postgres builder, a shared Playwright persona library across every web role, a SPOT env pipeline under the INFINITO_ namespace, and a new education-suite bundle (openwebui + mailu) alongside the KIX Service Management role.
+
+**Major Changes**
+
+* Promoted matrix-deploy to a full purge + full redeploy between rounds, taught the inventory validator to honour variants.yml keys, and split the variant runner into auth-isolated rounds so OIDC, LDAP, and native personas never share residual state
+* Replaced inline SQL task templates with a first-class database_query Ansible module that takes a caller-controlled mask_values parameter, and migrated every role to call it instead of templating ad-hoc psql/mysql commands
+* Rebuilt the env pipeline around a SPOT default.env at the repository root, retired the env/ subtree and the env.development marker, folded ci.env into default.env, and put every runtime knob under the INFINITO_ namespace (BUILDKIT_ENABLED, OUTER_NETWORK_MTU auto-detected from the host route, CONTAINER_CA_ENABLED, and the path/image overrides)
+* Reworked the Make surface into domain prefixes (compose-, network-, clean-, container-), added comment-derived make help, parallel test/lint wrappers with per-target wall-clock, a default help target, a single make deploy router, a make console REPL, make compose-playwright, a test-signed pre-push gate, and a clean-container-owned target
+* Routed every role image reference through lookup(config, ...) so the GHCR mirror takes effect uniformly, and introduced a per-consumer Postgres image builder so shared:false rdbms consumers get the extensions and libraries they need via initdb.d
+
+**Added**
+
+* Added web-app-kix (KIX Service Management, req-015), the education-suite bundle wiring web-app-openwebui and web-app-mailu, the bundles deploy-bundles / redeploy-bundles flow, and a deploy verifier that walks required_by for every non-invokable role
+* Added an interactive CLI console with stateful navigation, ls, and modular subcommands; a meta roles applications complexity command with reverse direction, level filter, total column, ordering, and cli/json output; and a meta roles services called verifier hooked into dev-deploy
+* Added a shared Playwright persona library that now drives every web role, parameterized matomo tracker checks, web-svc-logout injection specs via roles_with_service, dashboard dropdown handling, iframe-aware deny checks, keycloak auth-provider exemption, the PERSONA_*_BLOCKED contract, a PLAYWRIGHT_KEEP_ALL artefact toggle, persisted artefacts per variant and pass, and a Time column in the summary table
+* Added lint guards: auth-isolation across variants.yml, variants-services-match with a nocheck opt-out, required_by on non-invokable roles (Bundle C), lint-playwright per-role spec parse, a raw-image ban in compose templates (and the eight existing violations fixed), expanded required_by[web] for the webserver and CSP infra, and a Python-ized lint installer with host/docker dispatch
+* Added a requirements archive CLI with a completeness lint, a live registry-reachability probe for pinned images, top-N Ansible role runtimes in the deploy job summary, Playwright JUnit reports rendered as a workflow step summary, an affected-roles filter that skips .md/.rst outside roles, and an update open-pr deduper that supersedes stale class siblings
+* Added native admin login for web-app-bluesky when oauth2 is disabled, native + LDAP + OIDC persona tests for web-app-openwebui, a multi-auth dispatcher for web-app-matrix (OIDC plus native/LDAP password), web-app-lam registered as a service provider with moodle v0/v1 opt-in, web-app-prometheus navbar logout injection, SMTP wiring for web-app-pgadmin, dynamic LDAP and Playwright LDAP coverage for web-app-opencloud, version-incompatible plugin tolerance for web-app-nextcloud, gated enable_local_logins for web-app-discourse, and biber+admin persona blocks for web-app-akaunting, web-app-bookwyrm, web-app-bluesky, and web-app-postmarks
+
+**Removed and Renamed**
+
+* Renamed deploy to compose-deploy across Make, container-* purges and refresh to compose-*, the legacy backup roles to svc-bkp-* with container/local-2-remote invokable entrypoints, lookup status to deployment with a runtime-aware deployed flag, dmbs_*/dbms_base templates to a container_depends_on lookup, INFINITO_CMD to a plain cmd parameter, and web-opt-rdr-www canonical to w3redirect with lookup-based mappings
+* Dropped the ci compose profile and its --profile ci arg, the run-once guard on web-opt-rdr-domains, the slim pkgmgr base image variant, requirement-file references from runtime code, and the inline XML payload duplication in web-app-xwiki
+
+ -- Kevin Veen-Birkenbach <kevin@veen.world>  Wed, 27 May 2026 17:26:17 +0200
+
 infinito-nexus (7.0.0-1) unstable; urgency=medium
 
   This major release migrates every role to the new meta/ layout with explicit per-role networks, ports, run_after, and info.yml metadata, introduces a variant-aware matrix-deploy planner, ships a process-wide YAML / file / registry caching stack, promotes 13+ apps from alpha to beta, and adds a lint corpus that pins the new conventions in CI.

packaging/fedora/infinito-nexus.spec

@@ -1,5 +1,5 @@
 Name:           infinito-nexus
-Version:        7.0.0
+Version:        8.0.0
 Release:        1%{?dist}
 Summary:        Meta package for Infinito.Nexus host dependencies
 
@@ -58,6 +58,31 @@ install -d %{buildroot}%{_docdir}/%{name}
 %doc %{_docdir}/%{name}/DEPENDENCIES
 
