0.98.2 (2026-11-03)
Highlights
Fleet operations get the most attention here. Interactive reads against remote nodes now have deadlines, so a single unreachable node can no longer leave a tab hanging, and a missed deadline is reported by name instead of failing silently. The Actions tab has been rebuilt as a quieter list with task sheets, and Sencho now refuses operations that would stop the container carrying its own Docker connection. When a deploy is refused because the Docker endpoint is gone, you can recreate that endpoint on its own.
Networking and labels work together more closely. Sencho detects tunnel and private-overlay exposure in Compose stacks and shows it next to the exposure you declared, so the two can be compared directly. Image update decisions and alert routing now come from io.sencho labels, following a documented label contract. A misplaced sencho.service.url is flagged and can be renamed to io.sencho.url in one click, and a rendered double dollar sign is reconciled with the container's single dollar.
For agents and automation, there is a new Observe Only token scope with read-only observation endpoints. Off-site snapshot archives can be encrypted with a passphrase. Volume recovery points are in place and can restore to a new volume, though the broader recovery work is still foundation only, with no backup or restore flow yet. Evidence availability is now an explicit deploy-gate policy, and a deploy blocked by failed evidence logs the real cause.
Mesh membership confirmations are more honest, addresses are copyable, and failures are easier to read. Aliases and port reservations stay stable while a node is offline, and the leftover paid-tier gate is gone. Elsewhere, unreachable nodes no longer show a false update prompt, the connection pin matches between the phone card and the topology map, and the Docker host's cores and memory are reported correctly inside a nested container. The Recovery Vault is now the Snapshot Vault, with the managed vault held behind the experimental flag.
Added
- api: add an Observe Only token scope and read-only observation endpoints for AI agents (#2226) (729da01)
- compose: add the io.sencho.* Compose label contract (#2225) (7bd210b)
- compose: explain recreates caused by a different Docker Compose version (#2208) (a25fd08), thanks @Crosis47
- encrypt off-site snapshot archives with a passphrase (#2134) (e80bd2c)
- fleet: bound every interactive fleet read so one dead node cannot hold a tab (#2216) (c598994)
- fleet: recreate the Docker endpoint on its own, and offer it when a deploy is refused (#2203) (37f1716), thanks @Crosis47
- fleet: redesign the Actions tab as a quiet list with task sheets (#2197) (64b4911)
- fleet: refuse operations that would stop the container carrying Sencho's Docker connection (#2195) (9b56923), thanks @Crosis47
- labels: decide image updates and route alerts from io.sencho labels (#2230) (0b24294)
- mesh: honest membership confirmations, copyable addresses, readable failures (#2015) (e283ebd)
- mesh: proxy-mode dial headers and CA bundle, precise dial failure labels (#2014) (dc32080)
- networking: detect tunnel and private-overlay exposure in Compose stacks (#2212) (c24980c)
- networking: show detected exposure next to the declared exposure intent (#2229) (7e4f79a)
- proxy: bound interactive reads to a remote node and name a missed deadline (#2217) (7ecb1ac)
- recovery: add the data-recovery foundation contracts, with no backup or restore yet (#2213) (3d07549)
- recovery: add volume recovery points, restore to a new volume (#2215) (2e35e1f)
- release: show generated release highlights in What's New (#2223) (42cc5f6)
- security: make evidence availability an explicit deploy-gate policy (#2056) (51bad98)
Fixed
- anatomy: show the resolved host port for a variable mapping (#2219) (2c5942a), thanks @Jamie96ITS
- deps: bump follow-redirects to 1.16.2 (#2214) (0068be2)
- docker: bump go-jose to v4.1.6 in the source-built Docker CLI (#2207) (027e2f0)
- fleet: show the same connection pin on the phone card and the topology map (#2198) (a01bef7)
- fleet: stop showing "Update available" for unreachable nodes (#2202) (f8178ea)
- labels: flag sencho.service.url and rename it to io.sencho.url in one click (#2237) (b781f1b)
- labels: reconcile a rendered $$ with the container's single $ (#2228) (32d092c)
- mesh: keep aliases and port reservations stable while a node is offline (#2012) (54c2e10)
- mesh: remove the leftover paid-tier gate (#2021) (0dd0270)
- metrics: report the Docker host's cores and memory inside a nested container (#2222) (6830367), thanks @dduval-sgo
- security: log the real cause when a deploy block comes from failed evidence (#2200) (70289ff)
- settings: rename Recovery Vault to Snapshot Vault and hold the managed vault behind the experimental flag (#2196) (34e6fd7)
- ui: hydrate Resources and Security regions independently (#2224) (35fb96f)