Moltaro 0.0.8-beta

Release date: 2026-08-01

Moltaro 0.0.8-beta introduces governed Markdown content, secure inline image handling, a substantially improved Data Explorer experience, and a safer interactive production release workflow.

Highlights

Governed Markdown fields

• String and Text fields can be configured with the Markdown semantic role while retaining the exact Markdown source as their canonical value.
• Create and edit forms provide Source, Preview, and desktop Split modes, formatting actions, undo and redo, and a full-screen editor that preserves the active draft and selection.
• Details, preview drawers, read-only forms, and Board Data surfaces render a safe CommonMark/GFM subset. Lists, grids, history, child tables, and Board cards use a compact server-generated plain-text preview.
• Raw HTML, executable URL schemes, remote images, embedded data images, and unsupported extensions remain inert. Markdown fields are explicitly non-sortable and use a closed set of text filters.

Secure inline images and file inspection

• Markdown images can be added through file upload, clipboard paste, drag and drop, or File System selection in supported Entity, Association, Board target, and Board Data forms.
• Images remain in a destination-scoped draft until the outer business mutation succeeds. Cancelled, expired, or unused draft content is cleaned up without deleting already adopted durable attachments.
• New and replaced files enter a pending inspection state. The Worker validates binary signatures, MIME type, image dimensions, checksum and content generation, and the ClamAV malware verdict before content becomes available.
• Only verified PNG, JPEG, and WebP content can render inline. Pending, quarantined, rejected, stale, missing, deleted, or unauthorized content remains fail-closed.
• Downloads no longer expose backing-storage locations. The Package SDK returns a verified stream and requires consumers compiled against the previous attachment download result to be rebuilt.

Data Explorer and Tree View

• A quick-filter bar exposes active conditions as readable pills, including tag filters, with direct edit and removal actions.
• Mobile Data Explorer now uses a dedicated card/list experience with search, row actions, progressive loading, and responsive fact rendering.
• Parent Tree View supports a configured sibling sort field and direction. Sorting is applied independently within each root or child group and safely falls back to Display name when the configured field is unavailable.
• Tree data remains visible during refreshes instead of flashing a transient contract error while roots and expanded branches reload.

Search, automation, and runtime correctness

• Entity search targets now follow deterministic schema-derived ordering. Related paths stay grouped, record content remains last, and YAML export uses the same order.
• Dependency checks prevent fields, associations, or definitions from being removed while configured search paths still depend on them.
• Scheduled and trusted system automation can create and replace tags with the correct system attribution, correlation metadata, resource events, Board audit effects, and stable failure reason codes.
• The reserved system automation actor cannot be created as an ordinary workspace user or impersonated by HTTP and persisted resource-event callers.

Release operations

• Moltaro.Deployctl is now an interactive, provider-aware production release console. Hetzner Cloud is the first provider implementation.
• Every release strategy coordinates the base runtime, Portal, PortalDb migrations, public documentation, Object Storage publication, and Portal package catalog. The selected strategy changes only how existing Managed Apps are handled.
• Full runtime replacement creates per-application recovery points, applies WorkspaceDb migrations, replaces WebApp, API, Worker, and package-owned services, and verifies every application before synchronizing Portal state.
• Backup deletion and old-runtime retirement are intentionally manual. The console retains backups, runtime artifacts, VM caches, Docker tags, and recovery points and records the required follow-up for the operator.
• Runtime publication and offline signature import verify ClamAV databases through the supported sigtool --info contract and require an explicit Verification OK. result before accepting them.
• Runtime VM provisioning now includes the archive tooling used by production releases, and Deployctl checks every active runtime host for the complete release toolchain before builds or production mutations begin.
• Docker packages now validate and carry the complete ClamAV image, runtime configuration, health scripts, and signed signature baseline. Linux runtime text files are normalized to LF during publication, and invalid CRLF package content is rejected before an application is stopped.
• Full-package replacement now installs new ClamAV runtime files and host-path variables while preserving a live installation’s newer signature database. API and Worker resolve the Compose ClamAV service independently of older generated appsettings files.
• File-inspection readiness now accepts ClamAV’s native ctime-style VERSION timestamp and checks effective configuration values, including settings whose configured value equals the ClamAV default.
• Full Docker runtime replacements now drain legacy and pending file inspection through the target Worker before activating the Markdown storage contract. The remaining Worker writers stay behind the startup gate until activation succeeds.
• Deployctl can resume a full replacement when an earlier run migrated only a subset of Managed Apps. Mixed Workspace migration baselines are reported in the confirmation inventory and converged per application; delta-update preparation remains blocked until the interrupted replacement is recovered.

Database and upgrade impact

The Workspace database changes during the full replacement to add Markdown storage/preparation checkpoints, file-inspection state and work queues, destination-scoped attachment drafts and idempotency, Tree View sibling-sort configuration, and trusted-automation actor constraints. There is no PortalDb change.

Runtime and deployment

• WebApp, API, Worker, Workspace UI toolchain, Package SDK, package-owned runtime assets, and the new ClamAV service ship together in the 0.0.8-beta runtime.
• Existing Managed Apps require a full runtime-package replacement and Workspace migration. This release is not published as a delta update.
• New Managed Apps select the newly published 0.0.8-beta base runtime.
• Previous runtime artifacts must remain available until the operator has manually removed every backup whose restore contract references them.