v0.15.2-rc.3

0.15.2-rc.3 (2026-05-18)

Fixed

• ci,web: unused import + golangci v2 errcheck/staticcheck noise (CI recovery) (1d699dc)
• ci,workflows: golangci v2 config migration + oss-release pull-rebase ordering (codex r2) (4ad027d)

Documentation

• CHANGELOG,CLAUDE.md: document 2026-05-17 r2 audit remediation campaign (CA-523..CA-536) (2c4cd1b)

v0.15.1-rc.3

0.15.1-rc.3 (2026-05-17)

Fixed

• api,workers,ci,graph: codex r2 reconcile — platformStats non-admin regression + DNS bound comment + yq install + filtered.go file comment (c5b9c27)
• orchestrator,db: close pre-existing flaky-test class + CA-183 ctx-threading miss (89fefbf)
• rest,graph,web: codex r2 reconcile — CA-518 sweep pruning + canary positive path in line + import try/finally (1331b6a)
• web: restore aria-label on InFlightPagesPanel warn-dot (18909e3)

Changed

• auth,rest: cohesion accessor + secondsString cleanup + loginBucket sweep + doc drift (CA-505, CA-516, CA-517, CA-518, CA-502, CA-513) (dd66b00)
• rest: promote localAuthUsername to package constant + remove unreachable secondsString branch (D-L1, X-L1) (83b862c)

Documentation

• 2026-05-16-deliver-audit-remediation: CHANGELOG + CLAUDE.md + installation + llm-config (4dd368c)
• CLAUDE.md,CHANGELOG.md: document 2026-05-17 audit remediation campaign (4001233)
• README: bump kustomize overlay example from v0.12.0 to v0.14.0-rc.3 (f69232d)

v0.15.0-rc.3

0.15.0-rc.3 (2026-05-16)

Added

• enrich cluster — helper extraction, admin gate, tests, web UI (D-H1, X-H1, T-H1, T-H4, U-H1) (5be8393)

Fixed

• ci: ruff SIM117 + F401 in test_rebind_guard.py (79b30c9)

v0.14.0-rc.3

0.14.0-rc.3 (2026-05-15)

Added

• graphql: explain result refs + tag-merge enrichment + bulk mutation (CA-86, CA-88, CA-89) (e9ab059)

Fixed

• ci: UP037 — remove quotes from in-class type annotations (CA-172 follow-up) (7540a13)
• concurrency: optimistic LWiki settings + per-request provider gate (CA-158, CA-172) (0da7533)

v0.13.1-rc.3

0.13.1-rc.3 (2026-05-15)

Fixed

• web: onboarding step indicator a11y, close CA-374 + CA-261, CHANGELOG (CA-380, CA-374, CA-261) (0fcfa8a)
• web: per-artifact CTA semantics, admin knowledge row CTA, scope subtitle (CA-375, CA-376, CA-377, CA-379) (caeb140)

Changed

• code-health: Tier-5 audit sweep — CA-330/331/332 + CA-192/194 closed (2a9cdb5)

Documentation

• CLAUDE.md — record CA-400 PostHog ctx.waitUntil fix as load-bearing constraint (147af0e)

v0.13.0-rc.3

0.13.0-rc.3 (2026-05-15)

Added

• admin: surface Ollama model-loaded state on /api/v1/admin/llm/activity (ce56f54)
• auth: thread password_min_length to CLI + web consumers (CA-321) (fa3fd2a)
• helm: render writable emptyDirs when readOnlyRootFilesystem=true (CA-322) (6e74da2)
• security: phase 7 — LLM base URL SSRF guard + password min-length configurable + surrealLLMConfig DTO (CA-320) (0672ba8)
• telemetry agent — internal/usage rolling counters + Counts payload (CA-400 phase 2) (86330d1)
• web,security: phase 6 — Next.js CSP + PostHog PII removal + MCP probe gate (CA-320) (996069c)
• web: alias ?tab=field-guide and ?tab=cliff-notes to knowledge tab (CA-252) (a4b9e10)
• web: phase 3 — UX + a11y polish (useAsyncOp, skeleton, tooltips, forms, sidebar, topbar, openCategory) (CA-320) (cd72648)
• web: render Ollama model-swap warning on admin monitor page (aa35a9b)
• web: ruby audit Low batch — a11y + UX polish (CA-271..278, CA-269, CA-273) (8cc3554)
• web: sticky Simple/Advanced mode toggle on long-scroll (CA-264) (3a9d049)

