Stable Initial Version

What's Changed

• Relicense AGPL-3.0 → Apache 2.0 + add IP-independence NOTICE by @mickyarun in #48
• Public-launch follow-ups: BUD canonicalization, public-readiness docs, landing page by @mickyarun in #49
• README polish: move independence note to footer, mark Anthropic direct API as supported by @mickyarun in #50
• README + landing-page narrative restructure: How It Runs, AI Engines, Manifesto, FAQ, JSON-LD schema by @mickyarun in #51
• Position as Agent-Driven Development methodology (not agentic SDLC) by @mickyarun in #52
• feat: MCP-ify BUD design read/write + cascade reassignment to TODOs by @mickyarun in #53
• feat: surface BUD ↔ Feature links in Requirements tab + audit timeline by @mickyarun in #54
• fix+feat: BUD design wireframe preview, linked-features UI, PM agent grounding by @mickyarun in #55
• prompt: wireframes are plain HTML — drop Vue/Vuetify, retire v-app autowrap by @mickyarun in #56
• feat: BUD ↔ Feature links UI, wireframe preview fixes, todo regen on chat edit by @mickyarun in #57
• refactor: regenerate BUD todos only at DEVELOPMENT-phase transition by @mickyarun in #58
• scan: domain-overlap guard + compound-bigram cluster labels by @mickyarun in #60
• chore: replace customer-specific placeholders with generic ones by @mickyarun in #61
• feat(buds): Notion-style TODO board + agent-driven generation via job queue by @mickyarun in #59
• removed the deployment file by @tanu-atoa in #62
• chore(backend): clear all mypy --strict errors + open-source PR gates by @mickyarun in #63
• fix(ci): unblock Dependabot PRs (hatchling pin + DCO bot exemption) by @mickyarun in #90
• chore(deps)(deps): update tzdata requirement from >=2024.1 to >=2026.2 in /backend by @dependabot[bot] in #84
• chore(deps)(deps): update python-dotenv requirement from >=1.0.0 to >=1.2.2 in /backend by @dependabot[bot] in #81
• chore(ci)(deps): bump actions/setup-node from 4 to 6 by @dependabot[bot] in #64
• chore(ci)(deps): bump googleapis/release-please-action from 4 to 5 by @dependabot[bot] in #66
• chore(deps)(deps): update bcrypt requirement from <4.1 to <5.1 in /backend by @dependabot[bot] in #77
• chore(deps)(deps): bump the multiplayer-minor-patch group across 1 directory with 2 updates by @dependabot[bot] in #70
• chore(deps)(deps): bump the frontend-minor-patch group across 1 directory with 8 updates by @dependabot[bot] in #74
• perf(design): real --resume + iteration_model + no-link fallback by @mickyarun in #89
• chore(ci)(deps): bump amannn/action-semantic-pull-request from 5 to 6 by @dependabot[bot] in #65
• chore(ci)(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #67
• chore(ci)(deps): bump actions/setup-python from 5 to 6 by @dependabot[bot] in #69
• chore(ci)(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #68
• feat(security): layered defense for --dangerously-skip-permissions claude subprocess by @mickyarun in #92
• fix(claude-guard): post-merge bug fixes — MCP unblock, NPROC, env-exfil by @mickyarun in #93
• chore(ci): drop CodeQL quality queries, keep security-extended by @mickyarun in #94
• fix(security): block partial-SSRF in GitHub install-repo client by @mickyarun in #95
• refactor(bud-detail): split into focused subcomponents + composables by @mickyarun in #97
• feat(bud): phase-gated section edits + role fallback chain by @mickyarun in #98
• feat(bud-chat): session resume for all states + log-leak + concurrency + design auto-trigger fix by @mickyarun in #99
• fix(security): truncate password input to 72 bytes before bcrypt by @mickyarun in #100
• fix(bud-design): per-design cancel, per-repo banners, tracker loop fixes by @mickyarun in #101
• feat(bud-chat): durable resume, cancel, and restart recovery for AI Editor chats by @mickyarun in #102
• feat(pr-merge,features): phase 5 Redis-stream redesign + lineage UI by @mickyarun in #103
• feat(skills): custom skills per agent type, per-BUD stage overrides, override-aware resolver by @mickyarun in #104
