Form Forge v0.2.0

0.2.0

Form Forge 0.2.0 improves response intake, privacy, data management and embedding
while retaining the existing self-hosted PostgreSQL/Inngest architecture.

Changes since 0.1.0

• Faster webhook delivery: after a response commits, Next.js attempts ingestion of
  its outbox work immediately. Inngest also dispatches newly created deliveries
  immediately. Atomic persistence, stable event IDs, leases, at-least-once delivery
  and the five-minute recovery cron remain. Scheduler outages do not turn a saved
  response into a failed submission.
• Live intake controls: pause/resume, UTC closing time, a lifetime acceptance limit
  and a custom closed message. Controls apply to every published version,
  including already-open tabs. Concurrent submissions cannot claim the same last
  place; successful idempotent retries do not consume another place or quota.
• Optional source metadata is disabled by default for new forms. The server
  enforces the setting for both hosted forms and direct API submissions. Abuse
  counters and idempotency continue without a persistent visitor identifier in
  the response.
• Workspace owners can delete a single response after confirming its full ID.
  Deletion removes its values, metadata, deliveries, attempts, events and outbox
  work while retaining shared webhook endpoints, consumed quotas and form places.
  Busy workers or recovery transactions return a retryable conflict. Audit records
  contain identifiers rather than answer values.
• Server-side UTC date filters, bounded answer-word search using PostgreSQL,
  selectable table columns and matching CSV filters. Independent new/processed
  status can be changed by editors and owners without editing original values
  or their historical version. Viewers remain read-only. CSV retains spreadsheet
  formula protection. Client navigation refreshes cached lists after mutations.
• A small optional embed script adds automatic iframe height using ResizeObserver,
  supports multiple forms and exposes ready/submitted events without answer values.
  Origin, window source and per-frame channel checks isolate messages. Plain iframe
  snippets remain supported; embed checks do not restrict direct public API use.
• OpenAPI 3.1 at /api/openapi and read-only, stateless MCP at /api/admin/mcp.
  MCP uses existing NextAuth session cookies and workspace permissions; no API keys,
  OAuth authorization server, LLM or external service is introduced.
• Dependabot configuration for weekly grouped patch/minor updates, three-to-seven
  day release cooldowns and separate toolchain updates. A monthly workflow creates
  a major-version/toolchain review issue. Security updates need the repository's
  Dependabot alerts/security-update settings and do not wait for that schedule.
  No workflow automatically approves or merges updates.
• Detailed guides now live in docs; the root README focuses on the product,
  quick start and documentation navigation. Reviewed dependency and GitHub Actions
  updates merged after the product changes are included.

GitHub, Google and GitLab remain the supported sign-in methods. Existing published
schemas, answer values, public submission contracts and webhook signatures remain
readable and compatible. No visitor analytics, unfinished-response collection or
mandatory CAPTCHA was added.

Upgrade from 0.1.0

Back up the application database, installation keys and both scheduler stores
before updating. Stop ingress/writes and workers, build for the installation's
public hostname and apply the committed migrations during maintenance. Do not
apply migrations from an application instance's automatic startup.

This release adds 0006_product_controls. It preserves metadata collection on
pre-existing forms, defaults future forms to collection off, initializes lifetime
accepted counts from existing responses, adds processing status and deletion-key
markers, and builds a GIN index for answer search. Existing schemas and saved
answers/metadata are not rewritten or silently cleaned. The ordinary transactional
index build can block writes; allow a maintenance window for existing data.

Disabling metadata affects future responses only. Deleting a response does not
return daily quota or free an accepted-response place. For 30 days after deletion,
a form-scoped keyed hash blocks reuse of its idempotency key with 409; no original
key, values or visitor identity is retained in that marker. After expiry, the key
can create a new response, so clients must stop retries after a deletion conflict.
Keep FINGERPRINT_SECRET stable. Backup copies and data already received by
external systems require separate removal; automatic response retention is not
included.

