Historial de cambios

Release v8.31.1 (#2598)

• Pin the expert-intake route's AI boundary so a direct model call cannot bypass the orchestrator's capability gate, prompt sanitisation, audit chain and kill-switch.

Release v8.30.96 (#3443)

• Complete the API error-leak sweep so no route returns raw Postgres error text to clients, preserving the four classified exceptions and both control-flow status branches.

Release v8.30.91 (#3430)

• Admin API routes no longer return raw Postgres error text to the client; the detail is logged server-side and callers get a per-operation error code.

Release v8.30.86 (#3430)

• Class-action API routes no longer return raw Postgres error text to the client, while preserving the 404 that the detail route derives from the error.

Release v8.30.81 (#3430)

• Settings API routes no longer return raw Postgres error text to the client; the detail is logged server-side and callers get a stable error code.

Release v8.30.76 (#2903)

• Bump @supabase/ssr to 0.12, @anthropic-ai/sdk to 0.112 and @aws-sdk/client-kms to 3.1090, and type the browser Supabase client explicitly so auth callbacks regain real types.

Release v8.30.74 (#3428)

• Wire the credential-free table-reference check into CI so it actually gates, alongside the schema drift check it complements.

Release v8.30.69 (#3424, #3428)

• Migrate the PR auto-labeler config to the actions/labeler v5 format so the label check stops failing on every pull request.
• Add a credential-free CI gate that fails when application code references a database table absent from the committed schema snapshot.

Release v8.30.63 (#3426)

• The governance seating console now reports unreadable tables instead of rendering an empty register as if it were settled, and marketplace conversation routes no longer return raw Postgres errors to the client.

Release v8.30.58 (#3421)

• Fix the public expert directory serving fabricated sample profiles as real professionals when the catalogue could not be read; a nonexistent expert profile now returns 404 instead of 200.

Release v8.30.53 (#3404)

• Generated Supabase Database types are now committed, so schema drift can be caught by the compiler.

Release v8.30.51 (#2593, #3320)

• Privileged admin, control-plane, and danger-zone server gates can now require a recently verified TOTP or security-key factor. Enforcement is fail-closed and enrollment-first behind ADMIN_REQUIRE_AAL2, with localized step-up and a documented operator recovery path.
• The Revenue department now shows a live revenue snapshot from recorded paid orders.

Release v8.30.36 (#2900, #2901)

• GitHub Actions updated — setup-node v7 and labeler v6.

Release v8.30.34 (#3390, #3392, #3399)

• ADR-0032 records the multi-platform client architecture (docs only).
• Feature/platform matrix for the multi-platform program (docs only).
• Batch PRs targeting integration branches get a cheap CI gate instead of the full suite.
• Litigation records registries — per-tab counts, cross-registry search, matter filter, matter deep-links into the workspace, column sorting, status-tinted badges, locale-aware dates, CSV export, real loading state and keyboard-accessible tabs.

Release v8.30.24 (#2904)

• Development dependencies updated, including the postcss bump that clears the repo-wide audit gate.

Release v8.30.22 (#0)

• Prepare a complaint for illegal practice of law and have it transmitted to the Barreau du Québec on your written mandate — you keep a copy and a transmission receipt (feature is off until enabled).

Release v8.30.12 (#3380, #3381)

• Home dashboard KPI tiles are now clickable — Matters, Deadlines and Overdue open the items behind the number, and the fourth tile is labelled "Documents" instead of misreporting a document count as evidence.
• Evidence is now a designation a person applies to a record in a matter, not an automatic consequence of uploading a file — Documents and Evidence are separate counts with their own filterable index pages.

Release v8.29.77 (#3380, #3381)

• Home dashboard KPI tiles are now clickable — Matters, Deadlines and Overdue open the items behind the number, and the fourth tile is labelled "Documents" instead of misreporting a document count as evidence.

Release v8.29.67 (#3256)

• Added the HTDA July 31 auction control panel to the admin Command Center — reads and flips the public holdtdaccountable.com "sale suspended" toggle from the cockpit via a new admin-gated, audit-logged proxy route whose write token stays server-side (fail-closed 503 until both secrets are configured); suspend asks for confirmation before publishing, restore is the truthful default.

Release v8.29.57 (#2931)

• Landed the Containment Board's atomic write API in-repo — set_kill_state, a service-role-only SECURITY DEFINER RPC that floor-validates the requested state, records arm intent without mutating state, and on commit/revert flips kill_switch_state and appends a hash-chained kill_switch_event in one transaction (the Phase-1 chain trigger still owns sequence/prev_hash/entry_hash, so the RPC cannot forge ledger entries). Already applied to production via the allowlisted apply_migration path and exercised live: arm → commit → revert, with a floored KILLED request correctly rejected.

Release v8.29.32 (#1702)

• Surfaced the acquisition→conversion funnel (Legal-intent → signup → activation → upgrade-intent → conversion) inside the admin Command Center's Growth & Revenue view — mounting the existing self-fetching ConversionFunnel component verbatim via an optional prop, so the standalone /admin/conversion-funnel page and the Workspace caller are unchanged and no new backend or dictionary surface is introduced.

