# Changelog

All notable changes to Switchboard Core are documented here.

## v0.5.2 — Chat Surface

### Added

- **`chat` surface package**: Full messaging UI built on `chat-core` library.
  Route `/s/chat`, icon `💬`, depends on `chat-core`.
- **Conversation list sidebar**: Conversations sorted by recent activity, last
  message preview, relative timestamps, unread count badges. "New" button
  for conversation creation.
- **Message thread**: Paginated message history with cursor-based load-more on
  scroll-to-top. Participant avatars, display names, timestamps. Scroll-to-
  bottom on new messages.
- **Compose bar**: Auto-resizing textarea, Enter-to-send, Shift+Enter for
  newline. Typing indicator broadcast on keypress (3s debounce).
- **Participant sidebar**: Collapsible right panel with participant list, online
  status via presence hub, role badges. Add participant via `sw.ui.Dialog` +
  `sw.ui.UserPicker`. Remove participant with confirmation.
- **Create conversation dialog**: Group or Direct Message type selector. Multi-
  user picker with chip display for group, single picker for DM. Auto-title
  from participant names.
- **Typing indicators**: Realtime broadcast via `POST /typing/:id` Starlark
  endpoint. Frontend subscribes to `conversation:{id}` channel, shows
  "X is typing..." with 4s auto-expire. Handles multiple typers.
- **Read receipts**: Auto mark-read on conversation focus and new incoming
  messages. Unread counts in conversation list, cleared on selection.
- **Message editing**: Inline edit mode on own messages with textarea. Save on
  Enter, cancel on Escape. "(edited)" label on edited messages. Realtime
  propagation to other participants.
- **Message deletion**: Confirm dialog before delete. "This message was deleted"
  placeholder. Admin can delete any message. Realtime propagation.

### Fixed

- **Stale token login deadlock**: REST client's 401→refresh→retry loop caused
  a deadlock when the refresh endpoint itself returned 401 (stale DB). Auth
  endpoints (`/auth/login`, `/auth/refresh`, `/auth/register`) are now excluded
  from the retry loop. Defensive 8s timeout on `auth.boot()` ensures login
  page always renders even on unexpected hangs.
- **Bundled package permissions**: Bundled packages were installed with
  `pending_review` status and `granted=0` permissions, requiring manual admin
  approval. Bundled installer now auto-grants all declared permissions and
  sets status to `active` on install.
- **Creator display name**: `chat-core.create()` now accepts
  `creator_display_name` so the conversation creator shows a readable name
  in the participant sidebar instead of a raw UUID.
- **Chat dark mode theming**: Replaced non-existent CSS variable names with
  actual theme tokens from `variables.css`. Fixes invisible text and wrong
  backgrounds in dark mode.
- **Dialog dropdown clipping**: UserPicker autocomplete dropdown in dialogs
  (New Conversation, Add Participant) no longer clipped by `overflow: auto`
  on `.sw-dialog__body`.
- **User menu at scaled UI**: Menu primitive now divides anchor coordinates
  and viewport dimensions by `sw.shell.getScale()` to compensate for CSS
  `transform: scale()` on `#surfaceInner`. Fixes menu clipping at 110%+.

### Changed

- **Named Docker volume**: `docker-compose.yml` switched from bind mount
  (`./data:/data`) to named volume (`sb_data:/data`). Fixes volume mount
  failures when Docker daemon runs on a remote host (DinD, k8s pod).
  Deterministic wipe via `docker compose down -v`.

## v0.5.1 — Chat Core Library

### Added

- **`chat-core` library package**: Conversations, messages, participants, and
  read cursors as ext_data tables. Permissions: `db.write`, `realtime.publish`.
  Consumable by other packages via `lib.require("chat-core")`.
- **4 ext_data tables**: `conversations` (title, type, created_by, updated_at),
  `participants` (conversation_id, participant_id, type, display_name, role,
  joined_at), `messages` (conversation_id, participant_id, content, content_type,
  edited_at), `read_cursors` (conversation_id, participant_id,
  last_read_message_id).
- **6 exported Starlark functions**: `create()`, `send()`, `history()`,
  `add_participant()`, `remove_participant()`, `mark_read()`.
- **15 REST endpoints**: Full CRUD for conversations, messages, participants.
  Cursor-based paginated message history. Per-conversation unread counts.
- **Realtime events**: `message`, `message.edited`, `message.deleted`,
  `participant.added`, `participant.removed` published to
  `conversation:{id}` channels.
- **`db.query()` range parameters**: New `before` and `after` kwargs accept
  dicts of `{col: val}` generating `col < ?` / `col > ?` WHERE clauses.
  Enables cursor-based pagination and efficient unread counting for all
  extension packages. 7 new Go tests.

### Security

- **Invisible Unicode scanning gate** (GlassWorm / Trojan Source defense):
  `ScanSource()` detects variation selectors, bidi overrides, zero-width chars,
  tag characters, and other invisible Unicode across 10 ranges. `Verdict()`
  blocks GlassWorm payloads (>=10 variation selector / tag chars), Trojan Source
  (any bidi override), and excessive zero-width chars (>=6). Two enforcement
  points: extension install (422 rejection before files written) and Starlark
  execution (belt-and-suspenders). 23 new tests including GlassWorm payload
  simulation.

### Changed

- **Admin packages type filter**: Added `Library` option alongside Surface/Extension/Full/Workflow. Filter dropdown replaced button group with themed `Dropdown` primitive (keyboard nav, CSS-var theming, consistent with rest of admin UI).
- SDK version bumped from 0.5.0 to 0.5.1.

## v0.5.0 — Realtime Primitive + Dialog Audit + Permissions UI

### Added

- **Realtime Starlark module**: `realtime.publish(channel, event, data)` lets
  extensions publish events to WebSocket channels. Gated by the new
  `realtime.publish` permission. Payloads limited to 7KB (pg_notify safe).
  Reserved event prefixes (`system.`, `workflow.`, etc.) are blocked.
- **WS room protocol**: Clients send `room.subscribe` / `room.unsubscribe`
  messages to join/leave rooms. Intercepted in the WebSocket readPump before
  the bus publish gate (like ping). Per-connection cap of 100 rooms.
- **SDK realtime module**: `sw.realtime.subscribe(channel, [event], callback)`
  manages room join/leave over WebSocket and filters incoming `realtime.*`
  events by room. Returns unsubscribe handle. Auto re-joins all rooms on
  WebSocket reconnect. `sw.realtime.channels()` debug helper.
- **Admin permissions UI**: Packages page gains a "Permissions" button for
  packages with declared permissions. Inline drawer shows each permission with
  Grant/Revoke toggle, granted-by user ID, and a "Grant All" bulk action.
- **Status badges**: `pending_review` (amber) and `suspended` (red) badges on
  package rows. Enable toggle disabled with hint when `pending_review`.
- **SDK API client**: `permissions()`, `grantPerm()`, `revokePerm()`,
  `grantAllPerms()` methods added to `sw.api.admin.packages`.
- **`starlarkToGoVal()` helper**: Converts Starlark values to Go `any` for
  JSON marshaling (reverse of existing `goValToStarlark`).
- **8 new Go tests**: Route table cases for `realtime.*` and `room.*`,
  realtime module publish (happy path, empty data, missing args, reserved
  prefix, payload too large), `starlarkToGoVal` type conversion.

