7.0.0-beta.5

[7.0.0-beta.5] - 2026-09-26

Summary

303 entries, 38 features and 165 fixes, dominated by one theme: the engine stops trusting ambient state. The P0/P1 audit batches close across security, data integrity, write path, supply chain and client; update/recovery becomes a set of verified restore points; and the assurance floor turns on, every gate runs somewhere, every census is derived from the tree, every ratchet refuses its own laundering.

• Security — fail-closed media protection and install IP allowlist, argon2 cost pinned, revocation that actually revokes (SEC-07/08/09), one outbound guard with loopback fixed (SEC-01/02), one read door with action-scope binding, secrets never travel with code (OPS-01), one escaper at the client render boundary.
• Data integrity — the five named defects closed: the write language is the request's (DATA-01), a delete locks the owner row (DATA-02), time-machine merges the restored language slice (DATA-03), CSV ingest reads as the oracle did (DATA-04), dataframe copies re-mint their targets (DATA-05); the allocator is a high-water mark; one writer owns matrix DML.
• Verification — the assurance floor closes: 687 test files that executed nowhere get an executing home (P0-1), anti-vacuity gates, tree-derived censuses, the DEC-14b twin map machine-read and total; the tripwire tier goes 41 → 75.
• Update & recovery — verified restore points with retention, disk space measured before download, zip-bomb refusal, a code master that probes its advertised URL, the restore-point panel, waivers that leave outliving evidence.
• Client & tooling — search panel redesign, error-report edge tab, server-built tool_export artifacts with paged preview, bounded fetches, media viewers, login/toolbar restyle.
• Site builder & ops — tenancy declared once with every path derived, generated deployment artifacts, a fleet law with provisioning replacing installing; Apache reverse proxy, Bun pin to 1.4.2, one locked CI image on every host.

🚀 Features

• (media) Fail-closed media protection (3 P1 audit findings)
• (install) The install-window IP allowlist is fail-closed
• (security) Pin the argon2 cost, and let stored hashes catch up
• (tools) Permission:null is a NAMED EXEMPTION, and sitebuilder is gated
• (parity) The DEC-14b twin map is machine-read, and total
• (update) The release files directory is created at boot, at a forced 0750
• (deploy) Add Apache reverse proxy configuration for Dédalo v7
• Add interactive client test server and suite database guard
• (runtime) Pin Bun 1.4.0
• (test) Shard the suite across processes, each on its own DB clone
• (update) Measure disk space BEFORE the download
• (update) Restore a code copy from the update_code panel
• (update_code) The blocked-restore row names BOTH Bun versions
• (update_code) The build row says it is building, and what it changed from
• (security) Ending an account's access actually ENDS it (SEC-07/08/09)
• (site_builder) A museum's tenancy is DECLARED once, every path DERIVED from it
• (site_builder) The deployment artifacts are GENERATED, and the hand-written ones are gone
• (site_builder) A fleet law, a pure plan, a dumb apply — provisioning replaces installing
• (site_builder) Adopt an existing install, decommission one, and actually SERVE the sites
• (lint) The browser code is in scope now — and scope is measured, not read
• (gates) A batch action takes its scope from the request, or refuses
• (update) A waived backup now leaves evidence that outlives the log
• (update_code) Restore-point retention, and a guarded delete
• (update) A code master probes the URL it advertises, and names the layer
• (test) Add dedalo_entity to engine-specific keys and non-empty strings
• (search) Sqo.children_recursive was inert — port the expansion
• (recovery) The engine owns the restore, the public tier is reconcilable, the seed compiles, the archive round-trips (batch 4)
• (db,test-data) Cost is measured on the proxy — inside transactions too — and the museum-scale corpus exists (batch 9, merged from lane C)
• Crop 50 implemented
• (client) Error-report launcher becomes an edge tab that unfolds on error
• (login) Installation chip in step 1 — primary button stops moving
• (maintenance) Identifying icon per System Map node + pairing tripwire
• (tool_export) Server-built export artifacts + paged preview — the browser no longer holds or draws every record
• (tool_export) Exports report cells an external source could not answer, and prefetch external rows per batch
• (search) Redesign the search panel
• (master) Pre-7 installs keep updating through master.dedalo.dev
• (change_log) Generate docs/change_log.md from changes/ fragments
• Add explicit bun path handling to pre-push hook

