v0.5.0

v0.5.0 — changes since v0.4.0

Features

• inietta l'agenda/note nel prompt della sintesi (punto c2) (91c9174)
• attivazione funzioni durante l'evento (punto d) (dce8ff2)
• funzione Agenda/Note — checklist live opt-in (punto c) (8dfc881)
• validazione step-2 'traduzione senza lingue target' + import-order fix (punto b) (1bfb9e6)
• altri default da template — descrizione, retention, n° relatori (punto a) (1459610)
• default da template per semplificare la creazione evento ai novizi (5cf2170)
• riepilogo wizard step-5 mostra il flag multitrack (PII-sensibile) (8ca1fe4)
• consentMultitrack in admin registrations (JSON+CSV) + consentSnapshot (832fb7d)
• includi consentMultitrack nell'export Art.15 (9032b42)
• consenso per-partecipante consentMultitrack (ADR-013 Fase 5 parte 2) (a2de17d)
• opt-in evento multitrackRecordingEnabled (ADR-013 Fase 5) (e288361)
• derisk cattura + TTL JWT bot per durata evento + trivyignore Azurite (0d55f2a)
• Helm chart + compose + CI per recorder & controller (ADR-013 Fase 3, punto 3) (4bb77c1)
• flusso claim-based + upload presign per-traccia (ADR-013 Fase 3) (6ae016e)
• endpoint recorder-desired/claim/upload-url + lifecycle unificato + edge-trigger (ADR-013 Fase 3) (65cd195)
• orchestrazione runner-agnostic (K8s + Docker) per riuso open-source (10c3e27)
• operator riconciliante per i Job recorder (ADR-013 Fase 3) (4efa8b5)
• storage provider signed-URL reale (Azure/S3/GCS) — ADR-013 Fase 3 (873e4a7)
• WebRTC capture core — Puppeteer + lib-jitsi-meet per-track MediaRecorder (ADR-013 Fase 3) (d581359)
• toast/modali + skeleton estesi a 15 superfici admin (punti 2+3) (612bc97)
• badge stato trascrizione per riga nella libreria registrazioni (punto 1) (0362eb8)
• token C_* + badge stato artefatti + empty-state (polish #1/#2) (17bce6f)
• pagina gestione video — contenuto tab in Card (polish UI) (d798b39)
• skeleton loaders al posto dei 'Caricamento…' (polish #3) (6488a6d)
• toast + modali di conferma .italia al posto di alert/confirm nativi (polish #2) (6099d3f)
• tab 'Post-evento' nell'evento → collega trascrizione/sintesi/traduzioni (86e7fd1)
• pagina dedicata di gestione video (trascrizione + sintesi + traduzioni) (b465563)
• archivio registrazioni (video-library) scopribile dall'header (69ed2af)
• accesso diretto alla gestione trascrizione da registrazioni ed evento (1ff89aa)
• auto-naming cluster pyannote dal dominant-speaker log (ADR-013 Fase 0) (d09135b)
• transcript UI gestisce segmenti sovrapposti (ADR-013 Fase 4) (38a0673)
• cattura dominant-speaker + alignment auto-naming (ADR-013 Fase 0) (76d3e47)
• CronJob multitrack-purge (ADR-013 Fase 5) (d86b3e1)
• cron purge tracce audio post-trascrizione (ADR-013 Fase 5) (da62d95)
• ingest manifest multitrack + enqueue TRANSCRIBE_MULTITRACK (ADR-013 Fase 2) (4aa6159)
• multitrack-recorder service (Fase 3) + GDPR multitrack (Fase 5 docs) (8bd0ee1)
• worker multitrack handler + auto-naming speaker (ADR-013 Fase 2) (1d79401)
• claim/schema wiring TRANSCRIBE_MULTITRACK (ADR-013 Fase 2) (149ec06)
• modello dati multitrack + dominant-speaker (ADR-013 Fase 0+2) (0b1b100)
• ADR-013 speaker attribution multi-traccia + merge logic (Fase 1) (f0f09f6)
• editor trascrizione post-evento + waveform/timeline (f4a47de)
• pannello bookmark del visitatore nel sidebar (ce53861)
• suggerimento nome speaker da LLM con un click (fcbba02)
• sample text accanto ad ogni speaker non mappato (592ca13)
• toggle AI postprod nel wizard di creazione/modifica evento (60dead2)
• qualità trascrizione — initial_prompt, filtro hallucination, k forzato, post-correction LLM, badge confidence (b90877c)
• pipeline provenance — fotografia dei modelli usati per ogni registrazione (7ac0b46)
• rebrand testi + mini-player sticky + share-at-time + bookmark + follow-mode (996afc8)
• UX/UI professionale post-evento (hero + topic chips + speaker palette + now-speaking chip) (2514735)
• dubbing gender-aware + pool esteso + VTT name-prefixed (48e5e54)
• dubbing multivoce (1 voce per speaker, sempre sintetica) (d0c2e77)
• pipeline AI locale (faster-whisper + ECAPA + Mistral via Ollama + Piper) (e4a191b)
• endpoint download trascrizione (.txt, .srt) e sintesi (.md) (a7bc675)
• search nella trascrizione + auto-scroll smooth centrato (dd18c8a)
• scorciatoie tastiera complete, popover help, a11y (e69cc30)
• i18n it/en per scorciatoie, ricerca trascrizione, menu download (ed950ba)
• tab 'Pipeline AI' in /admin/settings (#62) (88750b1)
• tab 'Pipeline AI' in /admin/settings con kill-switch + provider (bc13e8a)
• card pipeline AI sulla status page pubblica (#61) (0cea503)
• card pipeline AI sulla status page pubblica (4ce5108)
• AI pipeline in-cluster + fix postcss CVE-2026-41305 (#59) (643b0ab)
• pipeline AI in-cluster — trascrizione, sintesi, traduzione, dubbing (75081e8)
• cable logAdminAction into remaining mutating admin routes (12d65e2)
• add opt-in NetworkPolicy with default-deny + allow-list (722ea89)
• record privileged admin actions in append-only log (18c8a28)
• add Art. 17 right-to-erasure endpoint and UI (29f80cd)
• align all 22 locales with EN structure + admin nav fixes (76c3a2a)
• render the central card as a palazzo of the garden (9509b2d)
• treat the central card as an impassable structure (4376a74)