### Changed

- **Dialog audit**: 5 bare `confirm()` calls migrated to `await sw.confirm()`
  with `{ destructive: true }` styling in tasks, schedules, notes (×2), and
  editor packages. Package archives rebuilt.
- SDK version bumped from 0.2.3 to 0.5.0.
- Event route table: `realtime.` → DirToClient, `room.subscribe` /
  `room.unsubscribe` → DirFromClient.
- Runner gains `bus` field and `SetBus()` method; wired in main.go.

## v0.4.7 — Note Graph

### Added

- **Graph API**: `GET /graph` endpoint returns all non-archived notes as nodes
  and resolved wikilinks as edges in a single payload. Nodes include id, title,
  folder_id, and tags. Edges include source, target, and link text.
- **Graph view**: Canvas-based force-directed graph visualization replaces the
  editor pane when "Graph" button is clicked in the topbar. Force simulation
  uses repulsion (all pairs), attraction (edges), and center gravity with
  velocity damping. Supports zoom (scroll wheel) and pan (mouse drag).
- **Click focus**: Single-click a node to dim unconnected nodes/edges to 15%
  opacity; clicked node and direct neighbors stay at full brightness. Edges
  between focused nodes highlighted. Click empty space to reset.
- **Shift+click chain**: Hold shift and click a second node to union both
  neighborhoods — trace thought paths across two hops.
- **Double-click open**: Double-click a graph node to navigate to that note in
  the editor. Graph view closes, editor opens with the selected note.
- **Hover tooltips**: Hovering a node shows title, tag pills, and connection
  count in an HTML overlay (no additional API calls).
- **Folder coloring**: Nodes colored by folder using a 10-color palette.
  Unfiled notes shown in gray.
- **Tag filter integration**: Active tag filter dims non-matching nodes to 30%
  opacity, stacking with click focus.
- **Orphan highlighting**: Notes with zero connections shown with dashed stroke.
  "Hide orphans" checkbox in toolbar to toggle visibility.

### Changed

- Notes package version bumped from 0.7.0 to 0.8.0.
- Topbar gains a "Graph" toggle button alongside "New Note" and "Import .md".


## v0.4.6 — Sidebar Restructure

### Added

- **Sidebar tabs**: Two-tab header ("Notes" / "Outline") replaces the static
  sidebar header. Notes tab contains folder tree, tag filter, search, and note
  list. Outline tab shows the document heading tree for the active note.
  Outline tab disabled (grayed) when no note is selected.
- **Sidebar outline**: Document outline relocated from editor-side panel into
  the sidebar's Outline tab. Nested heading hierarchy (H1→H2→H3) with depth
  indentation via `padding-left`. Click heading scrolls to it in both preview
  and CM6 editor modes.
- **Active heading tracking**: Scroll listener (RAF-throttled) highlights the
  current heading in the sidebar outline based on scroll position. Uses
  `getBoundingClientRect()` in preview/split mode and CM6 viewport line in
  edit mode.

### Changed

- Notes package version bumped from 0.6.0 to 0.7.0.
- `EditorPane` exposes headings, scroll function, and active heading index to
  parent via callback props (`onHeadingsChange`, `scrollToHeadingRef`,
  `onActiveHeadingChange`).
- Sidebar auto-resets to Notes tab when active note is deleted.

### Removed

- Old `DocumentOutline` component and `.doc-outline` CSS styles (replaced by
  sidebar outline).

## v0.4.5 — Editor Modes + Document Outline

### Added

- **Tri-state view mode**: Notes open in rendered (read-only) mode by default.
  Toolbar button cycles through Edit (CM6) and Split (side-by-side) modes.
  Replaces the old binary preview toggle.
- **Split view**: Side-by-side CM6 editor + rendered preview using CSS grid.
  CM6 instance preserved when toggling between edit and split modes.
- **Synced scroll**: In split mode, scrolling the CM6 editor proportionally
  scrolls the preview pane via linear ratio mapping on `scrollDOM`.
- **View mode persistence**: User's preferred mode saved to localStorage
  (`sw.storage.local('notes')`). New `editor_mode` manifest setting with
  admin-level default (rendered / edit / split).
- **Document outline**: Collapsible TOC panel adjacent to the editor body.
  `parseHeadings()` extracts heading level, text, and line number (skips
  fenced code blocks). Click heading to scroll — uses CM6
  `EditorView.scrollIntoView()` in edit/split mode, DOM `scrollIntoView()`
  in rendered mode. Updates on body change with 300ms debounce.

### Changed

- Notes package version bumped from 0.5.0 to 0.6.0.
- Editor body wrapped in `.notes-editor__content` flex container to
  accommodate the outline panel.
- Wikilink click handling active in both rendered and split modes.
- Mobile: split view collapses to single column, outline panel hidden.

---

## v0.4.4 — Rich Editor + Import/Export

### Added

- **CodeMirror 6 integration**: Notes editor now uses the vendored CM6 bundle
  (`CM.noteEditor()`) for rich markdown editing with syntax highlighting,
  wikilink autocomplete (`[[` triggers note title completion), and inline
  preview decorations for headings, code blocks, and blockquotes.
- **CM6 dynamic loading**: Bundle loaded via `<script>` tag at boot time.
  Falls back to plain textarea if CM6 is unavailable.
- **Export as .md**: Export button in editor header downloads the note as a
  Markdown file with YAML frontmatter (title, tags, created date).
- **Import .md**: Import button in topbar allows uploading `.md`/`.markdown`/`.txt`
  files. Parses YAML frontmatter for title and tags, creates note via API.
- **CSS for CM6**: Editor fills the container with `max-height: none` override
  and proper scroller padding.

### Changed

- Notes package version bumped from 0.4.0 to 0.5.0.
- `EditorPane` component refactored to support CM6 with mutable refs for
  title/body (required for CM6 callback closures).
- Ctrl/Cmd+S save works in both CM6 and textarea fallback modes.

