v1.0.0

Changelog

• 9c674462a1a3581cdd0e9d64e2f252901eac2cef Disambiguate session terminology in exploration CLI summary (#12)
• 52d89da031542466265f54eb32e68eaa5cfe832a Harden beta launch readiness
• 9281fec5d618428357ad304298b70ab39bce5be0 Implement credit-based billing
• 8f719074f7322539bafe44fd31b6783a86ac1e5d Merge remote-tracking branch 'origin/main' into fix/rate-limit-migration-pk-order
• 144be00a0b4f33e138e93518cfd67deaf88910ff Merge: /v1/me, /v1/api-keys, /v1/feedback, /v1/auth handlers (100% func coverage on new files)
• 05b3442d3a5495bb563668320a0031429e024f25 Merge: internal/webapp embed package (88.9% coverage)
• 1ad2e9d02692ecf660095239355804f73042c047 Merge: internal/webapp embed package (88.9% coverage)
• 1072d2c74069ad391a32dbbb244444b965ea015a Merge: web/ SPA scaffold (Vite 6 + React 19 + TanStack Router; 16 tests passing)
• 4cbb973b414968889cf4e1e28415cfdd750b5dcd Scope public CLI to exploration-only and harden for agent use (#7)
• f4106d53d17899cb004a8881505a7c6ac2f4c159 build(release): add Dockerfile.cli for GHCR publish
• 40e5f2d167fe64d2a9ac43217edb9d1bda58e413 build(release): add GoReleaser config and release workflow for the public CLI
• b533e9bf62c72296f9d3b18fee24d88cbf6c3f17 build(release): add install.sh with SHA-256 verification
• 33df0fae19cd0fa5e5680dae7073508ccf9aeb44 build(release): wire Homebrew tap into GoReleaser (item 10/10)
• 6edf0c4a067e9339fa60ed2fa710892af922ae6c build: add Makefile (web pipeline + go build/test/vet)
• 8b9966c13513281103e77cbbdb89cabda0c9de6e chore(cli): write run reports under results/ instead of repo root
• 620011f2429835e16190681f92773d38f8811c58 chore(config): switch default LLM to moonshotai/kimi-k2.6
• a16aab9083eaa91c60c725e67fd5209fb910dd05 chore(dev): add MinIO + bucket init to docker-compose
• 8302e8f62651ecb8fc5a1ff996e344c84ddc6481 chore(docs): rename doc/ to docs/ and reorganize structure
• 9f608bac0c70ae00c607045f7148a698526834f3 ci: run MinIO as a container step, not a service
• c96480683d093632fd45c0acd800db61ea431c84 ci: stub dist title to match webapp test expectation
• 1c3c6f943717bde74233ca6f435926702783d60e ci: stub embedded SPA dist so Go jobs can build
• 145ec0b671aac95cb3be07f275602a41d4d25807 ci: use pgvector/pgvector:pg16 for the smoke Postgres
• 0ed57e9c2900ae8277cc45b18d870eb66955da5c copy(marketing): lean the landing into real Census-sampled personas
• 7ed6924f1fd5e23e9e76ab9f338166020019c647 docs(checklist): finalize launch-readiness status (9/10 shipped)
• 3fc97a5f99c118ce498a628623319acfb346927e docs(checklist): mark README quickstart shipped (item 9/10)
• 87913da629f77814a5f9925c40dd6c0b66cb179f docs(comparison): document severityRank's full mapping
• 077f064cfb0fcda88a96f3d051e85ceea331b01f docs(comparison): refresh CompareExploration doc comment
• 7695ffedbcdd2a764a43e1152edb007299008524 docs(copy): align glossary on "persona" + add demographic credibility line
• 998b77caf84a2b55ecd1bab3d7577ca8470848dd docs(deploy): add shared-VPS rebuild + dual-app deploy runbooks
• e4fb532e7775f71b43fed6de781ab3422a345974 docs(deploy): firewall, sizing, systemd backup timer, Stripe/Resend setup
• 253d77ddffbd91fabe92e522788c4acdc0a59d39 docs(design): seed PRODUCT.md and DESIGN.md for the Boidwatch direction
• 6c744cda9e54e0d79f9e866fb2f7039d99d763c1 docs(plan): add implementation plan for PM-readable exploration report
• 26c8bd9f32249c5e2d962d99138f573f0a8960cf docs(readme): lead with public CLI quickstart (sub-60-second flow)
• 2b89389c3e58bc2eda247f35747205d7e901d1b9 docs(spec): add PM-readable exploration report summary design
• 70f876e1ff52c747ac1a2c9252c9b77b74eb0194 docs(types): document RunSummary.TopGaps cap and ordering
