LOGAR/RELEASE_NOTES.md

LOGAR Release Notes

[v0.3.5] - 2026-09-30

🗄️ Enterprise Multi-Engine Storage Architecture

• Dynamic Backend Switching: LOGAR Server Hub now supports runtime switching between lightweight Local SQLite (WAL Mode) and Enterprise SQL servers (PostgreSQL and MySQL / MariaDB) via SQLAlchemy.
• Automated Schema Initialization: Switching to an external database automatically verifies connectivity, provisions normalized tables (telemetry_events, client_seats, license_config, admin_users), creates optimized indices, and runs health verification.
• Configuration Persistence: Persistent backend settings are saved in server_config.json under db_engine and isolated from temporary test environments.

⚡ Ingestion Ring Buffer & High-Throughput Batch Flusher

• In-Memory Queue Buffering: Built-in Python queue.Queue ring buffer with background worker thread decoupled from socket I/O.
• Burst Protection & Cache Mode: High-velocity bursts are accepted without blocking mTLS 1.3 socket listeners; configurable batch size (buffer_batch_size, default 100) and flush interval (buffer_flush_interval_sec, default 2.0s).
• Graceful Shutdown: Unflushed buffer entries are cleanly committed to storage on server shutdown.
• Explicit Opt-In Administrative Control: Ingestion buffering is strictly optional and requires explicit administrative activation (never auto-enabled upon license activation).

🔐 Zero-Knowledge OpenPGP Data Encryption at Rest

• Public-Key Cryptography: Enterprise SQL payloads (event_data) can be encrypted at rest using the server's X.509 RSA-2048 certificate / OpenPGP public key via AES-256-GCM symmetric session keys and RSA-OAEP key encapsulation.
• Zero-Knowledge on Database Host: External database administrators or compromised SQL servers cannot read raw telemetry payloads without the private key located on the LOGAR Server Hub.
• Explicit Opt-In Security Model: Payload encryption is strictly optional and configurable per compliance requirements.

📜 Dynamic Licensing Introspection & Clean Dashboard WebUI

• Modular Capability Introspection: PKI X.509 extension OID 1.3.6.1.4.1.58888.1.3 and persistent license records are dynamically parsed to expose active modules (enterprise_db, etc.) in a dedicated card on the 📜 Sub-CA & Licensing tab.
• Distraction-Free Tab Navigation: Cleaned all tab headers to remove redundant item counts and visual badges for a streamlined administrative interface.
• Graceful Feature Locking: Unlicensed enterprise features remain visible but gracefully disabled in the WebUI and rejected by backend API validation.

📖 Comprehensive Administrator Guide & Expanded Test Suite

• Administrator & Operations Guide: Published comprehensive 11-chapter guide in docs/ADMIN_GUIDE.md and wiki/ADMIN_GUIDE.md covering deployment, database switching, queue tuning, zero-knowledge crypto, forwarders, Hermes AI, 2FA, and troubleshooting.
• Automated Unit & Integration Tests: Expanded test suite to 51 automated tests covering dynamic licensing, WebUI rendering, opt-in isolation, database failovers, and mTLS pipelines.

---

[v0.3.4.2] - 2026-09-30

🔒 Exclusive Hardware Host-Binding & Reassignment Controls

• Automated Host Binding on First Activation: Licenses now automatically lock to the specific server hardware fingerprint (server_fingerprint) and hostname upon first activation/enrollment, preventing multi-host cloning or license hijacking.
• Manual Host Reassignment Control: Added 🔓 Reset Host Binding button to the Master License Authority dashboard (licenseDetailsModal), allowing administrators to unbind a license so it can be cleanly transferred or reassigned to a new server instance.
• REST & CLI Management: Added POST /api/license/reset-binding and CLI argument --reset-binding LIC_ID for automated provisioning pipelines.

