Changelog

What we shipped, when we shipped it.

July 10, 2026

FixGnosova production foundations + embed trust and client isolation

Fixpipeline fencing, fair polling, blob hardening, connector reliability

Fixbuyer money plane + durable booking notifications + trusted rate-limit keying

Fixleast-privilege API-key scopes, tenant parent ownership, authenticated UAT outbox

Fixagent-plane containment — sweep races, terminal webhook coverage, cost validation, rotation saga, DNS-pinned delivery, platform-IP allowlist

Fix/o/{non-uuid} returns branded 404, not a 500 (capstone UAT finding)

Fixisolation check no longer manufactures a bleed off an unbuilt second business

July 9, 2026

Fixticket-callback signature test signs the fresh (timestamped) form — 3 known-fails resolved

Fixstop false-flagging Stripe `re_` refund ids as Resend keys

Newnormalize the launch + grow mapError branches onto the ONE envelope

Fixa11y — nested-interactive on the kanban card + unlabeled Schedule picker

FixfunnelTypeForOffer justification used a hand-rolled dollar string

Fixa13 isolation "bleed" was a false-positive — narrow the distinctive-vocab set

Newe2e known-fail registry + no-growth ratchet

Fixstripe-money lane writes its receipt to disk — real-card PASS is now citable

FixB4 blocked-reason no longer claims the /d route is unbuilt

Fixcheckout idempotency was broken by a time-varying expires_at — anchor it to the key window

Fixread the FILE /d link from the ENQUEUED outbox, not drained email_log

Fixroute a PAID product/bundle to a product_launch CHECKOUT funnel + detect it buyer-side

Fixroute downloadable digital seeds to offerType=product — unlock the FILE archetype end-to-end

FixB7 archetype-aware refund clawback — observe revoke via 409, skip /d-dead for access-only

Fixarchetype-aware buyer grading + cookie-less unauth adversary probes

Fixsurface the buyer-portal link on the /o thank-you (not email-only)

Fiximplement the portal "Access" route — was a 404 dead link

FixplaneSeparation uses a real UUID productId (the fail-closed guard needs the query reached)

Fixnon-entitled review submit → 403, not a 22P02 cast 500

Fixbuyer session cookie Path=/ so it reaches /api/buyer/* (was /portal/{bid})

FixbuyerUrl.test.ts must not leak "undefined" env strings into later suites

Fixbuyer emails must use the buyer-public URL, not the internal callback host

Fixclose the four deterministic co-founder findings (#892-895)

Fixhonest corrections from the co-founder R4.5 adversarial pass

Newwire the ACCESS portal-login leg into the buyer walk (#859/#880)

Fixclose the sign-off-lane money-path + instrument defects

Fixharden the cohort instrument honesty — taxonomy/manifest/F7-dodge

July 8, 2026

Fixcharge-lane instrument — F7 charge-step gating, receipt classifier, app-flag stamp, operator signal, publish manifest

FixUAT business seeds a verified founder proof so publish-smoke can publish (#793)

Fix#865 — keyless BRANDED-SVG floor (monogram) + placeholder-only-imagery publish gate

Fixrestore tsc-clean typecheck — 14 type errors from #866 + #862 tests

Fix#862 (deterministic AC) — durable delivery: buyer purchase emails via the bj-o12 outbox

Fix#867 follow-on — UAT seed carries a REAL public identity, not the .test login

Fix#868 (R43-E3, part 2) — every numeric price tier carries a billing unit

Fix#861 (R43-E2, deterministic AC) — serve-time backstop so a STALE mis-wired money page fails loud

Fix#863 (R43-E2, AC#1) — tighten fulfillability signals so digital copy isn't mis-classified physical

Fix#867 (R43-E3) — a fabricated business identity never publishes or renders

Fix#866 (R43-E3) — a credential never fills the "Meet <name>" heading

Fix#864 (R43-E3) — public proof shows real results, not internal 'Operator proof <slug>' tokens

Fix#857 (R43-E1) — publish the run archive incrementally, so a cited run always has reports

Fix#856 (R43-E1) — evidenced failure taxonomy; a stall must cite a throughput signal

Fix#855 (R43-E1) — report.md renders B3 from the json status, can't narrate a false PASS

Fix#854 (R43-E1) — run aggregates roll up over the union, not just this invocation

Fix#853 (R43-E1) — the money receipt is archetype-aware and can say NO

Fixno per-batch harness restart by default (operator 2026-07-08)

Fix#766 — first-touch UTM attribution survives the opt-in (CT1)

Fix#814 — public routes emit the {code,message,detail?} error envelope + contract test

Fix#837 review — seed gate accept-only + overridable + fix stemmer

July 7, 2026

Fix#839 review MED — clear price_stale on ANY successful recompile

New#837 — activate the seed-relevance gate (thread the seed, tolerant match)

Fix#818 — videoless VSL gate accepts a complete text-first sales page

Fix#841 — conversion dedupe unique index (concurrent double-count)

Fix#839 — per-dimension price-staleness serve gate (not the broad content_stale)

New#845 review LOW — unauthenticated portal-access recovery route

Fix#847 review HIGH — re-publish covers ready/optimize state, not just draft

Fix#844 review HIGH — fail closed when a FILE offer binds no deliverable

Fix#845 — spine-built businesses get embedSecret + welcome email (portal reachable)

