v1.6.0 — Drive, notes as folders, the iOS widget, and Android

Web, api and mobile all move onto 1.6.0. The release carries 74 commits since v1.5.0.

Drive

• A document store for the organization. Upload a file, file it in a folder, and mention it from a task, a note or a comment. Web, mobile and the MCP reach the same files.
• Video and audio play in the preview, and the upload allowlist accepts both.
• The tree-and-sections layout now serves the Drive and the Notes.
• A browser end-to-end suite covers both.
• Object storage is written down. The deploy always needed a bucket. The docs now name the MinIO that serves it.

Notes

• A note can be a folder. Web and mobile browse the tree. A folder opens as its own screen on the phone, so back is the platform's own gesture.
• Folders sort by name on both surfaces, and an agent reads the folder fields the API already carried.
• The note page is the editor and nothing else. Live co-editing is gone.

Mobile

• A Tasks widget for the home screen and the lock screen, drawn in the app's own colours. A widget row opens the task it names.
• Android works. A tab bar, inset form cards, native switch thumbs, and no SwiftUI import left on the Android path. A read-only smoke tour covers it.
• The row swipe is one continuous gesture. A full swipe stays inside the reach of a thumb.
• The Profile screen no longer crashes on iOS, and the platform split is checkable.

Notifications

• A push arrives once, in the workspace it came from, when a task appears or moves.
• The toggles in settings govern push. Email now carries account mail only.
• The unread count follows the workspace the inbox shows.

Agents and the MCP

• A search tool, plus the task fields the API already had.
• Every tool reaches the organization you meant, instead of the first one you joined.
• The Elliptic agent skill ships with the repo.

Web app

• One sidebar list, and the task identifier gets a column of its own.
• The board sorts by lifecycle, and a closed section shows shut instead of leaving the board.
• The composers sit on the body's rails, at one height.
• Page and click events go to Open Analytics.

Markdown, one render path

• A table renders as a table in a comment, a task update and a description.
• The editor keeps the cells apart. Before this release it joined them and saved the result, so a description lost its table on the next save.
• A one-line preview shows clean text, with no asterisks and no pipes.
• The command palette no longer replaces the page with an error screen after you open a task, a note or a meeting.

Removed

• Eight features that nobody used, and seven project views, out of the API and the web app together. The docs and the agent skill describe what is left.

Known issues

• The markdown serializer writes --- for every table column, so a column alignment does not survive an edit. The cells stay correct.
• The public changelog jumps from 1.1.2 to 1.6.0. Nobody wrote an entry for 1.2.0 through 1.5.0.

v1.5.0 — monochrome retheme, new brand mark, mobile UX batch

Web, api and mobile all move onto 1.5.0 in this release. Three version schemes had drifted apart — tags at v1.4.0, web/api package metadata at 1.1.2, mobile at 1.1.0 — and they now agree. The mobile app's public version jumps 1.1.0 → 1.5.0 as a result, a deliberate gap in App Store history.

Mobile

• Swipe to commit. Dragging a task row past 45% fires the action instead of parking the panel open and waiting for a tap.
• Board hygiene. Done, cancelled and duplicate leave the board entirely rather than sitting collapsed; backlog and in-progress fold on every open. duplicate also reaches mobile at last — tasks in that state were previously filtered out and therefore invisible, not merely unselectable.
• Status and priority glyphs in every picker row.
• Comment composer rebuilt as its own memoised component owning its draft. The lag was architectural — the draft lived in the task screen and retyped the whole screen on every keystroke.
• Settings folded into Profile, sectioned, and no longer fighting the app's palette.
• Haptics across shared rows and buttons.
• Privacy overlay shows the app icon rather than the wordmark — it's the card you scrub past in the app switcher, where a line of text reads as a page that failed to load.

Brand

• Monochrome terminal palette across web and mobile, ported from the blog. Web derives everything from two variables per mode; mobile's 89 tokens were rewritten to match.
• Identity palettes — avatars, project tiles, collaborator cursors, chart series — move to grey ramps. Every avatar step stays dark enough for white initials at ≥4.5:1.
• New app icon and every brand raster, generated by scripts/render-brand.py from signed distance fields rather than checked in as opaque binaries. --check verifies the tree is current.
  • Android's adaptive foreground was pointing at the full opaque square, so the launcher's circular mask was clipping the ellipse. Now transparent and inside the 66/108 safe circle.
  • Icons the OS masks are full squares; App Store rasters carry no alpha channel.
  • Browser-tab icons are optically sized — a 2.5%-of-width stroke is a third of a pixel at 16px.

