CHANGELOG.json

{
  "irVersion": "1.0",
  "project": "systemforge",
  "repository": "https://github.com/plexusone/systemforge",
  "versioning": "semver",
  "commitConvention": "conventional",
  "maintainers": [
    "grokify"
  ],
  "releases": [
    {
      "version": "v0.30.0",
      "date": "2026-10-29",
      "highlights": [
        {
          "description": "`contract/audit/ocsfaudit` writes SystemForge's security events as OCSF 1.10 events, one JSON object per line, to an `io.Writer` the host names, for a security data lake or SIEM that ingests OCSF"
        },
        {
          "description": "`audit.NewMultiEmitter` hands every security event to several emitters, such as the log emitter and the OCSF emitter"
        }
      ],
      "security": [
        {
          "description": "OCSF events identify people only by principal ID and client address: names, email addresses, session tokens, tokens, token and code prefixes, codes and free-text reasons are left out of every field (a revoked managed-principal session is named by its record UUID), and event details reach the output only through a per-event-type allowlist of codes, UUIDs, booleans, integers and times",
          "commit": "f8f5d44"
        },
        {
          "description": "The client sends the `User-Agent`, so it can carry an email address or a token; both the log emitter and the OCSF emitter now record it only through `audit.SanitizeUserAgent`, which removes control characters and then leaves out a value that looks like it holds an email address or a credential (a heuristic for the common shapes)",
          "commit": "8eaa650"
        },
        {
          "description": "Token and authorization code replay events are High severity with `is_alert`, a platform-admin grant is High, and a production waiver at startup is Medium",
          "commit": "f8f5d44"
        }
      ],
      "added": [
        {
          "description": "`ocsfaudit.New(w, Options)`: an `audit.Emitter` that maps each event to an OCSF class (Authentication, User Management, Group Management, Entity Management, Application Lifecycle, or Base Event for an unknown type), entities OCSF has no type for as `type_id` Other with the type named,, with product, vendor and deployment metadata (`metadata.reporter.name`), the organization in `metadata.tenant_uid` and the request ID in `metadata.correlation_uid`",
          "commit": "f8f5d44"
        },
        {
          "description": "`Emit` never blocks, logs or fails the request: it queues each line in a bounded buffer written by one goroutine, and drops and counts events when the buffer is full (`Dropped`) or cannot encode them (`EncodeFailures`); a reporter goroutine logs the counts once a minute and on `Close`, write failures and short writes are counted (`WriteFailures`) and logged at most once a minute, a line torn by a failed write is the only one lost, and `Close` drains, flushes and syncs",
          "commit": "423324d"
        },
        {
          "description": "`audit.MultiEmitter` and `audit.NewMultiEmitter`",
          "commit": "76693ba"
        },
        {
          "description": "Dependency `github.com/grokify/ocsf-schema-go` v0.2.0",
          "commit": "d9c1761"
        },
        {
          "description": "`audit.SanitizeUserAgent`: removes control characters and invalid UTF-8, then leaves out a `User-Agent` that looks like it holds an email address or a credential, and cuts any other to 512 bytes",
          "commit": "8eaa650"
        }
      ],
      "changed": [
        {
          "description": "`audit.LogEmitter` leaves out a `User-Agent` that holds an email address or a credential-like value",
          "commit": "8eaa650"
        }
      ],
      "tests": [
        {
          "description": "The OCSF output of every security event type, with success and failure variants, validates against the schema embedded in `ocsf-schema-go`",
          "commit": "7b8d38e"
        },
        {
          "description": "The tests proving no token or secret reaches a log or event also run the OCSF emitter, and email verification and change events carry no address",
          "commit": "b0e01a3"
        },
        {
          "description": "Every event, Base Event included, validates through `ValidateEvent` with no skipped issues; torn lines, short writes, Emit with a stuck logger, periodic drop reports, unsyncable files and User-Agent sanitizing are tested",
          "commit": "423324d"
        },
        {
          "description": "A torn line stays marked through a failed Write that wrote nothing, and control characters cannot hide an email address from the User-Agent check",
          "commit": "0300d41"
        }
      ],
      "documentation": [
        {
          "description": "`docs/security/ocsf-events.md`: wiring with an append-mode file, the event mapping, fields, privacy rules and buffering",
          "commit": "66895d1"
        },
        {
          "description": "The README and the documentation home feature security events and OCSF output",
          "commit": "bbece5fa"
        },
        {
          "description": "The OCSF page states the schema version `1.10.0-dev`, recommends rotating by renaming over `copytruncate`, and describes delivery, session IDs and the `User-Agent` exactly",
          "commit": "cabf495"
        },
        {
          "description": "The README's privacy claim covers the OCSF emitter and says what the log emitter records; rotation by renaming waits for the reopen and uses `delaycompress` with compression",
          "commit": "23c5e87"
        }
      ]
    },
    {
      "version": "v0.29.0",
      "date": "2026-10-29",
      "highlights": [
        {
