Signify Creator v0.4.0

Production optimization release

Signify Creator v0.4.0 completes the sequential production hardening and efficiency program while preserving the existing Signature Studio-styled UI, approved login page, campaign overlays, banner effects, multi-tenant M365 registration, and Application Owner-only Stripe billing.

Architecture and performance

• Shared CSRF-aware frontend request client and common style primitives.
• Extracted authentication, authorization, validation, HTTP, media, and job services.
• Indexed email, workspace, approval, tenant pagination, and Application Owner query paths.
• Concurrent GET coalescing, bounded request timeouts, and stale preview cancellation.
• Health p95 measured at 16.364 ms versus 16.495 ms baseline.

Reliability and operations

• Durable SQLite jobs with atomic claims, deduplication, retry backoff, terminal failures, and stale-lock recovery.
• Tenant media quotas, atomic writes, immutable caching, and seven-day orphan safety window.
• Separate liveness, readiness, legacy health, and aggregate metrics endpoints.
• Structured startup errors and idempotent HTTP/job/database shutdown.
• Production operations runbook for deploy, monitor, jobs, backup, restore, rollback, and capacity.

Security and supply chain

• Explicit release asset allowlist and artifact privacy gate.
• Tenant storage path validation and server-side access policy modules.
• CycloneDX 1.5 production SBOM included.
• npm production audit: 0 known vulnerabilities.

Verification

• Unit, frontend, database, job, media, setup, smoke, SBOM, formatting, lint, build, and artifact suites passed locally and on Linux CI.
• Clean production-only install: 36 packages, 0 vulnerabilities.
• Archive inspection: 84 entries, no runtime uploads, generated tenant media, databases, local environment files, backups, logs, or dependencies.

Integrity

SHA-256: d7bd00ca40f5b767d51d8d38495575db322637cd4eebbb1bbab902d35e463732