Start the application and register the updated Inngest functions, including the
five-minute recovery job. Immediate dispatch requires a supported Next.js
after/waitUntil lifecycle; cron remains the fallback. Existing iframe snippets
need no changes. Load /embed.js only when automatic height/events are wanted.

A code-only downgrade to 0.1.0 is not supported once the new intake/privacy policy,
deletions or acceptance counters are in use: old code does not enforce those
operational rules or maintain the new state. Use an isolated, complete maintenance
backup restore for rollback and retain the matching keys and scheduler stores.
Do not remove migration history or drop tables to force a downgrade.

Verification and scope

The source revision used to prepare this release passed GitHub CI on the supported
Node versions, including formatting, types, lint, unused-code checks, PostgreSQL
integration tests, deployment utility regressions, browser lifecycle tests,
production build and production smoke test. Release preparation also runs through
the same required PR checks before tagging.

Regression coverage includes cron/delete ordering at the actual outbox insert,
rollback and successful retry, quota/idempotency races, metadata enforcement,
old-version closure, workspace roles, immutable processing updates, filtered CSV,
client cache refresh and multiple cross-origin iframe height changes.

Live OAuth, public DNS/TLS, Netlify's installed adapter, production capacity and
the full three-store cold-restore acceptance drill are not certified by those
checks. Verify installation-specific paths before accepting public traffic.
Receivers must persistently deduplicate at-least-once webhook deliveries. High
availability, point-in-time recovery and cross-architecture restore remain outside
the verified scope.

Artifacts contain source, a provenance manifest and SHA-256 checksums. Images are
built for the installation's public hostname; no prebuilt image is published.
See installation and verification.

Form Forge v0.1.0

0.1.0

First stable release of Form Forge, a free/libre, Apache 2.0 form platform with
versioned schemas, hosted forms, workspaces, and inspectable webhook delivery.

Changes since 0.1.0-rc.2

• Google and GitLab sign-in alongside GitHub. Link methods from
  an authenticated account to retain the same user and workspace memberships.
  Matching email addresses never automatically merge accounts.
• Read-only access to archived forms and their published versions, archive
  restoration, and owner-only permanent deletion with name confirmation.
  Deletion refuses active background processing without deadlocking workers.
• Shared client/server validation with immediate field errors, strict number
  input handling, and clearer preview validation messages.
• Optional checkbox agreement links, interactive select-option editing, field
  insertion at every boundary, and clearer version comparisons.
• Collapsed, independently scrollable previews, responsive account/workspace
  navigation, improved dark-mode controls, and reliable theme initialization.
• Direct view/publish actions in the form list, clickable submission rows, and
  separate archive and last-save timestamps.
• Netlify deployment with Neon PostgreSQL and Inngest Cloud, alongside the
  existing source-built Docker Compose installation.
• Recovery/outbox scheduling every five minutes. A new submission and its webhook
  delivery use separate outbox stages, so initial delivery can wait roughly ten
  minutes before additional queue or transport delays.
• Clearer licensing and privacy information: no product analytics, advertising
  trackers, or usage reports to the project authors. Deployment owners control
  optional Sentry error and performance reporting.

Upgrade

Back up the database, installation keys, and scheduler storage before updating.
No database migrations were added since rc.2; retain the existing migration history.
Configure additional OAuth providers only when both client credentials are ready,
using the callback URLs documented in the root README. GitHub remains required.
Unconfigured sign-in methods remain unavailable.

Register the updated Inngest functions so the recovery job uses the five-minute
schedule. Restoring an archived published form reopens its existing public URL.
Permanent deletion also removes submissions, versions, webhook endpoints,
delivery history, and queued events; audit history and consumed usage remain.

Checkbox links extend the stored schema. Older versions that reject unknown
schema properties cannot read forms containing those links, so a code-only
downgrade is not supported for affected forms. Original rc.1 backups also lack
the stricter backup metadata introduced in rc.2; create a fresh maintenance
backup before relying on the current restore verification.

