GateFlow v0.4.0

Workspace

• [DB] Red Sea --demo-full seed fills all demo orgs with 6-month contacts, units/classrooms, role logins, and scan history

• [Workspace] add pnpm health to run workflow contract, changelog check, and preflight

• [Security] drop unused workspace @lhci/cli to remove unpatched extract-zip (CVE-2026-56876); CI still installs LHCI globally

• [Security] remove polynomial ReDoS in email validation regex

• [Scanner-App] confirm expo export (Metro bundling + Hermes bytecode) now succeeds — the previously-documented hermes-compiler module-not-found failure no longer reproduces

• [Scanner-App] add accessibilityLabel to login, scan decision/result, and bottom-nav controls

• [Scanner-App] split 2118-line App.tsx into screen/component modules, remove 5 dead components, fix README stack description

• [Deps] regenerate pnpm-lock.yaml for scanner-app Expo SDK 57 bump

• [DB] validate retention mode and clamp month-end retention cutoffs

• [DB] commit missing retention-policy module and migration for PR #224

• [CI] regenerate pnpm-lock.yaml with correct patch hashes

• [Security] scope ScanLog export to org when zero QR codes match

• [Security] remove dead mock admin login route

• [Security] attach CSRF token to all client-dashboard mutation requests

• [Deps] patch 5 high-severity vulnerabilities, install pending patches

• [Security] close cross-tenant data leak/injection gaps

• [Security] filter deletedAt on all ScanLog/Incident reads

• [Security] make ScanLog/Incident append-only, wire real audit logging

• [Deps] update z.record() to zod 4 two-argument form

• [CI] regenerate lockfile against committed package.json, not local WIP

• [CI] commit missing pnpm patch files blocking CI Setup

• [Deps] reconcile CodeRabbit autofix — Babel dependency fix (PR #212)

• [Scanner-App] Phase 02 onboarding wizard (PIN, biometrics toggle, camera)

• [Scanner-App] Phase 01 device unlock gate and QR secret fail-closed

• [Scanner-App] Audit packet 2026-07-30 and Active onboarding plan

• [Client-Dashboard] share auth cookies across gateflow.site

• [Resident-Portal] CHECK_ALL 2026-07-29 focused check evidence (pilot blocked)

• [Resident-Portal] Phase 10 pilot gate and certification packet

• [Resident-Portal] Phase 09 i18n interim, logical CSS, and evidence

• [Resident-Portal] Phase 08 pilot UX revoke, share, and sign-out

• [Resident-Portal] Phase 07 API upstream, scannable QR, offline read

• [Resident-Portal] Phase 06 auth session and tenant containment

• [Workspace] tracking next changes

AI Tools

Apps

• [Scanner] align Expo SDK 57 native modules, monorepo Metro cache

• [Client] surface error toasts on failed csrfFetch mutations

• [Scanner] run resident-portal tests on Node 20

• [Scanner] use crypto-secure IDs instead of Math.random()

• [Scanner] BiometricGuard inactivity lock, motion polish, error boundaries

• [Scanner] high-density home dashboard with ADS-compliant master scan action

• [Scanner] harden shift accountability against code-review findings

• [Scanner] resolve shift typecheck errors blocking push

• [Scanner] harden shift accountability and logout races

• [Scanner] omit undefined shiftLogId on offline enqueue

• [Scanner] resolve Phase 03 shift typecheck and end-body parsing

• [Client-Dashboard] fix shift/end body parsing under Jest after CodeRabbit autofix

• [Scanner] harden Phase 03 shift concurrency and offline linkage

• [Scanner] Phase 03 shift start/end and scan gate

• [Scanner] Phase 01 device unlock and QR fail-closed

---

---

📦 GateFlow — Gate access management platform
🤖 Release automated by ralph-docs.js