          "description": "SystemAuth asks for consent by the client's party: clients get `party` (`first_party`, `second_party` or `third_party`) and an optional `logo_url`, only first-party clients skip the consent screen, and `social_login.skip_consent` no longer auto-consents every client"
        },
        {
          "description": "The authorization endpoint honours the OIDC `prompt` parameter, so a first-party application can sign a user in silently, and the login chooser names the requesting client and shows its logo"
        },
        {
          "description": "Verified email: with a new `mail` section, SystemAuth verifies an unverified provider email at sign-in, lets a signed-in person change their email at `/account/email`, and carries `email_verified_at` in ID tokens and UserInfo"
        },
        {
          "description": "Configuration secrets resolve through an omnivault vault named in `secrets.vault`, with the environment as the default, and no cloud SDK in the library packages"
        },
        {
          "description": "`systemauth org member add|remove|list`, organization slug resolution for relying parties, and read-only application vocabularies in the product contract API"
        }
      ],
      "security": [
        {
          "description": "`social_login.skip_consent` granted consent for every client to users signed in through social login, and `DefaultSessionProvider`'s `WithSkipConsent` did the same, so once a client the operator does not own was registered its users were never asked; the authorization endpoint now decides by the client's party, and a second- or third-party client needs the user's recorded consent to every requested scope",
          "commit": "6f0803a"
        },
        {
          "description": "A client from a custom `Storage` that does not report its party is treated as third-party, and a client registered at runtime without a party is `third_party`",
          "commit": "5ad47a0"
        },
        {
          "description": "Email verification links are single-use, purpose-scoped and stored as SHA-256 hashes; a `verify_email` link completes only in the browser that started the sign-in and an `email_change` link only from a session of the principal that asked, each behind an origin-checked CSRF form, so a forwarded or scanned link cannot complete it",
          "commit": "54303df"
        },
        {
          "description": "Verification mail is limited per recipient address and per client address on the shared rate limit storage, and requests answer the same whether or not a message was sent or the address belongs to an account",
          "commit": "17fee3f"
        },
        {
          "description": "Production mode refuses `mail.provider: log`, with no waiver, because it writes verification links to the server log",
          "commit": "17fee3f"
        },
        {
          "description": "The client logo on the login chooser must be an https URL, is rendered by `html/template`, and only that page allows images from its origin in the content security policy",
          "commit": "aa33316"
        }
      ],
      "breaking": [
        {
          "description": "Run `migrations/0012_oauth_app_party.sql` on an existing database without startup migration; it adds `sf_oauth_apps.party` and fills it from `first_party`. Without the column, reading or writing an OAuth application fails",
          "commit": "7004ac7"
        },
        {
          "description": "`social_login.skip_consent` and `WithSkipConsent` no longer grant consent; users of a second- or third-party client, including any client registered at runtime without a party, are asked for consent",
          "commit": "6f0803a"
        },
        {
          "description": "`DefaultSessionProvider` records no consent and now reports none; a deployment using it with second- or third-party clients needs a `SessionProvider` that records consent",
          "commit": "6f0803a"
        },
        {
          "description": "`rate_limit.redis_url` is now expanded like the other secret fields, so a literal `$` in it is expanded",
          "commit": "4a4470a"
        }
      ],
      "upgradeGuide": [
        {
          "description": "Run `systemauth migrate` (or start with `--migrate`), or apply `migrations/0012_oauth_app_party.sql`; the schema migration also creates `sf_verification_tokens`"
        },
        {
          "description": "Set `party: first_party` or `second_party` on runtime-registered clients the operator or a customer owns; otherwise their users are now asked for consent. Clients in the configuration file are rewritten as `first_party` at startup unless they set `party`"
        },
        {
          "description": "Remove `social_login.skip_consent` and `WithSkipConsent`; they are ignored, and SystemAuth logs a warning at startup when `skip_consent` is set"
        },
        {
          "description": "To verify unverified provider emails, add a `mail` section; `ses` needs a sender (`systemauthsvc.Options.MailSender` or `systemauth.WithMailSender`; the `systemauth` binary builds it from `mail.ses`), and production refuses `log`. Without `mail`, sign-ins with an unverified provider email are refused as before"
        },
        {
          "description": "To read secret references from a vault other than the environment, set `secrets.vault` to an omnivault URI, register cloud schemes with `omnivault.RegisterProvider` in your binary, or pass a resolver to `LoadConfigWithResolver`"
        },
        {
          "description": "Escape any literal `$` in `rate_limit.redis_url`"
        }
      ],
      "added": [
        {