🐛 Bug Fixes

• (csp) Frame-src carries the envelope source, like object-src
• (server) Trust X-Forwarded-For only on a proxied transport
• Fixup! feat(install): the install-window IP allowlist is fail-closed
• Fixup! feat(media): fail-closed media protection (3 P1 audit findings)
• (parity) The census stopped poisoning its own child — live drift legs are back
• (update) A refused chmod must not refuse a release build
• (update_code) The developer build uses the SERVER'S branch, not a baked 'v7'
• Align psql binary resolution and strengthen test DB env handling
• (test-db) The drop guard asks the database, not just its name (D13)
• (ci) The DB tier is a 15-MINUTE build, not a 5-minute one — timeout and docs corrected
• (update_code) Update progress must not render below the fold
• (test) The three env resets actually unset, and the smoke gate boots THIS runtime
• (probe) The update probe's origin detection works off the default route
• (db) Pin the pool's TLS mode so Bun 1.4's ambient PGSSLMODE cannot steer it
• (config) Classify DB_SSLMODE in the migration map
• Update dependabot to use bun ecosystem for lockfile compatibility
• (test) ResolveSuiteDatabase compared two derived names, never the app DB
• (verify) The assurance floor — lint, the ratchet, the selector, and 28 silently skipped tests
• (delete) Lock the owner row — a delete must not destroy a concurrent save (DATA-02)
• (duplicate) Re-mint dataframe frame targets — a copy must not share the original's (DATA-05)
• (time-machine) Merge the restored language slice — a restore must not delete the languages it did not restore (DATA-03)
• (update) The waiver headline names the gate that is actually waivable
• (update) The waiver's audit line records the fact, not the flag
• (update) The restore path stops refusing OLDER restore points
• (import) CSV ingest reads, decodes and identifies rows as the frozen oracle did (DATA-04)
• (write) The write language is the request's, and an undeclared one is refused (DATA-01)
• (security) Scope the FRONTIER, not just the first hop (SEC-01, SEC-02, DIFF-C + one unnamed)
• (ops) Secret material never travels with the code, by any lane (OPS-01)
• (vendor) Pdf.js 5.7.284 -> 6.2.108, and make a vendored advisory VISIBLE (CLI-26)
• (update_code) The pinned phase track stops eating the whole viewport
• (update_code) The run's scroll lands ON the track, not 184px short
• (update_code) The before-value shows only what MOVED
• (transport) A request the transport may RESEND executes ONCE (CLI-01)
• (update_code) Move the build motion into the kit and declare its resting state
• (site_builder) The drift census is DERIVED from the renderers, not listed beside them
• (site_builder) Git stays in the workspace; the engine proves the daemon before it pays it
• (rag) Refuse rather than answer arbitrarily, and stop writing the installation's index
• (write-path) A delete must name what it deletes, a move must land before it destroys
• (recovery,import) A backup is a VERIFIED restore point; an identifier is not an address
• (allocator) A section_id counter is a high-water mark, not a row count
• (gates) A forbidden statement is forbidden however PostgreSQL lets you spell it
• (time-machine) A record's history is its own, not its address's
• (backups) A store that never ran is not a store that succeeded
• (compose) The stack must SHOW the engine the backups it takes
• (import,gates) A candidate cap is not an answer; and three P0 gates that ran nowhere
• (data-lang) The last three write sites stamped the install default, not the operator's language
• (tests) A restore that reinstalls the mock is not a restore — and two files still did it
• (client-gate,import) A run that observed almost nothing must not report success
• (counters) Only the disk remembers — reconcile counters against the media tree
• (relogin) A session that dies mid-use must not change who authored the save
• (pdf-extract) The extraction the curator reads must be the text the PDF held
• (undelete) A restore that brings the row back must bring the files back
• (relogin,revert,reconcile) The guard I shipped was inert — and three more from review
• (relation-search) The ancestor index must move with the locators it indexes
• (tools,media) A path is what it RESOLVES to, and a root is an allowlist
• (security) One outbound guard — and it was letting loopback through as PUBLIC
• (ops) A TLS install cannot lose its TLS — and the update path cannot strip Secure
• (gates) A gate that passes while asserting nothing is not a gate
• (gates) A matcher must match the invariant, not one spelling of it
• (gates) A gate's census must be derived from the tree, not enumerated by hand
• (engineering) The half that travels with the code now has a currency gate
• (gates) A test nobody runs, and a deploy input that becomes a command
• (config) A secret with two readers, and the dead one is the documented one
• (deps) The pa...

v6.9.7

[6.9.7] - 2026-09-26

Bug Fixes

• [breaking] Sanitize client SQO and harden SQL sinks against injection
• Handle component data cloning and property cleanup in relation processing
• Make whole-blob pre-filter sound and use it through relations
• Ignore transcription tags in free_search fragments
• Safely quote and escape table names in SHOW COLUMNS
• Enhance error logging with query context
• Detect whole-blob trigram index by expression, not name
• Multi-step date and !! searches under $and broke the SQL
• Escape client values in SQL debug comments, share !! join
• Correct multi-section counts and multi-table pagination
• Restore filter by list and limit false, sanitize tools sqo
• Accept 'ALL' limit from set_limit(0), hierarchies were cut to 10
• Make tags masking opt-in, keep sql_filter lang precedence
• Accept legitimate client SQOs rejected or changed by the sanitizer

Documentation

• Publish v6 at /docs/v6/ — slate palette, version switcher, older-version banner
• Trim AGENTS.md to non-derivable guidance

Miscellaneous Tasks

• Version .agents skills and workflows, clean leaks
• Track .claude and CLAUDE.md as relative symlinks, as v7

Performance

• Merge !*/* lang checks into one EXISTS on same record
• Inner joins in relation EXISTS, single lang extraction for text

v6.9.6

[6.9.6] - 2026-09-21

Bug Fixes

• Prevent cartesian join explosion in multi-step AND filters
• Validate target_component_tipo before model lookup
• Speed up count queries for regex text searches
• Fix operator precedence and wrong property in diffusion_sql
• Fail closed on unresolvable filter, select and order paths

