Robot Vault 0.9.7

Corrective alpha release dated 2026-09-05. Version 0.9.6 passed appliance acceptance, but its published robot bootstrap could not read the manifest signature envelope. Version 0.9.7 corrects robot enrollment while preserving durable partial upload resume and the clean-host installation fixes.

Install the appliance on the server, claim it in a browser, then add each robot from the server's Robots page. Each robot receives only the small Ingotron agent.

What 0.9.7 corrects

Verify the robot manifest signature using the published key-ID and base64 envelope, so robot enrollment accepts authentic release metadata.
Stream versioned release artifacts through the delivery service for installers that do not follow redirects.

The short path

On a supported clean Linux x86-64 server, run one command:

bash

curl -fsSL https://get.ingotron.com/install | sudo sh

The signed bootstrap installs Docker Engine and Compose automatically when needed, installs the appliance, and prints the browser URL and one-time claim code. Claim the appliance in the browser, then open Robots → Add robot to choose the robot's recording root and copy its one-use enrollment command. Run that command on the robot. Do not install the full appliance on a robot.

Retained appliance corrections

Prepare the empty mountpoints required by query's read-only secret and TLS binds before startup, and recreate them before Docker starts after a reboot.
Accept distribution-packaged Compose versions such as 2.40.3+ds1-0ubuntu1~22.04.1 while retaining the Compose 2.20 minimum.
Use the ingest binary's built-in readiness probe in release Compose. The previous health check required curl, which is absent from the ingest image, and incorrectly kept a healthy service from becoming ready.
Create the reserved ingotron-secrets system group at GID 10001 before enabling the configuration manager socket. Conflicting groups, explicit members, and host accounts with primary GID 10001 are refused; existing accounts are not reassigned. Container identity stays 10001:10001.
Browser claim and sign-in work on a clean server, with the Admin UI available for the supported configuration settings.
Admin → Configuration uses a reviewed, revision-bound plan and a health-gated apply. The root-managed configuration manager, boot recovery, and global operation lock protect concurrent or interrupted changes.
Add Robot selects the recording root and uses it to render a one-command agent setup; robot upgrade and CA-change re-enrollment are supported workflows.
Upgrade, rollback, and complete backup restore converge their release, systemd-manager, configuration, TLS, and metadata state before declaring success.

These corrections preserve fail-closed boundaries: the appliance stays on one server, robot ingest uses TLS and a per-robot credential, and the browser is a trusted client rather than a host administration boundary.

Upload recovery and recording status

The 0.9.7 source preserves confirmed upload chunks across network loss and robot or server restarts. Retries send only the missing chunks, then the server checks the complete recording against its SHA-256. Inactive sessions expire after seven days. An older server continues to use full-file retries.

Recording details distinguish bytes saved by the server from bytes sent in the current attempt, and separate receipt, integrity, and processing status. A live source test resumed a 50 MiB file with 45 MiB saved by sending only 5 MiB.

The release includes the ingest image, robot agent, and toolkit with migration 026, database permissions, and session-aware cleanup. The distribution also supplies the updated ingest object-store policy. Update both the appliance and robot agent to use durable partial resume.

Compatibility and limitations

Host platform: Linux x86-64 (linux/amd64) with an active systemd manager.
Docker Engine: 24.0 or newer; Docker Compose: 2.20 or newer; OpenSSL 3.0 or newer; tar and curl.
Fresh installs use 0.9.7. Upgrades and adoption support installed versions >=0.9.0 <0.9.7; 0.9.1 remains yanked.
Supported automatic-Docker distributions are Debian, Ubuntu, RHEL, CentOS, Rocky, Alma, and Fedora families.
RHEL-family and Fedora hosts with SELinux Enforcing are blocked by the installer and upgrade path until Ingotron ships its packaged SELinux policy. Never disable SELinux to work around this refusal. Use a supported host or wait for the policy package.
The appliance is single-host, uses a private CA, and has no built-in HA or ACME automation. The release does not include a PII-scrubbing backend.
CLI recovery points include databases, the configured product object store, configuration, secrets, signing identity, and TLS state. Keep an off-host copy and test restores on a disposable host.

Read the user guide, operations guide, and security guide before deployment. The signed release manifest is authoritative for exact image and artifact digests; the changelog records the complete corrective scope.