          "description": "Client `party` (`first_party`, `second_party`, `third_party`) and `logo_url` on `Client`, static clients, `OAuthClient` and Ent storage (`sf_oauth_apps.party`, `sf_oauth_apps.logo_url`); unknown parties are refused by `Config.Validate`, `NewClientFromConfig`, `RegisterClient` and both storages",
          "commit": "5ad47a0"
        },
        {
          "description": "`sf_oauth_apps.party` in the identity schema and `migrations/0012_oauth_app_party.sql`",
          "commit": "7004ac7"
        },
        {
          "description": "OIDC `prompt` at the authorization endpoint: `none` answers `login_required` or `consent_required` instead of showing a page, `login` re-authenticates, `consent` always shows the consent page, `select_account` is accepted with no effect, and `none` with another value or an unknown value is `invalid_request`",
          "commit": "fdbd39e"
        },
        {
          "description": "The login chooser names the requesting client and shows its `logo_url`",
          "commit": "aa33316"
        },
        {
          "description": "`VerificationTokenStore` with memory and Ent implementations (`sf_verification_tokens`) and the `storetest.VerificationTokenStore` conformance suite",
          "commit": "3df8231"
        },
        {
          "description": "Ent schema `VerificationToken` (`sf_verification_tokens`)",
          "commit": "e870e8a"
        },
        {
          "description": "SystemAuth configuration `mail` (`provider` `ses`, `smtp` or `log`, `from`, `reply_to`, `product_name`, `support_url`, `token_lifetime` from 5m to 24h with a default of 30m, `per_address` default 5 an hour, `per_client` default 20 an hour, `smtp.*`, `ses.region`, `ses.configuration_set`); `systemauth.WithMailSender` and `systemauthsvc.Options.MailSender`; the `systemauth` binary builds the Amazon SES sender",
          "commit": "17fee3f"
        },
        {
          "description": "A verify-email step at social sign-in for an unverified provider email, with a rate-limited resend; a confirmed address counts as proven (`ExternalLogin.EmailProven`)",
          "commit": "54303df"
        },
        {
          "description": "Email change at `/account/email` with a notice to the current address; `PrincipalEmailChanger`, implemented by the Ent and memory directories",
          "commit": "67aa733"
        },
        {
          "description": "Security events `systemauth.email_verification.sent`, `systemauth.email.verified`, `systemauth.email_change.requested`, `systemauth.email_change.cancelled` and `systemauth.email.changed`, and the sign-in refusal reason `verification_invalid`",
          "commit": "54303df"
        },
        {
          "description": "`email_verified_at` claim (a NumericDate, with the `email` scope) in ID tokens, UserInfo and discovery's `claims_supported`; `HumanPrincipal.EmailVerifiedAt`, and `relyingparty.IDTokenClaims.EmailVerifiedAt`, `UserInfo.EmailVerifiedAt` (`*jwt.NumericDate`, accepting integer and floating-point values) and `VerifiedIdentity.EmailVerifiedAt`",
          "commit": "396032e"
        },
        {
          "description": "`secrets` package: `Resolver`, `New` and `Env`; SystemAuth configuration `secrets.vault`; `systemauth.LoadConfigWithResolver`, `ParseConfigWithResolver`, `DecodeConfigWithResolver` and `DecodeConfigFileWithResolver`; `systemauthsvc.LoadConfigWithResolver` and `LoadConfigBytesWithResolver`",
          "commit": "4a4470a"
        },
        {
          "description": "`systemauth org member add`, `remove` and `list` (`identity/organization/membercmd`) for managing members and application roles without the HTTP API",
          "commit": "66a30b1"
        },
        {
          "description": "`GET /oauth/userinfo/memberships/resolve?slug=`, the optional `MembershipResolver` interface implemented by `EntOrgsSource`, `relyingparty.Client.ResolveOrganization` and `relyingparty.ErrOrganizationNotResolved`",
          "commit": "2b666ca"
        },
        {
          "description": "`GET {base}/policy/vocabularies` in the product contract API and `contract.WithVocabularies`",
          "commit": "08a28f4"
        },
        {
          "description": "Dependencies `github.com/plexusone/omnimail` v0.1.0 and `github.com/plexusone/omni-aws` v0.11.0",
          "commit": "17fee3f"
        }
      ],
      "changed": [
        {
          "description": "Clients declared in the configuration file default to `first_party` and are rewritten from it at startup; clients registered at runtime default to `third_party`",
          "commit": "5ad47a0"
        },
        {
          "description": "With mail configured, a social sign-in whose provider email is not verified is held for verification instead of refused",
          "commit": "54303df"
        },
        {
          "description": "`rate_limit.redis_url` is expanded like the other secret fields; every secret field is resolved through the `secrets` resolver",
          "commit": "4a4470a"
        },
        {
          "description": "The example configuration and the CLI help no longer mention `skip_consent`",
          "commit": "9496517"
        }
      ],
      "deprecated": [
        {
          "description": "`social_login.skip_consent`: ignored, with a warning at startup",
          "commit": "6f0803a"
        },
        {
          "description": "`DefaultSessionProvider` option `WithSkipConsent`: a no-op",
          "commit": "6f0803a"
        },
        {
          "description": "`sf_oauth_apps.first_party`: use `party`; it is kept equal to `party == first_party`",
          "commit": "7004ac7"
        }
      ],
      "tests": [
        {
          "description": "Product entitlements in the `orgs` claim across the ID token, JWT access tokens, UserInfo and the memberships endpoint",
          "commit": "2c6605a"
        },
        {