Features

• Add DEDALO_DB_STATEMENT_TIMEOUT config and optimize search query joins

Miscellaneous Tasks

• Update DEDALO_BUILD timestamp

v6.9.5

[6.9.5] - 2026-08-25

Bug Fixes

• Avoid fork failure passing background job payload as a file
• Avoid corrupting caller section pagination on open relationships
• Pass the caller section to windows opened from relationships
• Enhance query parsing with improved operator handling and wildcard support

Documentation

• Update v6 to v7 migration docs and reposition legacy column cleanup

Features

• Split legacy 'datos' cleanup into two steps for v6 migration stability
• Add CLI-only security checks to migration helpers
• Enhance query parsing with improved operator handling and wildcard support

Miscellaneous Tasks

• Add search operators test suite for component text validation

Refactor

• Extract search lang resolution and empty behavior query logic

v7.0.0-beta.4

[7.0.0-beta.4] - 2026-08-24

📌 What changed in this release

Beta.4 is mostly foundation work: a new error system on the wire, a new external-services subsystem, an operable code/ontology updater, and a test suite that stops trusting whatever the ambient database holds.

• Error system v2 (P0→P4, breaking on the wire). Closed DedaloError registry, ONE converter, envelope v2 (ok/request_id/data/notices/error). The compat mirror and the result key are DELETED; the client got its own contract (ApiError, error policy/dispatch, one renderer). Zero-tier directories now refuse an untyped throw (420 → 126 repo-wide).
• External record services. New src/external/ facade + component_external, catalog config with security controls, per-source status indicators, compact display mode, search-failure notices and labels in every supported language.
• Code & ontology update, end to end. The update panel works and tells the truth: status readouts for both roles, developer channel (same-version installs, archive-digest identity), remembered master server, operator-owned TLD input. Verified by a real-scenario drill (test:update) and the museum-cycle probe against the real stacks (probe:update). Panel fully translated into 17 languages.
• Transcription tool + AI model store. Status panel replaces the clipped one-liner, a failure classifier with a report contract, model states on the wire with verify/repair, and a rule applied throughout: state the unknown, never claim green falsely.
• Media. Atomic write discipline with a writer tripwire, encode integrity, ICC profiles, non-fatal derivative generation with error tracking, one thumb/posterframe handler for all five models, canonical retouched tier.
• Thesaurus picking, unified. One shared picker module + a picker constraint module for read/write relation validation; portal, list, tree and tool_indexation all attach the same picker.
• section_id is canonically an integer. New SectionId concept, v6-compatible parser, docs/samples/specs migrated.
• Test honesty (the big one). Tests build their own situation on the generic test TLD instead of reading an install's records; test-data writes are refused on a database without the dedalo_test_marker, and file writes outside a marked test media root are refused too. The client suite runs on its own server + suite DB with real auth: 131/131. Parity's permanent reds are under a shrink-only ratchet, plus a CRAP complexity ratchet.
• Performance. A record is read once per read (145 row fetches → 3), cached per-section button lookup (42ms → 0.64ms), concurrent list-column build, and on the client: coalesced in-flight reads, one shared IndexedDB connection, one shared MutationObserver.
• Security fixes. Dashboard user names rendered as text (SEC-XSS-013), allowlisted cross-origin callers answered again, CSRF token accepted from the RQO body (sendBeacon), record ACL enforced on the filter datalist.
• Client robustness. Per-instance unsaved-data registry, isolated event-bus subscribers, an in-flight build registry for get_instance, a local cache that survives an idle kill and refuses to commit a worse one.
• Jobs & diffusion. Background work is discoverable, monitored and manageable; diffusion degrades a dangling field instead of aborting the element, and gained chain groups, data slicing and element-scoped aliases.