Fixed

• ci: unused qa_deps helpers, button-test types, worker import sort (abf5e55)
• ci: use Parameters<typeof useQuery>[0] instead of any for mock signature (78c3f87)
• code-health: phase 2 — coerce helpers, joinComma deletion, UNCAPPED_SENTINEL, StoreRequirements error-return, sentinel errors, resolver dedup (CA-320) (ab19334)
• graphql: scrub low-level storage errors before they reach the browser (b51c5f1)
• infra: reconcile Phase 5 — Helm networkPolicy template (CA-320) (4cf332b)
• qa: CA-324 — discussCode prompt structure + null usage + silent empty answers (5ba768c)
• qa: CA-324 Fix B follow-up — AskModelResolver + synthesis_failed path (5d5f685)
• qa: CA-325 — make discussion-class RPC timeout operator-configurable (4736b83)
• qa: CA-326 — pin QA synth to MaxAttempts=1 + log provider-overload hint (f40ccbd)
• security,infra: reconcile codex r2 — worker SSRF wiring, sanitization, Helm memory default, PostHog tenant_id, CSP test, README (CA-320) (eb1df44)
• security: phase 1 — HSTS + token validation + JSON error sanitization + OIDC scrub + CORS guard (CA-320) (0d5f6ab)
• security: phase 1 follow-ups — trimmedName stored, HSTS docs, config.toml.example, CORS error message (CA-320) (a58336f)
• web: admin monitor mode-card uses control-radius token (CA-269 amend) (802febe)
• web: CA-363/364/365/370/U-M4 — error states, button consolidation, contrast (3d3e911)
• workers: CA-181 result_holder IndexError — append, not index-assign (d79344c)

Changed

• canonical discussionContextFromArtifact in internal/knowledge (CA-329) (9e93068)
• canonical qa.JobTypeToOp helper for REST/GraphQL convergence (CA-327) (7f4cf74)
• db: extract sqlbuild.Builder for 4 SET-clause sites (CA-306) (fdad166)
• dexter audit Low batch — fragment, stdlib, enum logging, dead alias (CA-195, CA-196, CA-197, CA-199, CA-310) (625bf31)
• rest: collapse rest.Server mirror fields onto Deps *appdeps.AppDeps (CA-328) (2e0f670)

Documentation

• aggregate CLAUDE.md entry for 2026-05-13 audit-remediation campaign (21 C+H + 2 M co-fixes) (c9ee1ab)
• CHANGELOG + CLAUDE.md for audit Medium cleanup campaign (CA-320) (939e9e4)
• CHANGELOG + CLAUDE.md for CA-324/325/326 + gqlgen scrubber (f5b4be4)
• CLAUDE.md entry + finalize campaign artifacts for CA-400 telemetry metrics expansion (d9ec4a4)
• fix duplicate section numbering in telemetry-collector-qa-fields.md (CA-400 post-validation) (2cc6266)
• tests: document nil-store scope on phase1 setupTestServer (CA-288) (fb3577a)

v0.12.0-rc.3

0.12.0-rc.3 (2026-05-11)

Added

• db: RunInTxBatch helper + atomic transaction wrapping for index writers (CA-TBD-store-multi-step-write-atomicity) (692e5da)
• db: thread context.Context through all store interfaces (CA-183 Phase 1) (0e34381)
• search: wire embeddings backfill into indexing completion (CA-TBD-embeddings-autobackfill) (691fdfc)
• security: atomic CSRF gate flag — admin route group + Bearer-bypass tighten (CA-198 + CA-201 phase 2) (127243b)
• security: block SSRF in git clone — scheme allowlist + IP denylist + redirect/submodule hardening (CA-312) (16221c0)
• security: tighten gRPC reflection gate to dual-key (CA-202) (41b00b5)
• web: inject X-CSRF-Token on every browser mutating request (CA-198 phase 1) (b43f1f1)