• cbd2b41436954199216c5062801855436d01dceb feat(agent): persist and render key-moment screenshots in exploration
• 088d66ba94e95740ce526828a1a17ecad7408290 feat(api): add GET /v1/runs list endpoint
• 64e797450791c657f924dfe3c913c35567a52c83 feat(api): add POST /v1/runs/preview for dry-run cost preview
• 6b0bb44641f478756c10c6fab5e8d88925a066e9 feat(api): server-side Idempotency-Key dedup on mutating POSTs
• cb5378ee044f9385b81c9930b0979f6c4537fb32 feat(api): support format=summary and format=html on run results
• 3717c249e4c66a6028bff0a8712a917652f81450 feat(auth): Google + GitHub OAuth sign-in
• e533123b8ee229497205f0df312785c07399dff1 feat(backend): auto-refund failed runs, account-deletion/logout-all endpoints, IP rate-limit auth routes
• a06b7e244934fe3d2b3513858ac6dd980fbaf298 feat(billing): 2× credit multiplier for credentialed runs
• 2a8e02daca9faa859548af77b69540368b61c95c feat(ci): add API DTO drift guard (check-api-types) — the spec's missing stopgap
• fb9b97e15d3d7b39333cb354858d2c22ffe41602 feat(cli): split public HTTPS-only flockate CLI from flockate-server
• 3d2543e230ba83b8bc4ba8cbb095e506afd73b9f feat(comparison): build run summary with top-gap selection
• d1fe2344824b73993424b0a3daacf29850398de7 feat(comparison): enrich archetype breakdowns with persona context
• fc2c8d8d181b154ffbf28ad327198aa5ada01ab9 feat(comparison): refine HTML report styling and use template renderer
• 1710dfbed60889a055f5ce2cc41805f33d75cf28 feat(comparison): render PM summary and archetype context in exploration report
• a1d0a05ad8311b8f6045c2878cffbc7cd65890cd feat(comparison): wire enrichment and summary into CompareExploration
• d1c78526814f7c1d5f890c4637307f310b5788c6 feat(deploy): legal pages, SEO assets, and single-VPS deploy runbook
• 07f294da03bca1ce57997122d9ac9cc04fbf8a92 feat(deploy): off-site R2 Postgres backups + monitoring guidance
• ec3039baf581eda687720cef05d215ef6bee9e86 feat(exploration): add exploration eval mode with cognition capture and perception summaries
• b5b5f206a2d14d0d87d75a5c6d66fb85bd19a6d2 feat(llm): add OpenRouter provider and per-run model override
• e9fb1b2180314fc5d75e321251b4d364df7f1e00 feat(marketing): add real-report showcase, clarify cards, fix funnel labels
• 8305768caee8860306bc7904238eeec51e667ac4 feat(marketing): re-skin the beta landing to the Boidwatch direction (Chunk 4b)
• 3369f69c861c9710ea535a598296b9da63c35503 feat(marketing): real boid identity on the landing — flock, accents, persona funnel (Chunk 4d)
• e928efcb6c6b6d6e5631a6432ab1cc0eda07abad feat(marketing): static beta landing page + SPA email hand-off
• d8f53e2757f820a5b65d369241567862f70ed55c feat(orchestrator): load personas for exploration enrichment
• d9b8f5b586c0c763fce2c71f03ed516514ae858d feat(persona): add curated archetype descriptions
• 29b1058c8828624d3823e7a8ddbcf0a7e2f4f3f2 feat(runs): credentialed runs capture screenshots by default + portable HTML export
• 49a89e7906e698ea9540e81ac65b82eb875db44a feat(server): Resend mailer, private metrics listener, model startup check
• eeb4c287595269a9ca7b1435d76e20696845a070 feat(web): /v1/billing/transactions handler + user/session/api-key store methods
• d380a8489d36467d62c97cf41a824376dc360901 feat(web): /v1/me, /v1/api-keys, /v1/feedback, /v1/auth/logout handlers + tests
• 1393635112922c565ccae0770c85a7db7a45d3ad feat(web): SPA scaffold (Vite + React + TanStack Router + login)
• 451cef586d7c7e00317ea0accb4b1626b318e314 feat(web): foundation for hosted web app (migrations + auth primitives + DTOs)
• 745b6e75a05260dd82c2dcb27f1564af971165e2 feat(web): full SPA pages + cartography brand identity
• 224407e93bc3b7fe7c8443b6f01f4a2ab4eb6d33 feat(web): internal/webapp embed + SPA history fallback + security headers
