Release v0.8.11

🎉 What's Changed

🔧 Other Changes

• Release 0.8.11 with a collapsible navigation rail and one Workbench design. (2d6df2d)
• Give the repository app the arc new Workbench design and add a collapsible navigation rail. (43eaf5c)
• Add README quality badges and project links (636dcec)
• Repair security audits and remove vulnerable frontend tooling (1cf15d0)

Release v0.8.10

🎉 What's Changed

🐛 Bug Fixes

• Fix command-specific help across the Arc CLI (8018ace)

🔧 Other Changes

• Record publication of all Arc 0.8.10 packages (06127a5)
• Release 0.8.10 with command-specific CLI help (5cad494)

Release v0.8.9

🎉 What's Changed

📚 Documentation

• Label the safeguard docs as Steps 1 to 5 and remove wording that implies HIPAA compliance. (821bb40)
• Serve the docs folder on GitHub Pages without Jekyll. (0ab0685)
• Rename the docsify-docs directory to docs. (a79804d)

🔧 Other Changes

• Release 0.8.9 with the MIT or Apache 2.0 license. (31077fa)
• Dual-license Arc under MIT or Apache 2.0. (9c36b11)
• Add the Arc banner to the top of the README. (412af89)
• Remove stray terminal output from the LICENSE file. (8c9b019)
• Add the MIT license file. (1c488b2)

Release v0.8.8

🎉 What's Changed

✨ Features

• feat(security): durable browser session handles and invalidation (14731ec)
• feat(security): durable SQLite read-access audit journal (855a7ab)
• feat(security): bound read-model and identity collection queries (416430a)

🐛 Bug Fixes

• fix(scaffold-check): persist the session cookie refreshed at sign-in (b52f1ed)
• fix(ci): make runtime diagnostics scan fail reliably (ae5ff0c)

🔧 Other Changes

• chore(release): prepare v0.8.8 security release (070a170)
• ci: gate the durable-audit and security-session browser suites (0a372d3)

Release v0.8.7

🎉 What's Changed

✨ Features

• feat(security): add response headers and browser regressions (ecc6c67)

🐛 Bug Fixes

• fix(ci): avoid ripgrep dependency in documentation checks (5a7e60a)
• fix(security): restrict sensitive access-log capabilities (c086b90)
• fix(security): bound generated resource input and pagination (314cd41)

📚 Documentation

• fix(ci): avoid ripgrep dependency in documentation checks (5a7e60a)
• docs: mark merged security workstreams complete (d161405)
• docs: reconcile v0.8.6 roadmap and routing (c6cc0d7)

🧪 Tests

• test(security): cover threat-model boundaries and fail closed JWT validation (ad7bd6f)

🔧 Other Changes

• chore(release): prepare v0.8.7 and validate merged security work (221cb51)

Release v0.8.6

🎉 What's Changed

🐛 Bug Fixes

• fix(ci): repair pipeline checks and release permissions (3679fde)

🔧 Other Changes

• chore(release): prepare v0.8.6 (4e1f0f6)
• ci: support safe release workflow dry runs (8463ae3)
• ci: allowlist historical placeholder secret findings (e74d946)
• ci: enable manual workflow dispatch (6eecda2)

Arc 0.8.2

Arc 0.8.2

Arc 0.8.2 fixes spacing and composition across the generated authentication and admin UI.

• Removes the redundant nested frame from the sign-in page.
• Adds a reusable padded panel body for forms and detail content.
• Applies consistent spacing to profile, user-management, and generated resource forms.
• Keeps data tables intentionally edge-to-edge.
• Extends clean-scaffold browser coverage to prevent nested frames and missing content insets.

Arc 0.8.1

Arc 0.8.1

• Restore interactive first-administrator setup for generated applications.
• make setup now prompts for administrator name, email, and a hidden password when the
  ARC_SETUP_ADMIN_* variables are absent.
• Noninteractive setup continues to accept the one-shot environment variables and fails clearly
  when they are missing.

Arc 0.8.0

Arc 0.8.0

• Add the application-owned, immutable UiRegistry with typed host, template, navigation, shell
  action, page, and form contracts.
• Split browser administration into the new arc-auth-admin crate; arc-auth-session is now a
  headless cookie/session protocol and middleware package with no Tera dependency.
• Add host-rendered sign-in, profile/password, and resource-grade Users administration, including
  filtering, pagination, detail/create/edit pages, roles, activation, and final-admin safeguards.
• Render generated resources and authentication capabilities through the same host shell, with a
  visible CSRF-protected sign-out action and reusable accessible field primitives.
• Stop capability navigation from modifying application layouts and add auth-admin to the
  auth-db-session installation bundle.

This is a breaking pre-1.0 release. Existing UI applications should preserve customized layouts
and migrate their builder wiring to register a UiHost before installing browser UI capabilities.

Arc 0.6.0

Arc 0.6.0

Arc 0.6.0 makes generated administrator access application-owned and event-sourced.

Fresh applications now include a User aggregate, projector, users_view migration, and
projection-backed browser/API authentication. make setup creates the first administrator from
interactive prompts or the one-shot ARC_SETUP_ADMIN_NAME, ARC_SETUP_ADMIN_EMAIL, and
ARC_SETUP_ADMIN_PASSWORD variables. Setup is idempotent and never writes the plaintext password
to .env.

UI scaffolds now provide functional profile and password forms, refresh cookie identity after
profile changes, and revoke API sessions after password changes. Synthetic generated-admin
identity and runtime ADMIN_* authentication have been removed, as have incomplete registration,
recovery, and Settings surfaces.

Generated resource UI also receives an explicit form-state contract and a responsive compact
filter group, fixing new/edit rendering and desktop/mobile filter layout. The clean-room gate now
proves fresh setup, JWT login, API CRUD, browser sign-in, browser Product creation, CSRF-backed
forms, absent Settings behavior, formatting, tests, and Clippy for generated applications.