🚀 Features

• (ai) Extract fetch logic into injectable transport and add model path validation
• (ai) ModelState reports ready/unverified/incomplete/damaged/missing
• (ai) Pass principal to save operations for enhanced access control
• (ai) Per-model completion manifest
• (ai) Update image source resolution to use managed extensions and document 3D/AV alternative extension deprecations
• (ai/mcp/tools/media) Add uploadId to media uploads
• (ai/rag) Enhance kill-switch behavior for embed_groups action
• (ai_models) The speaker pair is its own row group, and the size stops lying
• (area) Implement picker caller resolution and hierarchy ACL filtering
• (area_maintenance) Ai_models widget client
• (area_maintenance) Ai_models widget — model store state
• (area_thesaurus) Addthesaurus picker pane styles and related state handlers
• (area_thesaurus) Enhance picker integration and documentation
• (area_thesaurus) Restructure picker pane layout and behavior
• (client) Add external source status indicators and improve component rendering
• (client) Add thesaurus pane test and update registry
• (client) Enhance record pin handling and SQO scoping in render_open_list_with_direct_relations.js
• (client) Implement type-safe section ID comparison utility
• (client) Own search render for component_inverse
• (client) P1 client error contract — ApiError model, api_transport, error policy/dispatch, one renderer, consumers swept
• (client) P1 follow-up — notices contract, compat-mirror alias, tool_diffusion/identify/assistant/sitebuilder/media_versions/upload/import/hierarchy on envelope v2
• (client) P4 compat census → 0 — core
• (client) P4 compat census → 0 — tools
• (component_external) Add compact display mode for dense inline views
• (component_geolocation) Enhance coordinate handling and documentation
• (component_geolocation) Refactor view and feature separation with improved save behavior
• (component_info) Refactor render level handling for better code clarity
• (component_iri) Implement resolve_title module with label frame logic
• (component_portal) Implement sqo cloning to prevent pagination state corruption
• (component_portal) Refactor thesaurus pane toggling and picker integration
• (component_relation_model) Add targetSource support for default section model resolution
• (config) Add external record service configuration options
• (config) Add external services configuration and related environment variables
• (config,maintenance) Retire 8 untranslated PHP constants; port export_hierarchy natively
• (core) Introduce picker constraint module for unified read/write relation validation
• (core) Introduce SectionId concept and canonical section_id storage format
• (core/relations) Add config_ddo_map module for multi-engine ddo expansion
• (css) Add search notice styling for autocomplete service
• (db) Add shared-row seed correction mechanism and update error message
• (db) Add test seam for dbExecute to enable isolated integration tests
• (diffusion) Add chainGroup support for source-tracking in item bridge
• (diffusion) Add data slicing and section deduplication support
• (diffusion) Add IRI label resolution with frame-based labeling support
• (diffusion) Degrade a dangling field instead of aborting the element
• (diffusion) Enhance delete record logic with element type filtering and improved error handling
• (diffusion) Implement element-scoped alias handling for diffusion graph traversal
• (diffusion) Implement uninstalled ontology package detection and handling
• (diffusion) Introduce targetKey helper and foldElementOutcomes for consistent outcome keys
• (diffusion,menu) A domain parameter, a built domain, and a native menu gate
• (docker) Dev build target — the container can serve the client test harness
• (docker) Dev build target — the container can serve the client test harness
• (engineering) Add computed-inverse relation hops support
• (engineering) Add computed-inverse relation hops support for diffusion fields
• (engineering) Add RAG OFF response handling for embed_groups endpoint
• (errors) P0 foundation — closed error registry, DedaloError, converter, envelope v2 schema, throw ratchet, parity transform
• (errors) P1 chokepoints — dispatch/server/tools gates throw DedaloError, converter emits envelope v2, legacy body adapter (transitional)
• (errors) P1 exit — adapter/shells deleted, taxonomy + wire + client-contract tripwires
• (errors) P1 sweep — core modules
• (errors) P1 sweep — core-handlers
• (errors) P1 sweep — install-update-tools
• (errors) P1 sweep — tools-servers-diffusion
• (errors) P2 sweep — MCP/streams/external fold-in
• (errors) P3 burn-down — media
• (errors) P3 burn-down — periphery
• (errors) P3 burn-down — read paths
• (errors) P3 burn-down — write paths (db, section/record, section_record) to 0 untyped
• (errors) P3 exit — ZERO_TIER_ENFORCED=true (all zero-tier prefixes at 0 untyped throws; 420→126 repo-wide)
• (errors) P4 contraction — delete ERROR_ENVELOPE_COMPAT; result forbidden on the envelope; client v1 aliases gone
• (errors) Register internal.invariant for the P3 typed burn-down
• (external-api) Introduce external service facade and types
• (i18n) Internationalize download register file label
• (jobs) Background work is discoverable, monitored and manageable
• (media tools) The operator can create every thumbnail, and hears what happened
• (media) Add masterQualities support for image types with retouched tier handling
• (media) Encode integrity, boot tree provisioning, ingest companions, delete/restore
• (media) Enforce canonical retouched tier to prevent derivative overwrites
• (media) Introduce replacesArchivalCue function and improve tier handling logic
• (media) One thumb/posterframe handler for all five media models
• (media) Optimize imagemagick binary execution and enhance meta alpha handling
• (oh1) Record scope, search correctness, indexation TCs, legacy info blobs, tool fixes
• (ontology) Derive ontology7 from its section (ONT-TLD)
• (ontology) Export restoreSnapshots function for better accessibility
• (ontology) Extract target section defaulting logic into dedicated function
• (ontology) Make recovery file paths configurable
• (parser) Add v6-compatible section_id parser for backward compatibility
• (relations) Enhan...

v6.9.4

[6.9.4] - 2026-08-19

This release focuses on comprehensive improvements to the v6 to v7 migration process, including enhanced validation, error handling, and data integrity features. Key additions include a full migration script, preparation widgets, parity validation tools, and improved documentation to support the transition to the next major version.

The v6->v7 migration script is now available in maintenance panel. It's in development and should not be used in production. Is allowed to test the migration in development environments. The code is aligned with the v7 branch, in beta state.