Bug fixes

• drift Migration Integrity (agenda id) + trivyignore piano per Azurite (1ad8f8b)
• evidenzia i campi moderatore obbligatori al publish (no più 'campi evidenziati' fantasma) (2e678f7)
• override form-data 2.5.5 (CVE-2025-7783) (d0b6bbf)
• process.exit(0) a fine main — il processo non terminava (1d33489)
• porta controller 'ctrl' non 'http' — esclude il pod dagli endpoint del Service app (22efb38)
• idle-timer conta solo partecipanti remoti visibili (88f06a4)
• usa il config.js reale del Jitsi + uscita pulita con 0 tracce (38ae776)
• estensioni .js negli import relativi (ESM runtime) (84a6e5e)
• Dockerfile — PUPPETEER_CACHE_DIR nel build stage (Chrome non trovato) (b84d1ec)
• allinea l'ingest al contratto reale del portale (multitrack-manifest) (a1b64e4)
• gestione trascrizione/AI raggiungibile dalla sezione Registrazioni (75453af)
• registra artifact con language NULL (no upsert composite) (8d56874)
• x-ms-blob-type BlockBlob su PUT presigned Azure (d77774f)
• worker TMPDIR=/work (rootfs read-only, /tmp non scrivibile) (ce9c0a4)
• claim ritorna 204 senza body (no-job) (2c6ab5b)
• claim query 500 (FOR UPDATE su lato nullable) + risorse worker (9a32f87)
• worker CronJob eredita imagePullSecrets dall'app (6a483d0)
• mini-transcript inline + "Partecipante N" + icone provenance + hint dub (b38d588)
• rimuovi crossOrigin dal
• audio dub si avvia + sync video↔trascrizione word-level (7a6bcd3)
• orchestrator conta correttamente i worker Pending (0ccd6e1)
• defaultTimezone whitelisted in PUT /api/admin/settings (cab51a5)
• React #137 su tab Pipeline AI + tab nav wrap su più righe (113564d)
• green up CI for PR #59 (migration drift, license, trivy) (b86ca73)
• bump postcss to ^8.5.10 via override (CVE-2026-41305) (66aa63d)
• widen getClientIp fallback chain for rate-limit keys (#58) (a3f91c2)
• widen getClientIp fallback chain for rate-limit keys (7d0efb4)
• rate-limit admin login + strip Next-version header + add security.txt (73f8814)
• switch CSP to nonce-based scripts, drop unsafe-inline (ffdb244)
• admin session TTL 24h -> 4h + /api/admin/refresh (32bcd60)
• tighten Jitsi moderator JWT TTL from 4h to 2h (3ebc417)
• encrypt Person.displayName (rubrica) at rest (f08a987)
• encrypt ChatMessage.senderName and text at rest (4966fcb)
• encrypt Registration.displayName at rest (b316fba)
• encrypt EventModerator.name and EventInvitation.name (4ce4f15)
• unblock docker-compose APP_SECRET >= 32 bytes (#52) (e5f6ede)
• CSP frame-ancestors + Zod schemas on admin endpoints (08bd4bd)
• tighten Jitsi JWT TTL for participants (90 min vs 4h) (10f0594)
• rate-limit 7 public POST endpoints (819440f)
• encrypt EmailOutbox html/text bodies at rest (64250f2)
• encrypt CallSession.participants JSONB at rest (531e7f7)
• encrypt EventInvitation.email with HMAC-keyed hash (1eb4dfd)
• encrypt moderator/organizer emails and outbox recipient (8ec846b)
• gate Art. 15 export behind a signed email link (86d344c)
• rate-limit registration access-token lookup (0fdb64f)
• migrate client API calls off ?token= and warn on legacy use (c5db5d7)
• HMAC-sign recording webhooks (707820d)
• validate APP_SECRET length and centralize access (dcfbb55)
• make constantTimeEqual actually constant-time (bb3543d)
• keep IDLE/PROVISIONING users in the waiting-room garden (2ce2d9a)
• unstuck the avatar (spawn outside card + symmetric toggle) (ac125a6)
• make avatar movement work even when form input is focused (9d4866f)
• cap endsAt at 4h and disable endsAt-based auto-close (704c632)
• network-resilient rejoin after Jitsi videoConferenceLeft (e31c58c)
• real participant name in stats-id (Jicofo logs no longer show "Judah-hqj") (2108370)
• align schema to DB to clear Migration Integrity drift (56b2710)