          "description": "A managed principal created through `appauth` `Transport` against a packaged SystemAuth, and refused without DPoP proofs",
          "commit": "bbf8362"
        },
        {
          "description": "Configuration clients stored before parties existed stay first-party after an upgrade",
          "commit": "2b5d5b9"
        },
        {
          "description": "The legacy-name gate blocks Core-era names, the `cf_` prefix and upstream GitHub and Google OAuth wiring outside `identity/oauthclient`, and skips `.claude`",
          "commit": "49f8029"
        },
        {
          "description": "Verification token store conformance, verify-email and email-change flows, mail limits and the `prompt` values"
        }
      ],
      "documentation": [
        {
          "description": "Verified email guide: configuration, messages, abuse controls, the sign-in step, email change and what relying parties receive",
          "commit": "396032e"
        },
        {
          "description": "Sending Mail with Amazon SES: domain identity, Easy DKIM, SPF through a custom MAIL FROM domain, DMARC, a configuration set, leaving the sandbox and a least-privilege policy",
          "commit": "396032e"
        },
        {
          "description": "Client parties, consent, `prompt`, the client name and logo, and the `sf_oauth_apps.party` upgrade",
          "commit": "9496517"
        },
        {
          "description": "Secrets and `secrets.vault` in Deploying SystemAuth",
          "commit": "4a4470a"
        },
        {
          "description": "Organization slug resolution for relying parties, application vocabularies, entitlements in the `orgs` claim and `systemauth org member`"
        },
        {
          "description": "v0.29.0 release notes"
        }
      ]
    },
    {
      "version": "v0.28.0",
      "date": "2026-10-29",
      "highlights": [
        {
          "description": "Layered rate limits are on by default in SystemAuth: a limit per client address on every route, route policies for the token, login, sign-up and BFF sign-in paths, limits on failed client authentication, the JWT-bearer grant and social login, and a signed-in limit, all on one shared storage and answered with IETF `RateLimit-Policy` and `RateLimit` headers"
        },
        {
          "description": "One client-address rule (`session/clientaddr`), configured with trusted proxy networks and the header they write, used by SystemAuth, the BFF, `appauth`, rate limits and security events"
        },
        {
          "description": "Structured security events through `contract/audit`, logs without stack traces or secrets, and no internal error text in about 60 API responses"
        },
        {
          "description": "Static API key authentication is removed from relying parties; a threat model documents the trust boundaries and their mitigations"
        }
      ],
      "security": [
        {
          "description": "SystemAuth had no limit on most routes, so credential endpoints could be guessed at and any route flooded; layered rate limits now apply by default: 300 requests a minute per client address on every route, route policies for `/oauth/token` (per address and per OAuth client), `/login*`, `/signup*` and `/bff/auth/*`, and exemptions for health checks, static assets and the billing webhook",
          "commit": "50704e6"
        },
        {
          "description": "Handler limits cover failed client authentication at the token endpoint (per address and client, then per address), tokens issued per service account by the JWT-bearer grant, and social login start and callback; the login-token, waitlist, sign-up code and managed-principal code limits move onto the shared storage",
          "commit": "50704e6"
        },
        {
          "description": "On a storage outage the default layer and the signed-in limit let requests through and log the failure, while the route policies and credential handler limits refuse with `503`; a full `MemoryStorage` is always a `429`, so a flood of new addresses cannot switch limits off",
          "commit": "395e6ee"
        },
        {
          "description": "Client addresses were found in several ways, some of which believed forwarding headers from any peer; `session/clientaddr` believes `X-Forwarded-For` (read from the right) or a single-value header only from trusted proxy networks and falls back to the direct peer",
          "commit": "2687031"
        },
        {
          "description": "Token, authorize and access-token log records carried the error value, which slog's text handler formats with its stack trace; they now carry the RFC 6749 error code, description, hint and status, adding the cause by message only at debug level or for server errors",
          "commit": "f82ee42"
        },
        {
          "description": "Tests run sign-in, the authorization code flow with PKCE, refresh, code and refresh-token replay, client credentials, JWT bearer, revocation, logout and BFF sign-in and sign-out at debug level and fail if any token, code, verifier, secret, DPoP proof, assertion, key or session cookie appears in a log record or security event",
          "commit": "72be528"
        },
        {
          "description": "SystemAuth, organizations, platform administration and service accounts record security events through an `audit.Emitter`, each with the request ID and the visitor's address, and never a token, code or secret",
          "commit": "b764542"
        },
        {
          "description": "Security events recorded the direct peer as the client address, so behind a reverse proxy every event named the proxy; they now use the client-address rule",
          "commit": "c21a796"
        },
        {