---

[v0.3.4.1] - 2026-09-27

🎨 Installer Dialog UI Spacing & Branding Enhancements

• NSIS Client Config Profile Dialog Fix: Adjusted vertical coordinates and label boundaries in the Windows Client NSIS installer (installer_client.nsi) to prevent input field overlap and ensure multi-line instructional text renders without visual clipping.
• Installer Footer Branding Clean-Up: Escaped ampersands in Windows installer branding labels (BrandingText) to avoid character truncation in native win32 footer panels.
• License Authority UI Clean-Up: Simplified table ACTIONS column in the Licensing Authority portal to exclusively display ⚙️ Manage, keeping secondary actions (Reinstate, Delete) inside the dedicated management modal.

---

[v0.3.4] - 2026-09-27

🔄 In-Place Installer Upgrades & Mutual Exclusion Guards

• Seamless In-Place Upgrades: Windows (Inno Setup & NSIS) and Linux installers now detect existing installations automatically. In upgrade mode, installers stop background services, update core binaries and runtime in-place, and restart services without overwriting configuration files (server_config.json, client_config.json), database state (logar_state.db), state tracking (client_state.json), or mTLS certificates.
• Host Mutual Exclusion Validation: Added pre-installation validation across all installers to prevent accidental co-installation of LOGAR Server and LOGAR Client on the same host, showing descriptive guidance to administrators.

🛡️ WebUI 2FA & Telemetry Stability

• Server Hub TOTP Two-Factor Authentication: Implemented RFC 6238 TOTP 2FA for the LOGAR Server Hub web portal (:8443), featuring interactive QR code setup, secret generation, and secure session validation.
• Telemetry Stream UI Buffer Capping: Limited the live verified telemetry stream view to the latest 50 events in the Server Hub dashboard for enhanced browser performance and UI stability.

🔑 Licensing Authority Management & Registry Tooling

• Revocation, Reinstatement & License Deletion: Enhanced the Master Licensing Authority (logar.eibl.tech) with instant license revocation, reinstatement of revoked licenses, and conditional permanent deletion of revoked records.
• Interactive Capability Explorer: Added interactive implementation breakdown modals across core capabilities on the public project landing page.
• Automated Gitea Container Pruning: Added prune_images.py utility to maintain clean container registries by keeping only the latest active image versions.

---

[v0.3.3] - 2026-09-27

🎨 Brand Identity, Centralized Asset Library & Design System

• Centralized /assets Repository: Added official vector graphics (logo.svg, logo_transparent.svg, logo_dark.svg, logo_banner.svg), high-resolution master PNGs (16px to 512px), multi-resolution Windows ICOs (logo.ico, favicon.ico), and installer dialog bitmaps (wizard_header.bmp, wizard_small.bmp, wizard_sidebar.bmp).
• Official Wiki Branding Guide: Published comprehensive visual identity standards on the Gitea Wiki at https://gitea.eibl.tech/me0nline/LOGAR/wiki/Branding-Guide detailing logo anatomy, color palettes (Cyber Cyan #00E5FF, Emerald #00FFA3, Dark Navy #0E1A2E), typography, clear-space rules, dos and don'ts, and strict non-SIEM positioning.
• Unified Interface & Tab Branding: Implemented transparent vector logos on all web navigation bars and browser tabs across both the LOGAR Server Hub (:8443) and Master Licensing Authority (logar.eibl.tech).
• Clean Installer Bitmaps: Regenerated 24-bit RGB header bitmaps with seamless white backgrounds (#FFFFFF) matching native Windows Inno Setup wizard dialogs.
• Automated Asset Pipeline: Enhanced compilation/generate_branding_assets.py to deterministically compile and distribute assets across main repo, compilation subdirectories, and the licensing submodule without third-party graphics dependencies.

---

[v0.3.2] - 2026-09-27

🪟 Windows Installer & Web Portal Enhancements

• Project Showcase Landing Page: Deployed high-impact public homepage at GET / on the licensing authority with architecture diagrams, quickstart commands, and direct navigation to Gitea, Wiki, and the Licensing Portal (/licensing).
• Standalone Windows Binaries & Python Runtime: Resolved issues with standalone Windows executable execution and bundled runtime paths.
• Data Directory Selection & Permissions: Added custom data directory selection during setup and fixed permissions for background Windows services.
• Service Lifecycle & Clean Uninstallation: Resolved service startup issues and ensured complete cleanup of state files upon uninstallation.