Fix#847 — re-publish an edited-after-approve offer (a14 dead-end)

Fix#844 — bind a deliverable in activate_offers so a purchase mints /d/{token}

Fix#842 — dedupe recurring re-expansion on the local calendar date (DST)

Fix#836/#832/#839 review — gate-on-result, runtime money mirror, stale revert

Fix#835 review med+low — seat-lost idempotent; honest concurrency note

Fix#840 review med — invalid timezone fails soft to UTC

Fix#836 review med — case-insensitive booking-count email compare

Fix#838 review high+med — text-only price is waivable; detect CTA prices

Fix#834 review low — sibling ai-execution route fails closed too

Fix#833 review lows — dedup prefers live; loser doesn't strand 'building'

New#837 — seed-relevance gate for domain-bearing deliverables (dormant)

Fix#839/#836 — fail-closed serving on stale price + legal-less pages

Fix#838 — text-price arms the money gate; demoGoLive keys on is_sandbox

Fix#836 — close the guestEmail booking-count oracle (server-resolve email)

Fix#840 — expand recurring posts in the series' anchor timezone (DST)

Fix#835 — conversion-count idempotency under redelivery + double-submit

Fix#833 — one live publication per funnel; unpublish revokes all

Fix#832 — money gate asserts a payment surface exists on charge pages

Fix#834 — reconcile webhook fails closed on unparseable COMPLETED

Fix#831 — buyer self-service "resend my download" recovers a lost digital-delivery link

Fix#821 — past-date booking returns a friendly 400 (not 404/409) + honeypot on public forms

Fix#830 — money-wire keys on CHARGE stepType (isChargeStep), never a purchase-CTA buttonAction

July 6, 2026

Fix#820 proving-lane — the test-subscription creator uses a real PaymentMethod (pm_card_visa is not attachable)

Fix#820 proving-lane — create a real confirmed test PaymentIntent for a payment-mode offer (open session has no PI)

Fix#820 proving-lane — create a real Stripe test subscription so a subscription-mode offer can grant + prove a receipt

Fix#820 proving-lane — an access-only sale grades a complete receipt without delivery.status=200 (the entitlement is the unlock)

Fix#820 — EMAIL the digital-delivery /d link on purchase (buyers never received their download) + proving-only email-link read seam

New#820 proving-lane — drive the REAL /d/{token} delivery route so the money receipt reaches delivery.status=200

Fix#820 proving-lane — self-signed completion carries the REAL Stripe charge object (payment_intent / subscription)

Fix#820 proving-lane — self-signed webhook replays the business's authoritative workspace scope (grant no longer silently no-ops)

Fix#820 — resolve the funnel conversion destination by step TYPE, not by any checkout_form / purchase CTA

Fixcheckout omits the options arg when empty (stripe-node rejects {}) — the LAST money-path link

Fixpayback gate uses the TRUE sandbox flag (isSandboxOrgRaw) — MONEY_BYPASS_OFF proves the charge path, not unit economics

Fixmoney gates agree under bypass-OFF + cohort approve-publishes the funnel's bound offer (money path completes end-to-end)

New#828 paced-cohort orchestrator — batched, backend-restart + cooldown, re-queue stalls (no fake-pass)

New#824 #825 #826 #827 #819 — close the money path (a generated funnel takes money end-to-end)

Newcohort runner exercises the #793 operator waiver leg for waivable publish gates — cohort run-1 blocker 3

Fix#814 book-route 409 carries the specific slot_unavailable code; B2 grader accepts the typed envelope — cohort run-1 blocker 2

Fix#801 canonical/og furniture must use the PUBLIC origin, never the cross-plane APP_BASE_URL — cohort run-1 launch blocker

Fix#814 error contract (exemplars, 6 families) + cycle-2 review fixes — consent-gated server Lead, bounded dispatches, ics chain UIDs, cohort readiness

July 5, 2026

New#797 #799 #801 #803 #804 #805 #806 — pixels/CAPI, page fitness, email finish, a11y + polish (Wave 2 complete)

Newreview-fix + Wave-2 lanes — #792 #793 #794 #795 #800 #810 #811 + #791 dead-code + 10 verified review findings

New#781 #787 #788 #789 #790 #796 #798 #816 — recompile seam, attribution/ROAS, feature wiring, community surfaces

Fix#776 #777 #778 #779 #780 #782 — buyer-surface security + data-protection correctness

Fix#773 #774 #775 #783 #784 #785 #786 #815 — money-path safety + cross-module seams + ops wiring

New#807 #808 #809 — harness wiring debt: env loader, checkoutLive/courseLive probes, real B6–B9, adversary default-on, proof seeding, mobile lane

Fix#756 — exclude bare "start" stem so quiz funnels aren't rerouted past their quiz

Fix#756 — token-match conversion anchors (catch #calendar/#payment/#checkout-form + all hyphenated variants)

Fix#756 — extend conversion-link wiring to the application/booking archetype (#apply/#book/#schedule)

Fix#758 — render a default confirmation instead of 404 after conversion (missing thank-you page)

Fix#757 — extract externalOrigin to a shared helper; fix the double-opt-in confirm redirect too

Fix#757 — checkout redirect must use the request host, not the 0.0.0.0 standalone bind

Fix#756 — guarantee the sales→checkout link (dead #plans CTA conversion break)