• 9776903b49486e56262338e3121f3d1bcc7b158f feat(web): live BoidField backdrop on Login and Dashboard heroes (Chunk 2)
• aa88cf5d8e03d0fae870475dd3e3a6f8addabf0b feat(web): magic-link signup + checkout session-only + auth regression tests
• bfb94b1db21f4bd7f414fde68941762339484299 feat(web): one-click "Sign in as demo" (FLOCKATE_DEMO_MODE)
• 180cc136b9a4140c7eb4722057f7b69bc37a03cb feat(web): open report screenshots in a host lightbox instead of new tab
• b41f8c2a69a12730377f2f1869064b1006ad5760 feat(web): persona-count slider on dashboard exploration form
• ed4a01a1d30cd97bd86a916216f3d9a7a48dffd0 feat(web): proxy report screenshots through API so iframe images render
• 820498f1b1c8ca3a144bdf8ee9f43140e418f8f7 feat(web): re-skin to cool-light boid identity (Chunk 1)
• 5863a67d26d8c8bf84cfd11ef2fdeb331ee9eb40 feat(web): reconcile run-state labels, add PostHog, wire account controls
• 8419c8c20ec8504796711738c3a2dd26e60f10da feat(web): show signed-in user identity in the top rail
• c3054cd9d60865463ba5bd058064b3d3f1d45696 feat(web): wire web frontend routes + SPA mount + AnyAuth/CSRF middleware
• b76a7ef0ec8187aec0dbd03d40420cc05186c448 feat(web,marketing): add beta badges + light polish
• 7dc8dda14269291f2986823a4c67124f0992947f feat: add session context and reviewer foundations
• 091cff7fbdb43003d5b3403b0c3e6c97175f4095 feat: add session replay runner
• 2e0eac59dc3868639ca002550d0a838e7c4e5869 feat: bootstrap flockgate backend runtime
• 50b8408f75796831a86588d6e3ebdbcdbeded605 feat: complete autonoma graft — site profiles, replay, run-context
• b6642ea27a0979abfc90bf4a2de8e2f1ad83117a fix(agent): cap browser actions at 15s so a stuck selector cannot stall the agent
• 368334ab67a4faa01b5393deb33c47bddd2aa200 fix(agent): cap observation capture at 30s so a stuck CDP call cannot stall the agent
• be07c73db95925562115c34bbc96de08137e8f62 fix(agent): enforce per-step timeout on observation and action
• ee3d28faaffe57972405d89b06bfe968c65caaee fix(agent): repair credential injector — Evaluate type mismatch skipped every login
• 9d9aeaa5cede5a74bacb49d58b539e0a0c31e150 fix(agent): tighten browser-crash detection and use stdlib
• 2f08bf06c07a8d53a77d66717a3737456efbd8c8 fix(api): COALESCE nullable run columns so GetRun/ListRuns survive NULLs
• a6557513b7014df8520558878e76a12c44583e18 fix(api): cap request body and header sizes
• 8a757cfced04c102cc406b4808351ef10b632c54 fix(billing): auto-refund orchestrator timeouts; test account + IP-limit paths
• 731f34008aa3e39414e3a71edb6b7dae3b4b5213 fix(billing): close auth-multiplier arbitrage for referenced site-profile scenarios
• 83e9088243205a06d4d2643a7c509cc672ba29a7 fix(browserpool): drop redundant remote-debugging flags
• 3c2850272bfb040952f4a02f0c895e67317f5e0b fix(browserpool): handle burst context acquisition
• 5476b74f40b8cf7a3d5536d1dd012696c0be9ffa fix(comparison): count SPA hash routes as distinct pages in exploration
• 23dcababc03678d3c9bee0272151f55d3152e006 fix(comparison): style "high" severity as critical in HTML reports
• 6543649f5145190060eae91356c854a47bf12a5c fix(config): make LLM HTTP timeout configurable, raise default to 600s
• 08f16cd0b343022f986f2f74fc65fc67d02a24ed fix(db): drop rate_limit_windows PK before DROP NOT NULL in 00031
• 69172e73b507df2eca0cc74bb05bf6a74dcbb154 fix(llm): disable reasoning for OpenRouter requests
• fad33fdadfd3942c0d29c33cc2537c80356a6b82 fix(marketing): add pricing, align persona count, accurate Big-Five claim
• 2621f9df5a21360b6a2ec9e93e10b98f936bd047 fix(marketing): address PR #2 review comments
• bf03353fe354e5abf32b9cc1c07dfda47b44d214 fix(orchestrator): also upload screenshots from exploration mode path
