feat: prepare v0.1.4 live UMS validation

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.1.4] - 2026-05-24
+
+### Added
+
+* `docs/LIVE_UMS_VALIDATION.md` with the v0.1.4 live read-only UMS validation checklist.
+* `scripts/Test-LiveUmsValidation.ps1` for validating `Get-UMSStatus`, `Get-UMSFirmware`, and `Get-UMSDevice` through the same allowlisted runner used by the API.
+* README live validation section with the supported read-only commands and documentation link.
+* Release-check verification that the live validation doc and script exist.
+
+### Changed
+
+* Bumped project version to `0.1.4`.
+* Updated GitHub Pages footer and docs links for v0.1.4.
+* Roadmap now tracks v0.1.4 as a live-validation release candidate instead of a feature expansion.
+
+### Safety
+
+* Documented redaction rules for hostnames, usernames, domains, serials, device names, tokens, API keys and credential paths.
+* Live validation remains read-only and does not add new UMS write actions.
+
 ## [0.1.3] - 2026-05-23
 
 ### Added

README.md

@@ -3,7 +3,7 @@
 Local web UI for managing IGEL UMS via [PSIGEL](https://github.com/MCamner/PSIGEL).
 
 ![CI](https://github.com/MCamner/mq-ums/actions/workflows/ci.yml/badge.svg)
-![Version](https://img.shields.io/badge/version-0.1.3-blue)
+![Version](https://img.shields.io/badge/version-0.1.4-blue)
 ![License](https://img.shields.io/badge/license-MIT-green)
 
 ```text
@@ -53,6 +53,26 @@ Start with read-only commands: `Get-UMSStatus`, `Get-UMSFirmware`, `Get-UMSDevic
 .\scripts\Test-PSIGEL.ps1 -UmsHost ums.example.com -CredPath C:\mq-ums\ums.cred.xml
 ```
 
+## Live UMS validation
+
+v0.1.4 adds a live validation flow for the first three read-only PSIGEL
+commands:
+
+```powershell
+Get-UMSStatus
+Get-UMSFirmware
+Get-UMSDevice
+```
+
+Run it on a Windows management host that can reach IGEL UMS:
+
+```powershell
+.\scripts\Test-LiveUmsValidation.ps1
+```
+
+See [docs/LIVE_UMS_VALIDATION.md](docs/LIVE_UMS_VALIDATION.md) for the full
+checklist, redaction rules and troubleshooting notes.
+
 ## Adding commands
 
 Edit `config/commands.json` and add an entry. Run `npm run validate` to check.
@@ -68,6 +88,7 @@ No code changes needed — the runner is data-driven.
 - Every command execution is written to `logs/audit-YYYY-MM-DD.jsonl` — timestamp, command, args, status
 - Credentials stored via Windows DPAPI (`Export-Clixml`) — never in `.env` or plaintext
 - API binds to `127.0.0.1` by default — not exposed to network without explicit override
+- `docs/LIVE_UMS_VALIDATION.md` defines the live read-only validation path and secret-redaction rules for v0.1.4
 - `release-check.sh` gates every release on: config validation, tests, version sync across VERSION/package.json/README/CHANGELOG/docs/index.html
 
 ## Security
@@ -90,5 +111,6 @@ See [ROADMAP.md](ROADMAP.md).
 - [Architecture](docs/ARCHITECTURE.md)
 - [Security](docs/SECURITY.md)
 - [PSIGEL Notes](docs/PSIGEL_NOTES.md)
+- [Live UMS Validation](docs/LIVE_UMS_VALIDATION.md)
 - [Roadmap](ROADMAP.md)
 - [Changelog](CHANGELOG.md)

ROADMAP.md

@@ -39,10 +39,10 @@ Every dangerous command must require explicit confirmation.
 
 ## Current status
 
-Current stable version:
+Current release candidate:
 
 ```text
-v0.1.3 — docs, CI and validation hardening
+v0.1.4 — live UMS validation
 ```
 
 Current capability:
@@ -58,11 +58,13 @@ Current capability:
 - config validation
 - GitHub Pages landing page
 - CI validation
+- live validation checklist
+- live read-only validation harness
 
-Current priority:
+Current priority after v0.1.4 validation:
 
 ```text
-v0.1.4 — live UMS validation
+v0.2.0 — daily-use operator UI
 ```
 
 Reason:
@@ -81,7 +83,7 @@ environment.
 | v0.1.1  | Local UI and command catalog foundation | Done    |
 | v0.1.2  | Health, dry-run and audit foundation    | Done    |
 | v0.1.3  | Docs, CI and validation hardening       | Done    |
-| v0.1.4  | Live UMS validation                     | Next    |
+| v0.1.4  | Live UMS validation                     | RC      |
 | v0.2.0  | Daily-use operator UI                   | Planned |
 | v0.3.0  | Safety profiles and command governance  | Planned |
 | v0.4.0  | Device fleet workflows                  | Planned |
@@ -170,7 +172,7 @@ Make the prototype easier to trust before live UMS testing.
 