 %changelog
+* Wed May 27 2026 Kevin Veen-Birkenbach <kevin@veen.world> - 8.0.0-1
+- This release lands the matrix-deploy hardening pass, an interactive console for the CLI, the bundles workflow, a per-consumer Postgres builder, a shared Playwright persona library across every web role, a SPOT env pipeline under the INFINITO_ namespace, and a new education-suite bundle (openwebui + mailu) alongside the KIX Service Management role.
+
+**Major Changes**
+
+* Promoted matrix-deploy to a full purge + full redeploy between rounds, taught the inventory validator to honour variants.yml keys, and split the variant runner into auth-isolated rounds so OIDC, LDAP, and native personas never share residual state
+* Replaced inline SQL task templates with a first-class database_query Ansible module that takes a caller-controlled mask_values parameter, and migrated every role to call it instead of templating ad-hoc psql/mysql commands
+* Rebuilt the env pipeline around a SPOT default.env at the repository root, retired the env/ subtree and the env.development marker, folded ci.env into default.env, and put every runtime knob under the INFINITO_ namespace (BUILDKIT_ENABLED, OUTER_NETWORK_MTU auto-detected from the host route, CONTAINER_CA_ENABLED, and the path/image overrides)
+* Reworked the Make surface into domain prefixes (compose-, network-, clean-, container-), added comment-derived make help, parallel test/lint wrappers with per-target wall-clock, a default help target, a single make deploy router, a make console REPL, make compose-playwright, a test-signed pre-push gate, and a clean-container-owned target
+* Routed every role image reference through lookup(config, ...) so the GHCR mirror takes effect uniformly, and introduced a per-consumer Postgres image builder so shared:false rdbms consumers get the extensions and libraries they need via initdb.d
+
+**Added**
+
+* Added web-app-kix (KIX Service Management, req-015), the education-suite bundle wiring web-app-openwebui and web-app-mailu, the bundles deploy-bundles / redeploy-bundles flow, and a deploy verifier that walks required_by for every non-invokable role
+* Added an interactive CLI console with stateful navigation, ls, and modular subcommands; a meta roles applications complexity command with reverse direction, level filter, total column, ordering, and cli/json output; and a meta roles services called verifier hooked into dev-deploy
+* Added a shared Playwright persona library that now drives every web role, parameterized matomo tracker checks, web-svc-logout injection specs via roles_with_service, dashboard dropdown handling, iframe-aware deny checks, keycloak auth-provider exemption, the PERSONA_*_BLOCKED contract, a PLAYWRIGHT_KEEP_ALL artefact toggle, persisted artefacts per variant and pass, and a Time column in the summary table
+* Added lint guards: auth-isolation across variants.yml, variants-services-match with a nocheck opt-out, required_by on non-invokable roles (Bundle C), lint-playwright per-role spec parse, a raw-image ban in compose templates (and the eight existing violations fixed), expanded required_by[web] for the webserver and CSP infra, and a Python-ized lint installer with host/docker dispatch
+* Added a requirements archive CLI with a completeness lint, a live registry-reachability probe for pinned images, top-N Ansible role runtimes in the deploy job summary, Playwright JUnit reports rendered as a workflow step summary, an affected-roles filter that skips .md/.rst outside roles, and an update open-pr deduper that supersedes stale class siblings
+* Added native admin login for web-app-bluesky when oauth2 is disabled, native + LDAP + OIDC persona tests for web-app-openwebui, a multi-auth dispatcher for web-app-matrix (OIDC plus native/LDAP password), web-app-lam registered as a service provider with moodle v0/v1 opt-in, web-app-prometheus navbar logout injection, SMTP wiring for web-app-pgadmin, dynamic LDAP and Playwright LDAP coverage for web-app-opencloud, version-incompatible plugin tolerance for web-app-nextcloud, gated enable_local_logins for web-app-discourse, and biber+admin persona blocks for web-app-akaunting, web-app-bookwyrm, web-app-bluesky, and web-app-postmarks
+
+**Removed and Renamed**
+
+* Renamed deploy to compose-deploy across Make, container-* purges and refresh to compose-*, the legacy backup roles to svc-bkp-* with container/local-2-remote invokable entrypoints, lookup status to deployment with a runtime-aware deployed flag, dmbs_*/dbms_base templates to a container_depends_on lookup, INFINITO_CMD to a plain cmd parameter, and web-opt-rdr-www canonical to w3redirect with lookup-based mappings
+* Dropped the ci compose profile and its --profile ci arg, the run-once guard on web-opt-rdr-domains, the slim pkgmgr base image variant, requirement-file references from runtime code, and the inline XML payload duplication in web-app-xwiki
+
 * Fri May 08 2026 Kevin Veen-Birkenbach <kevin@veen.world> - 7.0.0-1
 - This major release migrates every role to the new meta/ layout with explicit per-role networks, ports, run_after, and info.yml metadata, introduces a variant-aware matrix-deploy planner, ships a process-wide YAML / file / registry caching stack, promotes 13+ apps from alpha to beta, and adds a lint corpus that pins the new conventions in CI.
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "infinito-nexus"
-version = "7.0.0"
+version = "8.0.0"
 description = "Infinito.Nexus"
 readme = "README.md"
 requires-python = ">=3.11"