Fixdrive the #161 drafter->approver cross-session accept (a08 owner+assistant)

Fix#689 follow-ups — operator-session auth on the GET + document OPS_ALERT_EMAIL

New#689 — self-hosted public-surface #418 alerting (no Sentry account needed)

New#678/#620 — keyless on-brand page imagery (logos already wired via monogram)

Fix#683 root cause — the offer prompt itself steered booking seeds into subscriptions

New#688 — self-hosted distributed rate-limit backend (no Upstash account needed)

Fixdeploy shipped an unverified email FROM domain — platform sends would 4xx

Fixdocument EMAIL_TRACKING envs in .env.example (green the suite)

New#752 opened/clicked segment predicates + email open/click tracking

Fix#637 — real Resend/Vercel/Stripe secrets were committed in secretScan.test.ts fixtures

Fixa09 buyer expectation stale — consulting seed correctly routes service, not download

Fixbalance 5+ item grids — no orphaned last card (#680 regression)

Fixa13 isolation keyword-bleed flagged generic marketing words, not identity terms

Fixharness masked a correct model-drift rejection as transient accept-noop (a10 booking)

FixR3-E8 harness gaps — a13 second-business never switched; a14 brand check used stale palette

Fixharness beauty probe graded a transient builder draft — stabilize before scoring

Fixharness archetype false-positive — 'community' seed word mislabeled a06 subscription as course (#684)

July 4, 2026

Fixbrand not applied — WCAG AA auto-fix stranded teal/cyan accents, funnel shipped default #ff6200

NewR2/R3 Wave 2+3 — buyer-depth harness + PMF plane (30 sub-issues) + review fixes

Fixunbreak `next build` — extract pure campaignPlanScore off the fs/blob chain

FixR2/R3 Wave 1 — 52 sub-issues across 11 subsystem lanes + review-loop fixes

Newoffers-engine vague-seed ASK path — clarify, never stall (#611)

Newwire Google Calendar OAuth client into harness deploy (#460 BJ-B)

FixBJ-C/BJ-E #458/#462 mint delivery token on purchase + BJ-O #472 dead-letter wrapped FK

FixBJ-H #465 — render approved reviews as social proof + operator approve endpoint

FixBJ-G #464 — subscription entitlement onConflict must use targetWhere arbiter

Newexternal cron scheduler for the local docker deploy (#634)

Fixnormalize slot-fill capitalization in generated copy (unblocks go-live)

Newharness — AVATAR accepts a comma-separated avatar subset (batched runs)

Fixharness — funnelType parse must include Subscription/Application (E3 archetypes)

FixPR-E3-1 follow-up — subscription funnel needs a framework set

NewPR-E9-1/E9-2/E6-6 — buyer-journey harness (B2 booking, B3 checkout plumbing, multi-session)

NewPR-E6-5 — cohort determinism (rerun-agreement + flake monitor, ban rosy snapshot)

NewPR-E10-1 — double opt-in (pending→confirm→active), consent-complete

NewPR-E3-1/E3-2 — subscription + service/booking archetypes (fix the collapse)

July 3, 2026

FixPR-E3-3 refine — block the archetype COLLAPSE, not benign paid-type variance

Fixcorrect a06 stale archetype expectation (paid newsletter = subscription, not download)

FixPR-E4-3 regression — STRIP unverified social proof at publish, don't fail-close

FixPR-E9-3 — blank buyer-phase capture guard (isNearUniformImage)

NewPR-E6-2/3/4 — capture fidelity, hash stability, funnel beauty score (pure cores)

NewPR-E6-1 — rubric that can FAIL bad copy (the instrument must be able to fail)

FixPR-E3-3 — archetype detection honors billingPeriod + mismatch blocks the run

NewPR-E2 — generator fail-loud (no silent stalls, no locked dead-ends)

NewPR-E1 — launch/publish integrity (slug fallback, live probe, explicit failure UI)

NewPR-E4 (2/2) — WCAG AA auto-fix, media warnings, offer-price binding

NewPR-E4 (1/2) — cookie-bar offset, balanced grids, block fabricated social proof

NewPR-E5 — copy integrity (lint gate, mojibake, guarantees, value math, campaign score)

NewPR-E8 — production deploy readiness (env, secrets, preflight)

FixPR-E7 — wire the win-back retention lane end to end

FixPR-S1 — fail closed on unsupported capability, drop dead TODO-throwing stub

Fixdrip send resolves recipient from envelope.body (bj-a1/h7)

Fixadd pipeline-tick cron to advance due drip/pipeline runs (bj-a1)

Fixseed connector capability catalog on boot + in db:seed (bj-a1 root cause)

Newbj-e2 schema — leadForms.deliveryAssetId FK -> brand_asset (0005)

Newbj-n7 — per-renewal shipment trigger for physical subscriptions

Newbj-e1/e2 — sellable lead-magnet artifact type + real-file opt-in delivery

Newbj-e7/d8 — sellable-asset versioning + quiz->paywall checkout gate

Newbj-i1/o11/o4/j2 — seat confirm/release, entitlement<->sub rebind, operator-churn grace->suspend

Newbj-b4/o8 — DB-enforced slot uniqueness + atomic reschedule exclusion/stale-token

Newbj wave-13b schema — seat caps, quiz paywall FK, booking slot-unique index (0004)