• fix(skills): prune orphan agent_skills rows mis-tagged by step-4 fallback by @mickyarun in #105
• feat(scan,pr-merge): route subsequent scans through the diff-based engine by @mickyarun in #106
• fix(rbac): manager team:manage + developer buds:edit seed by @mickyarun in #107
• feat(design-systems): user customisations preserved across re-extraction by @mickyarun in #120
• fix(scan): include .bodhiorchard/mcp_bridge.py in bootstrap PR by @mickyarun in #121
• fix(nginx): proxy /mcp/ to backend for example-repo bridges by @mickyarun in #122
• fix(hooks): resolve tracked repo by basename when laptop path misses by @mickyarun in #123
• fix(xp): resolve PR author to BUD assignee when github_username misses by @mickyarun in #124
• feat(xp): stage-gated XP awards split among BUD contributors by @mickyarun in #125
• feat(code-review): classify git-auth failures + retry-once + explicit cwd by @mickyarun in #126
• fix(rbac): grant QA role buds:test for evidence upload + result entry by @mickyarun in #127
• fix(github): preserve valid inline review comments on 422 by @mickyarun in #128
• fix(github): post code-review on every re-run, not just the first by @mickyarun in #129
• fix(storage): surface S3 errors as FileStorageError + bump success log by @mickyarun in #133
• feat(qa-evidence): pydantic-settings storage
  • filename sanitiser + scoped UI errors by @mickyarun in #134
• feat: external-LLM mode + remote MCP endpoint + per-phase auto-generate by @mickyarun in #136
• fix(mcp-connect): show full URL when VITE_API_BASE_URL is a bare path by @mickyarun in #137
• feat(mcp): write-side BYO-AI tools + append-only BUD edit history by @mickyarun in #138
• fix(webhook): use webhook_event= kwarg to avoid structlog event collision by @mickyarun in #132
• fix(bud-assignment): phase-scope continuity to stop cross-phase bleed by @mickyarun in #135
• fix(security): safe_join helper + targeted path-injection guards by @mickyarun in #142
• fix(qa-evidence): always-visible delete button on evidence tile by @mickyarun in #140
• feat(qa): allow reverting manual result to pending by @mickyarun in #141
• feat(tech-spec): figma URL on Design tab + local-Claude tech-spec generation by @mickyarun in #143
• feat(figma-tech-spec): add figma URL field and make tech spec sections universal by @mickyarun in #146
• feat(mcp): accept bud_number on get_bud_by_id by @mickyarun in #147
• fix(narrow-synthesis): containment tier + deactivate filter prevent wrong-deactivation by @mickyarun in #148
• fix(dev): add missing dev-start.sh referenced by package.json by @mickyarun in #149
• feat(bud-board): add title and assignee filters to kanban header by @mickyarun in #150
• feat(slack): feature Q&A + harden triage duplicate detection by @mickyarun in #151
• fix(mcp): drop top-level oneOf from get_bud_by_id input_schema by @mickyarun in #159
• fix(scan): prevent silent-empty synthesis from wiping repo features by @mickyarun in #160
• feat(scan): adaptive narrow cap on PR-merge dispatcher by @mickyarun in #161
• feat(bud): re-review action on Code Review tab by @mickyarun in #162
• fix(bud): activity log + timeline render for code-review re-runs by @mickyarun in #163
• fix(scan): refresh origin auth before rescan ls-remote by @mickyarun in #164
• feat(scan): close Flutter exclusion gaps in indexer + extractor by @mickyarun in #165
• fix(skills): line-churn scoring + walk develop branch for authorship by @mickyarun in #166
• feat(scan): extend backend-link extractor to Dart/Flutter sources by @mickyarun in #167
• feat(slack): make all Slack agent prompts honour Settings UI edits by @mickyarun in #152
• fix(agents): two subprocess-resilience bugs in the BUD-agent path by @mickyarun in #158
• fix(slack): make feature Q&A bot actually search and stay conversational by @mickyarun in #168
• fix(scan): invalidate dashboard tree cache on scan complete by @mickyarun in #169