• 86553e75eccae370bbeb847ec334bb911e23e6ae fix(orchestrator): correct River credential purge INSERT columns
• 2489e293a2e7210f8d855a20fc69de98221c83c2 fix(orchestrator): recover panics in per-agent goroutines
• 830f52b458eb07a656b539a6edd440b5a64b95f6 fix(orchestrator): skip URL B reachability check for exploration mode
• c7a913ff330cd7ecf418226c7b538b40ce672c41 fix(orchestrator,replay): log silent JSON unmarshal failures
• c3f98c82f29aaecd845c302775ea15fbb39b7180 fix(persona): preserve partial slice from GetByIDs
• 3fe5054524e7db15f6bb28197894096af3a44212 fix(persona): tighten two archetype descriptions
• 02fca760b64c1a795cc5ad732ceaac013fa2625c fix(persona): use A-Res key for us-representative weighted sampling
• 11f881683957684ba8ea46cef52c470f1328cc15 fix(persona): use explicit column list in ExplorationStratifiedQuery
• 9819c2b6d34abdd2f7cedc698f08f472a2baa322 fix(security): SSRF guard on every browser navigation path
• ccbceabe96312de42e6b60e91e736ca2fadd5d88 fix(security): address PR #1 review comments
• 8e70981441b0e58523dd68f7182525ebf78d0e8e fix(security): block SSRF via run target / webhook URLs
• 99e8db730865b96bb44ffc40d1e85e5d4dd8efcd fix(security): close numeric IPv4 SSRF bypass
• f859646f025f2989863c351da1545a3400b622da fix(security): validate every agent navigation against SSRF, bind CDP to localhost
• cc06662d1d56faef67ffb1643d2a43623c9abcfe fix(web): allow inline style + Google Fonts in CSP so iframe report renders
• 54fb09d62e0dc89fedc5e0193fefe2926f240419 fix(web): gate dead OAuth buttons, correct refund copy, add 404 route
• 4c3a38114f21faf036a3ef4960b97b17a29f4c31 fix(web): iframe scrollbar policy + split report vs app feedback
• a058f7a673e852785a845b03d03fbdd77a4c8364 fix(web): restore canonical run states (failed/cancelled), drop bad session-state mapping
• d57a4fd3c6e3598a58be11e4e2408884a1299319 fix(web): three defects caught in E2E run vs hobby-map.pages.dev
• 538d890eba796fa34895a10b28bc533602413e31 initial commit
• 2ef1f70b23a0660dfbf8f8314d17eaed7de562e5 marketing: add authenticated-run sample report (Poprop)
• f83465c90c720e9af3b00043886660c05de5bd35 marketing: document live Cloudflare Pages deploy + redeploy command (#11)
• 75762819ae8fe120416bd9d4a9a15ef43486a351 marketing: publish CLI artifacts to public boidwatch/cli repo
• 6d1392f59ed57d6c79c1611d8706f6aace5eb600 marketing: redact dummy demo email from public Poprop report
• 33978ff0f2013ad622cc9a4a4d9fbbff0434c28a polish(web): SPA voice pass + fix stale .flock-dot class (Chunk 4c)
• 3cb78da48cfbd7149b17df2cf49d46b54eb3297d polish(web): mono-tnum on data, drop shadows, cool the modal scrim (Chunk 3b)
• 90663657d79fa4f7a8ac4406055964cf19f14d2a refactor(cli): credentials at ~/.boidwatch/credentials.json (dotfile pattern)
• ab6c9a5e507e14a2a95258e1e232125ce18c579b refactor(cli): route run create/cancel through typed Enqueuer
• f0b69d0e9cec15ff38bffe49f2ffe746073c8dfd refactor(comparison): redesign report templates with token-based design system
• 05d45c103a019d34583152dbbc8937756a51428b refactor(web): retire legacy color aliases (Chunk 3a)
• a4ec99f5beb8e864d8169bcf02ff8fa73c55155e security: disable proxy on SafeTransport; tighten amount-mismatch test
• f8713e43a3623bb2fdcc52351d24874c908217ca security: fix webhook SSRF + open redirect; harden OAuth/Stripe
• fe2b7939eaf9da233aed10946a4672ecfaf79940 test(comparison): assert all 7 trait averages in enrichment test
• a9bc9db74124341da65f0158fd45e2fc87941651 test(smoke): end-to-end CLI ↔ flockate-server smoke test + CI job
• ef6eb1eab8d8b67a6046aba95daefaff0370e613 test(web): repair Login provider-gated test setup
• e479d6ae1dc3ffc213e8af7b623288b39f636193 types(exploration): add RunSummary and archetype context fields