DON'T RUN THE MIGRATION IF YOU DON'T WANT TEST V7 IN BETA STATE

The diffusion migration was tested for common TLDs (dd,rsc,hierarchy) with a 100% accuracy:

• oh was tested at 100%
• numisdata was tested at 83%
• tch was tested at 58%
• tchi was tested at 32%
• Other TLDs were not tested

Bug Fixes

• Enhance pg_dump preflight validation and error handling in backup process
• Include ontology recovery sql and preserve area modules during migration
• Handle server-side upload errors and thumbnail display
• Sanitize export filenames and add error handling for CSV, TSV, ODS, and Excel exports
• Add request size validation and upload error handling
• Enhance v6 to v7 migration with improved geolocation repair and consistent findings handling
• Improve geolocation data handling and messaging during v6 to v7 upgrade
• Resolve title logic and migration clarity

Documentation

• Update v6 prepare v7 widget documentation and ignore rules
• Update diffusion mapping documentation with dry-run details and log paths
• Update prepare v7 widget README with deep preflight details and maintenance mode restrictions
• Update documentation references from master to v6 branch
• Update prepare_v7 documentation with detailed finding categories and improved preflight explanation
• Update PARITY_RUNBOOK.md with migration insights and v7 divergence details

Features

• Add full v6->v7 migration script
• Add v6 to v7 migration widget with isolated engine package
• Add loud failure handler and migration table resolver for v6 to v7 preparation
• Add security .htaccess and update v6→v7 migration documentation
• Add prepare_v7 widget for v7 migration preparation
• Enhance close_v6_prepare_v7 widget with tool_common inclusion and improved legacy datos logging
• Add dry-run option and runtime dir creation for v7 migration
• Add pg_dump version compatibility check to prevent migration failures
• Add deep-preflight option for enhanced data review in v7 migration
• Improve data review summary and error handling in v6 to v7 migration
• Add password upgrade utility for v6 to v7 migration with Argon2id hashing support
• Enhance v6 to v7 migration with location tracking and sql generation
• Handle fabricated map centre data in v6 to v7 migration
• Add section_id int unification script for v7 migration
• Add override handling and scope matching for diffusion properties migration
• Enhance diffusion migration harness with schema dumping and canonical JSON support
• Add publication parity comparator for v6 to v7 migration validation
• Update accepted differences and normalize media by default
• Handle diffusion data slicing and clean DES_/ts_map properties
• Add float normalizer and enhance json multiset comparison for v6 to v7 migration
• Add new accepted differences for games and antropologia columns
• Add v6 to v7 migration parity runbook with operational guidelines
• Include legacy v6 record classes and backups in package gitignore
• Update gitignore and readme for config/ handling in close_v6_prepare_v7 widget

Miscellaneous Tasks

• Increase log tail lines and add inline widget styles
• Optimize v6 to v7 migration by improving geolocation handling and updating time machine policy comments
• Update parity runbook and helpers documentation

7.0.0-beta.3

[7.0.0-beta.3] - 2026-08-03

This release delivers the largest security hardening pass to date (S0/S1 remediation closing the pre-auth install RCE chain, XSS, SSRF, CSRF, media exposure and more), a fully rebuilt server-side observer subsystem with a subscription registry and bounded cascade, a native semantic search with RAG embed groups and per-component ACL gating, and the matrix_relation_index relations engine with per-DDO column sorting and value_with_parents exports. Also included: transcription diarization and speaker detection, single-session policy with synchronized media cookies, media protection rules and files_info repair, database maintenance health verdicts, deep-pagination and search-at-scale performance work, and the "Calm Scholarly" design line with dark-mode menu tokens.