          "description": "About 60 API responses across organization, marketplace, contract, invite, connections, `session/middleware`, managed principals, SystemAuth identity sync and the sign-up API copied internal error text, such as database errors, into the response body; known errors now map to fixed messages and anything else is logged and answered with a generic `500`",
          "commit": "511701e"
        },
        {
          "description": "`bff.CookieConfig` accepted `SameSite=None`, which lets the browser send the session cookie on cross-site subrequests that the origin check relies on it withholding; `Validate` and `NewHandler` now refuse it",
          "commit": "107bf57"
        },
        {
          "description": "`EmbeddedOAuthProvider.Revoke` passed the raw token where storage expects a request ID, so it reported success without revoking anything; it now revokes the access and refresh tokens of the token's family",
          "commit": "3c9390d"
        },
        {
          "description": "The `multiapp` server and the `publicclient` loopback callback server set no `ReadHeaderTimeout`, so a client could hold a connection open by sending headers slowly; every server systemforge builds now sets it",
          "commit": "b390161"
        },
        {
          "description": "Static API keys were a second, weaker way into a relying party: long-lived bearer secrets outside the short-lived, revocable access tokens; they are removed",
          "commit": "bc9558e"
        }
      ],
      "breaking": [
        {
          "description": "`appauth.Options.APIKeys`, `relyingparty.BearerConfig.APIKeys`, `relyingparty.APIKeyValidator`, `relyingparty.AuthMethodAPIKey` and `relyingparty.AuthenticatedPrincipal.APIKeyID` are removed; a non-JWT `Bearer` value is answered `401` with `invalid_token`, and `X-API-Key` is ignored",
          "commit": "bc9558e"
        },
        {
          "description": "Rate limits are on by default in SystemAuth; set `rate_limit.disabled: true` to turn off the default layer and route policies when the host applies its own (handler limits stay on)",
          "commit": "50704e6"
        },
        {
          "description": "Organization API status codes: the personal-organization conflict is `409` on every path, a storage error while reading a member is `500` instead of `404`, and an unexpected error on create or remove is `500` instead of `400`",
          "commit": "511701e"
        },
        {
          "description": "Error responses of the organization, marketplace, contract, invite, connections, managed-principal, identity sync and sign-up APIs and the bearer and DPoP middlewares carry fixed messages instead of the underlying error text",
          "commit": "511701e"
        },
        {
          "description": "`contract.ToContractError` no longer copies a non-contract error's text into its message",
          "commit": "13364ef"
        },
        {
          "description": "`ratelimit.Limiter.Middleware` answers `429` instead of `503` when a `MemoryStorage` is full",
          "commit": "395e6ee"
        },
        {
          "description": "`bff.CookieConfig.Validate` rejects `SameSite=None`",
          "commit": "107bf57"
        },
        {
          "description": "`EmbeddedOAuthProvider.Revoke` returns an error wrapping `ErrInvalidToken` for an unknown, expired or already revoked token",
          "commit": "3c9390d"
        }
      ],
      "upgradeGuide": [
        {
          "description": "Behind a reverse proxy, set `client_address` (for example `trusted_proxies: [\"127.0.0.1/32\", \"::1/128\"]` with `header: X-Forwarded-For`); otherwise every visitor has the proxy's address and the per-address limits apply to all of them together"
        },
        {
          "description": "With several SystemAuth instances, set `rate_limit.redis_url`; with one, set `rate_limit.single_instance: true`"
        },
        {
          "description": "A relying party that calls `/oauth/token` from one server address should add that network to `rate_limit.exempt_networks`, or raise the `token` route's limits under `rate_limit.routes`"
        },
        {
          "description": "Move API key callers to `identity/publicclient` sign-in (command-line tools) or service accounts (automation), and remove `APIKeys` from `appauth.Options` and `relyingparty.BearerConfig`"
        },
        {
          "description": "Wire an audit emitter (`systemauthsvc.Options.AuditEmitter`, or `systemauth.WithAuditEmitter`, `organization.WithAuditEmitter`, `principal.WithAuditEmitter` and `serviceaccount.Config.Audit`) and ship the events off the host"
        },
        {
          "description": "Expect `429` responses with `Retry-After` and `RateLimit` headers, and check clients that rely on the old organization status codes or on error text in responses"
        }
      ],
      "added": [
        {
          "description": "`session/clientaddr`: `Resolver`, `Config` (`TrustedProxies`, `Header`), `New`, `MustNew`, `LoopbackProxy`, `Peer`, `PeerAddr`, `PeerIP` and `ParseNetworks`",
          "commit": "2687031"
        },
        {
          "description": "SystemAuth configuration `client_address.trusted_proxies` and `client_address.header`, and `systemauth.WithClientAddressResolver`; `scimtoken.WithClientAddress`, `bff.ClientIPConfig.Resolver`, `appauth.Options.ClientAddress` and `Authenticator.ClientAddress`",
          "commit": "2687031"
        },
        {
          "description": "`ratelimit.Policy`, `PolicyConfig`, `NewPolicy`, `Route`, `RouteLimit`, `DefaultRoutes`, `MergeRoutes`, the route names (`RouteToken`, `RouteLogin`, `RouteSignup`, `RouteBFFAuth`, `RouteHealth`, `RouteStatic`, `RoutePaymentWebhook`), `KeyAddress`, `KeyClient` and `AddressKey`",
