# Changelog ## v0.1.0-preview.25 — 2026-09-05 - Add optional, credential-free user and organization directory readers for application-authorized instance administration. They include inactive/pending users and personal/archived organizations independently of membership. - Bound literal searches and stable-ID pagination to at most 200 returned records. Queries do not load passwords, sessions, recovery material, invitations or role grants; they grant no authority. Applications must authorize each read. - Cover pagination, renamed records, literal SQL/wildcard input, Unicode text, invalid bounds and cancellation. Schema 10 and existing repository contracts remain unchanged; source exports include the new optional interfaces/readers. ## v0.1.0-preview.24 — 2026-09-05 - Add explicit owner-managed profile and optimistic membership operations. Current direct ownership is checked inside the SQLite write transaction even when the target is an ordinary member. Active account/membership, non-personal organization, last-owner, optimistic state, and atomic audit requirements remain intact. Existing delegated-administrator APIs retain their behavior. - Require `OwnerManagedRepository` support without a preflight-only fallback. No schema migration is added; schema 10 remains current. - Test revoked, narrowed, suspended, removed and incomplete actor authority, archived/personal organizations, stale and concurrent submissions, and rollback of profile, membership, team, role and invitation effects after audit failure. ## v0.1.0-preview.23 — 2026-09-05 - Add atomic direct organization role sets with optimistic binding IDs, current direct-owner authorization, last-owner protection, and a single audit. Roles may be combined without changing narrower or team grants. - Add bounded multiple-role invitations and opt-in owner-managed invitation policy. Persist the required grantor authority and recheck it at acceptance, together with active, fully registered users and recipient email. Suspended members cannot reactivate themselves by accepting an older invitation. - Invitations enroll new members rather than adding permissions to existing members. Membership removal revokes pending invitations for that recipient in the same transaction, preventing an older offer from restoring access. - Add SQLite schema 10 for invitation role sets and stored owner authority. Legacy single-role data remains readable after explicit migration; older schema-9 applications are not approved writers of the migrated database. Custom repositories must implement the role-set extensions before exposing these operations; there is no non-atomic fallback. - Include the owned-organization implementation and tests in the public-source export, and compile the exported tree to catch incomplete source distributions. - Cover competing changes and invitation acceptance, failure rollback, stale owners, unsupported adapters, and migration of legacy invitations. ## v0.1.0-preview.22 — 2026-09-04 - Add `organizations.CreateOwnedOrganization` for atomic creation of an existing user's organization, initial membership, direct configured owner role, and correlated organization/access audits. - Require an active, fully registered owner and a pre-seeded role inside the SQLite transaction. Missing storage support fails without a non-atomic fallback. - Preserve the older membership-only creation API and schema version 9. Customer and merchant permissions remain application-owned, with no commerce dependency. - Exercise failure at every write stage, concurrent duplicate creation, scoped access, restart recovery, last-owner protection, and mismatched authority/audits. ## v0.1.0-preview.21 — 2026-09-04 - Derive the registered credential algorithm from the verified COSE public key embedded in authenticator data instead of the optional browser `publicKeyAlgorithm` convenience member. - Preserve the ES256-only policy while accepting standards-compliant response serializers that omit redundant response conveniences, including the Bitwarden/Vaultwarden passkey flow exercised through Gamertan. - Add regression coverage for an ES256 credential whose convenience algorithm is absent, plus malformed and non-ES256 credential rejection. ## v0.1.0-preview.20 — 2026-09-04 - Extend the direct-owner transaction boundary to invitations. Creating or revoking an invitation that grants the configured owner role now requires the actor to remain an active direct owner after the SQLite write lock is acquired. - Preserve application-owned permission policy for ordinary invitations while preventing a broad access-management role, stale ceremony, or alternate repository call from creating or cancelling owner access. - Pass the configured owner role explicitly through invitation repository mutations so non-SQLite adapters cannot silently omit the invariant. ## v0.1.0-preview.19 — 2026-09-04 - Require a current active direct owner for every direct-role transition to or from the configured owner role. The SQLite adapter rechecks that authority after acquiring its write lock, preventing a role manager from promoting itself or changing an owner through a stale application authorization. - Apply the same transactional owner-authority boundary to membership suspension, reactivation, and removal, including the legacy lifecycle methods. Non-owner administrators may still manage non-owner members while last-owner protection remains a separate invariant. - Expose stable owner-authority errors so applications can distinguish an authorization drift conflict from malformed input or storage failure. ## v0.1.0-preview.18 — 2026-09-04 - Add owner-assisted account recovery for a documented human-review path when normal password, passkey, and