---

## v0.4.3 — Backlinks + Wikilinks

### Added

- **Links table** (`ext_notes_links`): source_id, target_id, link_text columns
  with indexes on source_id and target_id for bidirectional lookup.
- **Wikilink extraction**: `_extract_wikilinks()` parses `[[...]]` patterns
  using `split("[[")` + `find("]]")` (Starlark has no regex or while loops).
  Returns deduplicated list of link text strings.
- **Link sync on save**: `_sync_links()` called from `_create_note` and
  `_update_note` when body changes. Follows the tags delete-all + reinsert
  pattern. Resolves link text to note IDs via case-insensitive title matching.
  Unresolved links stored with empty `target_id`.
- **Cascade delete**: Hard-deleting a note removes both outgoing links
  (source_id matches) and incoming backlinks (target_id matches).
- **Link API endpoints**: `GET /links/:note_id` returns outgoing links.
  `GET /backlinks/:note_id` returns incoming links enriched with source note
  titles to avoid extra frontend round-trips.
- **Wikilink preview rendering**: `[[Note Title]]` syntax renders as clickable
  accent-colored links in the markdown preview. Unresolved wikilinks styled
  in danger/red with dashed underline.
- **Wikilink click navigation**: Clicking a resolved wikilink navigates to the
  target note. Clicking an unresolved wikilink creates the note and navigates
  to it, then re-saves the source note so the link resolves to blue.
- **Backlinks panel**: Collapsible panel below the editor showing all notes
  that link to the current note. Each backlink displays source title and link
  text. Click to navigate. Hidden when no backlinks exist.
- **Updated stats**: `/stats` response now includes `links` count.

### Data model

| Table | Columns |
|-------|---------|
| `ext_notes_links` | source_id, target_id, link_text |

### Notes package version

0.3.0 → 0.4.0

---

## v0.4.2 — Tags + Search

### Added

- **Tags table** (`ext_notes_tags`): note_id, tag columns with indexes on
  both for bidirectional lookup. Many-to-many relationship via join table.
- **Tag CRUD API**: 3 new Starlark handlers — list all unique tags, get tags
  for a note, replace tags for a note (delete-all + reinsert). Tags are
  normalized to lowercase, trimmed, and deduplicated on save.
- **Tags in list/get/search**: `_list_notes` batch-fetches all tags in a
  single query and attaches a `tags` array to each note item. `_get_note`
  includes tags. `_search_notes` now matches search terms against tags.
- **Tag cascade delete**: Hard-deleting a note also removes its tag rows.
- **Tag input in editor**: `TagInput` component with removable pills, text
  input (comma or Enter to add), and autocomplete dropdown populated from
  all existing tags.
- **Tag pills on note cards**: `NoteCard` renders up to 3 tag pills with
  "+N" overflow indicator for notes with many tags.
- **Tag filter in sidebar**: `TagFilter` component displays all unique tags
  as clickable pills. Clicking toggles client-side filtering of the note
  list by that tag.
- **Drag-and-drop note moves**: `NoteCard` is draggable (HTML5 drag/drop).
  `FolderNode`, "All Notes", and "Unfiled" items are drop targets. On drop,
  calls the existing move-note API.
- **Folder context menu**: Replaced `prompt()` hack with a proper right-click
  popup menu showing "Add subfolder", "Rename", and "Delete" actions. Positioned
  at click coordinates, dismissed on outside click.
- **Updated stats**: `/stats` response now includes `tags` count (unique).

### Data model

| Table | Columns |
|-------|---------|
| `ext_notes_tags` | note_id, tag |

### Notes package version

Bumped from 0.2.0 → 0.3.0. 15 API routes (12 existing + 3 new).

## v0.4.1 — Folders + Navigation Tree

### Added

- **Folders table** (`ext_notes_folders`): name, parent_id, creator_id,
  sort_order. Indexed on parent_id and creator_id. Nested hierarchy via
  parent_id foreign key (empty string = root).
- **Folder CRUD API**: 5 new Starlark handlers — list, create, update, delete
  folders plus a dedicated move-note endpoint (`POST /notes/move`).
- **Navigation tree**: `FolderTree` + `FolderNode` Preact components in the
  sidebar. Flat API response built into a nested tree client-side via `useMemo`.
  Expand/collapse toggles, depth-based indentation, inline rename via
  right-click context menu.
- **Folder filtering**: Clicking a folder filters notes by `folder_id` query
  param. "All Notes" clears the filter. "Unfiled" shows notes with empty
  folder_id (client-side filter).
- **Editor folder select**: Dropdown in the editor header moves notes between
  folders. Shows nested hierarchy with `└` prefix indentation.
- **Folder-aware note creation**: New notes inherit the active folder's ID.
- **Delete cascade**: Deleting a folder orphans its notes (moves to Unfiled)
  and reparents child folders to the deleted folder's parent.
- **Updated stats**: `/stats` response now includes `unfiled` and `folders`
  counts.

### Data model

| Table | Columns |
|-------|---------|
| `ext_notes_folders` | name, parent_id, creator_id, sort_order |

### Notes package version

Bumped from 0.1.0 → 0.2.0. 12 API routes (7 existing + 5 new).

## v0.4.0 — Notes Surface

### Added

- **Notes surface package** (`packages/notes/`): Obsidian-style markdown notes
  rebuilt as a standard installable `.pkg` archive. Type `full`, tier `starlark`.
  Zero kernel changes — proves the extension stack end-to-end.
- **Starlark backend** (`script.star`): 7 API routes — CRUD, search, stats.
  Note bodies stored in `ext_notes_notes` TEXT columns. List endpoint returns
  lightweight projections (no body); full content fetched on select.
- **Markdown editor**: Preact+htm frontend with sidebar note list, monospace
  textarea, and toggle-able live preview. Inline markdown renderer (~100 lines)
  covers headings, bold, italic, code blocks, links, lists, blockquotes, and HR.
- **Auto-save**: Debounced save (1s) with dirty/saved status indicator.
  `Ctrl/Cmd+S` for force save. Tab key inserts two spaces.
- **Pin & archive**: Pin important notes to the top of the list. Archive
  (soft-delete) via the delete button; hard delete with `?hard=1` query param.
- **Search**: Case-insensitive full-text search across title and body content.
  Search bar in sidebar filters the note list in real-time.
- **Theme support**: All styles use CSS variables — light and dark themes work
  out of the box. Responsive layout collapses to vertical on narrow viewports.

### Data model

| Table | Columns |
|-------|---------|
| `ext_notes_notes` | title, body, folder_id, creator_id, updated_at, pinned, archived |

Indexes on `folder_id`, `creator_id`, `pinned`, `updated_at`.

### Planned (v0.4.1–v0.4.4)

- Folders + navigation tree
- Tags + enhanced search
- Backlinks + `[[wikilinks]]`
- Rich editor (CodeMirror 6) + markdown import/export

## v0.3.8 — Distribution

### Added

- **Bundled packages**: Production Docker image now ships with 12 pre-built
  `.pkg` archives (4 workflows, 3 surfaces, 1 full, 1 library, 2 test runners,
  1 extension). Auto-installed on first boot via `InstallBundledPackages()`.
  Install-once, skip-if-present — admin uninstalls are respected on restart.
- **Package allowlist** (`BUNDLED_PACKAGES`): Comma-separated list of package
  IDs to install. Empty (default) installs all. Useful for Helm/K8s where
  different environments need different packages.
- **Skip bundled** (`SKIP_BUNDLED_PACKAGES=true`): Disables auto-install
  entirely. Intended for production until post-MVP packages are ready.
- **Builder image** (`Dockerfile.builder`): Pre-caches Go modules, Node
  dependencies, and vendor lib tarballs for faster custom builds.
- **Distribution docs** (`docs/DISTRIBUTION.md`): Quick start, bundled
  packages, builder image usage, custom build guide, production deployment
  reference.
- **Migration 012**: Adds `bundled` to `packages.source` CHECK constraint
  (both Postgres and SQLite).
- **K8s manifest**: `SKIP_BUNDLED_PACKAGES` and `BUNDLED_PACKAGES` env vars
  added to `k8s/switchboard.yaml`.
- **Tests**: 6 handler tests (fresh install, skip existing, missing dir, empty
  dir, dormant handling, allowlist filtering).

