Changeset 0.36.0 (#212)

CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+## [0.36.0] — 2026-03-20
+
+### Summary
+
+Full OpenAPI 3.0.3 specification covering all API domains. Expands the
+hand-curated spec from v0.33.0 (12 endpoints) to 296 paths / 216
+operations across all ICD-documented domains. Documents Bearer JWT,
+mTLS, and OIDC auth modes. Adds reusable schemas, error responses,
+and pagination parameters.
+
+### New
+
+- **OpenAPI spec expanded to 296 paths** — up from 12 endpoints.
+  Covers: Auth (builtin + OIDC), Profile & Settings, Channels (CRUD,
+  participants, models, KB bindings, presence, folders, typing,
+  summarize, title generation), Messages (tree walk, edit, regenerate,
+  siblings, cursor), Completions (streaming + non-streaming), Files
+  (upload, download, metadata, message files), Personas (3-scope CRUD,
+  avatars, KB bindings, tool grants, persona groups), Models (enabled
+  list, preferences, bulk), Providers (BYOK CRUD, model sync), Notes
+  (CRUD, search, graph, backlinks, bulk delete), Knowledge Bases
+  (CRUD, documents, search, rebuild, discoverable), Memory (CRUD,
+  approve/reject, count, compact), Projects (CRUD, channels, KBs,
+  notes, files, reorder), Workspaces (CRUD, file ops, archive, git),
+  Git Operations (clone, pull, push, status, diff, commit, log,
+  branches, checkout), Git Credentials, Tasks (CRUD, runs, kill),
+  Workflows (CRUD, stages, publish, versions, instances, advance,
+  reject), Workflow Assignments (list, claim, complete, comment),
+  Workflow Forms (template, submit, visitor entry), Notifications
+  (CRUD, preferences, unread count), Data Portability (export, import,
+  ChatGPT import, GDPR delete), Webhook triggers, Health probes,
+  Metrics, WebSocket tickets.
+- **29 reusable component schemas** — AuthResponse, AuthUser,
+  UserProfile, Channel, Message, Participant, FileObject, ToolDef,
+  CompletionRequest/Response, TokenUsage, PersonaInput,
+  ProviderConfigInput, ProviderHealth, ErrorResponse, MessageResponse.
+- **Standardized error responses** — 400, 401, 403, 404, 409, 429
+  with $ref reuse across all paths.
+- **Security scheme documentation** — bearerAuth (JWT, 15m TTL) and
+  mtlsAuth (mutual TLS via proxy headers).
+- **Reusable parameters** — ResourceID, Page, PerPage for consistent
+  pagination across all list endpoints.
+- **25 domain tags** pre-declared for Swagger UI navigation.
+- **AuthResponse schema corrected** — `access_token` (was incorrectly
+  `token`), added `token_type`, `expires_in`, `handle`, `auth_source`.
+- **Login endpoint corrected** — field is `login` (accepts username
+  or email), not `username`.
+
+### Changed
+
+- `server/static/openapi.yaml` — complete rewrite (643 → 11845 lines)
+
 ## [0.35.1] — 2026-03-20
 
 ### Summary