          "commit": "395e6ee"
        },
        {
          "description": "`ratelimit.NewSignedInLimiter`, `SignedInKey`, `Check`, `Exhausted`, `Record`, `WriteHeaders`, `WriteTooManyRequests`, `RetryAfterSeconds`, `WithName`, `WithSkip`, and `Peek` on `MemoryStorage` and `RedisStorage`",
          "commit": "395e6ee"
        },
        {
          "description": "SystemAuth configuration `rate_limit.disabled`, `redis_url`, `single_instance`, `default`, `signed_in`, `exempt_networks` and `routes` (`name`, `paths`, `methods`, `per_address`, `per_client`, `exempt`, `fail_open`)",
          "commit": "50704e6"
        },
        {
          "description": "`systemauth.WithRateLimitStorage`, `Server.RateLimitStorage`, `Server.RateLimitPolicy`, `Server.SignedInRateLimit` and `Server.ClientAddress`; `systemauthsvc.Options.RateLimitStorage`; `appauth.Options.SignedInRateLimit`",
          "commit": "50704e6"
        },
        {
          "description": "`audit.Context.RequestID`, `audit.RequestID`, `audit.NopEmitter`, `audit.NewLogEmitter` and `requestprincipal.AuditActor`",
          "commit": "8f4422e"
        },
        {
          "description": "`systemauth.WithAuditEmitter`: sign-ins and their refusals, sign-outs, refused token requests, refresh-token reuse, authorization-code replay, token and token-family revocations, and the signing key in use at startup",
          "commit": "b764542"
        },
        {
          "description": "`organization.WithAuditEmitter`, `principal.WithAuditEmitter` and `serviceaccount.Config.Audit`: membership, ownership, platform administration and service account changes",
          "commit": "0c33a0b"
        },
        {
          "description": "`systemauthsvc.Options.AuditEmitter` reaches SystemAuth and the organization and principal services, and each production check waived at startup is recorded as a `systemauth.production.waiver` event; the `systemauth` command writes its security events to its log",
          "commit": "a82d77e"
        },
        {
          "description": "Sentinel errors `organization.ErrOwnerRequired`, `ErrAlreadyMember`, `ErrNewOwnerNotMember` and `ErrInvalidOwnerRole`",
          "commit": "511701e"
        },
        {
          "description": "Sentinel errors `marketplace.ErrInvalidListing` and `ErrListingNotDeletable`",
          "commit": "1d36333"
        },
        {
          "description": "Sentinel errors `invite.ErrInviteNotFound`, `ErrPendingInviteExists`, `ErrAlreadyMember`, `ErrAppRolesNotConfigured` and `ErrCollaboratorAppRoles`",
          "commit": "f5df37b"
        }
      ],
      "changed": [
        {
          "description": "Responses carry the IETF `RateLimit-Policy` and `RateLimit` headers beside `X-RateLimit-*`, and `Retry-After` is rounded up to at least one second",
          "commit": "395e6ee"
        },
        {
          "description": "`systemauthsvc` warns in production when rate limit counters are per instance and no single instance is declared",
          "commit": "50704e6"
        },
        {
          "description": "The bearer and DPoP middlewares answer the matching sentinel's text, or `authentication failed`, instead of the full error chain",
          "commit": "f2ce11d"
        }
      ],
      "deprecated": [
        {
          "description": "`ratelimit.ForwardedClientIP` and `ratelimit.ForwardedIPKey`; use a `clientaddr.Resolver` with `ratelimit.AddressKey`",
          "commit": "2687031"
        },
        {
          "description": "`systemauth.WithLoginTokenClientIP`; configure `client_address` or use `WithClientAddressResolver`",
          "commit": "2687031"
        },
        {
          "description": "`bff.CloudflareClientIPConfig` and the `ClientIPConfig` fields `TrustCloudflare`, `TrustProxy`, `TrustedProxies` and `CloudflareIPRanges`; set `ClientIPConfig.Resolver`",
          "commit": "2687031"
        }
      ],
      "removed": [
        {
          "description": "`appauth.Options.APIKeys`, `relyingparty.BearerConfig.APIKeys`, `relyingparty.APIKeyValidator`, `relyingparty.AuthMethodAPIKey` and `relyingparty.AuthenticatedPrincipal.APIKeyID`",
          "commit": "bc9558e"
        }
      ],
      "fixed": [
        {
          "description": "Security events behind a reverse proxy recorded the proxy's address instead of the visitor's",
          "commit": "c21a796"
        },
        {
          "description": "`EmbeddedOAuthProvider.Revoke` reported success without revoking the token",
          "commit": "3c9390d"
        }
      ],
      "tests": [
        {
          "description": "Client addresses: spoofed headers, proxy chains, IPv6 and ports",
          "commit": "59e4812"
        },
        {
          "description": "Rate limits: each layer, headers, storage outages and exemptions",
          "commit": "33fa3c0"
        },
        {
          "description": "Logs and security events carry no tokens or secrets, and each security event is recorded",
          "commit": "72be528"
        },
        {
          "description": "No internal error text in the responses of each API changed"
        }
      ],
      "documentation": [
        {
          "description": "Threat model: scope and assumptions, assets, actors, trust boundaries, threats and mitigations per boundary, and residual risks",
          "commit": "5cee54e"
        },
        {
          "description": "Security events: how to record them, their common fields and each event type",
          "commit": "0af03b0"
        },
        {
          "description": "Client addresses and rate limiting guide, with the `client_address` and `rate_limit` settings in Deploying SystemAuth and the production checklist",
          "commit": "b202382"
        },