Newblock unfulfillable checkout + physical renewal shipment trigger (bj-i2 close, n7 partial)

Newfinish drip unsubscribe end-to-end + funnel booking-block slug (bj-h7/b1)

Newbuyer affiliate self-signup + community reactions/RSVP + moderation (bj-h6/h8)

Newbuyer-avatar lane stages B4-B7 + cohort roll-up + multi-archetype (bj-f4/f5/f6/f7)

Newcourse completion certificates — detect/issue/render (bj-d5)

NewStripe Tax + hosted invoices + trials/proration for buyers (bj-g6/g7)

Newlive/VOD session access + paid-newsletter gate (bj-n2/n4)

Newrecurring delivery loop + subscription->appointment + buy-then-book (bj-n1/n5/n6)

Newseat-hold at checkout + business wind-down lifecycle (bj-i1/o11/j2 partial cont.)

Newseat holds/waitlist + business-status guard (bj-o11/i1/j2 partial)

Newdurable notification outbox + fixed cohort start-date (bj-o12/n3)

Newservice engagements — quote/intake/contract/portal/signoff (bj-k1..k5)

Newschema-batch — engagements, outbox, waitlist, seat-holds, cohorts, business-status (bj-k*/o12/i1/o11/n3/j2)

Fixregister dead-entitlement monitor cron in vercel.json (bj-c10)

Newwave-10 shared helpers — win-back drip template + notify/email plumbing (bj-h5/h4)

Newoperator->buyer message + dead-entitlement monitor (bj-m3/c10)

Newbuyer DSR export + erasure + wind-down export + tier-downgrade guard (bj-l1/l2/j3/j4)

Newbuyer support intake + first-party reviews + account self-service (bj-h1/h2/h3)

Newwin-back drip + buyer refund-request + per-purchase conversion event (bj-h5/h9/i10)

Newfunnel-sells-course, cart/upsell/quiz-checkout, operator refund + churn wind-down (bj-d3/d6/i6/i11/i13/m2/j1/h4)

Newbooking notify/reminders/sync-status + team fan-out (bj-b3/b5/b6/b8/m4)

Newbuyer-avatar experiential lane — model + scaffold + B1/B2 (bj-f1/f2)

Newoffer deliverable + buyer asset serving + brand-kit-applied render (bj-e3/e4/e6)

Newcourse learner surface serves real bodies + paywall activation (bj-d2/d4)

Newnurture wiring — seed drip, email-connector state, handoff observability, CRM merge (bj-a1/a2/a6/a9)

Newbusiness-model fulfillability guardrail (bj-i14)

New.ics calendar invite + funnel booking block render wiring (bj-b2, bj-b1 partial)

Newbuyer billing portal + card-expiry dunning link (bj-g2/g5)

Newrecord renewals (invoice.paid) + populate expiresAt (bj-g3/g4)

Newsubscription + refund races — cancel grace, false-revoke guard, clawback (bj-o5/o6/o7)

Newno-show sweep + reminder dedup + phantom-revenue guard (bj-o9)

Newwebhook integrity — ordering/status, dead-letter, claim lease + reconciler (bj-o2/o3/c8)

July 2, 2026

Newsellable lead-magnet asset + real opt-in delivery (bj-e1/e2 partial)

Newpurchase auto-enrolls into course + order receipt (bj-d1/i3)

Newoperator customer roster — business-scoped buyer view (bj-m1)

NewTerms / Privacy / Refund policy pages + working footer links (bj-i7)

Newmoney-plane separation regression test + booking widget a11y (bj-c9/i9)

Newdrip unsubscribe send-config + opt-out route (bj-h7 partial)

Newpersist buyer billing snapshot + partial-refund policy (bj-g1/g8)

Newexpire + harden booking cancel/reschedule token links (bj-b9)

Newmarketing consent + business-scope dedup + custom fields (bj-a3/a5/a7)

Newcourse drip — timed lesson release by enrollment offset (bj-d7)

Newschema-batch for consent, custom fields, drip, buyer billing (bj-a3/a7/d7/g1)

Newdiscount codes at checkout + webhook livemode guard (bj-i5/o1)

Newcourse polish — live enroll CTA + paid-course publish gate (bj-d9)

Newbooking robustness batch — horizon tz, Meet link, sync health, priced-deal (bj-b10)

NewCRM upsert enriches on repeat + unified capture idempotency/validation (bj-a4/a8)

Newbuyer portal — magic-link login + business-scoped my-purchases (bj-c5/c11)

Newbuyer-facing signed delivery route /d/[token] (bj-c4)

Newrefund/dispute revokes one-time buyer entitlements + delivery tokens (bj-c7)

Newwire buyer entitlement grant + receipt/welcome email on checkout (bj-c1/c3/c6)

Newbuyer money-plane foundation — schema + pure libs (bj-epic-c PR1)

Newfunnel cookie consent + accessibility/DPA pages (bj-l3/l4)

Newbrand-kit export is a real PDF, not an HTML data-URL stub (bj-e5)

Newbooking availability correctness + book-time revalidation (bj-b7/o10)

Newbuyer offer-page — POST checkout, confirmation, trust, a11y (bj-c2/i4/i8/i12)

Fixstabilize layout.test.ts metadataBase (baseline red)

