HotLoop Cascade 1.0.0 release notes

What this is

1.0.0 is the identity and governance work and a new editor, in one release. Everything in 0.1.2 is still here and works the way it did: the engine, the connectors, the importer, the Helm chart, the Quadlet units and the workflow file format. What changed is what a plant can do with an instance, and what it looks like while it does it.

I’m calling it 1.0.0 because the editor is the last piece I wanted before I’d put my name under the number. Every screen works against the real API, and every feature below was tried against the real server it talks to, not a stand-in.

The new editor

It’s rebuilt in Astro with Svelte islands, in HotLoop’s own colors and type, and it follows your system’s light or dark until you pick. It is still baked into the binary and fetches nothing from anywhere, so a box with no internet runs it as well as one with. Every screen the old editor had is here and does what it did, the canvas included: I carried its code across rather than rewriting it, and I counted every screen, button, field and API call before and after to make sure nothing went missing.

The URLs you saved still work. #/w/<id>, #/x/<id>, #/executions and the debug links open the same screens, and /app/main.js and /app/main.css still answer.

What’s new in it

SAML, against Keycloak, with signed responses only. LDAP and Active Directory, against OpenLDAP and a Samba domain controller, with roles from groups. SCIM, against scim2-tester, so a provider makes and switches off accounts without anyone touching a screen. Custom roles, made from the project permissions. External secrets in OpenBao or HashiCorp Vault, so a credential’s password lives in the store and rotates there. Log streaming of the audit log and finished runs to syslog (TCP, UDP or TLS) and OTLP, tried against a real syslog server and Loki. Variables, folders, insights, annotations on runs, redaction policies, and S3 and Azure blob stores, tried against Garage and Azurite.

The editor has a screen for each of them: Variables, Insights, and under Settings, Roles, Redaction, External secrets, Log streaming, and Sign-in and SCIM. The workflow list is your folders, a run’s page has its annotation, and a workflow’s own settings (in the side panel with nothing selected) pick its redaction policy. A person is only offered what their role allows, and the server still refuses the rest.

EmberOps steps are gone

I took the EmberOps connector out. The nine steps (erpnext.trigger, getList, getDoc, create, update, delete, submit, cancel and call), the “When an EmberOps document is created or changes” trigger, the EmberOps credential type and the screens and docs that offered them are not in 1.0.0. If you need to reach EmberOps, the HTTP step calls its REST API with a credential, and that works today.

A workflow you saved with one of those steps is not dropped and not quietly changed. It fails to validate and it won’t start, and the message names the step and says EmberOps steps were removed in 1.0.0. Delete the step, or replace it with an HTTP step, and it runs again. A credential of the EmberOps type stays in your list, unused, and you can delete it. The importer no longer carries an EmberOps node across, so it comes in disabled with its settings in its notes, like any node it has no step for.

Upgrading from 0.1.2

helm upgrade to 1.0.0, or let :stable roll the Quadlet units. Eight migrations (0018 to 0025) run on the way up. They create tables for roles, variables, folders, annotations, redaction policies, SCIM, secret providers and log destinations, and add one column, the folder a workflow is in. They don’t touch what you have, so your workflows, credentials and runs are where they were and the key still opens them. SAML, LDAP, SCIM and the blob stores are off until you set their HOTLOOP_CASCADE_* settings, which are in docs/IDENTITY.md and docs/GOVERNANCE.md. Nothing changes for an instance that sets none of them, unless a workflow of yours uses an EmberOps step (see above).

Things you need to know

Migrations only go forward. A rollback puts the old image back, it does not un-migrate your database, so take a backup before you update, and treat the backup as the way back. Nothing in these migrations changes or removes what was there, but I haven’t run the old image on the new schema, so I’m not promising it.

External secrets need allowed paths. A provider with none is refused, on purpose, because the store’s token can usually read far more than anyone who edits credentials should be able to name.

SCIM never shows the instance owner to a provider, and a DELETE from a provider turns an account off and hides it instead of erasing it, so a provider can’t remove the last person who can sign in. A re-create brings the same account back.

Variables are not secrets. Anyone who can read a project reads its variables, and the value isn’t scrubbed from run data. Passwords go in credentials or an external store.

What isn’t proven

The sign-in page is still the plain one from before. It works and it’s tested, and it isn’t in the new look yet. LDAP, SAML and OIDC settings are read from the environment when the server starts, so the Sign-in and SCIM screen shows what is on and doesn’t change it. SAML is tried against Keycloak only. I didn’t try the blob stores against AWS S3 or Azure itself, only Garage and Azurite.

The workflows on a real GitHub runner. I ran the release’s own steps under Podman on a box cut to two CPUs with a CPU hog beside them, and the tag run is the first time ghcr.io sees any of it.

License

Cascade is under HotLoop’s Business Source License 1.1 (BUSL-1.1), same as the rest of the HotLoop lineup. It is not open source and I’m not going to pretend it is. Each version turns into GPL-3.0 or later four years after it’s first made public. Home and lab use is free, and so is production use by schools, nonprofits and government. Business use goes through EmberNet, where signing up is free and so is business use. Hosting it as a service for other people, reselling it and embedding it in something you sell are not granted. The LICENSE file is the legal text and it wins any argument with this paragraph.