v0.2.0 - Wiki Collaboration, Skills Collaboration, Access Control & MCP Overhaul

Wiki — Versioning & Contribution Workflow

• Draft proposal system — contributors propose edits; editors review, approve, or reject with a required note
• Full revision history — every edit creates an immutable snapshot; rollback to any version
• Scoped wiki pages — pages can belong to a workspace or global scope, with permissions enforced at read and write time
• MCP contribution tools — propose_wiki_edit, edit_wiki_page, list_pending_drafts, review_draft, approve_draft, reject_draft exposed via MCP

Access Control — Dual-Realm RBAC

• Global realm — department-scoped permissions (doc:read:own_dept / doc:read:all); sources with no department are visible to all
• Workspace realm — pure membership model: Viewer → Contributor → Editor → Admin; global role does not bleed into workspace access
• Audit log — all admin actions (source uploads, employee changes, permission updates) recorded with actor, timestamp, and diff

AI Skills

• Versioned skill packages distributed via MCP
• Department-scoped visibility
• Bulk upload flow and skill library browser

MCP Server

• Full permission-aware tool suite: wiki read/write, raw source drill-down, knowledge type browsing
• Shared permission helpers eliminate duplicated auth logic across tools
• selectinload on draft queries — eliminates N+1 DB round-trips
• offset pagination on all list tools; top_k capped at 50 for search
• wiki_index_resource now requires authentication

Docker & Deployment

• Multi-stage frontend Dockerfile (deps → builder → runner) using Next.js standalone output — image size ~75% smaller
• .dockerignore at root and frontend — excludes .venv/, node_modules/, build artifacts from context
• docker-compose.yml uses YAML anchor to build backend image once, shared by api, worker, worker_skills
• API healthcheck — workers start only after API passes health check
• Next.js rewrites use INTERNAL_API_URL env var instead of hardcoded 127.0.0.1