Fixbj-c12 — enforce exp + maxTokenAge on embed-token verification

Fixbj-carryover-ci — move CI workflow to repo root so Actions actually runs it

Fixlr-g2 add Fraunces + serif faces to webfont registry

Fixlr-g1 preflight keys on ACTIVE brand, not any draft kit

NewEPIC LR-G — published funnels are on-brand, production-grade pages

Fixhonor ONOMACO_DEMO_GOLIVE on the sellable-offer floor + idempotent offer re-publish (UAT: go-live blocked "no purchasable price")

Fixnormalize live harness trends (string[]) to canonical {trend}[] at ingest (UAT: MARKET accept blocked)

Fixf3 market gate must credit the narrative-avatar shape (UAT: valid market falsely rejected)

Fixre-resolve activeRole when a session's default org is first established (UAT: fresh-signup owner stuck role=null)

Fixdon't evict sessions with no sessionVersion claim (UAT: fresh signup nulled)

Fixcofounder phase page must not crash on a null-content deliverable (UAT)

Fixhumanize launch-capstone blockers (UAT: raw PHASE enum → friendly label)

Fixa failed/revoked publication must not block re-publishing its slug (UAT: publish 409 → 202)

Fixpublish-time funnel form action is relative (UAT: publish 500 → 202)

Fixwire custom-domain attachment at publish (lr-e4)

Fixpurge internal vocabulary from customer surfaces + finish UI consolidation (lr-f1, lr-f14)

Fixrepair the migration story — fresh journaled squash baseline (lr-e2)

July 1, 2026

Newapp-wide loading / error / not-found segments (lr-f8)

Fixredirect/URL allowlisting + token hygiene (lr-b14)

FixWave-6 review fixups — pause actually stops spend, honest completeness + sellable-offer gates (lr-d8,f3,a5,a4)

NewCI + typecheck + observability + health + secrets + test-lane + mass-assignment (lr-e1,e3,e6,e8,e10,e11,b8,b10)

Fixapply consolidated-review findings — 1 critical + ~10 high (Wave3+drizzle+Wave5)

Fixlaunch honesty + capstone + status/completeness/UX polish (lr-a4,a5,a6,d8,f2,f3,f15; partial a7,f14)

Fixsanitize community/course/event rich text at write+render; add CSP (lr-b2)

Fixglobal security headers + restricted embed postMessage origin (lr-b5)

Fixsession/account hardening + rate-limit keying (lr-b6, lr-b7)

Fixconnector idempotency-on-read + newsletter send integrity (lr-c3, lr-d7)

Fixagent executor containment — paused objectives + guarded transitions (lr-d2, lr-d3)

Fixpublished funnel converts end-to-end (lr-a1,a2,a3,a8,b4)

Fixcustomer-surface validity — campaign dates, market units, list error-states, forms a11y, SEO, offer math (lr-f4,f5,f7,f11,f12,f13)

Fixbilling/idempotency constraints + indexes (lr-c2, lr-c5, lr-c8, lr-e9)

Fixapply Waves 1-2 review findings — PKCE wiring, SVG regression, invoice tx

Fixcustomer-surface error/empty/silent-success states (lr-f6, lr-f9, lr-f10)

Fixguard reset-db against non-local databases + document backup/restore (lr-e7)

Fixagent-plane — webhook SSRF/rebinding + secret-at-rest, cancelled posts never publish (lr-d5, lr-d6)

Fixmoney path — retry-safe Stripe webhook + real Google Ads budget/structure (lr-c1, lr-c4)

Fixregister missing crons in vercel.json + inventory guard test (lr-e5)

Fixagent-plane hardening — key-rotation abort, IP allowlist, HMAC freshness, PKCE (lr-d4/d9/d10/d11)

Fixbilling integrity — atomic from-time invoicing + role-gated portal/checkout (lr-c6, lr-c7)

Fixcron/internal auth fails closed when CRON_SECRET is unset (lr-b9)

FixLR-B isolated security batch — blob XSS, subtask IDOR, booking email, embed leak

Fixclose cross-org role bleed in lr-d1 path + add review regression guards

Fixsecurity perimeter — prod-gate UAT bypass flags + derive roles server-side (lr-b1, lr-d1)

Fixsanitize benign display enums at compile boundary (a04 challenge publish)

Fixmarket degenerate-gate scales {value,unit} by unit magnitude

Fixrequire non-empty sources + structured marketSize in the market executor schema

June 30, 2026

Fixserve the entry page at the canonical funnel URL (published_url no longer 404s) (#368/#351)

Fixhumanize the billing-period enum on the funnel customer surface (F3 leak)

Fixexperiential demo polls for async narration + spawned funnel (#374)

Newharden experiential receipt to assert live artifact correctness (#374)

Newwire the funnel-type selector into the live spawn path (#370)

FixF1 — live market gate produces a real avatar narration + non-$1 sourced sizes (#369)

Newactivate domains + agent-key rotation overlap & /actions IP allowlist (#372, #373)

Newwire sandbox-publish bypass + 30-Day Payback gate into publish (#368, #371)

Fixepiphany-bridge grounds founder origin, forbids hedge meta-fills (#319/#331)

Fixwire F3 customerSurfaceGuard into the publish compile path (#324)

Newexperiential quality monitor mechanism (#319/#324 continuous tier)

