vwiebe/conductor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

1 Release 3 Tags

RSS Feed
  • v1.1.0 fc73f26726

    Conductor v1.1.0 Stable

    vwiebe released this 2026-09-13 18:11:12 +02:00 | 3 commits to main since this release

    Conductor now supports independently installed applications. Social Scheduler and future applications can be installed or updated without editing Conductor source or rebuilding its image.

    This release includes the completed home and Projects screens, an empty-by-default Included with Skeleton Works catalog, the Conductor favicon, application-aware browser titles and optional app icons. Social Scheduler appears only when its installer registers its package.

    Installation and compatibility

    • Application version 1.1.0, project schema 0.1.0, installed application host API 1.
    • Supported container platform: Linux/AMD64, using Node 24.
    • Social Scheduler 0.5.0 is included as a separate compatible portable kit. Its Node-RED modules are inside the kit. Scheduling, social credentials and posting remain in Node-RED; the scheduler data remains in PostgreSQL.
    • Fresh Conductor runs without Social Scheduler. Installers own their application packages; trusted VM administrators control installation.
    • Packages and their encrypted backend connections persist with the Conductor data volume. Backup v2 includes installed app files; restore also accepts old v1 backups.
    • The current combined Conductor/Social Scheduler 0.4.0 VM needs the upcoming SLICE13 migration. This publication does not upgrade the customer VM. SLICE12 updates setup-conductor.sh; do not use the older fresh-install script as an upgrade.

    Application package contract · Installation · Operations and recovery

    Verified artifacts

    Source commit: fc73f2672602983bd80fa29ee501886ba64ea5a3

    Container: gitea.skeletonworks.online/vwiebe/conductor:v1.1.0
    Matching source tag: gitea.skeletonworks.online/vwiebe/conductor:git-fc73f2672602

    OCI index: sha256:ab5e7dcaed065a304660af31e53ffada290b22dc9176ffeb5817f2e7f07ac313
    Linux/AMD64 manifest: sha256:87a31b370eab199af96c6592799645c98492314eaabdde8e21f2922a414c8d51

    Anonymous source download and image pull passed. All 283 files in the Gitea source archive match the release commit, and the image's OCI revision/version match that commit and tag. The published image passed startup, persistence, backup, restore and container recreation checks.

    The attached Conductor source archive and Social Scheduler kit have SHA256 checksums in SHA256SUMS. SLICE11-VERIFICATION.json records the evidence. The automatically generated Gitea source archive was also verified: SHA256 bd22948100d1ddff39a69509ae2cd5641a09241b3ce5c8d3e4441ccd31adcc55.

    Validation

    • 531 frontend tests across 29 suites; 29 backend tests; TypeScript and production builds.
    • Schema matrix, documentation links, governance and shell validation.
    • Browser tests for management, 26 identity checks, independent Social Scheduler and a second sample application.
    • Authentication, role checks, CSRF, API-token delegation, fixed workspace/identity values, private-token reflection rejection, callback privacy and encrypted connections.
    • Package install/update/remove, checksum rejection, repeated installation and restart persistence.
    • Social Scheduler: 37 core tests, 15 installer tests, real Node-RED/PostgreSQL integration and the actual installer in the hardened final container.
    • Non-root, read-only production container; missing-key refusal; backup/restore of SQLite and deliberately removed application files; successful recreation after restore.

    Production backend dependency audit reports zero vulnerabilities. Existing Create React App development/build advisories remain a separate toolchain follow-up; those build tools are excluded from the production runtime. No customer VM or live social account was used for these release checks.

    Downloads