🚀 Features

• (.agents/skills/dedalo-docs-authoring) Add comprehensive documentation authoring skill
• (activity_log) Rename 'datos' to 'data' for consistency and clarity
• (ai) Enhance egress filtering with contributor validation and RAG tool improvements
• (ai) Implement canonical RAG embed groups parsing with validation and improve test coverage
• (ai) Implement component-level ACL gating for RAG group chunks
• (ai/rag) Add group filter and contributor egress policy support
• (ai/rag) Add relation detection and mode handling for embedding
• (api) Add request detail logging for slow API requests
• (api) Add text area component API handlers and registration
• (api) Implement principal-based access control for relation lists and inverse references
• (area_maintenance) Database_info surfaces a table-statistics health verdict (WC-070)
• (area_maintenance) Dataframe scan reports COVERAGE and cannot fake completeness (WC-069)
• (area_maintenance) Eager statistics verdict + analyze_statistics repair (WC-074)
• (area_maintenance) Split Tools + Dev & testing out of the core map node
• (area_maintenance) Statistics verdict on the folded card, map chip + boot wipe probe (WC-074 addendum + WC-075)
• (area_maintenance) Statistics verdict on the folded card, map chip + boot wipe probe (WC-074 addendum)
• (client) Add dataframe layout for literal components
• (client) Add new CSS variables for field styling in unit test theme
• (client) Enhance ddinfo column handling in get_columns_map
• (client) Unify new/duplicate record confirms on a custom dd-modal dialog
• (component_text_area) Implement deferred rendering for large text values to improve page load performance
• (component_text_area) Implement get_display_value function for reference component rendering
• (config) Add DEDALO_MEDIA_WEB_BASE support for cross-origin media serving
• (config) Add DEDALO_SINGLE_SESSION feature flag for exclusive user sessions
• (css) Add field color variables and edit mode input styling
• (css) Add field tokens for quiet grid theme support
• (css) Add media placeholder styles for improved visual consistency
• (css) Add semantic search and block UI components
• (css) Enhance component tool strip and quiet grid styles
• (css) Enhance edit view input visibility and add selection scrollbar styling
• (database_info) Add backfill_search_stores functionality and UI
• (datalist) Implement HIDE ddo support and fix dataframe colour rendering
• (db) Enhance database rebuild workflows with search store cache invalidation and table/retrigger support
• (db) Introduce commit-only transaction actions to ensure side effects run only on successful commits
• (db) Introduce transaction-scoped memo for isolated cache invalidation
• (db) Refactor table and function rebuild to use idempotent entries with explicit drop handling
• (diffusion) Add parent chain resolution for relation exports
• (diffusion) Live publication progress in the maintenance widget (WC-067)
• (engineering) Add DEDALO_MEDIA_WEB_BASE support for absolute media URLs
• (engineering) Add IDENTIFY_SPEC.md documentation and update AGENTS.md
• (engineering) Add RAG index scope tripwire test
• (engineering) Add tripwire for remote code loading prohibition
• (engineering) Add WC-048 portal column sort feature with per-ddo model and retire legacy sort properties
• (engineering) Implement session lifetime reduction and media cookie synchronization
• (engineering) Implement WC-049 export parents chain feature with per-ddo flag support
• (graph) Rework the graph edit view — node panel, close controls, legend
• (install) Add media path and socket configuration options
• (install.sh) Add TLS configuration and wizard mode for secure HTTPS setup
• (media) Add time computation for date items during save operations
• (menu) Dark-mode menu tokens + theme_token_parity tripwire
• (menu) Quieter dark active item + visible dropdown separators
• (register_tools) Per-tool ACTIVE control + readable import report (WC-057)
• (relations) Add value_with_parents support for breadcrumb triggers
• (relations) Implement configurable inverse question for relation index components
• (relations) Introduce graph IO interface and expansion memo for optimized traversal
• (scripts) Add media_repair_files_info script for repairing stale files_info cache
• (scripts) Enhance observer reconcile with shrink protection and sub-law handling
• (search) Add semantic search UI with RAG support and preset integration
• (search) Implement dynamic section map resolution for search presets
• (search) Omit section-info group from Activity search fields (WC-045)
• (search) Omit section-info group from Time Machine search fields too (WC-045)
• (search) Refactor preset rendering and update documentation
• (section) Add related-sections read support with permission validation
• (section_group) Standardize UI styling with inspector card variables and add hover effects
• (security) Implement single session policy with DEDALO_SINGLE_SESSION flag
• (server) Add sanitized 500 error handling to prevent sensitive data leakage
• (sql) Implement projects filter exemptions for shared vocabulary tables
• (state widget) Kit-language edit view + items, the total's divisor
• (test) Add backfill_search_stores to ownership tripwire
• (test) Add button_trigger tool context test and remove button_import filter
• (test) Add commit lane native test suite with rollback, commit, and async action handling scenarios
• (test) Add comprehensive AI model store unit tests with fail-closed security checks
• (test) Add comprehensive observer cascade native tests with relay and bounded cascade logic
• (test) Add dataframe contract tripwire tests to enforce normalization invariants
• (test) Add datalist hide ddos test case to prevent rendering failures
• (test) Add mode handling test and isRelation helper for rag resolution
• (test) Add observer reconciliation tests and bypass door validation
• (test) Add security tests for inherited prototype keys and single session eviction
• (test) Add stop_process unit tests for WC-043 implementation
• (test) Add test case for section owner target preservation in implicit config
• (test) Add test for search-presets compact list native functionality
• (test) Add tests for serving keys persistence and socket directory contract
• (test) Add tests for sqo validation and signal cancellation in update_cache
• (test) Add thumb parity test and bulk process cleanup
• (test) Add unit test for relation index sync and search consistency
• (test) Add unit tests for record loader caching and prefetching behavior
• (test) Add WC-040 test cases for create and denied login activity rows
• (test) Add WC-049 parents export test and update value_with_parents test case
• (text_area) Add original language handling for list and edit contexts
• (text_area) Enhance list value rendering with equivalence-aware language handling and improved fallback processing
• (tool_diffusion) Structured run report, lossless and gated on nothing
• (tool_indexation) Alphabetical lang selector
• (tool_ontology) Show on ontology components (dd5 tree)
• (tool_transcription) Enhance configuration container layout and styling
• (tools) Add multilingual translations for speaker detection and model download features
• (tools) Add new CSS color variables for field labels and values
• (tools) Add new CSS variables for field styling in cataloging tool
• (tree) 'M' icon carries the model name (Ctrl+M badge)
• (ui) Add dev-mode option validation and improve text content handling
• (ui) Parallel "Calm Scholarly" design line (data-design switch)
• (ui) Unify button concept — icon + colour + spinner capable
• Add matrix_relation_index table and sync trigger definitions
• Add AI model fetching script for local storage seeding
• Add children_view support for relation components
• Add dedalo-observers-ts skill documentation
• Add diarization support for speaker detection and transcription workflow
• Add language equivalences configuration and parsing support
• Add language equivalences configuration for Català/Valencià support
• Add localized labels for database maintenance widget info texts
• Add log and changelog to gitignore
• Add media CSP origin support for split-origin deployments
• Add noise detection and time regression handling to transcript postprocessing
• Add observer reconcile script and migrate server-side observers to save chokepoint
• Add per-component schema ACL check in read_facade.ts
• Add per-read record loader with caching and batching support
• Add persistent speaker assignment button and enhance diarization model handling
• Add rebuild_component_in_lang utility to fix language switching in built components
• Add section_tab children support and update view resolution
• Add semantic search labels for meaning-based queries
• Add single session restriction feat...