Fixnarrate prompt demands the def's REAL output field (#319) — all 6 framework outputs land

Fixseed the real business name into non-IDEA phase generation (#319/#324 F4)

Fixlift the real brand name onto the brand_kit head (#319/#324 F4 interaction)

NewE1 BRAND + FUNNEL cutovers — all generation gates now framework-driven (#319)

Newrender the offer-stack letter in the OFFERS gate (#319)

NewE1 OFFERS cutover — offer-stack@v1 letter into offer.frameworkCopy (#319)

Fix#324 QA batch — F3 dev-string lint, F4 placeholder-in-READY, F6 StatCard format (4-agent workflow)

Fixdecouple the avatar run from the journey-critical reconcile (#319)

June 29, 2026

Fixbound the avatar reconcile load (#319) — in-flight guard vs poll-bridge re-entry

FixE1 avatar cutover works LIVE — narration fills the MARKET Avatar tab (#319)

NewE1 cutover — MARKET gate runs avatar-research@v1, emits the avatar narration (#319)

Fix/code-review loop — 10 correctness findings across the Phase-1 diff

Newgrowth-operator round Phase 1 — 18 sub-issues across E1-E7 (parallel workflow)

Newfree launch URL on the Vercel default deployment domain (#352)

Newrotation overlap + per-version auth predicate logic (E7 #365/#362)

Newagent-key push client to the live harness accept endpoint (E7 #364)

NewIP-allowlist containment logic for /actions (E7 #366)

New30-Day Payback verdict + overridable GO-LIVE gate logic (#341)

Newunified per-type designed page templates for 6 funnel types (#336)

Newversioned export + provenance for the framework library (#333)

FixQA F9 — Market/Plan -after capture lands on the post-accept detail (#359)

FixQA F6 — StatCard values never clip + palette labels never overlap (#357)

FixQA F3 — ban dev/env/gate strings on the customer canvas (#355)

FixQA F4 — gate readiness on real content, not field-count (#356)

Newrules-first funnel-type selector + constrained tie-break (#334)

Newsmallest-lever solver for a failing unit economy (#342)

NewBusinessUnitCase cost-per-stage cascade + unit econ (#340)

FixQA F7 — offer value-stack math never negative-by-bug (#358)

FixQA F2 — compiled funnel CSS defaults to brand orange, not indigo (#354)

Newavatar-research@v1 framework def — the Market Intelligence quality bar (#329)

Newcomplete the keystone — forms/booking/newsletter capture events (#344)

NewVercel v10/v9 project-domains connector (#349)

NewHost-header middleware routing to /f render handler (#350)

Newtwo-pass framework step runner (battery→narrate over /jobs) (#328)

June 28, 2026

NewplanFrameworkRun + feed-forward sequence runner (#327)

Newkeystone capture-event wire — publishCaptureEvent + funnel opt-in (#344)

Newversioned framework-IP registry + FrameworkDef schema (#326)

FixMESSAGE_STUDIO journey gate is the single accept control

Fixautonomous go-live readiness — wire spawned funnel steps + bind published offer version

Fixphase 409 shows the honest block reason, not 'already in progress'

Fixpoll bridge settles a permanently-404'd harness job instead of polling it forever

Fixai_build_session.created_by must be text, not uuid (FK to user.id)

FixBuildChatPanel — inline mount fetch with a mounted guard (eslint setState-in-effect)

June 27, 2026

Newresolve the two external blocks onomaco-side — keyless logo + onomaco-owned web search (#297 #298)

Fixstop Tailwind scanning docs/ — a class-like doc string broke the app CSS (#196/#214)

Newwire /jobs/{id}/stream job-status into the build chat as live progress (#305)

Newbuild-loop app layer — funnel chat-over-tickets turn/reconcile/panel (#303 #304 #305 #308)

NewCampaign Planner depth — scenario apply, scoped AI, editable schedule, channel edit/delete (#241)

Newnewsletter issue scheduling — schedule send with date/time/timezone (#283)

Newadopt the Page width-cap in the dashboard shell — kill the empty viewport (#199)

Newbuild-loop integrated cores — orchestrator + accept/reject diff + SSE progress (#303 #304 #305)

Newconnector realignment — image-gen connector + web-search decision + brand-logo wire (#309 #310 #311/#178)

Newgeneration depth — Courses + community pricing outputSchema (#316/#263 #260)

Newgeneration depth — Social/Grow/Funnel/Campaign outputSchema (#314 #315 #317 #318)

Newgeneration depth — Plan + Market outputSchema (#312/#216 #313/#219)

Newidempotent build reconcile + version snapshots/rollback (#307 #306)

Newpersist + thread harnessSessionId through job dispatch (#302)

Newblock-patch outputSchema + applier under optimistic lock (#301)

Newgeneric ai_build_session + ai_build_message tables (#299)

Newstable funnel block ids — build-loop KEYSTONE (#300)

June 25, 2026

Fixscope drizzle.config schema glob to real modules (exclude schema.*.test.ts)

Newmop-up — funnel step CRUD (#236), segment send (#282), design-system adoption sweep (#198/#200/#201/#202/#209/#212)

NewL10 backend follow-on — real uploads, segments, rich cards, freshness, seat-cap, badge counts (#276/#279/#281/#284/#291/#292/#295)