• feat(buds): priority-aware smart assignment + yield-offer flow by @mickyarun in #170
• fix(features): render BUD-authored rows so pagination + count agree by @mickyarun in #171
• docs: extract landing site from Vue methodology page; refresh READMEs by @mickyarun in #172
• feat(mcp): priority on create_bud + update_bud (optional) by @mickyarun in #175
• fix(slack): scope-gate triage duplicate detection to stop false positives by @mickyarun in #176
• fix(buds): let QA promote testing → uat without buds:edit by @mickyarun in #177
• fix(triage): wire PRD agent + downstream skills on approval by @mickyarun in #178
• docs(landing): add Slack triage & MCP tools demo video by @mickyarun in #179
• fix(rbac): drop legacy OrgToUser.role; resolve canonical role via role_id by @mickyarun in #180
• fix(tech-planner): forbid Unicode operators in Mermaid labels by @mickyarun in #182
• fix(rbac+estimation): drop legacy OrgToUser.role and harden every estimate_bud_dates caller by @mickyarun in #181
• feat: wire Learning Agent (post-close retrospective + estimator feedback loop) by @mickyarun in #183
• fix(frontend): drop playcanvas manualChunk + raise Docker build heap + add fork-friendly prepare hook by @mickyarun in #184
• fix(bud-closure): prevent running code synthesis on BUD close by @mickyarun in #185
• docs(landing): add Design phase & agent prompts demo video by @mickyarun in #186
• feat(landing): thumbnail-grid video picker + 2 new demos + Design URL fix by @mickyarun in #187
• fix(reconciler): global score-descending pairing prevents false-positive feature deactivations by @mickyarun in #188
• fix(bud): show "Run estimation" button when no estimates exist yet by @mickyarun in #189
• fix(buds): polish Learnings recap rendering + share markdown styles with QA panel by @mickyarun in #190
• fix(learnings): open org-wide Learnings overview to every org member by @mickyarun in #191
• fix(learnings): fold merged + external contributor rows into active target by @mickyarun in #192
• docs(readme+landing): lead with virtual-world hero, tuck rest under 'More walkthroughs' by @mickyarun in #197
• fix(buds): stop unrelated PRs leaking onto PROD / UAT tabs by @mickyarun in #193
• feat(buds): per-BUD branch override for UAT / PROD tabs by @mickyarun in #194
• feat(buds): edit impacted_repos from BUD detail by @mickyarun in #195
• fix(buds): allow QA role to use AI editor on Testing tab by @mickyarun in #200
• docs(readme): lift screenshots above the fold by @mickyarun in #201
• fix(reconciler): add absorbed tier for old-into-bigger-new merge pattern by @mickyarun in #198
• feat(bugs): production bug board with Feature links, Kanban + comments by @mickyarun in #202
• fix(bugs): sync frontend/package-lock.json for Docker npm ci by @mickyarun in #205
• fix(bugs): restore frontend/package-lock.json minimal diff (revert #205 drift) by @mickyarun in #207
• fix(agents): refresh GitHub App tokens on every Claude spawn site by @mickyarun in #209
• fix(bud-agent + ai-editor): multi-repo token refresh + AI Editor cross-BUD pollution bundle by @mickyarun in #210
• feat(slack-qa): route brain bot intents via a haiku classifier into focused sonnet specialists by @mickyarun in #212
• fix(slack): three Brain bot thread + matching fixes by @mickyarun in #211
• fix(deps): bump multiplayer vitest 1.6.1 -> 3.2.6 to unblock prod docker build by @mickyarun in #213
• fix(deps): regenerate frontend lockfile + skip canvas postinstall to unblock prod docker build by @mickyarun in #214
• fix(backend): pre-bake fastembed embedding model into the docker image by @mickyarun in #215
• fix(slack-qa): treat bud-fact specialist max_turns as soft not_found by @mickyarun in #216
• fix(members): rebind aliases on merge + admin unlink + Danger Zone skill rerun by @mickyarun in #217

New Contributors

• @dependabot[bot] made their first contribution in #84

Full Changelog: https://github.com/mickyarun/bodhiorchard/commits/v1.0.0