Fixed

• claude-md,samples: close valerie validation punch list (CA-183 phase 5 reconcile) (6b152aa)
• cli: phase 1.5 — sourcebridge ask inherits server-side mode default (CA-319) (949cd91)
• db: add ctx to integration test compile sites missed in CA-183 phase 1 (9b44512)
• db: forward ctx in GetClusterForSymbol second DB hop (CA-183 phase 2 mid-build) (27e910c)
• graphql,docs: close codex r2 punch list for P11 (CA-184 + CA-305 reconcile) (62de64a)
• helm,infra: remove /healthz, /readyz, /metrics from public Ingress (CA-318) (60d708c)
• helm: canonical registry org, pinned tag, appVersion sync (CA-223, CA-224) (ca49b87)
• helm: per-component ServiceAccounts with automountServiceAccountToken: false (CA-230) (ac1bafa)
• helm: Redis probes use redis-cli ping (CA-226) (4074532)
• helm: SurrealDB chown initContainer, securityContext, httpGet probes (CA-316, CA-225) (2885972)
• knowledge: extend OnJobFailed reconciler-callback to all artifact types (CA-TBD-knowledge-artifact-reconciler-coverage) (8c2c3d0)
• knowledge: phase 2 — allow needs-refresh transition from failed (CA-319) (c36e8ff)
• lint: remove dead ulaBlock and noCtxHandler — fix golangci-lint unused gate (37476b4)
• mcp: commit Phase 5 ctx-threading remainder + gofmt cleanup (CA-183 phase 5 follow-up) (3749b75)
• mcp: convert all noCtxHandler registrations to withCtxHandler (CA-183 Phase 5) (c52beb4)
• mcp: thread ctx through MCP resource helpers and access check (CA-183 phase 5 polish) (bcd84a5)
• qa: address validation findings — CLI legacy default, docs, enum tripwire, agentic mirror (CA-319) (4b2b90b)
• qa: persist clone cache + defensive grep-fallback path (CA-TBD-qa-no-evidence-with-hits) (ab8252e)
• qa: phase 1 — default ask mutation to deep mode (CA-319) (e2b4fce)
• qa: phase 3 — accept partial-and-progressing corpus in readiness predicate (CA-319) (7096892)
• search: flatten vectorSymbolRow + explicit field list (CA-TBD-search-vector-symbol-hydration) (2a9d54d)
• search: raise VectorTimeout default, make configurable, populate EmbedMs (CA-TBD-vector-retrieval-timeout) (730bdcc)
• security: close P8 reconcile findings — 0.0.0.0/:: denylist + gitPullCmd redirects + SSE handler tests + MCP fallback validation + docs (CA-202..CA-205 reconcile) (8b21f70)
• security: close P8 valerie punch list — T29/T44/T45/T46 tests + docs/installation.md + CHANGELOG (CA-202..CA-205) (6ae7105)
• security: gate TenantFilteredStore federation methods on tenant access (CA-203) (9fa08a9)
• security: per-tenant SSE filter, repo_id backfill, and subscription cleanup (CA-205, X-L2) (bf2b53b)
• workers: ruff I001 — sort imports in test_main_grpc_reflection.py (87856f1)

Changed

• db: decompose store.go into per-domain files (CA-182 phase 3) (04d75bf)
• db: delete ctx() helper, thread ctx parameter into method bodies (CA-183 phase 2) (88221e0)
• db: extract jobParams to deduplicate llm_job_store Create/Update (CA-185) (0e140d1)
• db: thread ctx through llm_config_store, livingwiki_settings_store, queue_control_store (6ba8e78)
• graphql,rest: delete GitConfigLoader legacy adapter (CA-305) (763d93c)
• graphql: collapse Resolver mirror fields into r.Deps.X (CA-184 Phase 1) (64fec4d)
• graphql: extract runKnowledgeGeneration shared scaffold (CA-186) (991be45)
• workers: extract _run_simple_streaming_generation envelope (CA-181) (0edc0fe)

Documentation

• audit-remediation: CLAUDE.md + flip runbook polish for CA-198 + CA-201 (ab59c37)
• changelog: fix duplicate Unreleased — fold stale block into v0.11.0-rc.3 extended notes (07ff003)
• claude-md: add CA-183/CA-182 P10 entry; fix stale store.go refs and CA-200 cipher claim (CA-183 phase 4) (14fc555)
• claude-md: add CA-184/CA-305 P11 entry (CA-184 phase 3) (dc1ec94)
• claude-md: update P8 wave-3 entry with reconcile SHA 2552036 (78845df)
• claude: add CA-TBD-knowledge-artifact-reconciler-coverage load-bearing constraints (e53072a)
• claude: update P10 Phase 5 SHA in CLAUDE.md (ea3dfcb)
• p10: final documentation pass for CA-183/CA-182 campaign ([1b30b99](1b30b99...

v0.11.0-rc.3

0.11.0-rc.3 (2026-05-08)

Added

• db: bump SurrealDB v2.2.1 → v2.6.5 + option<…> NULL remediation (CA-179) (6951279)
• learning_path: section-level repair pass for deep render (CA-178 phase 1/2) (810dc1a)
• orchestrator: Phase 2 — capacity clamp, breaker recalibration, gRPC auth, capacity provider wiring (6ea3fa7)
• orchestrator: Phases 3+4+5+6 — retry telemetry, no_think strategy-f, max_concurrent_calls DB+REST, docs (ccf8d9d)
• security: Argon2id KDF + per-installation salt for at-rest cipher (CA-200) (b4d7a08)
• security: JWT secret file-priority resolver + entropy gate (CA-311) (b55b623)
• security: pprof admin gate, Confluence handler-time secret, Notion-poll bearer auth (CA-204, CA-206, NEW-H1) (9b17a60)
• web: UX terminology + a11y wave 1 (CA-239..CA-250) (2309b60)
• worker: Phase 1 — concurrency probe, capacity RPC fields, gRPC auth interceptor (e730009)
• workflow_story: section-level repair pass for deep render (CA-178 phase 2/2) (ac1d173)