Refactoring

• design token colori (.italia) al posto di 261 hex hardcoded (polish #1) (26ed9c9)

Documentation

• design orchestrazione recorder — operator riconciliante (edge+level triggered) (a67d07d)
• marca multitrack-recorder come PIANIFICATO (non ancora deployato) (e035cbb)
• report — esito finale waveform validata, sezioni allineate (26c48bc)
• report run cluster — waveform validata end-to-end + 6 bug corretti (9310724)
• informativa privacy + service inventory per la pipeline AI (e39602f)
• explain why style-src 'unsafe-inline' stays + migration plan (5c19dc3)
• add PENTEST-RFP for an external pentest vendor (eee02c9)
• note that CodeQL needs Code Scanning enabled in repo settings (fcb898a)

CI / build

• runs-on arc-runner-eventi-dtd → arc-runner-pa-webinar (78b9558)
• build & push immagine recorder :dev su modifiche infra/recorder/ (ADR-013 Fase 3) (a7a7114)
• aggiungere workflow_dispatch trigger a ci.yml (689d1c7)
• trigger CI workflow re-run on PR #62 (2676a7e)
• pull postgres service from mirror.gcr.io too (#57) (ef54753)
• pull node + postgres from mirror.gcr.io to dodge Docker Hub rate-limit (44a684f)
• make CodeQL non-blocking + retry compose on Docker Hub rate-limit (08ffd6d)
• add actions:read permission for telemetry upload (a0c6d4b)
• add CodeQL workflow (f6eb839)
• docker compose plugin + bump @xmldom/xmldom past CVE-2026-41672/3/4/5 (987ffd6)
• run on arc-runner-eventi-dtd instead of ubuntu-latest (8578ff4)

Chores

• flip GHCR ghcr.io/italia/eventi-dtd* → pa-webinar* (43598c2)
• eventi-dtd → PA Webinar (codice, chart, brand, docs) (c2f2866)
• add no-console-with-pii custom rule (warn level) (134fddd)
• appease lint (unused GDPR_ACTIONS) and refresh license-report (8b3906e)
• pin xmldom to 0.8.x and override fast-xml-builder (7cab31b)
• bump next, marked, next-intl to patched versions (ba6d5a3)

Tests

• align live-flow smoke tests with waiting-room refactor (bd6a3a1)

Other

• i18n(admin): esternalizza stringhe inline conferma/toast (gdpr-templates/publications/sessions) (f26f75f)
• deps(worker): gender-guesser per name_gender inference fallback (876ff66)
• ux(postprod): testi più chiari, voice cloning explicit, status card informativa (6b1b7b2)
• security: hardening admin/postprod surface (audit review) (9340207)
• i18n(gdpr): seed export+erasure keys across the remaining 20 locales (d8f6322)
• i18n: native translations for Irish (ga) (598c89b)
• i18n: native translations for 21 EU locales (Irish pending) (16ba10f)

Full diff: v0.4.0...v0.5.0