RodexDB v0.5.1

Added

• Single canonical contract — contract/rodex-contract.json is now the
  one source for every public limit/capacity value (NORMAL + PERFORMANCE
  budgets, 400 KB item cap, batch/query/admin caps, storage, MCP budgets).
• Deterministic generator — npm run contract:generate produces the
  gateway + dashboard typed modules, generated Markdown tables, README limit
  row, and OpenAPI x-rodex-capacity metadata from that one file.
• Drift guards — npm run contract:check fails CI when generated output
  is stale, active pages/docs contain old public numbers, or the contract is
  invalid (contract parity tests added; 182 gateway tests).
• docs/generated/ reference tables + generated sections embedded in
  docs/capacity.md, docs/rate-limits.md, docs/mcp.md; ADR-007;
  docs/contract-maintenance.md guide.

Changed

• Gateway + dashboard now import public limits from the generated contract
  module (runtime values unchanged — NORMAL 800/800/2 000/2 400, PERFORMANCE
  100 000/400 000/500 000/2 000 000, 400 KB cap, 50-batch, 100-query).
• Package versions aligned to 0.5.1 (root, gateway, dashboard, rodexdb, rodex-mcp).

Tests

• 182 gateway tests (179 prior + 3 contract-parity).

RodexDB v0.5.0

Added

• Capacity modes (platform-wide): PERFORMANCE = all tables on-demand
  (pay-per-request, no throttling, budgets become guardrails: writes
  100 000 units/min, reads 400 000/min) · NORMAL = provisioned 5/5 ($0 free
  tier, budgets 800 write-units / 800 reads per app/min — the free-tier pool made honest).
• Switch via dashboard (AppsPage strip + confirm modal, SWITCHING… state)
  · REST GET/POST /v1/admin/capacity · MCP get_platform_capacity
  • set_platform_capacity (confirmation-gated) — 26 tools.
• Item cap 20 KB → 400 KB (DynamoDB's hard limit) in BOTH modes — reads
  were never size-gated; writes now accept any size; 20 KB becomes a cost
  recommendation. Batch byte cap 400 KB total.
• docs/capacity.md (matrix + cost ladder + AWS switching facts).

Changed

• Budgets in NORMAL were raised (120 → 800 write-units/min per app; 240 → 800 reads; 600 → 2 000 total;
  1 000 → 2 400 platform — the real 25 WCU+25 RCU/s shared pool with margin) — 429s
  now only at genuinely absurd rates.
• New tables created while PERFORMANCE are on-demand directly.

Tests

• 177 gateway + 14 package (capacity endpoint suite, PERF guardrails,
  400 KB round-trip, TEST profile for exact end-to-end bursts).

Fixed (from the write-safety round)

• CORS: DELETE now allowed from the console — app soft-delete and MCP
  key delete were blocked by preflight since launch (day-one bug).
• delete_table pacing — drains big-row tables with ≤20-item chunks,
  1 s gaps and 429-retry backoff; cleanup no longer throttles mid-drain.

Changed (WCU-honest writes — the universal precaution, research-validated)

• Write budget is now size-honest: 120 write-units/min where every
  row costs max(1, ceil(bytes/1024)) — DynamoDB's exact rounding rule.
  Rows ≤ 1 KB = 1 unit (unchanged); an 18 KB row = 18 units; 429s name the
  budget. Matches the OpenAI TPM / DynamoDB WCU capacity-unit precedent.
• batch/put byte cap: total serialized bytes ≤ 20 KB per call, checked
  before any write → 413. A WCU-burst batch is structurally impossible.
• all_ok flag on batch responses (Elasticsearch errors precedent):
  a 200 with failed items is now impossible to miss. Per-item errors still
  carry ok:false + reason; retry guidance documented everywhere.
• bytes echoed on every item (put/get/query/update/batch) — consumers
  see the exact number the budget charges on.

Tests

• 183 → 188 (all_ok matrix, batch byte cap, WCU-unit ceiling proof,
  bytes echo, CORS preflight regression).

