v3.5.0

Added

• pando login [SERVER_URL] signs the CLI in from the browser (OAuth device flow) and saves a
  90-day token in ~/.config/pando/credentials.json (mode 0600), used when neither --token nor
  PANDO_TOKEN is given; pando logout revokes it and pando whoami shows the account (ADR-033).
• Invitations: organisation administrators invite by email (CreateInvitation,
  ListInvitations, RevokeInvitation); the single-use, 7-day link signs the person in (creating
  an account if needed) and adds them with the invited role (ADR-033).
• First sign-ins ask the person to confirm they are 18 or older and accept the terms
  (--terms-url, --privacy-url) before an account is created; the time is stored on the account.
• Viewer returns the calling token's id, so clients can sign out by revoking it.
• Console: "Sign in with …" buttons and an email form when the server has sign-in pages, sign out,
  a guided set-up for a new organisation (name it, invite teammates, connect an agent), and
  invitations on the organisation's People tab.
• pandod repo disable|enable OWNER/NAME takes a repository down at once without deleting it,
  and pandod repo delete OWNER/NAME removes it and its storage; documented with a secret purge
  procedure in docs/deploy.md.
• --trust-proxy: audit-log client addresses from X-Forwarded-For sent by a local proxy.
• Console: "New repository" on the organisation page; an empty repository shows how to clone it,
  make the first change or bring in a git repository; a new token shows ready-to-copy CLI and MCP
  setup.

Changed

• SQLite commits are synced to disk (synchronous=FULL) so an acknowledged land survives power
  loss; --sqlite-synchronous normal restores the previous behaviour. file:// object stores
  fsync every object and its directory (ADR-034).
• --metrics also serves /healthz and /readyz; gRPC health checks need no token and report
  NOT_SERVING when the registry or a data directory fails, and from the start of shutdown.
• SIGTERM drains calls in progress and stops the webhook worker before exiting.
• Platform servers limit each account to 128 calls in progress (--max-calls-per-principal)
  and request messages to 64 MiB (--max-request-mb), keep at most 256 repositories open
  (--max-open-repos, --repo-idle-minutes), and page repository listings.
• Webhooks: deliveries run concurrently, two at a time per webhook, 30 s each; delivery is at
  least once (dedupe by X-Pando-Delivery); finished deliveries are deleted after 30 days.
• The audit log is written to one file per UTC day and kept --audit-retention-days (365).
• --web-origins is now --cors-origin (the old name still works); pando mcp --http takes
  --allowed-origin and stops on SIGTERM.
• The registry records its schema version and applies ordered migrations.
• Console UX pass: a first visit to a server with sign-in pages opens sign-in instead of the demo;
  set-up asks for the organisation's name and derives its short name; the full repository header
  shows on Overview only; gold marks landings only (dark-theme buttons, selection and unread marks
  use Fishlake blue); form errors read as sentences.

Fixed

• Console: the clone and mount commands name the repository (SERVER/OWNER/NAME) on servers that
  host many; Home shows an error instead of loading forever when the server is unreachable or
  refuses the token; Issues breadcrumbs; Escape closes the phone navigation drawer; wide tables no
  longer widen the page on phones; imported git authors show their name without the email; the
  Connect page's "remember" checkbox is visible.

Security

• Production hardening (ADR-034): metric labels only for methods the protocol defines (no
  unbounded series from made-up paths); internal errors return an id, not SQL or paths; the
  registry survives a panic while locked; inbox, events, issue and repository listings scan a
  bounded number of rows and never open every repository; archived repositories refuse writes;
  Locks/List shows only paths the caller may read; the MCP gateway refuses browser origins unless allowed; the
  free-tier cloud-init no longer trusts a demo console origin; a stored object that fails its
  hash check is repaired by pushing it again.
• Plans and limits (ADR-035): platform servers record each organisation's active agents (agents
  that landed a change in the calendar month), people, storage (measured hourly, with the month's
  peak) and private repositories. With --multi-tenant, organisations' limits are enforced:
  suspended organisations and those over storage can read but not write, new agents beyond the
  active-agent limit can't land while active ones keep landing, and seats and private
  repositories are checked when added. Defaults come from --default-org-limits. New RPCs
  GetUsage, SetLimits, SetSuspended, GetCapabilities and GetLicense; commands
  pando org usage and pando admin limits show|set|suspend|restore; a Usage & plan tab in
  the console with a Change plan button linking to --billing-url, and a banner on every page of
  a suspended organisation linking to --support-url.
• Support licences: pandod server --license FILE and pandod license verify FILE check an
  Ed25519-signed licence offline and report it; nothing is turned off without one.

Changed

• The sign-in pages (/login/*: sign in, check your email, create your account, CLI approval,
  invitations, errors) carry the console's brand: the Pando mark, its palette in light and dark,
  labelled fields, a clear primary action and plain error messages, still self-contained under
  default-src 'none'.