Changelog
What we shipped.
Every commit, live from the main branch. 30 in the last 14 days. Stamped in Aqaba time, rebuilt hourly.
Live feed
main · last 14 daysTuesday, June 926 commits · Aqaba time
- secconstant-time cron auth, context injection filter, default-deny portal, rate-limit nitaqat9b414ff
- fixseodrop invalid ar-JO hreflang from 490 programmatic pages17aeea6
- featbrainexpand injection filter with anti-distillation patterns2325926
- featportalreal Clerk sign-out + idle auto-logout1c9e6d5
- choregitignore internal sprint/recon/OPSEC working dirs7305e59
- fixa11yadd aria-labels to unlabeled dispatch/hiring/shifts form controls8ce6b7f
- featoperatoraudit-log team invite + role changes3db9b5a
- docscspcorrect stale per-request-nonce comments after unsafe-inline migrationcea292b
- fixwebself-heal live-ops layers so the homepage proves itself alive on load6fffcbd
- fixcspallow React 19 streaming scripts on prerendered pages430f59e
- featdashboardemployee shifts clock-in/out + document vaulte58f4e9
- fixauthrender SplashIntro CTAs as links outside ClerkProvider0bb7045
- featslackbidirectional Slack bridge with HMAC verification + safe bot replies7ee85e3
- other[agent:fix] fix(operator): enforce hostile-block on team invite issuance9c9453e
- other[agent:fix] fix(operator): require verified email for operator gate09e60d2
- other[agent:fix] feat(operator): W7.W6 team management - invite + role grants5e66033
- other[agent:fix] fix(operator/map): drop next/dynamic ssr:false (forbidden in Server Component)9e7c9cd
- other[agent:fix] fix(operator): drop forbidden force-dynamic + add Clerk gate to health-streama35b53a
- other[agent:fix] chore(operator): suppress biome static-element a11y on SVG map pinsb14f985
- other[agent:fix] feat(operator): W7.W3 US map dashboard at /dashboard/operator/map0853de4
- other[agent:fix] feat(operator): W7.W7 realtime system health tracker at /dashboard/operator/health8b9b7da
- other[agent:fix] revert(next.config): drop turbopack.root -- ESM/CJS loader ambiguity broke Railway01906cf
- other[agent:fix] fix(next.config): __dirname undefined in ESM -- use import.meta.dirnamef3c8ed7
- other[agent:fix] chore(deploy): nudge Railway to rebuild apps/web after 539b35a8 no-op44d0319
- other[agent:fix] hotfix(deploy): revert railway.json + nixpacks.toml from 011dc8f3539b35a
- other[agent:fix] hardening: validate-csp parse path + railway build config redundancy + turbopack root011dc8f
Monday, June 84 commits · Aqaba time
- other[agent:fix] fix(api/visitors/stream): SSE keep-alive comment to defeat proxy buffering1e9e268
- other[agent:fix] fix(api/visitors/stream): safe auth + abort cleanup + max-lifetimef9a4d5c
- other[agent:railway-fix] fix(layout): CSP nonce->hash for static inline scripts, unblock SSG prerender9f5ed7d
- other[agent:p6-followup] fix(husky): pre-push shebang (sister of P6 pre-commit fix)4e71669
Milestones
wavesv0.8.0April 15, 2026Feature
Phase 6 — /prove-it · Trust surfacing · MCP manifest · Audit-log feed
- /api/mcp manifest endpoint — advertises com.steadywrk/mcp-dispatch ahead of G0 registry publish
- /status page — public platform status with live health probe, build hash, metrics version, deploy age
- /ai.txt — AI-agent manifest companion to /llms.txt
- /api/audit-log — append-only public feed of phase-gate receipts
- Footer Trust column — 7 trust surfaces + status + openapi + llms surfaced from every page
- Homepage Hero "Talk to Us" CTA now routes to /demo (was /contact) — higher-intent path
- /api/health reflects manifest-only MCP status + registry pointer
- GH Actions billing runbook (docs/GH-ACTIONS-BILLING-RUNBOOK.md) — 3 unblock paths
v0.7.0April 13, 2026Feature
Wave 7 — Agentic Control Plane · MCP · Public Evals · Trust Pack
- 7 public routes: /control-plane, /security, /system-card, /evals, /developers, /ai-policy, /dispatch-engine
- @steadywrk/mcp-dispatch npm package — 3 tools (dispatch.quote, dispatch.order, dispatch.evals)
- @steadywrk/sdk (TypeScript) + steadywrk (Python) SDK packages
- OpenAPI 3.1 spec at /openapi.yaml · MCP manifest at /mcp.json
- Live machine-readable evals at /api/dispatch/analytics/evals (30-day rolling window)
- Canonical metrics enforcement — verify:metrics gate fails build on drift
- Phase-gate CI — autonomous sprint execution with .sirius/receipts/ durability
- Trust Pack v1 — subprocessors JSON, data-flow diagram, security headers audit, RFC 9116 security.txt
- 5 ADRs documenting architecture decisions from Sprints A–D
v0.6.0April 11, 2026Security
Wave 6 — Maestro canon + edge hardening
- Maestro canon wired into the brain API — one source of truth for voice and governance
- Edge hardening — upstream infrastructure headers normalized at the boundary
- Layered request-integrity defenses across the API surface
- Provenance watermarking — provable origin if AI content is republished
- Anomaly detection on agent-facing endpoints
Stay in the loop
Every commit on the main branch rolls up here within an hour. Follow along at steadywrk.app or check back anytime.