 ---
 
-## Next: v0.1.4 — Live UMS validation
+## Current: v0.1.4 — Live UMS validation
 
 Goal:
 
@@ -193,13 +195,14 @@ real credentials and real UMS responses.
 - [ ] Confirm dry-run never executes PSIGEL
 - [ ] Confirm audit log captures command name, time, result and safety class
 - [ ] Confirm audit log does not capture secrets
-- [ ] Add `docs/LIVE_UMS_VALIDATION.md`
-- [ ] Add live validation checklist
-- [ ] Add sample redacted output
-- [ ] Add troubleshooting for failed UMS connection
-- [ ] Add troubleshooting for missing PSIGEL module
-- [ ] Add troubleshooting for certificate/TLS problems
-- [ ] Add troubleshooting for permissions errors
+- [x] Add `docs/LIVE_UMS_VALIDATION.md`
+- [x] Add live validation checklist
+- [x] Add sample redacted output
+- [x] Add troubleshooting for failed UMS connection
+- [x] Add troubleshooting for missing PSIGEL module
+- [x] Add troubleshooting for certificate/TLS problems
+- [x] Add troubleshooting for permissions errors
+- [x] Add live validation harness script
 
 ### Recommended live test commands
 
@@ -232,8 +235,8 @@ http://127.0.0.1:3000
 - [ ] Session teardown verified
 - [ ] Audit log verified
 - [ ] No secret leakage found
-- [ ] `docs/LIVE_UMS_VALIDATION.md` exists
-- [ ] README includes live validation status
+- [x] `docs/LIVE_UMS_VALIDATION.md` exists
+- [x] README includes live validation status
 - [ ] GitHub Actions pass
 - [ ] GitHub release `v0.1.4` exists
 
@@ -576,8 +579,8 @@ Every command must have:
 Work on:
 
 ```text
-v0.1.4 — live UMS validation
+complete live UMS validation on a Windows management host, then v0.2.0
 ```
 
-This release should prove that mq-ums works safely against a real IGEL UMS
-environment before the UI grows into daily operational use.
+v0.1.4 has the validation docs and harness in place. The remaining gate is to
+run the checklist against a real IGEL UMS environment before expanding the UI.

