# Release 0.2.2

Export and naming robustness update.

Included:

- `Export-And-Publish.ps1` now treats `GpoName` and repository `PolicyName` as separate concepts.
- `PolicyName` is optional and is automatically normalized when it contains spaces, umlauts, path separators or other unsupported characters.
- The resolved repository name is printed before the AD backup and upload start.
- `-StrictPolicyName` retains fail-fast validation when automatic normalization is not desired.
- `gpoctl` validates policy and profile names locally and reports the offending value before sending an HTTP request.

# Release 0.2.1

Container deployment update.

Included:

- Root-level multi-stage `Dockerfile` for reproducible source builds.
- Root-level `compose.yml` with persistent named volume, healthcheck and log rotation.
- Non-root runtime user, read-only root filesystem, dropped Linux capabilities and `no-new-privileges`.
- Direct TLS and reverse-proxy HTTP modes using the same image.
- `.env.example`, `.dockerignore` and TLS directory guidance.
- Compatibility deployment files under `deploy/`.

Validated in the build environment:

- Compose YAML parsing and environment interpolation.
- Dockerfile structure and build-context completeness.
- Native Go build and complete Go test suite.

A Docker daemon was not available in the build environment, so an actual image build and container startup could not be executed here.

# Release 0.2.0

Web administration release.

Included:

- Embedded, dependency-free German WebUI served directly by `gpo-server` under `/ui/`.
- Dashboard for policy, version, profile and client health metrics.
- Browser upload workflow with semantic duplicate detection, notes and forced versions.
- Full policy/version browsing, administrative artifact retrieval and guarded deletion.
- Ordered profile editor with `latest` or pinned versions and drag-equivalent move controls.
- Searchable and filterable client status view.
- Stateless eight-hour `HttpOnly` admin sessions signed with the admin secret.
- CSRF protection for all cookie-authenticated mutations.
- Restrictive Content Security Policy and additional browser security headers.
- New API deletion endpoints for policies, versions, profiles and stored client reports.
- Conflict protection for policy/profile references and pinned versions.

Validated in the build environment:

- `go test -race ./...`
- `go vet ./...`
- JavaScript syntax validation with Node.js.
- Linux amd64 and Windows amd64 builds.
- HTTP end-to-end flow covering embedded assets, login cookie, CSRF enforcement, Bearer-token compatibility, policy upload, profile creation and client reports.

Browser screenshot automation could not be executed because the managed Chromium installation blocks navigation to local test servers with `ERR_BLOCKED_BY_ADMINISTRATOR`. The UI assets and browser-facing API were still exercised through unit and HTTP integration tests.

# Release 0.1.0

Initial MVP release.

Included:

- File-backed Go server with admin/client authentication.
- Multiple policy objects and immutable versions.
- Semantic change detection for GPO payload files.
- Ordered profiles with `latest` or pinned versions.
- HMAC-signed manifests and SHA-256 artifact verification.
- Windows agent with safe extraction, local LGPO backup, ordered apply, rollback attempt and status reporting.
- Admin CLI and PowerShell deployment scripts.
- Docker, systemd and example configurations.

Validated in the build environment:

- `go test -race ./...`
- `go vet ./...`
- Linux amd64 builds.
- Windows amd64 cross-builds.
- End-to-end server/API test covering upload, duplicate detection, forced versions, `latest` profile resolution, HMAC manifest signature validation and ETag/304 handling.

Not validated in this Linux build environment:

- Execution of `LGPO.exe` on a real Windows Server.
- Scheduled Task registration on each supported Windows Server version.
- Functional equivalence of every possible Group Policy client-side extension.