Changelog

Pinned at 4258ee44. Observatory web only, no schema change, deployed web-only.

• Sidebar groups are readable and evenly spaced, with a divider between groups.
• A theme button in the header, next to the account controls.
• A compact account chip that shows one short line and the organization name without its code.
• Sign out is plain text rather than a menu item.
• The posture meter is bound to the score instead of to a fixed value.

Rollback target was the previous web image; the server, control plane and Constellation images were unchanged.

Pinned at 583beedb. Constellation gained a document GET route; the control plane was unchanged.

• Baseline pack v2 shipped to every tenant. Existing rule data and any admin-set monitor modes were preserved, and the reconciliation into monitor never overrides enforce or off.
• Document requests open their own decision page, and MCP rows link to the exact request that produced them.
• Vault coverage was deduplicated and the fixtures made deterministic.

Merge 95279055, PR #321, from ALY-405.

• Endpoint Security and network filter monitors, with the policy publisher and host app that carry them.
• The extension and its daemon are separately signed components with their own entitlements, so the profile your MDM approves is what grants authority.
• CI builds the shared policy library for aarch64-apple-darwin and validates the extension bundle layout.

That closes the gap on the third platform, alongside Windows and Linux.

One batched release across the console, so the navigation and the pages under it changed together.

• Every tenant now receives the Alyria managed baseline rules, reconciled into monitor. A tenant that had already set a mode to enforce or off kept it.
• Mesh, Call Log and Violations cross-link device, session and rule, with URL filters and distinct load states.
• Detail pages: session header links, a rule page, and linked drawer targets.
• Settings split into Organization, Access and Platform tabs. Controls that belong to another module moved to that module's page, and OIDC is badged as not available rather than shown as a save button that fails.
• An Assignments page showing where rules apply across both rule families, with per-device deployment status.
• An Approvals inbox for pending MCP server, document, device and memory requests.
• Top risks became the setup spine: each posture component links to where it is fixed, and a first-run panel lists what cannot be measured yet.
• Content packs and managed settings moved off the rail onto one Advanced page under Lyra, Deployment.