NewProduction-Readiness — fail-closed launch quality-floor + real collaboration runtime + honest demo capture (#145/#152/#153/#154/#159)

NewL10 Ops & Shell — shell IA rebuild, forms/content/projects depth, cockpit motion, billing/settings polish (#276-282/#284-295)

NewL10 Grow/CRM — inbox/reviews/affiliates/helpdesk depth, community rebuild, pipeline+schedule craft (#258/#259/#261/#262/#264-#275)

NewL10 Social — nav, composer, calendar, inbox, analytics depth (#249/#251-#257)

NewL10 Brand/Offers/Message — presentation depth + name-leak guards (#242/#243/#244/#245/#246/#247/#248)

NewL10 Funnel WYSIWYG builder — the canvas IS the editor (#226-#232/#234-#239)

NewL10 Build & Plan — kill dual-model plan collision + build-screen depth (#215/#217/#218/#220/#221/#222/#223/#224/#225)

NewL10 Systemic app-shell adoption — motion, Cmd-K, Toaster, a11y, gold (#197/#203/#205/#208/#209)

NewL10 Systemic foundation — design-system primitives + tokens (#198/#199/#202/#203/#204/#206/#207/#211)

Fiximplement GH-151 jwtCallback activeRole (cache-once) — suite now 4939/4939 (100%)

Fixclose Bundle E onomaco follow-ups — Plan 11-section export (#725) + campaign timeline persist (#736)

NewBundle E — export DocModel projections + artifact polish (#714/#715/#724/#725/#737/#736)

NewBundle D — arm dark connector executors + wire comms flows (#732/#733/#734/#735/#738/#739)

NewBundle C — offers buyable + blog safe/publishable (#712/#713/#704/#708)

NewBundle B — one canonical funnel block vocabulary, funnels render live (#701/#702/#703/#705/#706/#707)

NewBundle A — phase→renderer registry (#700/#710/#711/#720/#721/#722/#723/#730/#731)

June 24, 2026

Fixbelow-threshold IDEA accept -> clean 422; commit-then-score vague seeds

Fixreal seed-specific MARKET deliverable + harden #62 against placeholders

Fixvalue-check detects generation-failure markers, not the word "failed"

Fixdeliverable render shows content, not DB plumbing

FixresolveCanonicalArtifact returns full deliverable content, not head-only

Newautonomous spine mints a structural draft funnel for FUNNEL/CAMPAIGN

Fixnever regress an APPROVED phase in recordPhaseCompletion

Newconnect structured-output to the wire (onomaco↔Harness integration)

NewPhase 3 — DB cutover, delete duplicate reconciler + dead content paths

NewPhase 2 — rewire spine to executors + delete generic phaseRequest

NewPhase 1b — build MESSAGE + OFFERS net-new batch producers

NewPhase 1a — wire 5 existing producers as CapabilityExecutors

NewPhase 0 foundation + locked design package (one-executor-per-capability)

Fixexperiential demo infrastructure improvements (workflow-driven)

June 23, 2026

Newauto-approve + auto-forward for deliverables passing accept policy

Fixinject both overallScore and confidence for harness deliverables

Fixtemporary score injection for harness deliverables (issue #TBD)

Fixseed ingestion + accept policy for harness deliverables

Fiximplement actual score parsing in value gate (issue #640)

Fixaddress 10 code review findings (correctness, performance, cleanup)

Fixresolve all 23 production-readiness issues (seed ingestion, accept gates, RBAC, harness, design)

June 22, 2026

Fixexperiential harness regenerated over acceptable drafts → 3 avatars never accepted

Newclose cofounder accept-spine gaps + experiential-demo harness (Launch 0/12 → 9/12)

Newpopulate every UAT gallery detail screen + fix 3 latent render bugs (#139)

Fixpost-review QA — funnel bugs, command-center cockpit, density, gallery (#135-139)

June 21, 2026

Fixaddress /code-review findings (4 correctness bugs)

FixproviderStatus uses connScope so armed connectors actually show connected

Fixconnector by-id scope — api-key connect now actually arms (XOR bug)

Fixstructural a11y — name the notification bell + focusable deals board

FixWCAG a11y remediation — structural defects + brand-safe contrast (#129)

Newclose out UX/accept-flow issue program (#41-134) — audit + final gap fixes

Fixmarket competitor-analysis URL (workspaces->businesses) + VR goto load

Fixseed connector catalog + connector_capability unique key; align connectors/nav UAT

Fixgrow AI reply drafts dispatch regardless of send-connector (gate at send)

FixUAT regressions — paywall create inactive (no 500 from CHECK) + grow reply 503

Newbackend-completion — AI generate/draft routes wire the accept-flow

June 20, 2026

FixWave 9c build gate (#133) — next build + tsc + eslint + 2317 tests green

NewWave 9b — accept-moment motion (#51) + honesty/anti-fabrication sweep (#132)

NewWave 9a — motion system + dark mode + a11y primitives (#128,#131,#129)

NewWave 8 — Launch capstone + command center + journey strip (#47,#49,#50)

NewWave 7 — Operate views (#119-127)

NewWave 6 — Sell/Grow views (#104-118)

NewWave 5 — Build/Launch views (#91-103)

NewWave 4b — build-domain read endpoints (lights up Validate->Plan spine)

NewWave 4 — Validate + Plan/Brand views (#78-90)