VERSION

@@ -1 +1 @@
-0.1.3
+0.1.4

docs/LIVE_UMS_VALIDATION.md

@@ -0,0 +1,181 @@
+# Live UMS Validation
+
+mq-ums v0.1.4 focuses on validating the prototype against a real IGEL UMS
+environment without expanding the command surface.
+
+This document is intentionally operational. It should be completed on a Windows
+management host that can reach IGEL UMS and has PSIGEL installed.
+
+## Goal
+
+Verify that mq-ums can safely run read-only PSIGEL commands against live UMS:
+
+```powershell
+Get-UMSStatus
+Get-UMSFirmware
+Get-UMSDevice
+```
+
+## Preconditions
+
+- Windows Server or controlled Windows management host
+- PowerShell 7+
+- Node.js 18+
+- PSIGEL module installed
+- Network path to IGEL UMS
+- UMS account with read-only permissions where possible
+- DPAPI credential file created with `scripts/New-UmsCredential.ps1`
+- `.env` configured with `MQ_UMS_HOST`, `MQ_UMS_PORT` and `MQ_UMS_CRED_PATH`
+
+## Safety Rules
+
+- Do not test write commands during v0.1.4 validation.
+- Do not put credentials in `.env`.
+- Do not paste credential values into issues, logs or screenshots.
+- Keep `MQ_UMS_BIND=127.0.0.1` unless there is a specific controlled reason.
+- Use dry-run before any live execution path.
+- Redact hostnames, usernames, domains, serials and device names before sharing output.
+
+## Validation Commands
+
+From the repo root:
+
+```powershell
+npm test
+npm run validate
+.\scripts\Test-PSIGEL.ps1 -UmsHost $env:MQ_UMS_HOST -UmsPort $env:MQ_UMS_PORT -CredPath $env:MQ_UMS_CRED_PATH
+.\scripts\Test-LiveUmsValidation.ps1
+```
+
+Then start the local app:
+
+```powershell
+npm start
+```
+
+Open:
+
+```text
+http://127.0.0.1:8787
+```
+
+## Live Checklist
+
+### Environment
+
+- [ ] PowerShell 7+ confirmed
+- [ ] PSIGEL module imports successfully
+- [ ] Credential file exists
+- [ ] Credential file loads through DPAPI
+- [ ] UMS session can be created
+- [ ] UMS session can be removed
+
+### Dry-run
+
+- [ ] `get-status` dry-run returns `Get-UMSStatus`
+- [ ] `get-firmware` dry-run returns `Get-UMSFirmware`
+- [ ] `get-device` dry-run returns `Get-UMSDevice`
+- [ ] Dry-run does not spawn PSIGEL execution
+- [ ] Dry-run writes audit entry with `dryRun: true`
+
+### Live read-only commands
+
+- [ ] `Get-UMSStatus` succeeds
+- [ ] `Get-UMSFirmware` succeeds
+- [ ] `Get-UMSDevice` succeeds
+- [ ] Live commands return JSON or parseable raw output
+- [ ] Failed live commands return clear error text
+
+### Audit and secret handling
+
+- [ ] Audit log records command id
+- [ ] Audit log records PSIGEL command name
+- [ ] Audit log records status
+- [ ] Audit log records duration when available
+- [ ] Audit log does not contain credential path contents
+- [ ] Audit log does not contain password, token or API key values
+- [ ] Browser response does not contain secrets
+
+## Sample Redacted Output
+
+```text
+[check] environment
+[PASS] PowerShell 7+
+[PASS] PSIGEL module imports
+[PASS] credential file loads
+[PASS] UMS session create/remove
+
+[check] dry-run
+[PASS] get-status dry-run
+[PASS] get-firmware dry-run
+[PASS] get-device dry-run
+
+[check] live read-only
+[PASS] Get-UMSStatus
+[PASS] Get-UMSFirmware
+[PASS] Get-UMSDevice
+
+[check] audit
+[PASS] audit log exists
+[PASS] no obvious secret markers found
+```
+
+## Troubleshooting
+
+### PSIGEL module missing
+
+Run:
+
+```powershell
+Install-Module PSIGEL -Scope CurrentUser
+```
+
+Then verify:
+
+```powershell
+Import-Module PSIGEL
+Get-Command -Module PSIGEL
+```
+
+### Credential file missing
+
+Create it with:
+
+```powershell
+.\scripts\New-UmsCredential.ps1 -Path C:\mq-ums\ums.cred.xml
+```
+
+Do not commit or share the generated credential file.
+
+### UMS connection fails
+
+Check:
+
+- `MQ_UMS_HOST`
+- `MQ_UMS_PORT`
+- DNS resolution
+- firewall rules
+- certificate/TLS requirements
+- account permissions
+
+### Session teardown fails
+
+The runner attempts `Remove-UMSAPICookie` in a `finally` block. If teardown
+still fails, capture redacted error output and verify the installed PSIGEL
+version.
+
+### Certificate or TLS problems
+
+Confirm that the management host trusts the UMS certificate chain and that the
+configured UMS port is correct.
+
+### Permission errors
+
+Start with the smallest read-only permissions needed for:
+
+- `Get-UMSStatus`
+- `Get-UMSFirmware`
+- `Get-UMSDevice`
+
+If those fail, validate the same commands directly in PowerShell before using
+the browser UI.

docs/index.html

@@ -364,6 +364,7 @@ <h2>Documentation</h2>
         <a href="ARCHITECTURE.md" class="doc-link">Architecture<span>System design and security boundaries</span></a>
         <a href="SECURITY.md" class="doc-link">Security<span>Threat model and safe deployment</span></a>
         <a href="PSIGEL_NOTES.md" class="doc-link">PSIGEL Notes<span>Auth pattern and command reference</span></a>
+        <a href="LIVE_UMS_VALIDATION.md" class="doc-link">Live UMS Validation<span>v0.1.4 read-only validation checklist</span></a>
         <a href="https://github.com/MCamner/mq-ums/blob/main/ROADMAP.md" class="doc-link">Roadmap<span>Planned features and milestones</span></a>
         <a href="https://github.com/MCamner/mq-ums/blob/main/CHANGELOG.md" class="doc-link">Changelog<span>Release history</span></a>
       </div>
@@ -374,7 +375,7 @@ <h2>Documentation</h2>
 
 <footer>
   <div class="container">
-    mq-ums v0.1.3 — MIT License — <a href="https://github.com/MCamner/mq-ums">github.com/MCamner/mq-ums</a>
+    mq-ums v0.1.4 — MIT License — <a href="https://github.com/MCamner/mq-ums">github.com/MCamner/mq-ums</a>
   </div>
 </footer>
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "mq-ums",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "IGEL UMS management web interface via PSIGEL",
   "main": "server/src/index.js",
   "scripts": {