Added
- Add HuML/TOML filing-tree preview, import, merge, and tree-only export. The first
prefixed import creates permanent A00–Z99 filing systems, memberships,
SYS.AC.documentIDaddresses, and a recoverable00.00 archive.humlindex. - Add the pre-release Companion contract: five-minute single-use pairing, bound
filing-system identity, compatibility/scopes discovery, idempotent document
and version uploads, device OCR provenance, split-origin lookup, metadata reads,
bounded thumbnails, and device revocation. - Add type-to-select existing tags in document detail and bulk assignment on
Documents. Admin Manage tags links open one searchable Settings catalog,
with confirmed multi-tag deletion; saved-view editing and password-unlocked
state also appear in document lists and detail. - Add explicit application assembly through
distro/app.Run, independently
checksummed extension migrations, and an instance-owned automation-action
registry. Compiled distributions can register native routes and durable
subscribers before workers or the listener start; unlisted routes remain
session-only.
Changed
- Resolve classifier-created
needs-reviewwhen a person edits document
metadata through PATCH or bulk metadata/tag actions. The removal commits
with the edit; manual review tags and explicit reassertions remain, while
Trash, restore and rescan alone do not clear review. - Upgrade beta.2 archives directly to beta.3/schema 3 after taking a complete
backup of SQLite, blobs, the credential key, and configuration. Stable v1 will
accept both beta.2 and beta.3 archives directly; retain the backup and beta.3
release artifacts until that upgrade is verified. - Apply high-confidence inferred dates, model metadata, and local archive matches
by default, with review-first mode available. Suggestions remain bound to
source and field generations; review and queued application recheck the current
session, permissions, supporting documents, human edits, and explicit clears. - Make Archive Configuration the sole administration surface. Selecting a preset,
importing a tree, or explicitly choosing Blank is the only required archive
setup step; the Filing tree reminder persists across navigation and reloads,
while every ordinary setting remains available beforehand. - Ship all unreleased database work in migration 0003 without changing published
beta.2 migrations 0001/0002. Fresh and populated schema-2 archives advance to
schema 3 with preserved IDs, history, credentials, and a one-row
final-beta-schema-3marker. Stable v1 uses a squashed fresh-install baseline
and guarded compatibility paths so users can upgrade directly from beta.2 or
beta.3 without installing an intermediate release. - Define strict offline
suchi-taxonomy/v1; reject YAML and unsupported fields,
merge later presets/imports additively, keep refile explicit, and place rendered
projections under immutable per-system roots. Native takeout v2 remains a
selected-system export rather than a complete backup. - Publish versioned images without moving aliases, then promote stable/beta/RC
aliases only after signing, SBOM collection, and the GitHub release succeed.
Release runs are serialized, and dispatch verifies that the GitHub annotated
tag peels to the local commit. - Make automatic Processing update approval reminders a checked-in,
per-pipeline release policy. New proposal revisions are default-off and fully
determined by the release tag; existing reminders and explicit rescans remain
available. - Reuse verified AnyDoc artifacts and avoid unnecessary thumbnail decoding and
document-detail reloads.
Fixed
- Preserve literal SQLite filenames, archive isolation, taxonomy descriptions,
disabled or forked rules, symbolic filters, filing identity, and existing
Trash timestamps. Conflicts fail before partial taxonomy or seed changes. - Recover owned rendered links after archive changes and restarts without
overwriting unrelated files or letting purged links reappear. - Preserve sensitivity in new versions and current parent metadata in split
scans; stop extraction-created children after Trash; enforce restore limits and
reject custom-field edits on trashed documents. - Bind approval decisions and retries to their originating review, prevent
duplicate effects and reopened expired reviews, recover only provable beta.2
work, release the writer after callback panics, and expose only bounded producer
provenance with the same owner-level source checks used at application. - Keep upload, download, pairing, document-save, and Trash operations bound to
their original actor and filing system. Fix demo startup, streamed refile
options, account-tool visibility, avatar refresh, settings scrollbar clearance,
email-rule resizing, and QR alignment. - Keep child tags when deleting their parent (including on already-applied
schema-3 archives), and make selected-system multi-tag deletion atomic.
Security
- Enforce filing-system selection, token binding, membership, scopes, and document
ACLs across reads, counts, search, tasks, research, blobs, versions, uploads,
and Trash. Administrator privilege never bypasses an explicit token boundary. - Bind OAuth and mobile pairing to the actor and filing system. Membership removal
atomically revokes shares, tokens, and pairings; pairing validates public origins
and consumes each code with token issuance. - Prevent self-disable and last-administrator removal, recheck authority after
password hashing, normalize role capabilities, and commit dependent revocations
with account changes. - Rate-limit every credential alias and cap all concurrent Argon2 hashing and
verification across account creation, shares, login, and token checks.
Cross-site anonymous session creation, including headerless form posts and
decoded API slash aliases, is refused before routing. - Revalidate authenticated blobs and thumbnails on every browser reuse so logout,
account changes, ACL revocation, document state, and sensitivity gates take
effect before a cached response is reused. Public share metadata, unlock
responses, and downloads areno-storeso revocation, expiry, and password
changes cannot be bypassed by a browser or intermediary cache. - Pin the built-in demo corpus to its compiled SHA-256, resolve custom sidecars
before reuse, and never retain a verified marker across unverified replacements.
Confine manifest fixtures to already-opened regular files underfixtures/,
rejecting path traversal and non-regular files. - Keep extension migrations in separate checksummed ledgers and reject steps that
change corePRAGMA user_version. - Separate browser sessions from headless token exchange, constrain development
credentials to explicitly safe listeners, and retain request IDs and security
headers on rejections.