NewWave 3 — feed-forward drafts/spawns (#43-46)

NewWave 2b — Stripe/payment, harness assets, analytics ingest, cron (#53,#63-68)

NewWave 2a — 7 provider connectors armed + integrations catalog + web-research (#54-62)

NewWave 1 — accept-flow spine (#42, #48) + connector connect/status infra (#52)

NewWave 0 — data-model foundation (#69–#77) + AcceptBar primitive (#41)

NewUI rebrand — orange/navy token system, Roboto, components/ui library + migrated views

Fixmanual UAT polish — Composer nav route + 33 missing page titles

Fix~24 product bugs surfaced by the exhaustive UAT suite

June 19, 2026

FixUAT baseline — eliminate 25 stubs, reconcile schema drift, fix 2 real bugs

Newcomplete Harness integration + close all 40 gaps (100% test coverage)

Newadd CORS origin validation utility

Newimplement funnel analytics aggregation (issue #40)

Newimplement funnel publish/unpublish workflow (issue #39)

Newadd social post publish logs API endpoint

Newmigrate rate limiting to Redis/Upstash for multi-instance safety

Newactivate UAT auth middleware in middleware.ts

Newimplement Funnel Builder block system (issue #35)

Newrestore idea validation dispatch endpoint (#9)

Newimplement KMS envelope encryption for connection secrets

Newcomplete Message Studio AI copy generation with variant support

Newimplement idempotency enforcement middleware

Newimplement Direction B ACT actions API with safety gates (#14)

Newimplement AI reply generation via Harness (issue #28)

Newadd social media analytics infrastructure for issue #15

Newrestore agent service credentials endpoints

Newimplement SSRF screening for user-provided URLs

Fiximplement signup endpoint with email verification

June 18, 2026

Newcomplete + prove live Direction B cross-plane trace and Direction A webhook-primary against the deployed Harness

Newwire HR-1 callback webhook on dispatch + validate live integration against deployed Harness

June 17, 2026

Newimplement all 11 ON tasks of the Harness Integration Plan (Part III)

June 16, 2026

Newwire all async AI surfaces to the Harness via a kind-routed callback

Newlive Harness integration — generative surfaces now produce real AI output

Fixclose 13 P2 compliance gaps + migration 0009; final compliance report

Fixclose 32 P1 compliance gaps across all 5 areas + migration 0008

Fixclose all 14 P0 compliance gaps (security, containment, monetization, tenancy)

Fixevent bridge ON CONFLICT must match the partial dedupe index (UAT-found 500)

June 15, 2026

FixUAT-found UI<->API path bugs + clean console

Newdashboard UIs for all greenfield verticals + sidebar nav

NewPhases 7-8 — Grow build-out, Money hardening, agent SENSE/ACT, Journeys

NewPhases 3-6 backends — Build, Brand/Offer, Social, Launch, Pipelines

Newschema for all greenfield verticals (Build, Brand, Launch, Social, Pipelines, Grow, Money, Journeys)

NewPhase 2 — AI Co-Founder framework, journey state, deliverables

NewPhase 1 foundation — 3-level tenancy, AI dispatch, agent containment, connector core

April 1, 2026

Newadd authenticated community embed with auto-provisioning

March 3, 2026

Fixchange support email from hello@ to support@gnosova.com

Newembed Onomaco dashboard and projects in Gnosova portal with per-org SSO

Newadd public changelog page to all 3 sites

March 2, 2026

Newadd community embed support and seed script for Gnosova and PauseMeAI

Newfix notification dropdown clipping and add cross-org CRUD page

March 1, 2026

Fixalign test expectations with actual route behavior

Newembed Onomaco blogs and communities in Gnosova and PauseMeAI

Fixadd loading state to blog embed listing to prevent infinite Loading

Newadd blog module with embeddable posts, admin dashboard, and publish workflow

February 27, 2026

Newadd cross-module automation triggers and shared action functions

Fixadd contactId to newsletter subscribers API response

Newadd newsletter module with signup, billing, and email sending

Fixinvoice detail display - replaceAll for billing type, format amount decimals

Fixreplace transaction with sequential queries for neon-http driver

Fixadd error handling to from-time invoice endpoint for debugging

Newadd time reporting module with project and invoice integration

February 18, 2026

Fixalign event client types with API field names

Fixalign event form field names with API (startsAt→startTime, endsAt→endTime)

Fixpreserve modules state when saving course settings

Newadd community platform with spaces, courses, events, paywalls, and embeddable widgets

February 17, 2026

Newadd forms, quizzes, and embeddable widget system for lead generation

Newadd full CRUD for all Onomaco dashboard entities

Newadd inline edit for booking types

Fixresolve timezone offset bug in booking slots and calendar events

Fixawait calendar + email operations instead of fire-and-forget

Fixbooking API crash — neon-http driver does not support transactions

Fixadd error handling to listGoogleCalendars to prevent 500 on integrations page

Newadd self-service Google Calendar integrations page

February 16, 2026

Newupgrade Onomaco scheduling to Calendly parity

Newadd Sentry error monitoring to all 3 apps

February 15, 2026

Fixremove Apple OAuth, configure Resend sending domains

February 11, 2026

Newadd Google + Apple OAuth login to all 3 apps

February 9, 2026

Fixsign-out CSRF and SDK lazy-init crash bugs across all 3 apps