LOGAR/RELEASE_NOTES.md

LOGAR Release Notes

[v0.3.5.2] - 2026-10-03

🚀 Fleet Hub Client Update Caching & Distribution

• Local Package Caching: The Fleet Hub automatically caches edge client binaries and packages locally on startup and upon scheduled refresh, minimizing external upstream traffic.
• Edge Pull Mechanism: Forwarder nodes retrieve validated update payloads directly from the local Fleet Hub.

🛡️ Windows Defender Firewall Automation (Fixes Issue #1)

• Automated Port Exemptions: Inno Setup (installer_server.iss) and NSIS (installer_server.nsi) server installers automatically configure inbound Windows Defender Firewall rules for WebUI (TCP 8443) and mTLS log ingestion (TCP 9443).
• Clean Uninstallation: Uninstallers automatically remove the created firewall rules cleanly upon server decommissioning.

📊 Forwarder Liveness, Silent Server Detection & System Telemetry (Fixes Issue #2)

• Silent Node & Crash Detection: Resolved the "Silent Server Down Bug" by tracking forwarder heartbeats (last_seen). Hermes reporting (GET /api/hermes/report) automatically flags edge nodes that have gone silent for >15 minutes as CRITICAL NODE_OFFLINE alerts.
• Troubleshooting System Telemetry: Cross-platform system telemetry metrics (CPU utilization %, Memory load %, and Free Disk space %) are collected and attached to client heartbeats and Hermes anomaly records without external dependencies.
• Benign Service Noise Suppression: Filtered routine repetitive Windows and Linux background service lifecycle events (e.g., sppsvc, edgeupdate, trustedinstaller, wuauserv, backgroundTaskHost) from false-positive anomaly alert fatigue.

🔑 Dynamic Enrollment Key Rotation & WebUI Key Management

• Automatic Key Invalidation: Clicking "Download Client Config" (GET /api/client/export-profile) automatically generates a fresh enrollment secret and invalidates previous secrets, preventing reuse of leaked keys.
• WebUI Reset Shared Key: Added "🔄 Reset Shared Key" controls in the WebUI header, Fleet tab, and Export Modal, backed by POST /api/server/reset-enrollment-secret to rotate keys and update quick-deploy command snippets on demand.

🔒 Security Hardening & Modular Architecture

• Decoupled CI & Test Execution: Clean modularization across server, client, and authority services with fully autonomous unit and integration test suites.
• API Robustness & Validation: Added cryptographic CSR validation endpoints and request sanitization.

---

[v0.3.5.1] - 2026-09-30

🗄️ Multi-Engine Storage Architecture

• Dynamic Backend Switching: LOGAR Server Hub supports runtime switching between lightweight Local SQLite (WAL Mode) and Enterprise SQL servers (PostgreSQL and MySQL / MariaDB) via SQLAlchemy.
• Automated Schema Provisioning: Database switching automatically verifies connectivity, provisions normalized tables (telemetry_events, client_seats, license_config, admin_users), and generates optimized query indices.
• Config Isolation: Runtime backend parameters are stored persistently in server_config.json under db_engine and safely isolated from ephemeral test runs.

⚡ Ingestion Ring Buffer & Burst Protection

• In-Memory Queue Buffering: Built-in ring buffer with an asynchronous background flusher decoupled from mTLS socket I/O.
• Cache Mode: High-velocity log spikes are absorbed in memory without blocking incoming mTLS 1.3 frame streams.
• Configurable Batching: Configurable flush interval (buffer_flush_interval_sec, default 2.0s) and batch size (buffer_batch_size, default 100).
• Graceful Shutdown: Unflushed queue items are flushed and committed cleanly during server shutdown.
• Opt-In Security Policy: Buffering remains an explicit administrative choice and is not auto-enabled upon license activation.

🔐 Zero-Knowledge OpenPGP Data Encryption at Rest

• Public-Key Envelope Encryption: External SQL payloads (event_data) can be encrypted at rest using the server's X.509 RSA-2048 / OpenPGP public key with AES-256-GCM symmetric session keys.
• Zero-Knowledge on Database Host: External DBAs or compromised database hosts cannot read plaintext telemetry without the server's private key.
• Opt-In Security Policy: Payload encryption is strictly opt-in and configurable per compliance requirements.

📜 Dynamic Licensing Introspection & Clean Dashboard WebUI

• Modular Capability Introspection: PKI X.509 extension OID 1.3.6.1.4.1.58888.1.3 and persistent license records are dynamically parsed to display active modules (enterprise_db, etc.) in a dedicated card on the 📜 Sub-CA & Licensing tab.
• Distraction-Free Tab Navigation: Cleaned all dashboard tab headers to remove redundant item counts and visual badges for a streamlined administrative interface.
• Graceful Feature Locking: Unlicensed enterprise controls remain visible but gracefully disabled in the WebUI and rejected by backend API validation.

🛠️ Dynamic Installer Context Versioning & Streamlined CI/CD

• Context-Aware Installer Builds: NSIS and Inno Setup compiler scripts dynamically derive version information directly from build context/tags (v0.3.5.1) without hardcoded version strings.
• Pre-Integrated Builder Runner: Streamlined CI/CD workflows to rely directly on pre-installed container tools and libraries without runtime apt/pip overhead.

📖 WebUI Administrator Guide & 51 Automated Tests

• WebUI Administrator Guide: Published comprehensive WebUI management guide on the Gitea Wiki covering console access, telemetry filtering, seat management, licensing, database switching, queue tuning, zero-knowledge crypto, Hermes AI, and 2FA.
• Expanded Test Suite: 51 automated unit and integration tests passing with 100% test coverage.