Repository navigation
Releases: CalibraFacil/calibrafacil
Releases · CalibraFacil/calibrafacil
Release list
v0.4.1
0.4.1 (2026-10-28)
Bug fixes
v0.4.0
0.4.0 (2026-10-28)
Features
- api: health alerts (stale/failing crons, dead letters), /api/metrics, request id + access log (roadmap 2 G2) (#149) (4af00c4)
- jobs: a failed certificate render is RENDER_FAILED, retried by a manager (roadmap 2 C5) (#163) (3756f8c)
- jobs: the server says which actions the member may take (allowedActions), with separation of duties; the web follows it (roadmap 2 F1) (#158) (2bf61ff)
- methods: a declared decision rule (ILAC-G8) decides the as-found verdict and the out-of-tolerance alert (roadmap 2 C4) (#152) (c842d53)
- standards: calibration history; judgement by the certificate valid on the day of the work; renewals bring values; double precision (roadmap 2 C3) (#160) (b0c3190)
- sync: record the desktop clock skew with the changes it pushes (roadmap 2 E2) (#166) (da69af5)
- web,portal: measurement values in pt-BR with the decimal comma; one shared parser for typed readings (roadmap 2 F3, Q47) (#159) (527e432)
- web: an expired session is one notice with a way back in, not a retried error (roadmap 2 F4) (#168) (7e1f85d)
Bug fixes
- api: API key expiry/IP binding/live creator role, fresh session for sensitive actions, sniffed raster uploads, masked signer CPF (roadmap 2 D3) (#148) (b2930ea)
- api: CORS only for configured origins, Origin check on cookie writes, trusted-proxy client IP, rate limits, body limit (roadmap 2 D1) (#147) (81a52f0)
- api: no error response returned from inside a transaction; lint rule (roadmap 2 D4) (#164) (82ea0c7)
- api: one error shape: validation failures and bare HTTPExceptions answer { error, code }; api-app.ts route list checked against the server (roadmap 2 D2) (#157) (da46fd9)
- approval: separation of duties on the submitter, mandatory gates for accredited labs, standards re-judged at approval, recall covers in-flight jobs (roadmap 2 B5) (#143) (c83311a)
- auth: close Better Auth org creation + route allowlist; unit_admin elevation; separation of duties (roadmap 2 A1) (#131) (be57014)
- certificates: amendment supersedes atomically on issue, full technical record, withdraw via append-only status events (roadmap 2 B3) (#137) (81a9eeb)
- certificates: coverage sentence from the frozen result, signatory title from the signatory record, calibrating body, verified-only traceability (roadmap 2 C1+C2) (#140) (84b1d9e)
- certificates: seal from the frozen scope verdict; enforce by default for accredited labs; lapsed signing certificate fails closed (roadmap 2 A6) (#134) (312a0f6)
- ci: the restore drill installs the newest PostgreSQL client of the server's major (#145) (1c49174)
- ci: the restore drill runs the PostgreSQL client of the server's major (PATH), not pg_wrapper's 16 (#155) (d2a7de3)
- db: every connection runs in UTC and start-up refuses another session TimeZone (roadmap 2 C5) (#154) (a8265d3)
- db: evidence tables immutable by privilege, owner-only hatches, hash chain on job_audit_log (roadmap 2 B1) (#138) (eb9ad51)
- db: per-lab service-order document numbers; tenant unique-key and migration-journal invariants (roadmap 2 A4) (#130) (6f1140c)
- db: statement and idle-in-transaction timeouts on the application connections (roadmap 2 D4) (#165) (1408fc0)
- deps: better-auth 1.7.13 (GHSA-965c-763c-88jm, critical) (#144) (63c2d06)
- desktop: IPC origin check, navigation guards, CSP on app://, deny-by-default permissions, fuses (roadmap 2 A5) (#133) (ed408f7)
- jobs: post-approval asset effects in the approval transaction; notifications queued; nightly reconciler (roadmap 2 B2) (#136) (6068fb7)
- ops: scheduled backups with a verified restore, and compose hardening (roadmap 2 G1, G3) (#141) (c255954)
- ops: self-hosted storage config, fail-closed storage checks, worker scheduling, graceful shutdown (roadmap 2 A3) (#128) (fed5f3e)
- portal: a transient failure on the public quote is retryable, not "link expired" (roadmap 2 F4) (#167) (7c83c83)
- security: safeOutboundFetch for user-configured URLs; queued webhooks with retry and truncated responses (roadmap 2 A8) (#135) (6e83185)
- signing: envelope encryption of signing credentials, chain validation at upload, compliance audit log (roadmap 2 B4a) (#139) (cb80eff)
- sync: per-aggregate ordering with a server-side expected version; refused changes hold their dependents; audited discard (roadmap 2 E1) (#146) (8be48a5)
- sync: per-operation RBAC on push; offline attachments are uploaded and verified before their event (roadmap 2 A2) (#132) (76662a0)
- sync: scope fingerprint on the cursor, auth_required on 401, per-install device id (roadmap 2 E2) (#161) ([2108b41](https://github.com/CalibraFacil/cal...
