v0.1.0 — Platform shell (2026-08-25)

The first cut of the Aurume platform shell — the identity, project, and knowledge spine that later AI features are meant to be born into (gated, scoped, and grounded). Everything here landed on 2026-08-25. Pre-release: early development, expect change.

Added

Project & governance

• Open-source foundation: AGPLv3, an individual CLA (CLA Assistant Lite bot), plus Code of Conduct / Security / Contributing / NOTICE and GitHub issue templates.
• aurume.dev landing page on GitHub Pages (custom domain) — hero, principles, Tech stack, roadmap, mobile nav, footer links.
• ADR 0001 — auth, RBAC, and multi-org tenancy design of record.

Identity, auth & RBAC

• Shell app (Next.js 16 · TypeScript · Tailwind · pnpm) with Better Auth (organization + admin + access-control), Drizzle, Neon Postgres.
• Capability-based RBAC (resource.action) with a fixed role set (owner / admin / manager / contributor / stakeholder / finance / viewer).
• Multi-org tenancy across instance / organization / project scopes.
• First-run /setup, /login, and people/invite (/admin/people) → /accept-invitation/[id].
• Invitations carry a discipline (job title) and email via the org's Resend (env → console fallback). Disciplines are growable, with custom titles per workspace — separate from permission roles.
• Instance Super Admin (/superadmin): cross-org god-mode — grant/revoke super admin, ban/unban, delete org (cascade), and impersonate any user.

Connectors

• Encrypted org connectors (/settings/connectors): connect/update/disconnect; secrets encrypted at rest, masked, never sent to the client.
• Slack and Microsoft Teams providers available alongside Resend; Anthropic/Jira staged.

Projects

• Creation + member management — unique ID, name, description, budget + currency, expected start/end; creator auto-added; RBAC-gated create.
• Per-member hourly rate + timezone for globally distributed teams.
• Dates as MM/DD/YYYY; required fields on creation (budget, currency, dates, member rate + timezone), enforced UI + server.
• Settings page with lifecycle-aware editing: budget editable anytime; the expected start locks once the project has started, after which only the end is editable. Started / Not-started badge.
• Slack & Teams channel binding per project, with workspace-connection status.

Knowledge space

• Per-project knowledge space — upload any file type (25 MB) or add notes; pluggable filesystem blob storage (S3-ready), auth-checked download, delete removes row + blob; plain-text content extracted on upload.
• Organization knowledge space — every project's knowledge rolls up, plus org-wide items.
• getKnowledgeForAI(projectId) returns the whole org knowledge base tagged by scope (organization / this-project / other-project) — the retrieval hook for the coming AI layer.

Security

• Envelope encryption for connector secrets: per-secret data keys wrapped by a KEK from a dedicated AURUME_ENCRYPTION_KEY (falls back to BETTER_AUTH_SECRET). Rotating the auth secret no longer breaks connectors; rotating the encryption key only re-wraps data keys (Platform-admin "Re-wrap connector secrets" + AURUME_ENCRYPTION_KEY_RETIRED). Legacy secrets decrypt and upgrade transparently.

Changed

• Project detail: Project ID moved under the name; redundant settings helper line removed.

Fixed

• Super-admin run() return type widened so { ok } actions type-check (project type-checks clean).

Docs

• docs/GAPS.md — inventory of everything not yet built (AI layer, lineage/delivery chain, ingestion, ops) with priority, effort, and a suggested build order.

Full changelog: CHANGELOG.md