### Environment defaults

| Environment | `SKIP_BUNDLED_PACKAGES` | `BUNDLED_PACKAGES` |
|-------------|------------------------|--------------------|
| Dev (compose) | `false` | (empty = all) |
| Test (K8s) | `false` | (empty = all) |
| Prod (K8s) | `true` | — |

## v0.3.7 — Package Audit

### Added

- **Dormant status**: New `dormant` value in `packages.status` CHECK constraint
  (both Postgres and SQLite). Installer auto-detects packages with unmet
  `requires` entries and sets `status=dormant, enabled=false`. Enable endpoint
  returns 409 for dormant packages.
- **Generalized requires check**: Any unmet requirement triggers dormant status,
  not just specific values. Known capabilities checked against a whitelist;
  anything unknown is unmet.
- **Admin UI indicators**: Dormant badge, disabled Enable button with tooltip,
  Dormant stat card in packages admin view.
- **Tests**: 4 new handler tests covering dormant status, enable blocking,
  surface exclusion, and admin list inclusion.

### Fixed

- **Manifest fixes**: Fixed 6 chat-extension manifests (`"name"` → `"title"`)
  that were blocking install. Added explicit `"type": "surface"` to
  hello-dashboard, icd-test-runner, sdk-test-runner.
- **Dashboard + Editor tagged dormant**: Both depend on removed `sw.*`
  imperative SDK (`sw.tabs`, `sw.chat`, `sw.layout`, etc.) — render blank.
  Tagged with `requires: ["legacy-sdk"]` so installer auto-sets dormant.
- **Dependency check**: Relaxed library dependency validation to allow
  `pending_review` libraries (gitea-client declares permissions). Only
  `suspended`/`dormant` libraries blocked.

### Package Audit Results

- **7 working surfaces**: schedules, tasks, team-activity-log, git-board,
  hello-dashboard, icd-test-runner, sdk-test-runner
- **8 dormant**: 6 chat-dependent (csv-table, diff-viewer, js-sandbox,
  katex-renderer, mermaid-renderer, regex-tester) + 2 legacy-sdk (dashboard,
  editor)
- **1 library**: gitea-client (standalone, active)

## v0.3.6 — Example Workflows + Interactive Demo

### Added

- **Bug Report Triage** (`packages/bug-report-triage`): Public entry, progressive
  fieldsets, severity-based branch routing, SLA timer (3600s on critical fix).
- **Employee Onboarding** (`packages/employee-onboarding`): Starlark automated
  stages (`db.insert`, `notifications.send`), manager signoff gate with
  `required_role`, rejection reroute. `script.star` with `on_provision` and
  `on_welcome` hooks. Creates `provisions` and `onboarding_log` ext_data tables.
- **Content Approval** (`packages/content-approval`): Multi-party signoff (quorum
  of 2), rejection reroute creating a review cycle loop.
- **Webhook Notifier** (`packages/webhook-notifier`): Starlark `http.post` with
  `connections.get` fallback, delivery logging to `webhook_log` ext_data table.
- **Workflow Demo** surface (`packages/workflow-demo`): Interactive walkthrough
  with workflow cards, stage flow diagrams, Starlark viewer, API curl examples,
  and "Try It" buttons. Route: `/s/workflow-demo`.
- **Engine context fix**: `started_by` added to automated stage Starlark context
  dict, enabling hooks to reference the workflow initiator.
- **SLA package installer**: `sla_seconds` field added to `workflowPkgStage`
  struct and wired in both install and export paths.
- **Snapshot format fix**: `parseSnapshotStages` helper handles both wrapped
  (`{"stages":[...]}`) and legacy flat array snapshot formats in the engine,
  fixing `corrupt version snapshot` errors when starting published workflows.
- **Workflow adoption**: `POST /teams/:teamId/workflows/:id/adopt` claims a
  global (team_id=NULL) workflow for a team. `GET /teams/:teamId/workflows/available`
  lists adoptable workflows. `TeamID` added to `WorkflowPatch` model.
- **Tests**: 3 new engine tests (automated context, SLA install, manifest
  roundtrip). Total: 142 handler tests passing.
- Per-package `README.md` files for all 5 new packages.

### Fixed

- **Demo surface**: Added `sw.userMenu` to topbar. Fixed workflow install
  detection (was reading wrong response key). CSS uses theme variables for
  dark mode support.
- **Admin teams tab**: Extracted `.data` from paginated response — was stuck
  at loading because `setTeams` received the envelope object, not the array.
- **Team-admin workflows**: Added "Adopt Global" button to claim package-installed
  workflows into a team scope. Workflow list now unwraps paginated responses.

## v0.3.5 — Settings Audit + ICD + Tests + Clone

### Added

- **Clone endpoint**: `POST /api/v1/workflows/:id/clone` deep-copies a workflow
  and all its stages. Creates an inactive draft with "Copy of" prefix. Handles
  slug collisions with auto-suffix. Team-scoped mirror at
  `/api/v1/teams/:teamId/workflows/:id/clone`.
- **Integration tests**: 7 new engine-level tests in `workflow_engine_test.go`
  covering full lifecycle, branch routing, public entry, signoff validation gate,
  signoff rejection, cancel-clears-assignments, and error cases. Total: 28 tests.
- **Staleness timeout UI**: `staleness_timeout_hours` input added to workflow
  editor in team-admin settings (was backend-only since v0.3.3).
- **Branch rules UI**: Collapsible JSON textarea in stage form for configuring
  conditional routing rules (was backend-only since v0.3.2).

### Changed

- **ICD (OpenAPI spec)**: Fixed stale `Workflow` schema (added `description`,
  `branding`, `is_active`, `on_complete`, `retention`, `staleness_timeout_hours`).
  Fixed stale `Stage` schema (removed `history_mode`/`transition_rules`, updated
  `stage_mode` enum to `[form, review, delegated, automated]`, added `audience`,
  `stage_type`, `starlark_hook`, `branch_rules`, `stage_config`, `sla_seconds`,
  `auto_transition`, `assignment_team_id`, `surface_pkg_id`).
  Added `WorkflowInstance`, `WorkflowAssignment`, `WorkflowSignoff` schemas.
  Added ~20 new endpoint paths: instances, assignments, signoffs, public entry,
  clone, and team roles. Added tags: Workflow Instances, Workflow Assignments,
  Workflow Signoffs, Public Workflows.

