chore(release): bump version to v3.0.0 and prepare unified release

.gitea/workflows/release.yml

@@ -7,9 +7,9 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Release tag to publish assets to (default: v2.0.1)'
+        description: 'Release tag to publish assets to (default: v3.0.0)'
         required: false
-        default: 'v2.0.1'
+        default: 'v3.0.0'
 
 jobs:
   release-linux:

README.md

@@ -531,8 +531,8 @@ Releases can be built and published through three complementary channels:
 ### 1. Tag Push Automation (Gitea Actions)
 Pushing a release tag automatically triggers the build workflows:
 ```bash
-git tag v2.0.1
+git tag v3.0.0
-git push origin v2.0.1
+git push origin v3.0.0
 ```
 The consolidated workflow **`release.yml`** defines two parallel jobs:
 - **`release-linux`** (`ubuntu-latest`): Compiles standalone native ELF binaries (`Linux_Client.bin`, `Server.bin`) and checksums.
@@ -541,7 +541,7 @@ The consolidated workflow **`release.yml`** defines two parallel jobs:
 ### 2. Manual Workflow Dispatch (Gitea UI)
 Workflows can be manually triggered on demand from the Gitea web interface:
 1. Navigate to **Actions** $\rightarrow$ **Release Binaries & Installers** (`release.yml`).
-2. Click **Run workflow**, set the release tag (defaults to `v2.0.1`), and run.
+2. Click **Run workflow**, set the release tag (defaults to `v3.0.0`), and run.
 
 ### 3. Native Local Windows Build & Direct Release Upload
 For environments without a registered Windows CI runner, Windows executables can be built and published directly to Gitea releases:
@@ -550,5 +550,5 @@ For environments without a registered Windows CI runner, Windows executables can
 python compilation/package_dist.py --target windows
 
 # 2. Upload assets and release notes directly to the Gitea release
-python compilation/upload_release.py --tag v2.0.1 --token <GITEA_TOKEN> --skip-build
+python compilation/upload_release.py --tag v3.0.0 --token <GITEA_TOKEN> --skip-build
 ```

RELEASE_NOTES.md

@@ -1,3 +1,33 @@
+# LOGAR Release v3.0.0
+
+Major architectural release introducing the centralized **Master Licensing Authority** (logar.eibl.tech), Subordinate CA hierarchy, live seat synchronization over mTLS, authenticated Hermes AI Bearer token integrations, and streamlined WebUI dashboard controls.
+
+### Key Highlights & Changes in v3.0.0:
+
+- **Enterprise Master Licensing Authority (`LOGAR-LICENSING`)**:
+  - Implemented standalone hierarchical PKI Authority issuing and signing subordinate CA certificates with custom X.509 OID seat quotas (`1.3.6.1.4.1.59999.1.1`).
+  - Automated mTLS renewal and synchronization (`renew_ca_cert_mtls`) connecting Hub servers to upstream authority.
+  - Dedicated multi-tenant licensing dashboard with 2FA TOTP authentication, user RBAC, and WebSocket real-time seat synchronization.
+  - Dedicated Docker container publishing workflow on release tags and portainer GitOps redeployment webhooks.
+
+- **Real-Time Active Seat Quota Synchronization**:
+  - Hub automatically tracks and reports active node seat quotas (`seats_taken`, `active_seats`, `hostname`, `server_fingerprint`) to the upstream authority upon client enrollment, approval, revocation, and removal.
+  - Non-blocking asynchronous thread dispatch ensures instantaneous client responses while keeping central licensing metrics synchronized.
+
+- **Hermes AI Integration & Token Authentication**:
+  - Dedicated `/api/hermes/report` ingestion endpoint delivering verified anomalies within a 12-hour evaluation window.
+  - Bearer token administration (`/api/hermes/tokens`) with dedicated generation, copying, revocation, and deletion in the Hub WebUI.
+
+- **Streamlined WebUI Dashboard**:
+  - Cleaned up top summary KPI cards to focus strictly on operational status and fleet health.
+  - Centralized full cryptographic inspection (Master Authority URL, Server Hub Fingerprint, CA Fingerprint) into the dedicated *Sub-CA & Licensing* tab.
+
+- **Standalone CI & Modular Testing**:
+  - Decoupled LOGAR and LOGAR-LICENSING CI pipelines so each repository tests independently without submodule dependencies.
+  - 100% test coverage across 35 LOGAR unit tests and 14 Licensing Authority unit tests.
+
+---
+
 # LOGAR Release v2.0.1
 
 Maintenance and deployment release consolidating Gitea Actions release automation into a unified single workflow file, standardizing release dispatching across platforms, and bumping version definitions across server hub and Windows installers.

compilation/installer_client.iss

@@ -1,6 +1,6 @@
 [Setup]
 AppName=LOGAR Client
-AppVersion=2.0.1
+AppVersion=3.0.0
 DefaultDirName={autopf}\LOGAR
 OutputDir=..\dist
 OutputBaseFilename=LOGAR-Client-Setup

compilation/installer_server.iss

@@ -1,6 +1,6 @@
 [Setup]
 AppName=LOGAR Server
-AppVersion=2.0.1
+AppVersion=3.0.0
 DefaultDirName={autopf}\LOGAR-Server
 OutputDir=..\dist
 OutputBaseFilename=LOGAR-Server-Setup

src/Server.py

@@ -47,7 +47,7 @@ SESSION_SECRET = os.environ.get("LOGAR_SESSION_SECRET", "logar_server_hub_sessio
 DEFAULT_ADMIN_USER = os.environ.get("LOGAR_ADMIN_USER", "admin")
 DEFAULT_ADMIN_PASS = os.environ.get("LOGAR_ADMIN_PASS", "admin_logar_2026!")
 
-app = FastAPI(title="LOGAR Cloud Ingestion & Hermes Hub", version="2.0.1")
+app = FastAPI(title="LOGAR Cloud Ingestion & Hermes Hub", version="3.0.0")
 
 # Global context holding server state
 SERVER_STATE: Dict[str, Any] = {}
@@ -388,7 +388,7 @@ def generate_client_profile_dict(
 
     return {
         "format": "LOGAR_CLIENT_PROFILE",
-        "version": "2.0.1",
+        "version": "3.0.0",
         "generated_at": datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC"),
         "server_host": server_host,
         "server_port": int(server_port),