Changelog
388releases across 7 months
Every PAPI release, cycle by cycle. Each one pushes back against project drift.
Get started freeMarch 202618 releases
- Audit all JSONB write paths for double-encoding — JSON.stringify before postgres.js insertion
- BUG: planWriteBack in data-proxy is not atomic — sequential calls race under concurrent use
- BUG: Migration file 20260328_security_hardening_rls.sql doesn't match applied state + reviews_stage_check constraint missing from migrations
- Dead code cleanup: remove use-data-url.ts, ProjectIdentityHeader, brain-reader.ts fetchBrainData
- WriteCostSnapshot never called — dead write path with working read path
- PAPI_USER_ID auto-detection during setup — prevent NULL user_id projects visible to all OAuth users
- Fix structured_data JSONB double-encoding — stored as JSON string requiring double-parse
- Bug: phase-realign auto-updater contaminates H2 phases — needs horizon-aware gating
- Setup page references private repo URL — won't work for external users
- Fix two unsuperseded North Stars in DB — only most recent should be active
- Wire doc_search into strategy review context assembly
- DB: Add review_number + review_type columns to strategy_reviews
- MCP tool: board_edit for editing backlog task fields from CLI
- Update investor one-pager traction numbers — cycles 119→138, tasks 634→current
- Fix H2 hierarchy contamination — reset premature In Progress/Done statuses on H2 stages and S5
- Copy: rewrite hero heading — specific problem statement over vague claim
- Revert: undo velocity governance copy changes on landing page
- Copy: shift positioning from context persistence to velocity governance
- Add Active Decision compliance check to papi-audit skill
- Add cockpit empty state for new projects and completed cycles
- Only show doc reference nudge when task is actually created
- User-friendly error messages in DataWarning
- Show user identity in dashboard header
- Inject relevant Active Decisions into build_execute handoff
- Rename Docs to Get Started on landing page
- Extract hardcoded Vercel URLs to env vars
- Doc registry actions param + idea tool reference nudge
- SSE refresh debounce — prevent excessive re-renders on batch operations
- Extract comment formatting helper — dedup build.ts and board.ts
- Resolve onboarding/auth bugs breaking dashboard
- Doc registry phase 3 — doc_scan tool + dashboard data + plans directory
- Add retry on display_id collision in dashboard review submit
- Exclude scripts/ from tsconfig to fix Vercel type-check
- Only build prompts entry on Vercel — skip full server bundle
- Split tsup config so prompts entry builds without adapter deps
- Add server package build to Vercel build pipeline
- Add prompts subpath export to MCP server package
- Add display_id to dashboard review submission
- Wire SSE into cockpit for instant dashboard refresh
- Surface task comments in build_list and board_view output
- Add request-scoped memoization to dashboard data-provider
- Fix N+1 queries in loadProjectsFromDb and completeBuild over-fetch
- Protect Deferred phases from auto-propagation regression
- Tighten mapSupabaseResult — require mapper, restore length guard
- Idea tool similarity gate — block creation and require user confirmation
- Enforce full-depth strategy review output with two-phase delivery
- Prevent phase auto-update from regressing manually-set statuses
- Add project bootstrap from portfolio page
- Add cockpit polling and focus revalidation
- Replace allowlist gate with email-verified check
- Secure multi-tenant write paths
- Skip .papi commits when directory is gitignored
- API key management UI — generate, view, and revoke keys
- Email signup + sign-in with confirmation flow
- Provider-aware user_profiles trigger for email auth
- Provider-aware auth — support email alongside GitHub OAuth
- Preserve Supabase session cookies through middleware
- Separate auth layout — login/onboard without app nav
- Redirect unauthenticated root URL to landing page
- Personalised MCP config on setup page for logged-in users
- Setup verification endpoint + dashboard status indicator
- Onboarding flow audit & redesign document
- Security: remove hardcoded proxy key and shared-secret auth from data-proxy
- Landing page branding: Visual refresh with improved imagery and brand identity
- Landing page messaging: Sharpen value proposition and above-the-fold clarity
- Dashboard API: decision_events endpoint for AD timeline and relationship views
- Surface pending AD state on dashboard and flag in planner
- Fix pre-existing next build type error in stress test createTask call
- Setup page: add orientation context, completion state, error guidance
- Strategy page: decision staleness signals, relationships, connected narrative across tabs
- Doc Registry Phase 1: Foundation — Schema, Registry Service, Auto-Detection
- Complete taxonomy migration: rename Sprint* interfaces/types in pg-papi-adapter.ts and data-proxy
- Strategy review apply persistence — retry lost reviews next session
- Strategy review: replace cycle-count staleness with drift-based staleness for briefs, ADs, and North Star
- Strategy review: link recommendations to action items with status tracking
- Track build iteration count (pushbacks before review) as rework metric
- Strategy review: include non-task git commits in context to catch ad-hoc work
- Orient: include npm published version vs local version check — flag dist-tag drift
- Fix process.env.PAPI_PROJECT_DIR mutation race condition in API routes
- Npm security audit — verify package config, 2FA, access controls
- Validate /api/intelligence model and maxTokens to prevent cost abuse
- Add PAPI_LIGHT_MODE config for branchless builds
- Create /security-audit skill for codebase-wide reviews
- Fix planner cycle sizing, rec expiry, scope pre-check
- Add block action to board_deprioritise + planner blocked-task instructions
- Add PRE-BUILD VERIFICATION to BUILD HANDOFFs
- Drop -alpha suffix from npm package versions so latest dist-tag advances