Changelog

# Changelog

## 0.4.14 — 2026-10-20

- Accept an empty hosted-article delta when an edition links to original external reports. Editions, media, transcripts and HTML still pass all existing validation before staging or publication.
- Cover external-report editions and continued HTML/audio rejection with regression checks.

## 0.4.13 — 2026-10-20

- Register the independent maintenance URL and dated accepted fallback evidence in permanent-host release descriptors for Operations probes.
- Keep fallback evidence separate from whole-VPS recovery, which remains open. Temporary-host packages retain their existing descriptors.

## 0.4.12 — 2026-10-20

- Prepare the fixed permanent Studio, publishing and protected-preview origins together, retaining exact-origin authentication and a root-only configuration rollback snapshot. The migration tool does not change DNS, enable publication or copy workspace data.
- Redirect old staff GET/HEAD links to their matching canonical address; reject old-origin credential POSTs. Retain the prior certificate and configuration for rollback.
- Package canonical managed descriptors only when explicitly selected for the reviewed permanent-host deployment.

## 0.4.11 — 2026-10-20

- Normalize the leading slash captured by the IONOS Windows redirect extension so HTTP redirects use the exact canonical HTTPS path.

## 0.4.10 — 20 October 2026

- Generate independent-maintenance security headers and the IONOS-supported HTTP-to-HTTPS redirect while preserving provider IIS defaults.
- Require the maintenance builder itself to match the accepted package source. Existing server configuration stays outside Git and receives a verified backup before publication.

## 0.4.9 — 19 October 2026

- Prepare a separately hosted Studio maintenance page with bounded, credential-free positive-health checks, manual retry and a non-redirecting preview mode.
- Permit health reads only from the exact Studio maintenance origin on the two anonymous health paths. Private routes and staff authentication retain their existing boundaries.
- Build the maintenance artifact and its managed-site descriptor from the authoritative release version. Publication, hostname/TLS setup and traffic switching require separate acceptance evidence.

## 0.4.8 — 19 October 2026

- Document the accepted independent Studio recovery and guest reboot rehearsal, with explicit scope and remaining commissioning gates. Documentation only; deployed software is unchanged.

- Return bounded JSON errors for staff API requests rejected by session, Origin/CSRF or unavailable gateway/upstream checks. Keep browser sign-in and static maintenance pages for document routes.
- Preserve all authentication, staff attribution and proxy boundaries; never replay credential submissions. Add a real isolated Nginx fixture for accepted and rejected requests.

## 0.4.7 — 17 October 2026

- Preserve the exact Origin on staff sign-in and setup form submissions with same-origin referrer policy in both identity responses and Nginx. The preceding no-referrer policy could make browser form POST origins opaque and reject valid staff setup.
- Keep exact Origin and CSRF checks unchanged; external destinations still receive no referrer.

## 0.4.6 — 17 October 2026

- Report successful offsite completion in the managed collector's journal format after both complete encrypted cloud downloads verify. Scheduled recovery results now appear in Operations alongside the detailed readback receipts.

## 0.4.5 — 17 October 2026

- Serve the external maintenance page with HTTP 503 and retry/no-store/noindex headers when the staff session gateway is unavailable, including Nginx auth subrequest failures.

## 0.4.4 -- 16 October 2026

- Preserve the token-free loopback origin on the one-use enrollment POST. Browser testing showed that no-referrer makes cross-origin POSTs opaque and fails the exact Origin boundary; the bridge now sends only its fixed loopback origin, with no secret URL.

## 0.4.3 — 16 October 2026

- Explicitly apply narrow renderer/API directory access after creation under the worker's restrictive umask, including staged attempt and email artifact parents.
- Quarantine failed preview requests without crashing the broker. Prune terminal requests, consume completed requests without losing newer arrivals, and remove the old proxy pointer before replacing a renderer.

## 0.4.2 — 16 October 2026

- Explicitly trust only loopback Nginx's forwarded HTTPS scheme in the API and staff identity Waitress listeners. Preserve origin checks without trusting forwarded hosts or remote client identity.
- Add real Waitress HTTP tests for HTTPS health, preview/session boundaries and login; Flask test-client checks alone could not detect the production server stripping proxy headers.
- Add a one-use Windows loopback enrollment launcher with a CurrentUser-DPAPI recipient and RSA-encrypted SSH handoff. The user enters credentials/MFA only on Studio; no grant appears in a URL or tool output.

