Preflight: Release 0.1.0

[Xore]

Purpose

Single tracking issue for everything left to check before cutting 0.1.0. Replaces #671 (which tracked both the pre-0.1.0 gate list and the post-0.1.0 backlog — the backlog half moved to #1523, and #671 is closed) and absorbs #1033's own scoped pre-release checklist, so there's exactly one place to look.

Where things stood as of 2026-08-15 (from #671)

Every original pre-0.1.0 gate is closed: docs consolidation (#670), the original end-to-end smoke tests (#498, #593, #594, #597, #81), the full clean-reinstall E2E (#787), and the entire Keycloak hard-cutover epic (#986 and all its sub-gates #976/#977/#978/#979/#980/#981/#982, plus #1036/#1010 and Xore/auth-backend#91).

0.1.0 was unblocked as far as #671's own gate list was concerned — but closing that pass turned up one live production bug (VPS deploy pipeline broken, at least one merged fix never shipped) and prompted a deliberate pre-release bug-hunt pass, which is the actual remaining work below.

Remaining checklist (from #1033, not yet started — holding for go-ahead)

VPS deploy pipeline / report viewers

Root-caused live: the VPS deploy-runner SSH key is no longer trusted by the VPS, so no deploy has landed in a while. Confirmed casualty: honeypot-dashboard-ghidra-report's Traefik router (#1237, exempts /export/ghidra/{hash} from the blanket X-Frame-Options: DENY) is in the repo but missing from the live VPS config — the Ghidra report viewer is broken in production right now.

• Restore the VPS deploy pipeline (operator action item — SSH key trust).
• Once a real deploy lands: confirm honeypot-dashboard-ghidra-report is present in the live traefik/dynamic.yml and a real Ghidra report actually renders inside ghidra.html's viewer (not just "no console error").
• Re-check the other three iframe viewers (reports.html, payloads.html, github_analysis.html) post-deploy.
• Full vps/traefik/dynamic.yml diff against the live VPS file — anything else merged since the last successful deploy needs the same check.

General bug-hunt pass

Distinct from #672 (viewport rendering, closed) or #979/#982 (access-control criteria, closed) — actually use each feature as an operator would.

• Every dashboard page's real functionality exercised end-to-end (not just "loads"): filters, pagination, sort, search, export/download buttons, modal open/close, settings save.
• Every download/export path produces a real, openable file: generated report PDFs, Ghidra exports, payload downloads, CSV/JSON exports, pcap downloads.
• Deep links (direct URL to a specific result/detail page) load correctly and enforce auth the same as shell navigation — re-verify Phase 3: implement and validate Keycloak access for Kibana, EveBox, and Arkime #979's own noted gap is actually closed.
• Browser back/forward through authenticated SPA-ish navigation doesn't strand the user in a broken/stale state.
• Re-reproduce dashboard: intermittent API/session failures under concurrent load — 401 on preferences PATCH, six admin subsections, settings modal after SPA nav #1235's still-open items (six admin subsections failing to load, settings modal failing after SPA nav) against current main — item 5 (binding-cookie race) is already fixed and may have resolved more than just that symptom.
• Triage ops: deploy on 2026-08-13 ~20:32-34 UTC left log dirs owned by github-deploy-runner, silently stalling/crash-looping ~19 sensors for 14-18h #1374/elasticsearch: honeypot-30d ILM policy fails on dionaea-incidents-v1-* daily indices — rollover_alias not defined #1375/agent-intrusion-worker: every ES fetch fails with media_type_header_exception (Accept compatible-with=9, server is 8.13.4) #1376 (filed 2026-08-14): decide explicitly whether each ships in 0.1.0 or moves to AFTER RELEASE 0.1.0 #1523 (post-0.1.0 backlog), rather than leaving them silently unaddressed.

Golden-image / detonation sanity (carried from #1033's original scope)

• All three golden images boot cleanly from a fresh kvm_manage.sh revert (win11-analysis, win11-cape, win11-ghosts).
• NVIDIA GPU driver present and working on each guest with passthrough wiring (the passed-through card is a Quadro P2200, confirmed live on the homeserver — separate from the RTX 4000 Ada used for the LLM host).
• A full detonation run end-to-end on each VM type (sample submission → CAPE/ghosts pipeline → result page).
• verify_vm_detection.py (pafish/al-khaser) clean pass against a genuinely fresh clone of each rebuilt image.
• Dashboard reflects live sensor/event data via Elasticsearch for a real detonation.
• VNC/console access confirmed stable across a full detonation run, not just at boot.
• Keycloak login exercised end-to-end against the real deployed stack: login, first-login password replacement, TOTP enrollment, invalid credentials, password reset, logout, admin-host login — desktop and mobile widths.

Non-goals

Not a replacement for #787 (already closed) — this is the lighter regression/bug-hunt pass that #1033 originally covered for post-redeploy checks, expanded specifically to gate the 0.1.0 cut.

Explicitly deferred to post-0.1.0 (unchanged, tracked in #1523)

#174, #67/#84, #662, #195, #602/#603, #1123, and everything else now listed in #1523.