RodexDB v0.3.0

Added

• POST /v1/batch/get — up to 50 keys in one call; missing keys are
  listed, not errors; N keys = N reads (weighted, reserved first); strong
  for consistent reads.
• POST /v1/item/increment — atomic counters (DynamoDB ADD): one write,
  zero reads, race-free; auto-creates the row; negative by decrements.
• Row TTL — optional ttl (unix seconds) on put/batch items; rows expire
  and DynamoDB deletes them for free (~48 h lag); the gateway filters expired
  rows on every read path so clients never see them.
• MCP batch_get_item (read, ungated) + increment_item (mutation,
  confirmation-gated) — 24 tools total.

Changed

• put / batch/put echo ttl; counter rows read back with counter.
• Docs + Python client updated (get_many, increment, ttl).

Tests

• 170 → 182 (batch/get weight proof, increment atomicity + budget, TTL
  expiry across get/query/batch-get, MCP trio tools).

RodexDB v0.2.2

Fixed

• P0 — silent empty writes are impossible now: put rejects unknown
  top-level body keys with 400 + the allowed list (a data envelope at the
  top level used to be accepted with 200 and silently stored an empty row).
  Every /v1/item/* and /v1/query body is strict — never accept-and-drop.
• P0 — one canonical write shape: item: {pk, sk, data: {...}} (the
  envelope) is now accepted by put and stored flat — identical to the flat
  form and to what reads return. MCP put_item and REST now produce
  physically identical rows (contract-tested). Envelope + flat fields mixed
  in one item → 400.
• P0 — verification contract documented: the put/batch responses echo
  the stored row (result.data); docs now tell clients to assert it.

Added

• POST /v1/batch/put — up to 50 items in one call: all-or-nothing
  validation (one bad item rejects the whole batch, nothing written), a
  batch of N consumes N writes from the 120/min budget (reserved upfront),
  per-item {pk, sk, ok, item|error} results, request_id idempotency.
• MCP batch_put_item — same capabilities behind the confirmation gate
  (22 tools total now).
• Rate weights — RateLimiterDO supports weighted checks (batch writes);
  single unit requests are unchanged.
• docs/python.md — zero-dependency Python client (the crawler's
  production module) + the sharded full-table scan recipe.
• Docs: sharding recipe in the API reference; strict-shape rules; meter
  sampling truth (item counts lag up to ~6 h — AWS DescribeTable), request
  meters stay live; batch budget accounting.

Tests

• 157 → 170 (envelope/400/strictness matrix, batch endpoint suite, MCP
  batch tool, MCP≡REST contract test, weighted budget proof).

RodexDB v0.2.1

Added

• Strict rate limiting: single-point Durable Object counters
  (RateLimiterDO) replace the eventually-consistent edge bindings — no edge
  lag, no burst tolerance. 429s now name their budget
  ("Rate limit exceeded — writes budget, retry in 59s").
• Tables provision 5 WCU / 5 RCU (auto-upgrade of legacy 1/1 on next touch).
• Observability: GET /v1/admin/apps/:id/usage (limiter peek + storage
  size) and a LIVE METERS panel on app detail (30 s refresh).
• POST /v1/admin/change-password + PROFILE popup; app description field;
  POST .../view-key (48 h recovery window); rok_-prefixed keys;
  POST .../delete alias; get defaults sk to "~".

Fixed

• Split-flap board rebuilt to real half-flap mechanics; auto-sizes per message
  (no blank cells); endless cycling; resting shimmer.
• Logout hardened (persistent flag + hard navigation + no-store HTML).
• Force-purge crash (blank page); app-row read path dropping new fields.
• GitHub OAuth 403 (missing User-Agent); FoldButton submit type.
• First deploy of the DO needed new_sqlite_classes (free plan).

Docs

• docs/rate-limits.md rewritten (strict model + stress evidence table),
  docs/api.md + openapi.yaml synced, docs/env.md added,
  docs/decisions/ ADRs added, README modernized, CHANGELOG started.