v6.9.3

[6.9.3] - 2026-07-25

Current version is detached of master branch in public repositories; gitlab and github. This version includes enhancement of ddinfo column handling.

Bug Fixes

• Handle empty component values in ddinfo parents generation

Documentation

• Update installation instructions for v6 branch

Features

• Enhance ddinfo column handling for value_with_parents components

7.0.0-beta.2

[7.0.0-beta.2] - 2026-07-18

🎉🎉🎉 The TypeScript version is here! 🎉🎉🎉

Algo se muere en el alma
cuando un amigo se va...
Thanks to the PHP team for their amazing work all along the Dédalo journey, it was a pleasure to work with you. The decision was hard but necessary to move forward the Dédalo project.

This version is the first beta version of the new architecture in TypeScript. A complete new codebase has been developed to replace the legacy PHP codebase. This version includes all the features of the previous version, but with a new architecture and technology stack.

If you are using V7.0.0-beta.1, you can upgrade to this version easily, the database structure is the same and the ontology is compatible, therefore you can replace the old code directly without any data loss.

V7.0.0-beta.1 --> PHP version (with some parts in TypeScript), frozen code with all features implemented.
V7.0.0-beta.2 --> TypeScript version, new architecture and technology stack, full compatible with PHP version.

⚠️ Important

• Don't use in production.
• The v6 upgrade guide is not yet available, but it will be released as soon as possible.
• The next beta version will be focused on stability and bug fixes.

🚀 Features

• (docs) Update ontology documentation and security permissions implementation
• (svgedit) Upgrade from vendored build to @svgedit/svgcanvas@7.4.2
• (media) Add media protection configuration and tests
• Add docker support with multi-arch image and enhanced build configuration
• (engineering) Add docs tripwire and update hermetic checks
• (install) Add supervisor contract for restart-after-persist with exit code 75
• Add css:watch script and incremental rebuild support
• Add gitattributes for generated CSS and documentation improvements
• (tools) Push-based job progress stream + CSV import pipeline rewrite
• (tools) Re-attach to background jobs via server query, drop client-side IndexedDB tracking
• Add V1 API PHP version wiht DBi class for MySQL database connections and biblio class for bibliography text fragment handling
• Add Publication API v2 and update workspace configuration
• Add comprehensive test suite for batch endpoint and security authentication
• (config) Enhance API configuration with comprehensive validation and documentation
• (ontology) Ontology_state.ts — incremental reconcile + transactional rebuild for dd_ontology
• (area_maintenance) Add System Map view — topology dashboard alongside the classic list
• (add_hierarchy) Make the maintenance widget import hierarchies natively post-seal
• (site-builder) Add Apache configuration and systemd service for site builder deployment
• (publication) Add comprehensive test suite for site builder functionality
• (config) Add sitebuilder domain and configuration keys
• Add site builder integration configuration and test setup
• (widgets) Add site_builder_status widget with status panel and launcher
• (test) Add sitebuilder tool tests and update parity check
• Add tool_sitebuilder with three-pane interface and chat functionality
• (ui) Ontology-master server skin (WC-031)
• (area_maintenance) Redesign the update_ontology panel
• (labels) Repo catalogs are the label source of truth (WC-033)
• (error-report) Auto-focus description input on viewport entry
• (error-reports) Add screenshot support and improve context display
• (area_maintenance) Add publication category and update site builder widget
• (area_maintenance) Add site_builder_status tool to publication section
• Refactored build system to use workspace activity manager for concurrency control
• Add query performance and time machine cache configuration options
• (search) Add idsOnly option and optimize late row lookup
• (grid-export) Optimize bulk record hydration and streaming performance
• Add late row lookup and time machine cache config, plus batch record reader
• (test) Add batch read tests and enhance matrix record reading
• (test) Update widget differential test comments and class exclusion
• (core) Update section elements context exclude logic to respect client-sent options
• Improve cache isolation and build consistency
• (search) Make every Activity + Time Machine component searchable (json + TM columns)
• (geoip) Native offline IP→country for Activity (dd542); drop IP_API
• (sqo) Add session SQO merge functionality and enhance relation list handling
• (test) Add relation list narrowing and session sqo merge tests
• (component_text_area) Enhance list value rendering with embedded tag support
• Add test for text area emit hook list mode tag rendering before truncation
• (view_ip_list) Show raspa flag for private and loopback IPs
• (core) Enrich security-tools datalist with active tool metadata
• (config) Add mailer configuration domain and SMTP settings
• (config) Add SMTP mailer configuration options to sample.env
• (config) Add mailer and password recovery configuration variables
• (test) Add native TS password reset contract tests with mocked mailer and scratch user setup
• (engineering) Add WC-039 password recovery implementation for TS surfaces
• Enhance security context handling and permission checks
• (test) Add unit tests for permission stamp helpers and update request config permission gate
• (installer) Add outbound email configuration support and enhance field rendering
• (test) Add comprehensive mailer probe and config persistence tests
• Add email and mailer related labels for configuration and recovery features
• (i18n) Add missing mailer and encryption labels in Arabic and Catalan catalogs
• (install) Add SMTP mailer configuration and validation to installer
• (css) Add mailer_fields style rule for installer section

