1.7.1 — Standard host integrity, and vhost naming without ceremony

2026-08-09

Adds a standard AL2023 host-integrity profile — file-integrity monitoring, RPM verification, and exact trusted-change evidence — for nodes that opt in. Fixes two edge bugs: static assets under a declared app route 404ing, and renewed certificates silently not reaching nodes. Also removes the reserved-hostname mechanism for naming vhosts — owning the domain is now the whole requirement. That removal drops an internal, platform-admin-only endpoint and field (claim_reserved/claims_reserved); no known caller exists outside internal ops.

Added

• New packaged host-integrity profile al2023-web-v1 for standard Amazon Linux 2023 web nodes: a fast (60s) tier watching /etc, SSH, cron, systemd, and local executables, and a slow (6h) tier verifying RPM-owned system files and Python packages against package metadata.
• Known package installs, certificate renewals, and deployments now file exact, expiring "trusted change" evidence instead of being silently ignored or flooding operators with alerts.

Changed

• Home-directory exposure on integrity-monitored nodes now uses ProtectHome=tmpfs with explicit read-only binds, so monitoring sees the paths it needs without exposing the rest of the home directory.
• claims_reserved is no longer part of the vhost API response, and POST /api/edge/vhost/claim_reserved is removed (now 404s). This was a platform-admin-only operations action with no known external caller; naming a vhost now only requires owning its domain.

Fixed

• Static assets served under a declared application route (e.g. /api/account/static/...) no longer 404 — they were losing to an internal caching rule.
• A certificate renewed in place (same record, new material) now reaches every node on the next ordinary sync; previously it silently kept serving the expired certificate until something else changed.

Upgrade notes

• The new al2023-web-v1 integrity profile is opt-in and test-suite verified, but has not yet been validated on a live node by the maintainer — hold off enabling it in production until that validation lands.
• Anything calling the removed claim_reserved endpoint or reading claims_reserved needs to stop.