## 0.4.1 — 16 October 2026

- Wait for the API account to create its database and complete preview schema before the root worker opens it. First-start races cannot create an inaccessible root-owned job store.
- The initial 0.4.0 installation was held by managed health acceptance; its empty job database passed integrity checks. Portal/identity source and published reader content are unchanged by this startup correction.

## 0.4.0 — 16 October 2026 — prepared, not commissioned

- Prepare fixed-scope Studio runtime/configuration/source backups, consistent service quiescing, SHA256 manifests and isolated SQLite/source/secret recovery checks. Services resume before archive hashing or cloud transfers.
- Restore into a temporary directory only, with no production restore or worker/cutover command. Probe the restored API, staff identity and portal application/private boundaries using the restored software and dependencies.
- Require a fresh heartbeat from the same control-plane version for publishing health. Service installation, encrypted cloud readbacks, retention, protected browser rehearsal and Operations acceptance remain outstanding until commissioned.
- Add fixed direct-host service/Nginx installation, isolated users and secret provisioning, a public-field-only reader seed, disabled acquisition/publication startup, accepted-source packaging and a first-install withdrawal/return tool. Installation verifies pinned archives before dependency execution; staff enrollment and private draft migration remain separate.

## 0.3.0 — 16 October 2026 — prepared, not commissioned

- Recheck the Europe/London publication date, unchanged live baseline and explicit correction intent at the root promotion boundary. Future or duplicate new editions cannot reach activation.

- Add a separate individual staff identity gateway with password and TOTP enrollment, encrypted authenticator secrets, one-use recovery codes and expiring server sessions.
- Derive portal identity from a loopback gateway proof and MFA session; require exact Origin and session-bound CSRF for mutations. Account role changes revoke existing sessions and challenges.
- Prevent incomplete accounts being activated by an administrator and preserve the last active administrator.
- Add root-only initial administrator bootstrap that verifies the recipient RSA fingerprint and writes only an RSA-OAEP-SHA256 encrypted one-time grant. The user chooses password and MFA privately; no email or invitation is sent.
- Add generated-account tests for RFC 6238 vectors, one-use grants/recovery codes, MFA replay, expiry, revocation, proxy/CSRF boundaries and encrypted enrollment. Fifty-eight publishing/identity tests pass locally. Hosting and recovery acceptance remain outstanding.

## 0.2.0 — 16 October 2026 — prepared, not commissioned

- Add fixed-site worker orchestration for immutable content generations, isolated reader acceptance, managed recovery/promotion gates and separate staged/live browser verification.
- Fix relative media and story links when a dated page is copied to its email archive alias.
- Release the promotion lease while waiting for browser verification; lease final reconciliation separately, recover completed root receipts, and quarantine failed candidates without stopping other verification jobs.
- Share the manual publication lock and enforce the separate root publication interlock; rehearsals cannot activate a release.
- Bound retained uploads/jobs/preview grants and keep expired uploads charged against stored-byte limits.
- Add a read-only Linux integration tool. The accepted 0.32.0 snapshot passed the installed backup validator and isolated HTTP checks for 888 candidate recipient files; all 906 baseline files and 37 earlier dated-edition files stayed unchanged.
- Hosted login/MFA source, service provisioning, Studio runtime recovery, direct-host browser acceptance and Operations commissioning remain outstanding. This source update does not deploy Studio or change live editions.

## 0.1.0 — 16 October 2026 — preparation

- Begin a separate protected publication service; not yet deployed or connected
  to a client. Existing Daily Focus content is unchanged.

- Add scoped Bearer upload/job/status/review commands and one-use, origin-bound preview grants. The protected preview cannot access API actions or raw imported data.
- Persist idempotency, tenant ownership, revision checks, worker leases and crash reconciliation state in SQLite; consistent backup preserves committed WAL data.
- Validate content-only archives, public-field schemas, active HTML/SVG/CSS restrictions, decoded raster formats, MP3/WAV durations and spoken transcript equality.
- Preparation only: worker, managed installation/recovery and actual protected preview acceptance remain outstanding. No production endpoint or routine publication is commissioned by this change.

## Operational configuration — 20 October 2026

- Following the owner's explicit commissioning choice, enable reviewed publication in the existing API and fixed-site root worker after verified recovery. Staff must still stage, review and explicitly publish the exact candidate. Enabling the capability publishes no edition and leaves scheduled collection and email off.
- Retain private copies of the disabled configuration for rollback, verify the running API and new worker heartbeat, and preserve the accepted reader, Published snapshots and rehearsal job. This is an operational setting change; installed software versions remain unchanged.