Changelog

Subscribe: RSS · JSON feed · See also the incident log.

• New console shell for signed-in pages: fixed left sidebar, command palette, and shared design tokens.
• Dashboard, threat log, docs, and all five product workbenches (Vaults, RAG, Shield, Honeypot, Audit) rebuilt on the console visual language.
• Settings, billing, referral, and onboarding moved to the same language; new public verify and status pages.
• Mobile: console nav drawer, responsive instruments strip, and the sign-in / sign-up form is now visible above the fold.
• Post-redesign audit fixes for trust and correctness bugs, including a threat-log verify link that broke the build.

• Plan cards, the Shield card, and secondary landing components sell exactly the identity limits the backend enforces — no more overselling.
• Honeypot intent tags wrap correctly on mobile.
• Repository hygiene: .gitattributes (LF) added, scratch dumps untracked.

• A CI job bootstraps the Supabase substrate and applies every migration in a single transaction to detect schema drift.
• Real drift found and fixed: tripwire_events backfilled into the canonical schema.
• Hotfix: /pricing client crash caused by a dangling comparison-modal effect.

• Single refresh engine: the server now owns the refresh-token family end to end.
• Silent session restore via refresh cookie keeps user identity stable across syncs.
• Closed silent security-net gaps in infrastructure alerting.
• Pricing honesty pass, auth-credential hygiene, a working noindex mechanism for auth-gated routes, and copy/SEO cleanup.

• Stage 1: same-origin requests stop attaching JavaScript-readable Bearer tokens.
• Stage 2: in-memory tokens with a status-only session endpoint.
• Stage 3: server-side session refresh with in-memory Supabase storage.
• CI: authenticated deploy smoke test probes the dashboard and AI layer after each backend deploy.

• CanaryAgent added to the pricing comparison table and to the Free and Shield plan cards.
• Referral discount formula corrected (percent-off, correct for any value); landing free-tier decoy count fixed from 5 to 3.
• CanaryAgent heartbeat and skill-scan endpoints now require authentication; CanaryRAG monitoring is metered.
• Route auth-coverage test, RLS owner-policy script, and SameSite=Strict token cookies.

• CanaryAgent product page joins the public site; navigation gains Threat Log and Referral.
• Sitemap points to public pages instead of auth-gated ones; crawler-safe robots, branded 404, and a non-leaky RAG error message.
• Post-sign-in cleanup: real workspaces, no marketing loops, fake onboarding step removed.