[Benoît Cortier (CBenoit)]

2026.3.3 (2026-10-14)

Features

• dgw: keep agent tunnel data in a shared gateway.db (#2039) (e8ac5ef235) (DGW-464)

  Agent Tunnel data moves from agent_tunnel.db to gateway.db in the Gateway data directory.
  Gateway creates gateway.db on every start, even when Agent Tunnel is disabled.
  On the first start after upgrading, Gateway imports and removes an existing agent_tunnel.db, so enrolled agents keep working without enrolling again.
  Downgrading afterwards means agents have to enroll again, because earlier versions only read agent_tunnel.db.

• dgw: honor an explicit agent on KDC tokens (#2068) (458a0db6e4) (DGW-453)

  KDC tokens can name an explicit agent with jet_agent_id, as association and JMUX tokens already do.
  /jet/KdcProxy then sends every Kerberos message through that agent or fails, without falling back to a direct connection or another agent; tokens without the claim keep working as before.
  Previously, the client's Kerberos traffic for an RDP session pinned to an agent could reach the KDC directly from Gateway or through a different agent.
  Through an agent, the KDC must use tcp://: a udp:// KDC with an explicit agent is rejected.

Bug Fixes

• dgw,agent: fix Windows service crash at startup (#2069) (20c0119493) (DGW-460)

  The Gateway Windows service could crash at startup with an access violation in ntdll.dll and never start, as seen after updating to 2026.3.2 on Windows Server 2016.
  The Agent Windows service could crash the same way and is fixed too.
  When the service fails to start, for example because of an invalid configuration, Gateway and Agent now exit with a nonzero status, so service managers such as systemd can detect the failure and restart them.

[Benoît Cortier (CBenoit)]

Implementation notes:

• Version bumped with tools/bump-version.ps1 (VERSION, Cargo.toml/Cargo.lock, fuzz/Cargo.lock, .csproj, .psd1, AppxManifest.xml); cargo metadata --locked passes.
• Linux packaging changelogs say "No changes." because no commit since 2026.3.2 touches package/.
• The CHANGELOG.md entries were rewritten from the PR descriptions to only mention what ships: no tokengen or .NET KdcClaims, no libsql/SQLite versions, no design notes.
• The docs-writter skill commit (agents: update docs-writter skill #2067) has no entry: it only touches agent skills, and git-cliff skipped it because of the typo check.
• DGW-464 was created for feat(dgw): keep agent tunnel data in a shared gateway.db #2039 and moved to Done; feat(dgw): honor an explicit agent on KDC tokens #2068 and fix(dgw,agent): fix Windows service crash at startup #2069 already had DGW-453 and DGW-460.

chore(ai-skills) commit:

• JiraPS 2.16 New-JiraIssue has no -Assignee; the assignee now goes through -Fields @{ assignee = @{ accountId = ... } }.
• DGW transition IDs changed (961 no longer exists from Backlog). Transitions are now picked by target status, furthest along Backlog → To Do → Development → Reviewing → Done first, and the error lists the available transitions when none moves forward. Tested against mocked workflows (linear with new IDs, direct jump to Done, unknown status, already Done) and on DGW-464.
• The README asked for a scoped API token; Jira rejects those on the site URL with Client must be authenticated to access this resource., so it now asks for a plain token.

[Copilot]

🟢 Approval recommended

The version metadata is consistent, the changelog matches the included changes, and the JiraPS usage aligns with its supported API.

0 open findings

What changed in this PR

Prepares the 2026.3.3 hotfix release and improves the changelog-to-Jira workflow.

Changes:

• Bumps product and package versions to 2026.3.3.
• Adds release and packaging changelog entries.
• Makes Jira assignment and workflow transitions more robust.

File	Description
VERSION	Updates the release version.
Cargo.toml	Updates the Rust workspace version.
Cargo.lock	Refreshes workspace package versions.
fuzz/​Cargo.lock	Refreshes the fuzz package version.
DevolutionsGateway.psd1	Updates the PowerShell module version.
DesktopAgent.csproj	Updates the Desktop Agent version.
AppxManifest.xml	Updates the shell extension version.
CHANGELOG.md	Documents the hotfix release.
package/​Linux/​CHANGELOG.md	Adds the Gateway package release.
package/​AgentLinux/​CHANGELOG.md	Adds the Agent package release.
changelog-to-jira/​SKILL.md	Documents transition-failure handling.
changelog-to-jira/​README.md	Corrects API-token guidance.
invoke-jira.ps1	Resolves assignees and transitions dynamically.

No material findings identified.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.