Verification and scope

The application revision passed GitHub CI: supported Node-version tests, static
checks, PostgreSQL integration tests, deployment regressions, the browser
lifecycle suite, production build, and production smoke test. The PostgreSQL
integration suite contains 46 passing tests, including competing submission and
endpoint locks, transaction rollback, and successful retry after processing.

This release does not claim that live OAuth, public DNS/TLS, or the full
three-store cold-restore acceptance suite were reverified for this revision.
Verify those installation-specific paths before enabling them in production.
Webhook delivery remains at-least-once; receivers must deduplicate delivery IDs.
High availability, production capacity, point-in-time recovery, and
cross-architecture restore are outside the verified scope.

Artifacts contain source, a provenance manifest, and SHA-256 checksums. Images
are built for the installation's public hostname; no prebuilt image is published.
See installation and verification.

Form Forge v0.1.0-rc.2

0.1.0-rc.2

Maintenance cold restore and stronger backup verification for the single-host,
source-built deployment.

• Full PostgreSQL, Inngest SQLite and Redis restore into three new empty volumes
  in a separate Compose project, without source storage access.
• Real signed Inngest cron recovery of pending outbox and retry work, preserving
  logical delivery IDs, attempt history and retry budgets.
• Independent scheduler archive, SQLite history and Redis state verification
  before workers start, plus endpoint-secret decryption and HTTPS HMAC checks.
• Corrupted backup and incorrect encryption-key refusal before processing.
• Complete backup checksums covering installation keys, TLS, deployment
  configuration and release provenance; incomplete backups remain marked.
• Streaming checksum calculation and cleanup that preserves pre-existing
  destination stores when restoration is refused.
• Regression tests for backup completeness, isolation, bounded checksum memory,
  scoped cleanup and failure reporting. Python 3.9 remains supported.

Original rc.1 backups omit the new metadata and complete checksum coverage and
cannot pass the stricter verification unchanged. Create a new maintenance backup
with this release to use the strengthened verification procedure.

Application APIs, authentication, dependencies, database schema and at-least-once
delivery semantics are unchanged. The full extended acceptance also verifies
graceful scheduler restart, lost acknowledgement recovery and retained data after
PostgreSQL/Redis restart. Completed delivery is observed over two additional
completed recovery ticks; this is not an exactly-once network delivery guarantee.

The reference configuration is verified with Linux arm64 containers on one host.
Public DNS/TLS and live OAuth require installation verification. This release does
not establish cross-version or cross-architecture restore, abrupt power-loss
recovery, point-in-time recovery, high availability or production capacity.
See installation and verification.

Form Forge v0.1.0-rc.1

0.1.0-rc.1

First single-host self-hosting release candidate, built from source for the
installation's HTTPS hostname.

• Locked multi-stage Docker build, non-root standalone runtime, production
  configuration validation and build/runtime hostname consistency.
• Persistent PostgreSQL, independent Drizzle migration service, and application
  readiness checking database connectivity, migration state and HTTP rendering.
• Private self-hosted Inngest with signed SDK calls, minute recovery cron,
  persistent SQLite history and authenticated Redis with AOF enabled.
• HTTPS Nginx ingress with trusted client-IP replacement and private scheduler
  endpoints.
• Reproducible source archives with commit provenance, file hashes and checksums.
• Maintenance backup, isolated restore and disposable scheduler/HTTPS acceptance
  procedures, with regression tests for secret exclusion and failure reporting.

GitHub OAuth, workspace permissions, schema versioning, webhook restrictions and
at-least-once delivery retain their existing contracts. Generic production
configuration supports managed Inngest; self-hosted overrides are supplied by
Compose.

The reference configuration is verified with Linux arm64 containers on one host.
Public DNS/TLS and live OAuth require installation verification. Other CPU
architectures, future-version upgrades, abrupt scheduler termination, power loss,
point-in-time recovery, high availability and capacity require separate validation.
See installation and verification.