## v0.3.4 — Team Roles + Multi-party Validation

### Added

- **Custom team roles**: Removed `CHECK (role IN ('admin','member'))` constraint
  from `team_members` (both Postgres and SQLite). Custom roles are stored in
  `teams.settings["roles"]` as a JSON array. Builtins `admin` and `member` are
  always present.
- **Team roles API**: `GET /api/v1/teams/:teamId/roles` returns configured roles.
  `PUT /api/v1/teams/:teamId/roles` replaces the roles array (builtins enforced).
- **Role-based stage assignment**: `stage_config.required_role` restricts which
  team members can claim an assignment. `CheckClaimRole` verifies the user's team
  membership role before allowing claim; rolls back on mismatch (403).
- **Multi-party sign-off**: New `workflow_signoffs` table with
  `UNIQUE(instance_id, stage, user_id)` preventing double-signing.
  `StageConfig.validation` supports `required_approvals`, `required_role`, and
  `reject_action` (cancel or reroute to named stage).
- **Validation gate**: `advanceInternal` blocks stage advancement until the
  required number of approvals is met. Rejections trigger cancel or reroute
  based on `reject_action`.
- **`Engine.SubmitSignoff`**: Records approval/rejection, enforces signoff role
  if configured, emits `workflow.signoff` event.
- **Signoff HTTP API**: `POST /api/v1/instances/:iid/signoffs` (submit),
  `GET /api/v1/instances/:iid/signoffs` (list current stage signoffs).
  Team-scoped mirrors at `/api/v1/teams/:teamId/instances/:iid/signoffs`.
- **New events**: `workflow.signoff`, `workflow.rejected`.
- **Frontend — Members page**: Dynamic role selects populated from team roles API.
  "Manage Roles" panel for adding/removing custom roles inline.
- **Frontend — Stage editor**: "Required Role (claim)" dropdown and "Multi-party
  Validation" section (required approvals, signoff role, on reject action) appear
  when a team is selected for the stage.
- **Frontend — Monitor tab**: Signoff panel with approve/reject buttons, comment
  field, and approval progress display.
- **3 new store tests**: CreateSignoff (with UNIQUE constraint check),
  ListSignoffs (ordering), CountSignoffs (decision filter). 20 total, all passing.
- **Design doc**: `docs/DESIGN-EXTENSION-LIFECYCLE.md` — permanent vs PoC
  packages, graduation criteria, explicit install model.
- **Design doc**: `docs/DESIGN-TRIGGER-COMPOSITION.md` — triggers/schedules can
  start workflows, workflows emit events, no circular invocation.

### Changed

- `addMemberRequest` and `updateMemberRequest` binding relaxed from
  `oneof=admin member` to `required,min=1,max=50` with application-level
  validation against the team's configured roles.
- `TruncateAll` test helper updated to include `workflow_signoffs`.

---

## v0.3.3 — Public Entry + Background Jobs

### Added

- **Public workflow entry**: Unauthenticated routes for anonymous workflow
  participation. `POST /api/v1/public/workflows/:id/start` creates an instance
  with `started_by = "public:<uuid>"` and returns an entry token.
  `GET .../resume/:token` and `POST .../advance/:token` allow continuation.
  Only stages with `audience = "public"` can be advanced anonymously.
- **SLA scanner**: Background goroutine (5-minute interval) checks active
  instances against per-stage `sla_seconds`. Fires `workflow.sla_breach` event
  on first breach, marks `sla_breached: true` in instance metadata (idempotent).
- **Staleness sweep**: New `staleness_timeout_hours` column on `workflows`.
  Scanner marks instances as `stale` when `updated_at` exceeds the threshold,
  cancels open assignments, fires `workflow.stale` event.
- **New store methods**: `ListActiveInstances()`, `MarkInstanceStale()`.
- **New events**: `workflow.sla_breach`, `workflow.stale`.
- **3 new store tests**: MarkStale, ListActive, StalenessTimeoutHours round-trip.

---

## v0.3.2 — Workflow Engine

### Added

- **Stage execution engine**: `server/workflow/engine.go` — `Start`, `Advance`
  (with `branch_rules` conditional routing), and `Cancel` operations. Merges
  `stage_data` across stages, creates assignments, emits lifecycle events.
- **Automated stage handler**: `server/workflow/automated.go` — fires Starlark
  hook, auto-advances on success, cycle guard (max 10 consecutive automated
  stages).
- **Instance HTTP API**: Start, GetInstance, Advance, Cancel, ListInstances.
  Team-scoped mirrors under `/api/v1/teams/:teamId/workflows/`.
- **Assignment HTTP API**: Claim, Unclaim, Complete, Cancel, ListByTeam,
  ListMine. Claimer identity verification on unclaim/complete.
- **Starlark module expansion**: `workflow.get_instance()`,
  `workflow.list_instances()` (read-only).
- **14 store tests** covering all 15 v0.3.1 methods (instance + assignment
  CRUD). All passing.

---

## v0.3.1 — Instance Assignment

### Added

- **`workflow_instances` table**: Tracks workflow execution state —
  `workflow_version`, `current_stage`, `stage_data`, `status`, `entry_token`.
- **`workflow_assignments` table**: Per-stage queue for instance assignments —
  `instance_id`, `stage`, `team_id`, `assigned_to`, `status`, `review_data`.
  Optimistic claim locking via status transition.
- **15 new store methods**: Full CRUD for instances (Create, Get, GetByToken,
  Update, List, AdvanceStage, Complete, Cancel) and assignments (Create, Claim,
  Unclaim, Complete, Cancel, ListByTeam, ListByInstance, ListByUser).
- **New events**: `workflow.started`, `workflow.cancelled`, `workflow.error`.

---

## v0.3.0 — Workflow Schema Redesign

### Changed

- **`workflow_stages` schema modernized**: Dropped chat-era columns (`persona_id`,
  `history_mode`). Renamed `transition_rules` → `stage_config`. Updated
  `stage_mode` CHECK from `(form_only, form_chat, review, custom)` to
  `(form, review, delegated, automated)`.
- **New stage fields**: Added `audience` (team | public | system), `stage_type`
  (simple | dynamic | automated), `starlark_hook` (package_id:entry_point),
  and `branch_rules` (JSONB array of routing conditions).
- **Routing engine**: `ResolveNextStage` now reads `branch_rules` (flat array)
  instead of `transition_rules.conditions` (nested object). Cleaner separation
  between routing rules and stage config.
- **Hook handler**: `FireOnAdvanceHook` reads from `stage_config` instead of
  `transition_rules`. Renamed `channelID` parameter to `instanceID`.
- **Stage CRUD validation**: New fields validated on create/update. `delegated`
  mode requires `surface_pkg_id`. `dynamic`/`automated` stage_type requires
  `starlark_hook`.
- **Package export/import**: Updated to use new field names. Workflow packages
  now include `audience`, `stage_type`, `starlark_hook`, `branch_rules`,
  `stage_config`.
- **Starlark workflow module**: Stage dicts now include `audience` and
  `stage_type` keys. Removed `history_mode` and `persona_id`.
- **Frontend stage editor**: Both admin and team-admin surfaces updated with
  new mode values, audience selector, stage type selector, and conditional
  Starlark hook input. Fixed pre-existing bug in admin workflows.js where
  `STAGE_MODES` still contained `chat_only`.

