---
title: "News"
html_title: "Enroll News"
description: "Project status and release notes for the current Enroll 0.7 beta documentation."
---
<header class="py-5 hero">
  <div class="container py-3">
    <div class="kicker mb-3"><i class="bi bi-newspaper"></i> News</div>
    <h1 class="display-6 fw-bold mb-2">Project notes</h1>
    <p class="lead mb-0">The site now reflects the current 0.7 beta behavior documented in the repository.</p>
  </div>
</header>

<main class="py-5">
  <div class="container">
    <div class="feature-card p-4 mb-4">
      <div class="d-flex flex-wrap gap-2 align-items-center mb-2">
        <span class="badge badge-soft rounded-pill">0.7 beta</span>
        <span class="small text-secondary">current documentation refresh</span>
      </div>
      <h2 class="h4 fw-bold">Documentation now matches the current CLI</h2>
      <p>The rewritten site documents the current harvest/manifest model, Ansible-only public output, common role grouping, SOPS bundle behavior, JinjaTurtle flags, root PATH safety, remote SSH passphrase handling, validation, explain, and diff notifications.</p>
      <p class="mb-0">The security pages now emphasise the key trust boundary: Enroll can validate bundle structure, but it cannot prove that harvested host state is semantically safe to apply.</p>
    </div>

    <div class="feature-card p-4">
      <h2 class="h4 fw-bold">Highlights in the current codebase</h2>
      <ul class="mb-0">
        <li>Harvest validation runs before manifest rendering.</li>
        <li>Directory harvests are frozen before consumption to reduce race opportunities.</li>
        <li>Plain output paths are private and hardened against unsafe parents/symlinks.</li>
        <li>Root PATH checks can stop unsafe non-interactive runs unless <code>--assume-safe-path</code> is used intentionally.</li>
        <li>User shell dotfiles are automatic only in <code>--dangerous</code> mode.</li>
        <li>Container images are enforceable only when a digest-pinned registry reference exists.</li>
      </ul>
    </div>
  </div>
</main>