v0.3.0
0.3.0 (2026-10-26)
Features
- api: typed domain errors with stable codes, mapped once (#70) (25649d6)
- certificates: freeze certificate_input at approval; the worker renders only from it (P2-5) (#96) (0f9462e)
- config: one validated configuration module per runtime, failing fast at start-up (#82) (00b266d)
- contracts: typed contracts for standards, limits, job create, the portal and desktop parity (P2-15) (#95) (12d4bfa)
- db: database-level guard on calibration_job status transitions, generated from JOB_TRANSITIONS (P2-6) (#94) (169fc63)
- db: freeze approved jobs and make evidence append-only in Postgres (ec10e30)
- db: freeze approved jobs and make evidence append-only in Postgres (bd59caf)
- db: org-bound forOrg handle, raw-db ratchet in routes, portal fully migrated (P2-2 slice 1) (#98) (2737c22)
- db: organization_id on every tenant table with composite tenant keys (P2-1) (#87) (137bf2a)
- db: row-level security in shadow mode for a calibra_app role; owner unaffected (P2-3) (#105) (8678e16)
- desktop: enforce calibration location and phase justification at submit offline and at sync (P1-12) (#93) (298a8a1)
- jobs: draft saves keep a saved standard that went stale, with a warning; submit stays the gate (P1-11) (#92) (fbd5220)
- jobs: one submit/execute command for cloud, public API and desktop sync (#81) (469d56a)
- jobs: reject, cancel, assign, edit and amend as commands; no route writes jobs directly (#83) (fc37bd8)
- math-engine: pin the engine version to a source hash and reproduce the EA-4/02 examples (db54bde)
- math-engine: pin the engine version to a source hash and reproduce the EA-4/02 examples (4187712)
- retain regulated records (no cascade into evidence, soft-deleted labs, retention policy, purge job off by default) (#75) (a2c34b2)
- rls: calibration jobs run in org-scoped transactions (P2-18f) (#118) (6be8edd)
- rls: client portal runs in org-scoped transactions (P2-18a) (#110) (e326716)
- rls: desktop sync runs in org-scoped transactions (P2-18i) (#122) (b4a961d)
- rls: enforce row-level security by default; app runs as calibra_app (P2-18k) (#124) (893e01b)
- rls: integrations, public API, API keys, webhooks and notifications run in org-scoped transactions (P2-18h) (#117) (deb6752)
- rls: master data runs in org-scoped transactions (P2-18c) (#112) (026e4ad)
- rls: NC/CAPA, dashboard, reports and signing run in org-scoped transactions (P2-18e) (#115) (5de7cb1)
- rls: pre-org identity, platform sweeps, worker handlers and CLI on explicit paths (P2-18j) (#121) (f33aed0)
- rls: quality records run in org-scoped transactions (P2-18d) (#113) (2dd8128)
- rls: service orders and finance run in org-scoped transactions (P2-18g) (#114) (ee802b7)
- sync: commit-ordered change log with tombstones and a paged resumable bootstrap (P2-4b) (#104) (479d7b0)
- sync: typed versioned protocol, one transaction per event, stale-base conflicts, minimum desktop version (P2-4a) (#99) (881c9f8)
- typed and validated API contracts for jobs and the portal overview (#79) (1a8346b)
- web,portal: route error boundaries, a parallel portal startup and stable paginated lists (#69) (d80d3bd)
Bug fixes
- api: check request-supplied ids against the caller's organization (2506827)
- api: check request-supplied ids against the caller's organization (56d672e)
- api: guard every job status change with a compare-and-set (fe311b7)
- api: guard every job status change with a compare-and-set (a953d77)
- api: require the organization admin to change certificate numbering and the scope guard (59762f6)
- api: require the organization admin to change certificate numbering and the scope guard (f434726)
- api: send every approval through one approveJob policy (31c0109)
- api: send every approval through one approveJob policy (b9c0726)
- cash forecast counts order-less documents, quote PDF route, first-click OOT ack in the app (Q34–Q36) (#116) (a584d20)
- deps: electron 42.11.18 and vitest 4.1.12 for the open Dependabot alerts (#108) (c59be79)
- deps: next 16.4.2 for the critical RCE advisories (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr) ([#97](https://github.com/CalibraFaci...
v0.2.0
v0.1.1
v0.1.0
0.1.0 (2026-10-07)
Features
- api: add init and create-lab commands for new installs (d4fd317)
- api: fill the demo laboratory with sample work (4f6307c)
- api: let the demo customers sign in to the portal (88aa445)
- api: run the scheduled jobs in-process with CRON_SCHEDULER=internal (ee5a3f4)
- deploy: self-host on one server with Docker Compose (80889b6)
- email: send over SMTP as well as the Resend API (7cf7193)
- site: show the whole dashboard in a lit, nested frame (cead574)
- web,portal: read deployment settings when the image starts (3339faa)
- web: point new labs at the right controls with a guided tour (e0c2035)
Bug fixes
- deps: patch the seroval, sharp and source-map-js advisories (917f00c)
- desktop: build the usb module with C++17 (01070ce)
- documents: render document titles as a single string (ba50561)
- web,portal,docs: stop loading Vercel Analytics (5639475)