### Removed

- `persona_id` column from `workflow_stages` (personas are extension concerns)
- `history_mode` column from `workflow_stages` (chat-era context management)
- `StageModeCustom`, `StageModeFormOnly`, `StageModeFormChat` Go constants

---

## v0.2.9 — Builtin Extension Retirement

### Changed

- **6 builtin extensions → standard packages**: csv-table, diff-viewer,
  js-sandbox, katex-renderer, mermaid-renderer, and regex-tester moved from
  `extensions/builtin/` to `packages/` with standard `js/` layout. Each
  manifest now declares `"requires": ["chat"]` and `"type": "extension"`.
  Built via `build.sh` like all other packages — no auto-install.

### Removed

- **`SeedBuiltinPackages` seeder**: Deleted `seed_packages.go` (function,
  `builtinManifest` struct, `buildFullManifest` helper) and the startup call
  in `main.go`. Extensions are no longer auto-seeded into the DB.
- **`extensions/builtin/` directory**: Removed from repo and Dockerfile COPY.
- **Seed tests**: Removed 8 `TestSeed_*` functions and `makeSeedDir` helper
  from `extension_test.go` (~220 lines).
- **Stale comments**: Removed `SeedBuiltinPackages` references from
  `package_iface.go` and `trigger_sync.go`.

---

## v0.2.8 — Team Admin Settings Audit (Pass 1)

### Removed

- **Dead `HasPrivateProviderRequirement`**: Store method checked team settings
  for `require_private_providers` (BYOK vestige). Removed from interface,
  PostgreSQL, and SQLite implementations. No callers existed.
- **Dead `UserRole` field on `TeamMember`**: Joined `users.role` column
  (deprecated in v0.2.0 RBAC migration). Removed from model, `ListMembers`
  and `GetMember` queries in both stores. Frontend never consumed it.
- **Dead `allow_team_providers` policy**: Removed from `PolicyDefaults`, both
  test seed data blocks, and ICD test assertions. No handler or UI read it.
- **Dead personas in workflow stage UI**: Removed `sw.api.teams.personas()`
  call (endpoint doesn't exist), personas state, persona dropdown in
  StageForm, and persona badge in stage list.
- **Dead `history_mode` in stage UI**: Removed history mode selector and state
  from StageForm. Backend column retained for v0.3.x schema migration.
- **Dead ICD tests**: Removed assertions for `/teams/:teamId/personas`,
  `/teams/:teamId/providers`, and `/teams/:teamId/models` — endpoints were
  removed in Phase 0 fork.
- **Stale `chat_only` stage mode**: Frontend `STAGE_MODES` updated from
  `['chat_only', 'form_only', 'form_chat', 'review']` to
  `['form_only', 'form_chat', 'review', 'custom']` matching the backend
  CHECK constraint.
- **Stale comments**: Removed references to deleted `team_providers.go`,
  `personas.go`, and `apiconfigs.go` files.

---

## v0.2.7 — User Settings Audit

### Changed

- **localStorage namespace**: Renamed `cs-appearance` key to `sb-appearance`
  across appearance settings, base template, and workflow template. One-time
  migration preserves existing user preferences.
- **Policy-gating tests**: Replaced stale `allow_user_byok` / `allow_user_personas`
  assertions with `allow_registration` check (the only policy still in admin UI).

### Removed

- **Dead BYOK nav section** in user settings: empty `BYOK_ITEMS` array,
  `byokEnabled` state, "BYOK Enabled" footer badge, and the nav group
  that rendered an empty section.
- **Dead personas gate**: `personasEnabled` state and `.filter()` on
  NAV_ITEMS for a `gate` property no items have. `auth.permissions.changed`
  listener removed (existed solely for BYOK + personas state).
- **Dead Message Font Size**: Slider, `msgFont` state, and `--msg-font`
  CSS variable application from appearance section and base template.
- **Dead policy defaults**: `allow_user_byok` and `allow_user_personas`
  removed from `PolicyDefaults`, profile bootstrap, permissions handler,
  and `PublicSettings`. Test seed data cleaned.

---

## v0.2.6 — Admin Settings Audit

### Changed

- **Roadmap reorder**: Extension Lifecycle moved from v0.2.6 to v0.3.x
  (Workflows series). Settings audit milestones renumbered: v0.2.7→v0.2.6,
  v0.2.8→v0.2.7, v0.2.9→v0.2.8. Added v0.2.9 for builtin extension
  retirement (chat-centric extensions dormant until chat surface ships).

### Removed

- **Dead admin section categories** in `sectionCategory()`: AI (providers,
  models, personas, roles, knowledgeBases, memory), routing (health, routing,
  capabilities), and channels. Default category changed from `ai` to `system`.
- **Dead PublicSettings fields**: `system_prompt`/`has_admin_prompt`,
  `retention_ttl_days`, `paste_to_file_chars`, `allow_user_personas` policy
  — all chat-era with no frontend consumers.
- **Dead PolicyDefaults**: `allow_raw_model_access`, `default_model`.
- **Dead policy lookups**: `allow_raw_model_access` and `kb_direct_access`
  from profile bootstrap and permissions handlers.
- **Dead test seed data**: `model_roles` global setting, `allow_raw_model_access`
  policy from test helper.
- **Dead CORE_IDS entry**: Removed `chat` from packages admin page.

---

## [Unreleased] — v0.2.5

### Added

- **Welcome surface**: New core surface shown as fallback. Detects whether
  extensions exist (shows "Set Default Surface") vs truly empty install
  (shows "Go to Packages"). Topbar + UserMenu included.
- **User default surface**: Users can set a personal landing page in
  Settings > General, overriding the admin-configured global default.
- **UserMenu in admin topbar**: Replaced Back button with UserMenu,
  providing consistent surface navigation and eliminating infinite loops.
- **Package manifest icons**: Added emoji icons to hello-dashboard,
  icd-test-runner, sdk-test-runner, and team-activity-log manifests.
- **PoC documentation**: README.md for tasks and schedules packages
  documenting Proof of Concept status and graduation criteria.

