secubox-profiles (0.7.0-1~bookworm1) bookworm; urgency=medium

  * apply: observed state (not command return code) arbitrates STOP/START —
    non-blocking systemctl (--no-block) + best-effort lxc, wait_state is the
    sole arbiter and now checks the container (lxc-info) for LXC modules.
  * apply: wait_state timeout is derived per-module from systemd
    TimeoutStop/StartUSec (margin-added, safety-capped), replacing the flat 30s.
  * _run distinguishes a command timeout (still working, deferred) from a
    could-not-run (hard fail).
  * web: /apply reverts the `active` pointer when the ctl rolls back.
  * Fixes the spurious mass-apply rollback (ref #893).

 -- Gerald KERMA <devel@cybermind.fr>  Mon, 20 Jul 2026 09:13:20 +0200

secubox-profiles (0.6.2-1~bookworm1) bookworm; urgency=medium

  * Fix apply on condition-gated modules: a unit whose systemd start-condition
    fails (e.g. hexo — ConditionResult=no) can never become active, so `enable
    --now` succeeds but wait_state timed out → the whole apply spuriously
    rolled back. Now a START of a condition-failed native unit is treated as
    reached (the module is deliberately off in this environment), not a failure.

 -- Gerald KERMA <devel@cybermind.fr>  Sun, 19 Jul 2026 14:00:00 +0200

secubox-profiles (0.6.1-1~bookworm1) bookworm; urgency=medium

  * Fix apply/rollback from the panel: the service runs ProtectSystem=strict, so a
    sudo child inherited the read-only mount namespace (EROFS on the snapshot dir).
    The panel now delegates via `systemd-run --wait --pipe` so the root CLI runs in
    PID 1's context, OUTSIDE the sandbox, able to write snapshot/audit/routes and
    drive systemd/LXC. Sudoers grants updated to the systemd-run-wrapped commands.

 -- Gerald KERMA <devel@cybermind.fr>  Sun, 19 Jul 2026 13:00:00 +0200

secubox-profiles (0.6.0-1~bookworm1) bookworm; urgency=medium

  * Task 3: apply/rollback API + panel now sudo -> secubox-profilectl
    (webui->ctl). Unit sets NoNewPrivileges=false (was true, which
    neutralized sudo) — the rest of the hardening (User=secubox,
    restricted ReadWritePaths) is unchanged. Ships a scoped, exact-command
    sudoers drop-in (/etc/sudoers.d/secubox-profiles) granting only
    `secubox-profilectl apply --yes --json` and
    `secubox-profilectl rollback --yes --json`, matching the fixed argv
    api/web.py's _run_ctl_json builds — no wildcards.

 -- Gerald KERMA <devel@cybermind.fr>  Sun, 19 Jul 2026 13:00:00 +0200

secubox-profiles (0.5.0-1~bookworm1) bookworm; urgency=medium

  * Phase 2: Requires=secubox-core.service -> Wants= on this module's unit
    (remove the hard cascade-stop when secubox-core restarts/fails).

 -- Gerald KERMA <devel@cybermind.fr>  Sun, 19 Jul 2026 12:00:00 +0200

secubox-profiles (0.4.1-1~bookworm1) bookworm; urgency=medium

  * Fix LXC autostart actuation (found in lyrion board validation): lxc.start.auto
    is now set by EDITING the container config file at <lxcpath>/<name>/config
    (lxcpath from `lxc-config lxc.lxcpath` = /data/lxc on gk2) — the previous
    `lxc-update-config -n -x` is not a config-set tool and failed rc=1, leaving a
    module partly stopped. Also: set autostart=0 BEFORE lxc-stop so secubox-watchdog
    does not revive the container mid-stop.

 -- Gerald KERMA <devel@cybermind.fr>  Sun, 19 Jul 2026 11:00:00 +0200

secubox-profiles (0.4.0-1~bookworm1) bookworm; urgency=medium

  * Phase 3a: apply actuator. `secubox-profilectl apply [--profile X] [--only ID]
    [--yes]` (dry-run by default) and `rollback [--target R1..R4] [--yes]` — root
    only. Actuates systemd/LXC/portal one module at a time (stops before starts),
    waits for state, snapshots pre-state (4R, with portal route values), audits
    each decision, and rolls back on any failure. Boot reconciliation and the
    API/panel surfaces come in a follow-up.

 -- Gerald KERMA <devel@cybermind.fr>  Sun, 19 Jul 2026 16:00:00 +0200

secubox-profiles (0.3.0-1~bookworm1) bookworm; urgency=medium

  * Ship four functional profile tiers: full, lite, secure-gateway, media-lab
    (seeded into /etc/secubox/profiles on install, never overwriting edits).
  * New read-only CLI: secubox-profilectl export <profile> [--format
    pkglist|apt|json] — the Debian package list of a profile's active modules,
    for building a slim installer/image. Unresolved modules are surfaced, never
    silently dropped.

 -- Gerald KERMA <devel@cybermind.fr>  Fri, 18 Jul 2026 12:00:00 +0200

secubox-profiles (0.2.1-1~bookworm1) bookworm; urgency=medium

  * perf : /status batché — une seule commande `systemctl show` pour toutes
    les units natives + une seule énumération `lxc-ls -f`, au lieu de 3
    sous-process par module (observe.observe_all, mesuré 46s -> <1s sur 187
    modules). Cache TTL 60s hors-loop (asyncio.to_thread) côté API, avec
    rafraîchissement en arrière-plan ; cache froid = calcul direct, jamais
    d'erreur. /status expose désormais `cached_at`/`age_s`.
  * observe() module par module reste la référence ; observe_all() est le
    chemin rapide, pas un remplacement — unit/conteneur absent du batch
    reste enabled/active/lxc_running/lxc_autostart=None (jamais un False
    fabriqué), y compris pour les units *@.service (templates) qui feraient
    échouer tout le batch si elles y entraient.

 -- Gerald KERMA <devel@cybermind.fr>  Fri, 17 Jul 2026 12:00:00 +0200

secubox-profiles (0.2.0-1~bookworm1) bookworm; urgency=medium

  * webui : API web (socket dédié /run/secubox/profiles.sock, service propre,
    jamais servi par l'aggregator) + panel /profiles/ (hybrid-dark).
  * status/profiles/pins/diff en lecture ; écriture limitée aux membres de
    profil et aux pins (jamais d'apply — Phase 3). Pin protégé->off refusé
    en HTTP 409 avant toute écriture disque.

 -- Gerald KERMA <devel@cybermind.fr>  Fri, 17 Jul 2026 12:00:00 +0200

secubox-profiles (0.1.0-1~bookworm1) bookworm; urgency=medium

  * Phase 1 : manifestes, profiler scan, status, diff (lecture seule).

 -- Gerald KERMA <devel@cybermind.fr>  Fri, 17 Jul 2026 12:00:00 +0200