0.7.0 — 2026-09-30 Fewer moving parts: one registration lane, one Kratos client, one logout path. - Profile changes need a sign-in from the last 5 minutes (was 15). - An account with a passkey or password changes its email or recovery email only from a session whose newest sign-in used a passkey or password; the profile hook is now `/admin/profile-gate`. - Signing in to an app after another account signed out of the shared browser starts a fresh app sign-in; a sign-out an app did not start goes through the portal's own sign-out. - Every state-changing portal form carries a token bound to its action; the portal refuses to start without a `CSRF_SECRET` of at least 32 bytes. - Client registration runs only in the portal, on boot; the one-shot registration command, its compose service and its docs are gone. - The portal image builds on `ci-runtime-node` 4.8.0. - Source comments and docs are trimmed, and the tracked-prose ceiling drops to 153,000 bytes. - `POST /admin/revoke-user` and `OTHALA_ADMIN_ENDPOINT_BEARER`; the admin console covers the same ground. - `HYDRA_PAIRWISE_SALT` and the Hydra pairwise block. - LDAP remnants: the `ldap-app` snippet, the lab `glauth.cfg` and `filedrop` fixture, the LDAP bridge settings, and the `ldap` and `oidc+ldap` tile kinds. - The `admin-session` snippet, `scripts/pre-tag-check.sh`, the two CI jobs that compared mirrored copies, and the `is_admin` and `groups` fields of the gate webhook body; the gates read the admin API.