### Changed

- **Default surface resolution**: Priority chain is now
  user preference → global config → first extension → `/welcome`.
  User preference read from JWT cookie on unauthenticated `/` route.
  Correctly resolves `type: "full"` extension packages (not just `type: "surface"`).
- **User settings General section**: Replaced dead chat fields (Default
  Model, System Prompt, Max Tokens, Temperature, Show Thinking) with
  a Default Surface dropdown.
- **Admin settings**: Removed dead chat sections (System Prompt, Default
  Model, Policies, Web Search, Auto-Compaction, Memory Extraction).
- **Roadmap restructured**: Workflows → v0.3.x (includes team roles),
  Notes → v0.4.0, MVP → v0.5.0. Added settings audit milestones
  (v0.2.7 admin, v0.2.8 user, v0.2.9 team-admin pass 1).
- Updated bus doc examples and test labels from `chat.*` to `workflow.*`.
- Renamed `channel-` prefixed test paths to `test-` in storage tests.
- Updated doc comments throughout to remove references to gutted surfaces.

### Removed

- **~500 lines of dead CSS**: Orphaned classes for gutted chat, channel,
  project, notes, editor-chat, sidebar, and router-picker features from
  `layout.css` and `surfaces.css`.
- **Dead Go types**: `Grant` struct (persona-era), `CompositeModelKey` func,
  comment-only stubs for NoteGraph, ProjectChannel, etc.
- **Dead event code**: `chat.typing.*` / `channel.typing.*` condition in WS
  subscriber, empty Chat/Channel event route table sections.
- **Dead test helpers**: `seed_helpers.go` (SeedTestMessage, SeedTestMessages,
  SeedTestCursor — all callerless).
- **Stale template refs**: CSS link tags for non-existent `sw-chat-pane.css`,
  `sw-notes-pane.css`, `chat.css`. Orphaned `chat-pane.html` component.
- **Vestigial guards**: `"chat"` surface checks in `IsSurfaceEnabled()` and
  `DisablePackage()` (chat is no longer a surface).
- **Dead settings UI**: Chat defaults from user settings, System Prompt /
  Default Model / Policies / Web Search / Compaction / Memory from admin.
- Unused `fmt.Sprintf` references in team stores.

---

## [Unreleased] — v0.2.4

### Added

- **`sw.shell.Topbar`**: Standard navigation bar component for surfaces.
  Composes title + extension slot + NotificationBell + UserMenu into a
  consistent 44px bar. Surfaces use `<${sw.shell.Topbar} title="...">` with
  children rendered in the extension slot. Graceful fallback if unavailable.
- **Schedules surface** (`packages/schedules/`): New package wrapping the
  kernel `/api/v1/schedules` API. Table view with cron badge + human-readable
  preview, next fire time, enable/disable toggle, manual run, and execution
  logs panel. Create/edit dialog with live cron-to-english preview.
- **Manifest `icon` field**: Packages can declare an emoji icon in
  `manifest.json` (`"icon": "⏰"`). Served via the surfaces API `icon` field.
  Rendered in the UserMenu flyout next to each surface name.

### Changed

- **UserMenu**: Surface list now driven entirely by the `/api/v1/surfaces`
  API. Removed hardcoded Chat, Notes, Projects links (gutted in Phase 0).
  Core surfaces (Admin, Settings, Team Admin, Workflow) filtered from the
  API list and handled as dedicated menu items with RBAC gating.
- **Tasks surface**: Replaced custom `.tasks-header` with `sw.shell.Topbar`.
  View tabs and create button rendered in the extension slot.

### Fixed

- **`sw.isAdmin` RBAC regression**: `isAdmin()` in `can.js` was checking the
  deprecated `user.role === 'admin'` field instead of the v0.2.0 RBAC grant
  `surface.admin.access`. Admin menu item and admin-gated features now appear
  correctly for users in the Admins group.

---

## [Unreleased] — v0.2.2

### Added

- **Event bus subscriptions**: Extensions declare event triggers in manifest
  (`"triggers": [{"type": "event", "pattern": "workflow.completed", ...}]`).
  Wired via `bus.Subscribe()` on startup. Handlers fire asynchronously.
- **Webhook triggers**: Inbound HTTP at `/api/v1/hooks/:package_id/:slug`.
  HMAC-SHA256 verification via `X-Switchboard-Signature` header. Synchronous
  Starlark handler can return custom HTTP status and body.
- **Scheduled tasks**: User-created cron-scheduled Starlark scripts with
  restricted sandbox (no raw HTTP, no DB table creation, connections-only
  outbound). Runs as creator identity with RBAC scoping. Admin-created tasks
  can opt into system context. Creator deactivation auto-pauses schedule.
- **Schedule templates**: Extensions ship pre-built schedule templates in
  manifest (`schedule_templates` array) with configurable params and default
  cron expressions.
- `triggers.register` extension permission — required for event/webhook triggers
- `triggers` table — extension-declared event and webhook trigger definitions
- `scheduled_tasks` table — user-created cron tasks with script, template,
  and identity fields
- `trigger_logs` table — unified execution audit log for both tiers
- `TriggerStore` + `ScheduledTaskStore` interfaces (postgres + sqlite)
- Trigger engine (`server/triggers/`) — orchestrates event subscriptions,
  webhook resolution, and cron scheduling via `robfig/cron/v3`
- `SyncManifestTriggers()` — declarative sync of event/webhook triggers from
  manifest. Hooked into seed, admin install, and package install flows.
- Admin trigger API: `GET/PUT/DELETE /admin/triggers`, `/admin/triggers/:id/logs`,
  `/admin/packages/:id/triggers`
- Admin schedule API: `GET /admin/schedules`, enable/disable/delete
- User schedule API: full CRUD at `/api/v1/schedules`, manual run, execution logs
- `trigger.fired` and `trigger.error` event bus labels (DirLocal) for observability
- OpenAPI spec: Trigger, ScheduledTask, TriggerLog schemas + all new endpoints

---

## [v0.2.1] — 2026-03-26

### Added

- **Default surface routing**: `/` redirects to configurable default surface.
  Fallback chain: configured default → first enabled extension surface → `/admin`.
  First installed extension surface auto-becomes default. Admin can change via
  Settings > Default Surface dropdown.
- `default_surface` global config key (JSON `{"id": "slug"}`)
- Admin settings UI: Default Surface dropdown (extension surfaces only)
- **ICD (API contract)**: Full OpenAPI 3.0.3 spec covering all 160 kernel
  endpoints. 22 tag groups (System, Auth, Profile, Workflows, Packages,
  Connections, Teams, Groups, Extensions, and Admin subsections). Reusable
  component schemas for User, Team, Group, Workflow, Package, Extension, etc.
  Served at `/api/docs` (Swagger UI) and `/api/docs/openapi.yaml`.