RodexDB v0.2.0

Added

• Strict rate limiting: single-point Durable Object counters
  (RateLimiterDO) replace the eventually-consistent edge bindings — no edge
  lag, no burst tolerance. 429s now name their budget
  ("Rate limit exceeded — writes budget, retry in 59s").
• Tables provision 5 WCU / 5 RCU (auto-upgrade of legacy 1/1 on next touch).
• Observability: GET /v1/admin/apps/:id/usage (limiter peek + storage
  size) and a LIVE METERS panel on app detail (30 s refresh).
• POST /v1/admin/change-password + PROFILE popup; app description field;
  POST .../view-key (48 h recovery window); rok_-prefixed keys;
  POST .../delete alias; get defaults sk to "~".

Fixed

• Split-flap board rebuilt to real half-flap mechanics; auto-sizes per message
  (no blank cells); endless cycling; resting shimmer.
• Logout hardened (persistent flag + hard navigation + no-store HTML).
• Force-purge crash (blank page); app-row read path dropping new fields.
• GitHub OAuth 403 (missing User-Agent); FoldButton submit type.
• First deploy of the DO needed new_sqlite_classes (free plan).

Docs

• docs/rate-limits.md rewritten (strict model + stress evidence table),
  docs/api.md + openapi.yaml synced, docs/env.md added,
  docs/decisions/ ADRs added, README modernized, CHANGELOG started.

RodexDB v0.1.2

Added

• Strict rate limiting: single-point Durable Object counters
  (RateLimiterDO) replace the eventually-consistent edge bindings — no edge
  lag, no burst tolerance. 429s now name their budget
  ("Rate limit exceeded — writes budget, retry in 59s").
• Tables provision 5 WCU / 5 RCU (auto-upgrade of legacy 1/1 on next touch).
• Observability: GET /v1/admin/apps/:id/usage (limiter peek + storage
  size) and a LIVE METERS panel on app detail (30 s refresh).
• POST /v1/admin/change-password + PROFILE popup; app description field;
  POST .../view-key (48 h recovery window); rok_-prefixed keys;
  POST .../delete alias; get defaults sk to "~".

Fixed

• Split-flap board rebuilt to real half-flap mechanics; auto-sizes per message
  (no blank cells); endless cycling; resting shimmer.
• Logout hardened (persistent flag + hard navigation + no-store HTML).
• Force-purge crash (blank page); app-row read path dropping new fields.
• GitHub OAuth 403 (missing User-Agent); FoldButton submit type.
• First deploy of the DO needed new_sqlite_classes (free plan).

Docs

• docs/rate-limits.md rewritten (strict model + stress evidence table),
  docs/api.md + openapi.yaml synced, docs/env.md added,
  docs/decisions/ ADRs added, README modernized, CHANGELOG started.

RodexDB v0.1.0

Added

• Strict rate limiting: single-point Durable Object counters
  (RateLimiterDO) replace the eventually-consistent edge bindings — no edge
  lag, no burst tolerance. 429s now name their budget
  ("Rate limit exceeded — writes budget, retry in 59s").
• Tables provision 5 WCU / 5 RCU (auto-upgrade of legacy 1/1 on next touch).
• Observability: GET /v1/admin/apps/:id/usage (limiter peek + storage
  size) and a LIVE METERS panel on app detail (30 s refresh).
• POST /v1/admin/change-password + PROFILE popup; app description field;
  POST .../view-key (48 h recovery window); rok_-prefixed keys;
  POST .../delete alias; get defaults sk to "~".

Fixed

• Split-flap board rebuilt to real half-flap mechanics; auto-sizes per message
  (no blank cells); endless cycling; resting shimmer.
• Logout hardened (persistent flag + hard navigation + no-store HTML).
• Force-purge crash (blank page); app-row read path dropping new fields.
• GitHub OAuth 403 (missing User-Agent); FoldButton submit type.
• First deploy of the DO needed new_sqlite_classes (free plan).

Docs

• docs/rate-limits.md rewritten (strict model + stress evidence table),
  docs/api.md + openapi.yaml synced, docs/env.md added,
  docs/decisions/ ADRs added, README modernized, CHANGELOG started.