v1.16.0

1.16.0 (2026-06-08)

Features

• add bulk certificate retirement API and UI (#347) (196ab0c)
• add GET/DELETE /api/meters/:id with admin auth (#269) (444a447)
• add input validation and sanitization to all API endpoints (#338) (964d4b8)
• add loading skeletons for async data fetches (#255) (3fc2fcd)
• add pentest scope and report placeholder (#342) (d27703e)
• add public v1 verify API and OpenAPI spec (#352) (71dc4a9)
• admin interface and fractional kWh support (49bd5fe)
• api: versioning — 301 redirects from /api/* to /api/v1/*, API-Version header (fa8bf84)
• auth: configure token expiry, rotation, and revocation list (d4117a7)
• build analytics dashboard for energy generation statistics (#350) (971c19c)
• certificate transfer endpoint and UI (#1) (477a577)
• ci: Docker image scanning with Trivy — block on CRITICAL CVEs (164dbc7)
• contracts: add upgrade timelock tests for community_governance (#284) (79f5662)
• crypto: add verifyReadingSignature and 100% unit test coverage (2b79205)
• db: add perf indexes on readings, certificates, audit_anchors (7e37584)
• e2e: add Playwright tests for dashboard, certificate detail, and public verifier (1ecf24e)
• enable Turborepo remote caching for all CI steps (#297) (9385ff4)
• governance: add proposed_action field to create proposal form (515ed8d)
• governance: configurable quorum/threshold with admin guard and edge-case tests (ecda905)
• I-REC XML export for certificates (#4) (232bf4a)
• implement BullMQ+Redis async job queue for Stellar tx (#272) (a4b425c)
• implement certificate retirement API endpoint (#270) (861bcce)
• implement cooperative multi-meter management (#351) (640d0b9)
• implement meter key revocation mechanism (#339) (ce90af9)
• implement webhook notifications for certificate lifecycle events (#353) (4205191)
• load-test: add k6 baseline + breakpoint scenarios, p95<500ms threshold (f019ccc)
• mock Freighter wallet for CI testing (#2) (325b565)
• notifications: email alerts for mint, retire, and mint failure (#140) (7ce4a12)
• security: add HTTP security headers (#129) (944c5b9)
• security: add RLS policies for multi-tenant isolation (#274) (9b2ce49)
• security: API key auth for meter submissions (#131) (a437a9b)
• security: HTTPS redirect and HSTS headers (45c9c81)
• security: restrict Supabase service role key usage (#134) (037e825)
• staging environment deployment pipeline (#295) (8169df0)
• support fractional kWh tokens with 3 decimal places (84ee9a6), closes #354
• testing: add mutation testing for Rust contracts and TS utilities (#331) (29135d5)
• web: real-time energy chart with WebSocket + polling fallback (#260) (7881a7e)

Bug Fixes

• ci: add dependency license compliance check (#344) (ab4b39e)
• resolve conflicts, reconcile retirement model, and fix tests (a0d4332)
• resolve JSX parse errors in dashboard and verify pages (a1ec4b7)
• resolve residual merge conflict markers (1c8b371)
• resolve workspace compilation and type errors (042221a)
• security: add security headers to all HTTP responses (#340) (1d6db6b)
• security: implement audit logging for sensitive operations (#341) (34d0971)
• security: implement CSP headers for Next.js web app (#333) (2834203)

Documentation

• add hardware meter integration guide (#320) (f5c4b3e)
• add inline comments and required/optional markers to .env.example (#318) (92ea4da)
• add mainnet deployment process and checklist to deployments.md (#285) (c08ad58)
• add operational runbooks (#315) (2638a9f)
• add OWASP Top 10 security review and remediate misconfiguration (#334) (092e901)
• add SECRETS.md — centralized secrets management guide (#289) (90eed76)
• add Stellar mainnet deployment checklist and go-live plan (120d730), closes #142
• add user guide for web dashboard (closes #317) (eb1a425)
• audit: add security audit engagement tracking and remediation policy (bca11a2)
• contracts: add/enhance Rust doc comments on all public functions (#319) (18c472a)
• create SECURITY.md with vulnerability disclosure policy (#314) (7698660)
• performance: ensure load test baseline + breaking point documentation (9a0056a)
• standardize CHANGELOG.md and update PR template #312 (8281f08)