### Changed

- `disabledRedirect()` now redirects to `/admin` instead of `/` to prevent
  redirect loops when the default surface is disabled
- Disabled extension surfaces (`/s/:slug`) redirect to `/admin` instead of `/`

### Fixed

- **Gin route param conflict** causing backend startup hang: team-scoped
  package settings routes used `:pkgId` while sibling routes used `:id`.
  Gin's radix tree entered an infinite loop on the conflicting param names.
  Unified to `:id` across all `/teams/:teamId/packages/` routes.
- Docker entrypoint: increased health check timeout (10s → 60s), added stale
  process cleanup and crash detection to prevent zombie backends on restart

---

## [v0.2.0] — 2026-03-26

### Added

- **Full RBAC**: all authorization flows through group membership and permission
  grants. No magic roles, no implicit group membership, no special-casing.
- `surface.admin.access` permission — any group can grant admin panel access
- Admins system group seeded with all platform permissions
- Everyone system group — all users explicitly added on creation
- `EnsureEveryoneGroup()`, `AddToAdminsGroup()`, `RemoveFromAdminsGroup()` helpers
- `SeedAdminsGroupMember()`, `SeedEveryoneGroupMember()` test helpers
- System groups re-seeded after `TruncateAll` in test helper
- OIDC `isIdPAdmin()` — maps IdP role claims to Admins group membership
- **Settings cascade**: three-tier resolution (global → team → user) with
  `user_overridable` flag per manifest setting key. Admins can lock settings
  that team admins and users cannot override.
- `package_team_settings` table for team-scoped package setting overrides
- Team admin API: `GET/PUT/DELETE /api/v1/teams/:teamId/packages/:pkgId/settings`
- `RunContext.TeamID` for team-aware Starlark settings resolution
- `store.ResolveSettings()` / `store.FilterOverridableKeys()` pure functions
- `store.ParseSettingsSchema()` extracts `user_overridable` from manifests

### Changed

- `RequireAdmin()` / `RequireAdminPage()` check `surface.admin.access` grant
- `RequirePermission()` no longer bypasses for admin role
- `ResolvePermissions()` unions explicit group memberships only (no implicit Everyone)
- All user creation paths (builtin, OIDC, mTLS, admin, bootstrap, seed) add to
  Everyone group. Admin users added to Admins group.
- JWT claims no longer include `role` field
- Login response no longer includes `role` in user object
- Profile endpoint no longer returns `role`
- Profile bootstrap resolves permissions from groups (no admin shortcut)
- Middleware auth cache tracks `isActive` only (no role)
- Admin create user accepts `is_admin` bool (not role string)
- Admin update role endpoint accepts `is_admin` bool, manages Admins group directly
- Demotion/deletion safeguards check Admins group member count
- Notifications `RoleFallbackHandler` queries Admins group members
- OIDC syncs Admins group on login (no role column writes)
- Kernel permissions: 6 → 7 (added `surface.admin.access`)
- Admin users UI: role dropdown removed, admin managed through groups
- Starlark `settings.get()` uses cascade resolver instead of naive merge
- User settings save (`POST /extensions/:id/settings`) strips non-overridable keys

### Removed

- **`users.role` column** — dropped from schema, model, JWT, all handlers
- `UserRoleAdmin`, `UserRoleUser` constants
- `CountByRole()` store method
- `DefaultRole` config for OIDC and mTLS providers
- `SyncAdminsGroupMembership()` (replaced by `AddToAdminsGroup`/`RemoveFromAdminsGroup`)
- OIDC `resolveRole()` (replaced by `isIdPAdmin()`)
- **Token budgets** from groups: columns, `ResolveTokenBudget()`, all store/handler/UI
- **Allowed models** from groups: column, `ResolveModelAllowlist()`, UI
- Admin groups UI: Token Budgets section, Allowed Models section

### Migration notes

- 001_core.sql (both dialects): removed `role` column from users table
- 002_teams.sql (both dialects): added Admins group seed, removed
  `token_budget_daily`, `token_budget_monthly`, `allowed_models` columns
- No new migration files — edited in place per pre-MVP policy

---

## [v0.1.0] — 2026-03-26

Forked from chat-switchboard v0.38.5. Gutted to a pure extension platform.

### Removed

- **AI/Chat system**: providers, model catalog, routing policies, personas,
  channels, messages, completion streaming, tool loop, compaction, memory,
  knowledge bases, notes, workspaces, projects, folders, files, export/import
- **Task scheduler**: entire scheduler package, task store, task handlers.
  Tasks will be rebuilt as a Starlark extension with three trigger primitives
  (time, webhook, event)
- **Session system**: channel-based anonymous sessions. Workflow instances
  will get new storage in v0.2.0
- **Health accumulator**: provider health windows, tool health tracking.
  Replaced with kernel-only Prune (ws_tickets, rate_limit_counters, presence)
- **15 Go packages**: tools, compaction, extraction, roles, mentions,
  notelinks, export, memory, knowledge, providers, routing, capabilities,
  filters, retention, workspace
- **29 handler files**, 6 test files, ~44K lines total

### Fixed

- CI deploy: k8s resource quantity vars (`BE_MEMORY_REQUEST` → `MEMORY_REQUEST`)
  aligned with CI workflow outputs — `envsubst` was producing empty strings
- CI deploy: image var (`BE_IMAGE` → `IMAGE`) — caused `InvalidImageName` in pods
- CI rollout: deployment name (`switchboard` → `switchboard-be`) — rollout
  verification was looking for wrong deployment name
- Nginx BASE_PATH: regex cache-header locations intercepted static asset
  requests before alias could strip the sub-path prefix — moved inside alias block
- Post-login blank page: dead Go template references (`surface-chat`,
  `surface-notes`, `surface-projects`) caused html/template to silently
  produce Content-Length: 0 responses
- Login branding: "Chat Switchboard" → "Switchboard Core", updated tagline
  and feature pills to reflect platform pivot

### Changed

- Module renamed: `chat-switchboard` → `switchboard-core`
- VERSION: `0.1.0`
- Default DB name: `switchboard_core`
- Fresh migrations: 9 files × 2 dialects (postgres + sqlite), 27 tables
- Store interfaces: 40 → 20 (13 in interfaces.go + 7 in separate iface files)
- Stage modes: `chat_only` removed, `custom` added
- Task output modes: `channel|note|webhook` → `notification|webhook|log`
- Kernel permissions: 16 → 6 (`extension.use`, `extension.install`,
  `workflow.create`, `workflow.submit`, `admin.view`, `token.unlimited`)
- Everyone group seed: `["extension.use","workflow.submit"]`
- Global settings seed: site name "Switchboard Core"
- Config: removed 7 dropped fields (SessionExpiryDays, WorkflowStaleHours,
  ProviderAutoDisableThreshold, ExtractionConcurrency, etc.)
- Health stores rewritten: kernel-only Prune for stale tickets, counters, presence
- Maintenance goroutine replaces scheduler for background cleanup

### Retained

- Identity & auth (builtin, mTLS, OIDC)
- Teams, groups, permissions
- Package system (surfaces, extensions, libraries, workflows)
- Starlark sandbox with capability-gated modules
- Extension connections & dependencies
- Workflow definitions, stages, versions
- Notifications & preferences
- Audit log
- Object storage (PVC, S3)
- WebSocket hub & presence
- Multi-replica HA (ws_tickets, rate_limit_counters)
- Frontend shell (preact+htm, SDK, vendor libs)