🐛 Bug Fixes

• Update spec documentation paths in skill files
• (session_store) Ensure session database directory is created during bootstrap
• Update deploy workflow default branch and add self-hosted CI pipeline
• (test) Normalize file path in error message fixture
• (media) Derive MEDIA_PATH default from project root, fixing fresh-install 404s
• (tool_import_dedalo_csv) Fix columns map auto-detection. Update permissions, virtual section resolution, and scratch tests
• Normalize file paths in error messages across test fixtures
• Update css map with complete source paths
• (sw) Key the service-worker cache to served bytes, not a fixed name
• (ts_object) Resolve component_section_id data, port PHP is_empty for icon skip
• Redirect mount points and directory paths to app entry point
• (css) Update diffusion server control widget class names and styling
• (component_input_text) Prevent crash when find_equal returns no duplicates
• (ontology) Hierarchy_state.ts — single writer for hierarchy activation, verify targets exist
• (ontology) Split TLD teardown from registry-record delete in ontology_delete.ts
• (section) Normalize relation elements on set_data/update, not just insert
• (css) Make button_spinner work on all button colors by using transparent ring instead of filled disc
• (add_hierarchy) Mark "installed" from actual term rows, not the registry census
• (installer) Guard against non-array api_response.result in build
• (search_related) Return empty result when no requested table is relation-capable
• (ontology) Inline validated tipo in update-pipeline psql \copy/-c calls
• (ontology) Probe ontology/code masters with a JSON body, not form-encoded
• (area_maintenance) Widget style, loading & lifecycle fixes
• (maintenance) Adjust map stage heights and node margins
• (i18n) Complete truncated import hierarchies description
• (portal) Fix header clipping and align reference rows
• (import) Set_data lang-sliced for translatable literals — multi-lang imports keep every language
• (section) Virtual sections inherit real section's list columns
• (dashboard) Populate activity timeline + add get_activity_metric range fetch
• (test) Update WC-031 to WC-033 for tool_sitebuilder in differential test
• Update WC-031 reference to WC-033 in test files
• Update WC-033 to WC-035 for site-builder references
• (search) Date search on time-machine tables (Activity dd547) — object-q + operators
• (search) Portal link in search mode no longer 500s on read-only sections
• (search) Resolve the picked value's label in search-mode portals
• (search) Search-panel portal picker works — mode 'search' reads + string locator echo
• Handle section_id casting for search data resolution consistency
• (search) Implement correct client pick handling for search_1 host with string section_id casting and synthetic id matching
• Update environment variable handling and action lookup in tests
• Improve code formatting and readability across multiple files
• Cleanup test assertions and improve code formatting

💼 Other

• Initial commit: First complete rewrite of version 7 of Dédalo in TypeScript
• Move workflow files from private to selfhosted directory
• Remove render themes from docs
• Add media protection skill documentation for Dédalo v7 TS/Bun engine
• Add probe_*.ts to gitignore for debug probes
• Remove obsolete hierarchy import fixtures
• Remove obsolete hierarchy fixtures and update country hierarchy data
• Comprehensive ontology fixtures for v7.0 including country hierarchies, thesauri, and domain-specific data
• (spa) Add missing Spanish translations for new features
• (cat) Add missing Catalan translations for new features
• (deu) Add missing German translations for new features
• (ita) Add missing Italian translations for new features
• (fra) Add missing French translations for new features
• (por) Add missing Portuguese translations for new features
• (ell) Add missing Greek translations for new features
• (eus) Add missing Basque ...

v6.9.2

[6.9.2] - 2026-07-15

This version introduce new translation models for local AI and fix some issues with the translation tool.

Documentation

• Bump component_input_text version from 2.5.0 to 2.5.1

Features

• Implement period mode query handling with field-based comparison
• Add browser translation engine with AI model support
• Add translation_review_needed and discard messages in multiple languages to tool_lang register
• Enhance translation engine support and error handling
• Add reorder_inverted_pairs to fix reversed mark pairs in translations
• Add model parameter support and fallback models for translation tool

Miscellaneous Tasks

• Refactor markdown segmentation and repetition detection
• Refactor CSS styles and layout adjustments for improved responsiveness and component styling

Refactor

• Restructure placeholder handling for TranslateGemma model compatibility