        {
          "description": "Upgrade section for the removal of static API keys in the application authentication guide",
          "commit": "1c4e6db"
        },
        {
          "description": "Rate limiting described as shipped in the threat model",
          "commit": "3bde6b3"
        },
        {
          "description": "v0.28.0 release notes"
        }
      ]
    },
    {
      "version": "v0.27.0",
      "date": "2026-10-28",
      "highlights": [
        {
          "description": "Production hardening for SystemAuth: authorization codes and refresh tokens are used once under concurrency, social sign-in links to an existing account by email only when the provider is authoritative for the address, production startup fails closed on the token HMAC secret, bearer-token clients and a per-instance DPoP replay cache, and every response carries security headers"
        },
        {
          "description": "Payments move onto payforge in the new `billing` package: a verified, idempotent webhook handler, plans, sales, refunds, disputes and sellers applied to the database and the authorization graph, and checkout and customer-portal handlers with configured redirects; `marketplace/stripe` is removed"
        },
        {
          "description": "A security policy (`SECURITY.md`) and a production checklist for operators"
        }
      ],
      "security": [
        {
          "description": "An authorization code could be exchanged, and a refresh token rotated, twice by concurrent requests, because Fosite reads before it writes and the storage did not run the two in one transaction; invalidating a code now matches only an unused code and rotation retires the presented refresh token only while it is active, so the losing request gets no tokens",
          "commit": "d94d342"
        },
        {
          "description": "The memory store returned no request for a used authorization code, so a replayed code answered `server_error` and left the tokens it had issued active; it now returns the request and the tokens are revoked",
          "commit": "d94d342"
        },
        {
          "description": "A new GitHub or Google identity was linked to any existing account with the same verified email, so whoever kept a stale verification of an address (such as a former work address) could sign in to the account of its current owner; an identity now links by email only when the provider is authoritative for the address (Google for gmail.com and googlemail.com, and for a Workspace account's own `hd` domain), and GitHub sign-in uses the primary email only",
          "commit": "f5ba501"
        },
        {
          "description": "SystemAuth started in production without a token HMAC secret, with statically configured `allow_bearer_tokens` clients, and with a per-instance DPoP replay cache; these now fail closed unless waived in `production.allow` or, for the replay cache, `dpop.single_instance` is set, and the token endpoint refuses `client_credentials` with a shared secret and `allow_bearer_tokens` clients with `unauthorized_client`",
          "commit": "74f8f52"
        },
        {
          "description": "SystemAuth pages set no security headers; every response now carries a content security policy with `frame-ancestors 'none'`, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy: same-origin` and, on an https issuer, HSTS",
          "commit": "d49cd53"
        },
        {
          "description": "The `marketplace/stripe` payment path had no webhook handler, failed on Stripe API-version mismatches, never retried a failed authorization sync, had no replay or ordering protection, redirected to request-supplied `success_url` and `cancel_url` (an open redirect), returned raw errors to clients, and would retry another application's events forever; `billing` on payforge replaces it",
          "commit": "d5e6d5b"
        }
      ],
      "breaking": [
        {
          "description": "`marketplace/stripe`, `marketplace.CheckoutService` and its request and session types, `EntService.WithCheckout`, `Service.Checkout`, the marketplace API's `POST /checkout` and `WithPurchaseAuthorizer` are removed; use `billing.Checkout` and its endpoints, passing the `PurchaseAuthorizer` as `CheckoutConfig.Purchases`",
          "commit": "d5e6d5b"
        },
        {
          "description": "Outside development mode SystemAuth refuses to start without `tokens.hmac_secret`, or without `dpop.replay_cache_redis_url`, `Options.DPoPReplayCache` or `dpop.single_instance`, or with a statically configured client that sets `allow_bearer_tokens`, unless the check is waived in `production.allow`",
          "commit": "74f8f52"
        },
        {
          "description": "Outside development mode the token endpoint refuses the `client_credentials` grant from a client authenticating with a shared secret, and every request from an `allow_bearer_tokens` client, with `unauthorized_client`, unless waived",
          "commit": "852ae8f"
        },
        {
          "description": "A social sign-in links to an existing account by email only when the provider is authoritative for the address; otherwise an email that belongs to an account is refused with `ErrEmailConflict`, and GitHub sign-in uses the primary email only",
          "commit": "f5ba501"
        },
        {
          "description": "SystemAuth pages send `Referrer-Policy: same-origin` instead of `no-referrer`",
          "commit": "d49cd53"
        },
        {
          "description": "`marketplace.Subscription.IsActive` is true for a past-due subscription",
          "commit": "03abe3b"
        }
      ],
      "added": [
        {