Fixed

• bench: point embedding at Mac Studio Ollama + raise gate cap (#48) (78aade2)
• ci,ca-149: release-please dispatch fallback + vscode prerelease default (#39) (111bd3a)
• compose,web: unblock Living Wiki for fresh hub installs (cache path + onboarding banner) (#41) (2f2b65a)
• comprehension: provider-aware deep_parallelism resolution (CA-173 phase 3/4) (c403b1e)
• comprehension: require backtick-wrapped identifiers in deep-render prompts (CA-176) (f907f16)
• config: drop ineffectual jwtSource assignment in auto-generate path (CI lint) (e02bb38)
• db: chunk GetSymbolsByIDs at 500 to fit SurrealDB query timeout (CA-171 followup) (#46) (490be43)
• db: cluster ReplaceClusters/SaveClusters write nil LLMLabel as field-absence (CA-174 phase 1/2) (2dd1149)
• db: preserve test-linkage edges across ReplaceIndexResult (CA-304) (a37abb0)
• infra: close 4 critical infra gaps (CA-227, CA-228, CA-317, CA-229) (4a9ac10)
• knowledge: mark understanding stage FAILED on job failure (CA-180) (60bb4c2)
• learning_path: combine nested-with in budget-skip test (CA-178 reconcile) (4546ced)
• orchestrator: Phase 5 fixup — wire SeedDefaultProfileMaxConcurrentCalls into serve boot (d99e668)
• orchestrator: startup reconciliation kills zombie knowledge jobs (CA-175 phase 2/2) (1ed4cfd)
• orchestrator: wire UpstreamCapacityProvider into coldstart resolver (ian mid-build) (e1fe4b1)
• parse: NDJSON recovery in parse_json_sections (CA-173 phase 1/4) (952f88e)
• prompts: require backtick-wrapped identifiers in learning_path + workflow_story deep prompts (CA-177) (8ec96e8)
• security: address codex r2 findings on P1 diff (1H + 2M + 2L) (a398aba)
• security: transparent v1→v2 envelope migration on read (CA-200 amend) (7028590)
• web: Confluence creds stale cache + add configured badges to settings disclosures (#42) (5acb2e2)
• web: harden UI state-derivation against partial response shapes (CA-256..260) (db1614c)
• worker: gRPC auth interceptor wraps streaming handlers correctly (#47) (2f04621)
• worker: Phase 2 fixup — wire WithWorkerAuthSecret into serve boot (D10) (fe8c290)
• worker: sentinel api_key for openai>=2.34 empty-key rejection (7a3057e)

Changed

• web: standardize user-facing surface on "Cliff Notes" (CA-241 amend) (a28d6ee)
• worker: replace strategy F prompt-injection with Ollama-native /api/chat dispatch (c98f596)
• workers: is_local_provider predicate + consolidate duplicates (CA-173 phase 2/4) (66617d6)

Documentation

• audit-remediation: CHANGELOG + CLAUDE.md for wave 1 (P4 + P3 + P1 + P7) (4903358)
• audit-remediation: CHANGELOG + CLAUDE.md for wave 2 (P5 + P9 + P2) (f045f76)
• ca-173: CHANGELOG + CLAUDE.md + llm-config for qwen3.6 confidence regression remediation (55ca7ec)
• ca-174-175: CHANGELOG + CLAUDE.md + llm-config for knowledge-job slot-stall remediation (915feb1)
• ca-176: CHANGELOG + CLAUDE.md for deep-render confidence prompt fix (6b931e5)
• ca-178: CHANGELOG + CLAUDE.md for repair-pass parity in learning_path + workflow_story (b3ee929)
• ca-179: fill commit-range placeholder in CLAUDE.md (83ab674)
• ca-179: update plan path to finished- prefix after archival (cce1c63)
• ca-180: fill commit-range placeholder + finalize plan paths (f9d9203)
• changelog: preview today's CA-169 + CA-171 + confluence-adopt merges (d777cc5)
• cross-link capacity-detection campaign + ian wiring fix (bee9199)
• tidy CHANGELOG Unreleased section (1a4f8e0)

sourcebridge-vscode: v0.3.1

0.3.1 (2026-05-06)

Fixed

• audit-refactor: phase 1 slice 6 — flatten remaining if-err-else nesting (GQL-7) (27529fa)

v0.9.0-rc.3

Full Changelog: v0.9.0-rc.2...v0.9.0-rc.3