Circuit Breaker 1.0.0 Support Contract

Status: Approved 2026-08-28 under ADR-0001 (product, architecture, security, operations, release). Approval fixes the boundary this document draws. It does not evidence the rows inside it: a row marked "supported candidate" is promoted only when its named ACC/AGT acceptance passes against the release-candidate artifact, per RC-02. Requirements: RC-01, RC-02, RC-03 Companion slice: specs/1.0.0/slices/rc-1-scope-support-boundary.md

Related release-candidate contracts:

The decisions this contract records are argued in the architecture decision records below. They are deliberately absent from the sidebar — mkdocs.yml lists /adr/*.md under not_in_nav because a decision record is reached from the page that relies on it, not browsed. This is that page, so every 1.0 boundary decision is linked from here:

This page is the public-facing support boundary for the 1.0.0 release-candidate program. A row is not supported for 1.0.0 until the named acceptance evidence passes against the release-candidate artifact and is recorded in the release ledger.

Feature scope

Area 1.0.0 status Boundary Evidence owner
Inventory for hardware, compute, services, storage, and networks Supported candidate Single-site homelab/private-network inventory ACC-3 owner
Interactive topology map Supported candidate Browser UI for inventory relationships and manual layout ACC-3 owner
Local authentication, MFA, OAuth/OIDC, invites, and recovery Supported candidate Single deployment security model; not a multi-tenant isolation boundary SEC-4 owner
RBAC Supported candidate Authorization roles within one deployment SEC-3 owner
Audit log Supported candidate Tamper-evident application audit trail; chain repair/verification must be documented separately REL-4 owner
Backup and restore Supported candidate Application-state backup/restore within the supported deployment modes ACC-6 owner
Auto-discovery Beta Private IPv4 ranges and IPv6 ULA candidate ranges only; review-before-merge required AGT-5 owner
Hardware telemetry Beta Device integrations depend on vendor protocol availability and credentials ACC-3 owner
Monitoring/check engine Beta Basic ICMP/TCP/HTTP/DNS checks; maintenance windows and advanced alert policy are deferred REL-2 owner
Prometheus metrics Beta Metrics endpoint contract is not stable for third-party integrations SRV-7 owner
cb CLI Supported candidate Local administrative operations for supported installs SRV-5 owner
Public API/SDK Deferred No stable public API or SDK compatibility promise in 1.0.0 RC-2 owner
Localization Deferred English only; no translated content is shipped and no language selection is offered RC-2 owner
npm distribution Deferred for the 1.0 line No npm package is part of the supported 1.0.0 surface; decided in ADR-0004 and waived as EXC-003 NPM owner

Deployment support matrix

Deployment mode 1.0.0 status Supported environment Required evidence
Native systemd install Supported candidate Linux amd64 and arm64 on explicitly validated distributions ACC-2, ACC-3, ACC-5
Mono container install Supported candidate Linux amd64 and arm64 with Docker Engine; the Compose plugin v2 for the compose up path ACC-2, ACC-3, ACC-6
Proxmox LXC helper Beta Proxmox VE host creating Debian 12 LXC; support limited to install helper behavior ACC-2, ACC-4
Split multi-container Compose Does not ship in 1.0.0 No Compose file in the repository wires separate backend, frontend, database and Redis containers; every container install is the mono image — see Why there is no split mode RC-1
Docker Desktop on macOS/Windows Unsupported for 1.0.0 May work for development only; LAN ARP discovery is not supported there ACC-8
macOS native archive Unsupported for 1.0.0 Build script can name macOS targets, but no 1.0 packaged installer/service support is promised ACC-8
Windows native archive Unsupported for 1.0.0 Build script can name Windows targets, but no 1.0 packaged installer/service support is promised ACC-8
High availability deployment Unsupported for 1.0.0 Single-node application server only RC-1
Internet-exposed direct deployment Unsupported for 1.0.0 Operate behind trusted LAN/VPN; tunnel guidance remains beta until security acceptance passes SEC-3, SEC-5
Air-gapped/offline install Unsupported for 1.0.0 Online artifact download and dependency access are required unless a later signed offline bundle passes ACC-8

Distribution versions are intentionally not listed as supported until the ACC matrix proves exact rows. Documentation may describe likely installer behavior, but only the release ledger can promote a distribution/version row to supported.

