Changelog

Every change we ship, in plain words, newest first.

Earlier release notes

Before the automatic feed above, release notes were written by hand. They are kept here for reference.

2026.09.22 — Documentation rebuilt at orkosi.com/docs

Added

  • New guides: deploy guide, custom domains, database, billing and credits, templates and Telegram operations, alongside getting started, the chat assistant, platform architecture and the admin guide.
  • API reference generated from the OpenAPI specification on every build: one page per resource, authentication, quick start, conventions, rate limits and webhooks.
  • Search across guides, sections and every API endpoint (⌘K).

Changed

  • The documentation is part of the Orkosi app at orkosi.com/docs, with the platform's branding, light and dark mode and the shared public header and footer. docs.orkosi.com redirects there.
  • Guides are written in Markdown inside the repository; adding a page is adding a file.

2026.09.20 — Public documentation, support centre and social preview

New /docs and /support surfaces with an API reference generated from the route registry, and a refreshed Open Graph image.

Added

  • Documentation hub: getting started, platform architecture, admin guide, API reference and changelog.
  • API reference generated from the route registry, with search, method and public filters.
  • Support centre at /support with searchable FAQ, troubleshooting guides, contact channels and response-time commitments.
  • Open Graph and Twitter card image (1200 × 630) with absolute URLs in the page metadata.

Changed

  • Legacy docs landing, hand-written API docs, public support and public changelog pages replaced by the new hub.

2026.09.20 — Boot, CI and dependency fixes

Second and third remediation passes after the codebase audit.

Added

  • Generated API route inventory with a CI freshness check.
  • Migration runner --check gate: every pending migration is dry-run in a transaction before boot.
  • Documentation link checker and tracked-but-ignored file guard in CI.

Changed

  • One URL prefix per mount file; the app no longer mounts routes directly.
  • All application SQL goes through the RLS-aware adapter; the raw pool is only used inside the database layer.
  • Single design-token file for the frontend; dead styles and fonts removed.
  • Canonical systemd unit and nginx header snippet; build output untracked.
  • Unused and duplicated packages removed; lockfile regenerated.

Fixed

  • Schedulers subsystem and nine migrations that failed at boot.
  • CI timeouts raised to 90 minutes; runtime dependencies declared correctly.
  • Docker image build: nginx rejected its config because of a duplicate server_tokens directive.
  • tenant_monthly_costs table shape now matches its three writers.
  • Dispatcher crash loop root cause, restart back-off and a task-logs tenant type bug.
  • Public allowlist tightened, guard bypasses closed and /metrics made private.

2026.09.19 — Security and architecture remediation

Five-phase remediation following the 2026-09-19 codebase audit.

Added

  • Secrets moved out of git into AWS Secrets Manager, loaded at service start.
  • README, convention docs and JSDoc coverage.

Changed

  • Health probe, TLS guard and dependency fixes; the schema-migrations tracking column restored.
  • Verified-dead code removed and orphan migrations archived.

Fixed

  • Tenant isolation bypass, a remote code execution vector, webhook forgery, a rate-limiter bypass and an XSS issue.

2026.09.18 — Entity consolidation and CI stability

Legacy company and organisation tables consolidated into tenants; test suite stabilised.

Added

  • Secrets architecture documentation.

Changed

  • Company and organisation member references consolidated into tenant members across production code.
  • SPA fallback serves index.html for every non-API route so deep links work.
  • Auto-deploy installs dependencies before the syntax check and verifies them.

Fixed

  • Ten wrong-depth require() paths in libraries and hooks.
  • Test suite failures reduced from 78 to 4 by fixing table names and test categorisation.

2026.09.15 — Database-driven build prompt rules

Prompt construction for worker builds is configured per platform and per product.

Added

  • Build prompt rules with platform and product scopes, output-type filtering and priority ordering.
  • Admin API and UI for build prompt rules, and per-product rules.
  • Prompt size logging with a configurable cap.

Changed

  • Architect and research phases skipped for infrastructure and configuration tasks.
  • Reference tasks filtered by output type for more relevant context.

Fixed

  • Guard policy race: write restrictions now reach the builder.
  • Git clone cache permissions for worker containers; forced rebuild after a review rejection.
  • Benchmark tasks excluded from autopilot alerts and blocked-task scans.

2026.09.14 — Pipeline tier rename

Worker tiers renamed to a neutral progression: bicycle, turbo, rocket, spaceship.

Added

  • Per-tier margin configuration in system settings.

Changed

  • Legacy tier names removed from system configuration, tasks and products.
  • Model router, dispatcher and worker entrypoint updated to the new tier names.

This page as Markdown: /docs/changelog.md. All documentation in one file: /llms-full.txt.