Release v8.29.22 (#0, #3143, #3218)

• PRD-2026-0128 (E2) — versioned advocacy disclaimers and acknowledgements. The five required user confirmations (factual accuracy; no legal advice / no guaranteed coverage or outcome; prohibited content — unsupported allegations, unlawful, doxxing, threats, unnecessary PII; content may be moderated/suspended/corrected/removed; journalist distribution is outreach, not endorsement) are seeded as immutable, per-locale rows in the existing disclosure_versions catalog and captured as evidence in a new owner-scoped advocacy_acknowledgements table (service-role write, Loi 25, keyed-hashed IP/UA only when enabled). A lib catalog renders the copy (object-keyed en/fr), and helpers record acknowledgements and verify a user currently holds a valid acknowledgement of the active version of every key — so revising the wording (bump the version) forces re-acknowledgement without redesigning the product. Registered in the RLS and data-subject registries. No gate is activated.
• PRD-2026-0128 (E1, safety spine) — the paid advocacy product's release stopgates, built on the Release Orchestration Kernel instead of a parallel system. Adds an `advocacy` ROK flag subsystem with four founder-controlled gates (master, public publishing, journalist distribution, custom domain), all default OFF and fail closed. Enforcement (guards.assertAdvocacyGate) is hierarchical (sub-gates require the master) with a blunt-lever floor: the global kill switch and EMERGENCY_LOCKDOWN block every gate instantly, and — unlike Stripe — the fail-open ROK-enforcement escape hatch never opens an advocacy gate. Flipping a gate is founder-only (new capability advocacy.release.manage, enforced at the control-plane API on top of the ops-admin gate) and audited on the append-only system_control_events ledger (actor/timestamp/prior/new/reason). No gate is activated — every gate is seeded off; nothing goes live without a separate recorded founder decision.
• ADR-0022 (never persist a machine inference about a person) is ratified — counsel signed off, and the rule is now a binding platform invariant (docs only).
• Data layer only — add marketplace_order_refunds + marketplace_order_disputes (Stripe refund/chargeback records, idempotent on the Stripe object id, owner-read/admin-write RLS) plus typed upsert builders. Third slice of the #3077 rebuild, hardened by an adversarial Stripe review; inert until the webhook follow-up wires it.
• Admin QA-audit and activation-lock reports render again in the Command Center. The global X-Frame-Options: DENY and the enforced CSP frame-ancestors 'none' blocked the same-origin report iframes ("refused to connect"); relaxed to SAMEORIGIN / frame-ancestors 'self', which still blocks cross-origin clickjacking while allowing the app's own same-origin embeds.

Release v8.28.86 (#2670)

• Commissioners for oaths — a deterministic "Request a commissioner" form on the directory and listing pages captures a service request with source attribution, and every commissioner page now states plainly that this is an attestation service, not legal advice.

Release v8.28.76 (#3371)

• Unblocked CI's dependency-audit gate — bumped postcss 8.5.16 → 8.5.23 (direct dep and tree-wide override in lockstep) and brace-expansion in-range, clearing two freshly published high-severity advisories (GHSA-r28c-9q8g-f849 path traversal, GHSA-mh99-v99m-4gvg DoS) that were failing the build-and-test job on every pull request before tests could even run.

Release v8.28.74 (#2614, #3279, #3334, #3338)

• Stability/ops/UX batch — verified the QC dictionary's judge911 brand-leak invariant is green (adminMarketPage's earlier fix already landed), taught the post-deploy Fly verifier to settle-poll through a Machine whose health check still reads "warning" right after a canary swap instead of false-reding a shipped deploy, surfaced the bailiff order's quoted fee amount on the customer-facing status timeline, and formalized ADR-0030 (CLI Access Boundary) — correcting stray "ADR-0023" citations in the CLI's own code to the number this decision actually landed under.

Release v8.28.49 (#3286, #3292, #3296)

• Go Public safe-MVP — the dark public campaign page (structural allegation/right-of-reply/neutrality chrome) and the env-priced $5 hosted-page checkout SKU, both fail-closed behind the regulated-surface kill switch.

Release v8.28.24 (#3360)

• Rebuild the /admin home as the Command Center front door — an institutional table of contents over all 8 chapters and 43 departments with an honest integration-status summary (no fabricated metrics).

Release v8.28.19 (#3336)

• Command Center gets an "institutional book" visual system — deep-ink operator shell, warm paper working surfaces, muted-brass rules and chapter folios, a book serif for headings, scoped to /admin only so the public site is unchanged.

Release v8.28.14 (#3356)

• Fix a red main — allow the admin-gated Command Center market dashboard to name the juge.ca + judge911 portfolio it measures, unblocking every PR's build.

Release v8.28.9 (#3327)

• Command Center gains a Market & Penetration dashboard — portfolio TAM/SAM/SOM against live funnel, campaign, segment and trend metrics, with an editable sourced market model.