Platform and component matrix

Component 1.0.0 status Boundary Required evidence
Server OS Supported candidate Linux only; exact distro/version rows come from ACC evidence ACC-1, ACC-2
Server CPU architecture Supported candidate amd64, arm64 ACC-1, ACC-2
Agent OS Supported candidate Linux only for 1.0 release evidence AGT-1, AGT-2
Agent CPU architecture Supported candidate amd64, arm64 AGT-1, AGT-2
Browser Supported candidate Chrome 111+, Edge 111+, Firefox 113+, Safari 16.4+ ACC-4
Database Supported candidate PostgreSQL only. SQLite was removed in v0.2.0 and the backend refuses to start on a non-postgresql:// URL ACC-2, ACC-5, ACC-6
PostgreSQL major version Supported candidate PostgreSQL 15 for bundled mono/container evidence; PostgreSQL 16 client tooling in CI is test infrastructure, not a runtime promise ACC-2, ACC-5
TimescaleDB Beta Optional unless a deployment explicitly enables CB_REQUIRE_TIMESCALE=true ACC-2
Redis Supported candidate Disposable coordination/cache layer; not source of truth SRV-2
NATS Supported candidate Internal worker messaging layer SRV-2
IPv4 Supported candidate Private LAN/VPN operation AGT-4, ACC-3
IPv6 Beta IPv6 ULA scan input may be accepted; full IPv6 discovery/ACL correctness is not supported AGT-4
Multi-tenancy Deferred beyond 1.0 Multiple users/RBAC are supported in one deployment; true tenant isolation requires separate deployments for v1 SEC-1, SEC-2B

Known limitations for 1.0.0

  • 1.0.0 is not an internet-safe, directly exposed deployment without additional controls and release approval.
  • 1.0.0 is not a high-availability product. It supports one active application server.
  • 1.0.0 does not provide multi-tenant isolation. Use separate deployments for separate trust domains. True multi-tenancy is a long-term goal, not a v1 feature.
  • 1.0.0 does not promise stable public API, SDK, webhook, or metrics schemas unless a later slice explicitly promotes a contract.
  • Direct upgrade support starts at 0.3.5 unless ACC-12 proves older source versions. Downgrade after migration is unsupported; restore a verified pre-upgrade backup instead.
  • Auto-discovery and hardware telemetry remain beta because results depend on local networks, privileges, device behavior, and vendor protocols.
  • Full IPv6 discovery, ACL, and overlapping-subnet correctness is not complete. Treat IPv6 support as limited to explicitly tested ULA workflows.
  • There is no self-service password reset. POST /auth/forgot-password and POST /auth/reset-password answer 410 Gone and the email-reset scaffolding behind them has been removed. Recovery is administrator-mediated: an administrator resets the account from Users → Reset Password, which issues a one-time password, forces a change at the next login, and revokes every existing session. Reset With Vault Key on the login page remains for the case where no administrator can sign in either; it requires the holder to have CB_VAULT_KEY.
  • A publicly-trusted TLS certificate requires a publicly-resolvable domain name. Let's Encrypt issuance over HTTP-01 or DNS-01 (Cloudflare, RFC2136) is supported; a LAN-only install cannot obtain one from any public CA and stays on a self-signed certificate. See TLS Certificates.
  • Integrations cover Proxmox and Docker. TrueNAS and UniFi were accepted by the configuration API in earlier builds with no sync and no connection test; those configurations and their stored credentials are removed on upgrade.
  • Circuit Breaker 1.0.0 ships in English. The interface uses the i18next framework and its navigation labels are structured for translation, but no translated content is shipped and no language selection is offered. The language preference is still stored per install and per user; nothing reads it today.
  • macOS and Windows may appear in historical packaging notes or browser certificate instructions, but they are not supported server/agent platforms for 1.0.0.
  • Air-gapped installation, offline updates, and portable failure bundles are not supported until ACC-8 passes.
  • PostgreSQL and backup/restore promises remain candidates until fresh-install, upgrade, restore, and migration evidence is captured from release artifacts.

Approval checklist

  • [ ] Product owner approves feature scope.
  • [ ] Architecture owner approves deployment, platform, and compatibility boundaries.
  • [ ] Security owner approves exposure, tenancy, IPv6, and air-gap boundaries.
  • [ ] Operations owner approves support matrix rows and evidence ownership.
  • [ ] Release owner confirms every supported row maps to an ACC or AGT acceptance job.