v5.1.0

The instruction document is typed with pydantic in expertloop/document.py. A citation now has to be a line range in the note the set was compiled from or a reference to a source of a known kind, so an empty citation object or a line past the end of the note is a 422 rather than provenance, and an edit that cites a source the registry does not hold is refused unless it passes register_unknown_sources. Documents that leave out an optional list no longer reach a KeyError, because render_prompt and the executor read every section with a default, and a decision rule without a condition is rejected at the boundary. The compiler reads "do not proceed until X" as a guard on the step rather than a forbidden action and no longer treats a negated stop word as an instruction to halt, and membership requires the operator to be spelled out, so "logged in user is admin" is a comparison.

Authentication has no default keys: api_keys ships empty instead of four documented demo keys, authenticate checks only the keys configured for the running application, and an unconfigured or explicitly empty list answers 401 from every authenticated endpoint. The demo Compose stack passes its example keys explicitly and binds the API and the fake targets to loopback.

Delivery carries a delivery_id that is stable across retries, skips a target that already holds that version, posts the Jira comment as an Atlassian Document Format body, and audits a failed rollback. Every service function that writes state takes a row lock on the instruction set. tests/test_golden.py writes what the compiler and executor produce into samples/expected/, and the browser demo's self-check reproduces those files.

The static browser demo in web/ gained the source drift, reviewer workload, versions and merges, test gate and whole-run sections, so the port now covers the compile, drift, review, versioning, gate and delivery paths, and web/README.md lists what it leaves out. Its approval state machine is HTML rather than a scaled SVG, so the labels hold their size at phone width, and the muted text tokens were adjusted to pass WCAG AA contrast.

v5.0.1

Patch on top of 5.0.0: the ops overview counted each rollback once per delivery target (webhook and Jira), so a single rollback showed as two. It now counts the rollback itself, matching the demo summary. No schema change; 48 tests.

v5.0.0

The executor's condition grammar is now a plugin registry: flags, membership ("role is one of admin, owner") and the original comparison grammar ship built in, and a deployment can register its own grammar ahead of them. Every execution trace records which steps ran and which decision rules fired, so GET /instruction-sets/{id}/coverage can say exactly which steps and rules the test cases never reach, and each test run stores its coverage summary.

GET /ops/overview pulls it together: sets by state, coverage of the latest runs with the weakest sets listed, open drift flags, review SLAs and publish statistics, plus the plugin list. The README gains a Releases table summarising v1 through v5. Migration 0005 adds test_runs.coverage. 48 tests.

v4.0.0

Any two versions of an instruction set can now be compared with a structured, step-level diff: added and removed steps, per-field before and after on changed ones, and the section entries that moved. It reads the stored snapshots, so it works for history as well as the head.

Branches let an expert experiment without touching a live set. POST /branch copies a version (the published one by default) into a new draft with its own edits, test runs and review; POST /merge three-way merges it back into the parent head, taking one-sided changes and returning a 409 with the exact conflicting steps and fields when both sides changed the same thing. Migration 0004 adds the branch columns. 44 tests.

v3.0.0

Review policies now live on each instruction set: which reviewer roles must sign off, whether the person who wrote the current version may approve it (they cannot, unless the policy says so), and how many hours a review may take. Approval responses and audit events name the roles still missing, so a set with two reviewer approvals still waits when the policy asks for an admin.

Submitting starts the review clock. POST /reviews/escalate (and the background scheduler) writes a review_escalated event for every overdue set once, and GET /reviews/workload shows the queue with deadlines plus what each reviewer still owes. Migration 0003 adds the policy and timing columns. 41 tests.

v2.0.0

Sources can now drift out from under a published set and the service notices. Re-hash a source on demand (or re-register it with new content, or let the scheduler do it on an interval) and every step that cites it is flagged stale; GET /instruction-sets/{id}/drift shows the open and resolved flags, and publish is refused until an expert re-verifies the steps or edits them.

An edit only refreshes source hashes on the steps it actually changed, so fixing an unrelated step does not quietly clear a flag. Migration 0002 adds drift_flags and sources.last_checked_at; the suite now also round-trips every Alembic revision. 38 tests.

v1.0.0

First stable release of the note compiler and review pipeline. Expert notes compile deterministically into versioned instruction sets where every step cites its note lines and registered sources, edits are guarded by optimistic concurrency, and publication requires an approved review plus a green test run on the current version.

Deliveries go to a signed webhook and a Jira target with per-target receipts, and rollback re-delivers the previous published snapshot. 34 tests run against PostgreSQL through Testcontainers.