Two hues stay deliberately: Google's OAuth mark (recolouring it breaches their brand terms) and danger red.

API

• Stickies removed — table, endpoints and the last traces of the feature (migration e1f4a72c9d38). Production table was verified empty before the drop.

Tooling

• Pre-commit hooks routing staged files to ruff and each app's own eslint. Install with scripts/setup-hooks.sh.

Known issues

• Collaborator cursors are now told apart by lightness alone. Ten greys is a weaker signal than ten hues with several people editing at once; if it gets thin, cursors are the one place worth spending a hue.
• expo doctor flags three keys in app.json (newArchEnabled, jsEngine, android.edgeToEdgeEnabled) that the SDK 55 schema no longer recognises. They are silently ignored — all three are defaults now — but they read as if they are doing something.

v1.4.0 — caching, a delta sync feed, and two removals

Caching and sync groundwork, plus two removals.

Stage 1 — stop paying for data we already hold

• Web cache survives a reload. A return visit paints from disk instead of refetching every visible list.
• Sign-out clears that copy. The workspace is now on disk, so the next person at the machine must not find it. queryClient.clear() only emptied memory.
• Mobile patches instead of refetching. A task edit used to invalidate the whole tasks prefix, so returning to the list waited on a request for data the client had already computed. Edits now patch the cached lists in place and roll back on failure.

Stage 2 — a delta feed

GET /orgs/{id}/sync/changes?since=<cursor> answers what changed, so a client can ask for the difference rather than the whole workspace.

Built on updated_at, not the event outbox. The outbox holds what a writer remembered to emit; updated_at is maintained on every write. A feed that silently misses a change is indistinguishable from one with nothing to report.

Deletions are recorded in their own table rather than flagged on the row. Tasks and notes are the parents of 16 and 6 cascading foreign keys, and both are self-referential. Flagging would leave live children pointing at rows the user believes are gone, hold unique values hostage, and require a filter on every read where a single omission resurrects deleted data. The delete stays a delete.

Removals

• Comment visibility. It never hid anything from project members and only narrowed what a guest could read, while the lock beside the Comment button implied privacy.
• Stickies, from every surface. The table is deliberately left in place — dropping it is the one step that cannot be undone.

Also

Labels are set in their own case rather than uppercased. Markdown tables render as tables instead of rows of pipes.

Verification

536 API tests, 83 web, 93 mobile. Both migrations round-trip on a copy of real data — same row counts before, after downgrade, and after re-apply. The delta feed was exercised live: bootstrap, a no-op poll returning nothing, one edit reporting exactly one task, and a delete reporting the tombstone while the row really 404s and its cascade still fires. Mobile checked on the simulator.

Deploy note: the Dockerfile runs alembic upgrade head on container start, so three migrations apply on this deploy. All are additive or drop-only and were rollback-tested.

v1.3.0 — the Elliptic name, and the redesigned dashboard

First release under the Elliptic name, and the first with the redesigned dashboard.

Web dashboard

• Task list and board rebuilt on circle's row geometry — borderless 44px rows, hover separation instead of per-row hairlines, status-tinted group headers, 348px board columns.
• Tab strips are pills rather than underlines.
• Priority is drawn as ascending bars; lucide's Signal glyphs read as connectivity, not urgency.
• Product page headers lost their marketing eyebrows and taglines.
• Retuned neutral ramp with an inset content pane.
• Labels are set in their own case instead of uppercased.
• CI fails on a colour class naming a token the theme does not define. Tailwind emits nothing for those and exits 0 — we had shipped that twice.

Mobile — app version 1.1.0

• Icons moved to lucide, so a task row looks like itself on both platforms. The tab bar stays on SF Symbols, because it is a real UITabBarController.
• The create-task sheet is a real UISheetPresentationController wrapping a SwiftUI Form: system pickers, system calendar, and UIKit owning keyboard avoidance.
• Task descriptions render and edit as formatted text rather than raw source, including the grammar the web's editor writes — h4, ordered lists, blockquotes, fenced code, strikethrough, rules — which mobile previously displayed as literal characters.
• Lists page fully instead of silently stopping at the server's first 50 rows.
• Collapsed sections are remembered across navigation; inbox day groups collapse too.