recovery-code authentication is unavailable. Issuance requires an active direct organization owner and returns a bounded, single-use, 15-minute secret while persisting and auditing only its digest. - Invalidate the recovered member's existing password, passkeys, recovery codes, sessions, ceremonies, and older recovery grants when the reviewed enrollment is issued. Completion atomically installs one replacement password, passkey, and recovery-code set without issuing a normal session. - Keep identity and organization-visible recovery audits in the same SQLite transactions as their credential changes, and document the application boundary for fresh passkey authorization, secret-fragment delivery, and human evidence review. ## v0.1.0-preview.17 — 2026-09-04 - Add optimistic organization-membership suspension, reactivation, and removal for fresh-authentication administration flows. The exact displayed membership state is rechecked after acquiring the SQLite write lock, so a concurrent or stale ceremony fails without changing access or writing an audit event. - Keep membership lifecycle consequences transactional: suspension removes team membership, removal also revokes direct bindings, reactivation does not silently restore former teams, and every successful change appends its organization-visible audit before commit. - Strengthen last-owner protection to require another active direct owner whose platform account is also active. Existing storage adapters retain the legacy interface; security-sensitive applications fail closed unless their repository implements the optimistic lifecycle extension. ## v0.1.0-preview.16 — 2026-09-03 - Add bounded organization-member and direct user-role listings for application-owned access administration pages. Direct listings deliberately exclude team and narrower resource grants rather than flattening distinct authority into one apparent role. - Add atomic direct-role replacement with exact expected-binding checks, transactional access audit, active-member validation, and final active direct-owner protection. SQLite serializes competing replacements so stale administration fails with a stable conflict instead of partially applying. - Record the Gamertan administration dogfood boundary: applications authorize the route and fresh passkey assertion, while Foundations owns the reusable storage transaction and invariants. ## v0.1.0-preview.15 — 2026-09-03 - Permit applications to opt into an exact non-default HTTPS WebAuthn origin port for `localhost` and reserved `.test` relying-party IDs. The configured origin remains exact, production origins remain portless by default, and malformed, default, non-canonical, zero, or out-of-range ports fail closed. - Record the Gamertan local-Caddy dogfood pressure that required this explicit development boundary without weakening cross-origin ceremony rejection. ## v0.1.0-preview.14 — 2026-09-03 - Reject header-only, truncated, and structurally invalid PDF uploads in the bounded media preparer. Accepted attachments now require a supported PDF version, terminal EOF marker, numeric in-range `startxref`, and either a traditional xref/trailer or xref-stream object at the declared offset. - Keep PDF handling storage-neutral and non-rendering: applications still own authorization, reference tracking, attachment disposition, and lifecycle. ## v0.1.0-preview.13 — 2026-09-03 - Complete the password-plus-recovery-code flow with a short-lived restricted grant bound into a replacement-passkey ceremony. Completion atomically consumes the grant, stores the verified passkey, replaces every recovery code, revokes any intervening sessions and ceremonies, and records both audits without issuing a normal session. - Keep failed completion retryable until grant expiry: a duplicate credential or other transaction failure rolls back grant consumption and recovery-code replacement, while a mismatched WebAuthn binding consumes only the affected ceremony. ## v0.1.0-preview.12 — 2026-09-03 - Add a root-local bootstrap transaction that creates the first passkey-only application owner, non-personal organization, active membership, direct owner binding, one-time enrollment digest, and secret-free audit records atomically. - Fail closed and roll back the entire bootstrap when the application has not seeded the configured owner role. The raw enrollment token is returned only after commit and never enters repository state or audit records. ## v0.1.0-preview.11 — 2026-09-03 - Add expected-user completion for authenticated self-service passkey enrollment. A mismatched ceremony is consumed and fails before credential persistence, closing an authorization seam found while dogfooding Gamertan's account security page. ## v0.1.0-preview.10 — 2026-09-03 - Add atomic public-account registration with required canonical email, password authentication, printable recovery codes, a personal organization, direct owner access, and an optional initial passkey. Pending registrations cannot authenticate, and abandoned drafts expire without reserving identity fields indefinitely. - Add password verification without session issuance plus operation-bound WebAuthn completion hooks, allowing applications to require fresh passkeys for sensitive actions without imposing passkeys on ordinary customer use. - Add digest-only recovery-code persistence and short-lived, single-use recovery grants that consume a code and revoke existing sessions atomically. - Add bounded raster/PDF media preparation and a hardened content-addressed local filesystem adapter with atomic writes, private modes, and symlink rejection. - Add explicit SQLite open-without-migration and schema-requirement APIs while preserving the historical migrating `Open` behavior for existing adopters. - Record application dogfood findings and the independent future commerce module boundary. ## v0.1.0-preview.9 — 2026-09-03 - Add a documented root package and executable composition example so the module landing page presents its purpose, package-selection guidance, security model, and `net/http` integration rather than only a directory index. - Add the repository's default MPL-2.0 licence at the conventional root path so Go package tooling can identify the library licence while preserving the existing file-level exceptions for starters and operational machinery. - Rework the public README around progressive adoption, explicit design promises, package selection, assurance gates, and canonical project links. ## v0.1.0-preview.8 — 2026-08-28 - Preserve `http.Hijacker` through the request-evidence middleware so audited, authenticated WebSocket and other HTTP upgrade handlers can operate without bypassing request logging. Successful upgrades are recorded as HTTP 101; upgraded-protocol bytes remain outside HTTP body-byte accounting. - Add revisioned active/archived lifecycles for organizations and teams, invitation listing and revocation, membership suspension/removal, team-member removal, and transactional organization-visible audit events. - Make archived organizations and teams ineffective during authorization and preserve the final active direct owner during membership changes. - Allow invitations to carry one bounded direct role and reviewed team memberships, applied atomically with single-use acceptance. - Add an atomic password-to-passkey migration ceremony that stores the first passkey, retires the password credential, revokes all sessions, and records the migration audit event in one transaction. ## v0.1.0-preview.6 — 2026-08-24 - Add an explicit mode-`0640` JSONL option for applications that authorize one narrowly scoped collector group, while keeping private mode `0600` as the default and rejecting permissive modes. - Document the setgid-directory ownership boundary for Observatory-style collection without granting the collector broader application access. - Make vendored dependency and public-snapshot verification portable across the maintained Linux gate and native macOS development environments. - Keep Previews 1–5 immutable; applications select Preview 6 explicitly when adopting collector-readable request evidence. ## v0.1.0-preview.5 — 2026-08-21 - Add storage-neutral passkey registration, discoverable login, and operation-bound fresh assertions without adding self-registration, password fallback, TOTP, email recovery, or application-owned routes. - Require exact HTTPS relying-party origins, user verification, discoverable credentials, no attestation conveyance, and an initial ES256-only algorithm policy. - Add transactional SQLite credential, ceremony, enrollment, recovery, and last-credential protections with atomic single-use consumption. - Add a neutral session-issuance boundary for independently verified credentials while retaining existing password behavior. - Pin WebAuthn protocol verification to `github.com/go-webauthn/webauthn` `v0.17.1` and record its source identity, module checksums, licence, and transitive security boundary. - Add self-service passkey enrollment and removal primitives with fresh assertion, session revocation, and last-credential protection. - Keep Previews 1–4 immutable; applications select Preview 5 explicitly when adopting the passkey boundary. ## v0.1.0-preview.4 — 2026-08-18 - Add an explicit local-administrator password recovery operation without adding a public recovery endpoint or network protocol. - Atomically install a one-time Argon2id credential, restore mandatory password rotation, revoke every session, and append a secret-free audit event. - Prove transaction rollback when the audit event cannot commit and document private mode-`0600` delivery as application-owned policy. - Keep Previews 1–3 immutable; applications select Preview 4 explicitly when adopting administrative recovery. ## v0.1.0-preview.3 — 2026-08-18 - Add cryptographically generated temporary credentials and an explicit password-change-required account state. - Replace credentials, clear the requirement, and revoke all existing sessions in one repository transaction after verifying the current password. - Migrate existing SQLite users with the new requirement disabled; applications continue to own first-login routing, private credential delivery, and audit policy. - Keep Preview 1 and Preview 2 immutable; applications select Preview 3 explicitly when adopting forced bootstrap rotation. ## v0.1.0-preview.2 — 2026-08-17 - Add storage-neutral organizations, teams, projects, environments, services, single-use invitations, and independently scoped access roles. - Separate platform-level authentication roles from organization data access. - Add expiring break-glass grants with transactional organization-visible audit events and a no-CGO SQLite implementation. - Keep `v0.1.0-preview.1` immutable; applications adopt these additive packages by explicitly selecting Preview 2. ## v0.1.0-preview.1 — 2026-08-16 - Establish independent request metadata, logging, browser security, abuse, authentication, SQLite, and analytics package boundaries. - Add a minimal 0BSD `net/http` starter. - Fail closed when unsafe requests lack same-origin evidence or authentication middleware is constructed with invalid cookie/service configuration. - Bound untrusted request-record byte and duration fields before aggregation. - Support Linux as the maintained release platform; native Windows is not a release gate or compatibility promise. No compatibility promise is made before a stable release.