Verification

Dashboard checked in light and dark; the app driven on the simulator. Device testing caught three defects that typecheck, lint and the unit suites all passed: a native host covering the screen and swallowing every touch, an editor whose model silently drifted from the native text buffer, and a caret computed from the wrong length.

v1.2.0 — social sign-in, the first mobile app, and Coolify deploys

What's new since 1.1.2

Web

• Social sign-in with Google and GitHub: full OAuth round-trip, provider icons, and env plumbing (#11, #12)
• Protected routes now gate on the refresh token instead of the access token, so sessions survive access-token expiry (#10)
• Board columns cap at the fold and lead with the newest task (#13)

Mobile

• Initial Expo/Ignite app scaffold wired to the production API: auth, tasks, notes, inbox, offline queue, push registration, and Maestro E2E flows

Deployment

• Production deploys moved to Coolify with health-checked rolling updates and auto-deploy on push to main; the GitHub-runner deploy workflow is retired (see DEPLOY.md)

Full changelog: v1.1.2...v1.2.0

v1.1.2 — MCP OAuth, where consent decides the grant

A second MCP OAuth compatibility patch: consent decides the grant.

MCP OAuth

• Fixed write access for MCP clients. Clients like Claude Code send no scope parameter on the authorize request. The server defaulted such requests to the read-only baseline and intersected the user's consent decision with it — so every choice on the consent screen, including Root / Admin — full access, was silently reduced to read-only. The selection made on the consent screen is now exactly the grant.
• Clients that request explicit scopes are unchanged: the grant is still capped at what the client requested, and nothing can widen a token's scopes without a fresh consent.

Containers

• ghcr.io/woosal1337/companyos-api:1.1.2
• ghcr.io/woosal1337/companyos-web:1.1.2

Full changelog: v1.1.1...v1.1.2

v1.1.1 — MCP OAuth, with an optional resource parameter

A compatibility patch for connecting MCP clients.

MCP OAuth

• The RFC 8707 resource parameter is now optional on the authorize request. When a client omits it, the server binds the request to the canonical MCP resource URI from its own protected-resource metadata, so clients that predate resource indicators in the MCP auth spec (for example JetBrains Air's MCP settings) can complete the browser consent flow.
• Audience binding is unchanged: a provided resource must still equal the canonical MCP URI, and the token endpoint's invalid_target check is untouched. A code minted for this server cannot be replayed against another audience.

Containers

• ghcr.io/woosal1337/companyos-api:1.1.1
• ghcr.io/woosal1337/companyos-web:1.1.1

Full changelog: v1.1.0...v1.1.1

v1.1.0 — the public site, the blog, and the changelog

The public site, properly.

Marketing site

• Functional footer and top nav, with every link resolving
• Landing-quality, technical product pages: Projects, Meetings, Notes, and Activity
• Rebuilt About and Contact, plus Privacy and Terms

Blog and changelog

• A CompanyOS-hosted blog with posts and an RSS feed
• A hosted changelog at /changelog

SEO and social

• sitemap.xml, robots.txt, canonical URLs, and JSON-LD structured data
• Generated Open Graph and Twitter cards, with a per-page image

Other

• Removed the placeholder testimonials section
• A dead-link regression test wired into CI

Containers

• ghcr.io/woosal1337/companyos-api:1.1.0
• ghcr.io/woosal1337/companyos-web:1.1.0

Full changelog: v1.0.0...v1.1.0

v1.0.0 — the first public release

Jira for your agents. The first public release of CompanyOS, an open-source, agent-native work platform where your AI agents operate the same projects, tasks, meetings, and notes your team does, over a built-in MCP server, on your own keys.

Quick start

git clone https://github.com/woosal1337/companyos.git
cd companyos
cp .env.example .env
docker compose up --build

Web on http://localhost:3000, API on http://localhost:8000. Database migrations run on start.

What's inside

• Multi-tenant coordination: projects, Linear-style tasks, meetings with transcripts and AI summaries, notes, calendar, and a full activity log.
• A built-in company-brain MCP server (OAuth 2.1) that makes the whole workspace agent-operable, and bidirectional.
• Bring-your-own-key: every AI feature runs on your org's OpenAI or Anthropic key, every call audited.
• Self-host with one docker compose. Apache-2.0.

Container images: ghcr.io/woosal1337/companyos-api and ghcr.io/woosal1337/companyos-web.
Docs: https://docs.company.chele.bi