          "description": "`billing`: `Store`, payforge's store on the Ent client for processed event IDs (`sf_billing_events`) and the customer-to-organization mapping (`sf_billing_customers`)",
          "commit": "4f4b6a5"
        },
        {
          "description": "`billing/pglock`: payforge's `Locker` as a PostgreSQL transaction-scoped advisory lock held on its own connection, shared by every instance",
          "commit": "4f4b6a5"
        },
        {
          "description": "`billing.NewWebhookHandler`: verifies with payforge's reader under its body limit, applies the event under the organization's lock, answers fixed words, and acknowledges duplicate, ignored, other-mode and foreign events",
          "commit": "47e2546"
        },
        {
          "description": "`billing.NewSink`: payforge's entitlement, sale, seller and dispute sinks and the webhook's checkout completer, applying plans, licenses from recorded orders (`sf_billing_orders`), refunds (`sf_billing_refunds`), disputes (`sf_billing_disputes`) and seller accounts (`sf_billing_sellers`) in one transaction and re-writing the authorization graph on every apply",
          "commit": "5fc3fbc"
        },
        {
          "description": "`billing.NewSellerGate`, `marketplace.PublishGate`, `marketplace.ErrSellerNotReady` and `EntListingService.WithPublishGate`: a paid listing is published only when its seller can take charges",
          "commit": "5fc3fbc"
        },
        {
          "description": "`billing.NewCheckout`: plan checkout, one-time listing checkout and the customer portal for the caller's organization, with configured https redirects on allowed hosts and fixed JSON errors; `billing.NewStripe` builds payforge's Stripe client and webhook reader for production",
          "commit": "67e08b6"
        },
        {
          "description": "`appauth.Options.SingleInstance`; `New` warns when DPoP proofs use a per-instance replay cache on a public URL",
          "commit": "3b1b26d"
        },
        {
          "description": "`production.allow` (`ephemeral_hmac_secret`, `client_secret_client_credentials`, `bearer_token_clients`), `dpop.single_instance`, and `systemauth.WithProductionPolicy` with `ProductionPolicy`",
          "commit": "852ae8f"
        },
        {
          "description": "`oauthclient.User.HostedDomain`, read from Google's `hd` claim, and `systemauth.AuthoritativeEmail` with `ExternalLogin.EmailAuthoritative`",
          "commit": "f5ba501"
        },
        {
          "description": "Ent tables `sf_billing_events`, `sf_billing_customers`, `sf_billing_orders`, `sf_billing_refunds`, `sf_billing_disputes` and `sf_billing_sellers`, created by the schema migration",
          "commit": "4f4b6a5"
        },
        {
          "description": "`relyingparty.BFFConfig.LoginErrorPath` and `appauth.Options.LoginErrorPath`: a browser whose sign-in fails at the BFF's login or callback routes is redirected to the app's sign-in page with `?error=<CODE>` instead of shown a JSON error; requests that ask for JSON still get JSON",
          "commit": "69ce7a4"
        },
        {
          "description": "`relyingparty.BFF.SignOut` ends a browser session (deletes it, revokes its SystemAuth refresh token, clears the cookie) without writing a response, for handlers that serve their own sign-out; `/bff/auth/logout` calls it after its cross-origin check",
          "commit": "fb08960"
        }
      ],
      "changed": [
        {
          "description": "Discovery stops listing `client_credentials` when the production policy refuses it",
          "commit": "852ae8f"
        }
      ],
      "fixed": [
        {
          "description": "A past-due subscription keeps its plan while the provider retries the payment, so the organization's entitlements no longer drop the paid tier during retries",
          "commit": "03abe3b"
        },
        {
          "description": "Cookie-authenticated writes required a JSON body even with an allowed `Origin`, so signed-in browsers could not upload files with `multipart/form-data` or send bodyless writes; with an allowed `Origin` any body is now accepted, and without one the JSON body and an allowed `Referer` are still required",
          "commit": "f59dd02"
        },
        {
          "description": "`billing.NewCheckout` accepted loopback redirect URLs with any Stripe key; they now pass only with a test-mode key, and a provider that reports no mode counts as live",
          "commit": "b906d66"
        }
      ],
      "removed": [
        {
          "description": "`marketplace/stripe`, `marketplace.CheckoutService`, `EntService.WithCheckout`, `Service.Checkout`, `POST /checkout` and `WithPurchaseAuthorizer`",
          "commit": "d5e6d5b"
        }
      ],
      "tests": [
        {
          "description": "Production checks, waivers and the replay cache warning",
          "commit": "67feabf"
        },
        {
          "description": "Security headers on every SystemAuth page",
          "commit": "9a508ff"
        },
        {
          "description": "SCIM-provisioned users link only on authoritative sign-ins: a Workspace sign-in links, a GitHub sign-in with the same verified address is refused",
          "commit": "ee8a640"
        }
      ],
      "documentation": [
        {
          "description": "Security policy (`SECURITY.md`): reporting through GitHub private vulnerability reporting, response targets, supported versions and disclosure",
          "commit": "ad689bc"
        },
        {
          "description": "Production checklist for operators",
          "commit": "f439c79"
        },
        {
          "description": "Production checks, waivers and `dpop.single_instance` in Deploying SystemAuth and the DPoP pages",
          "commit": "0314b62"
        },
        {
          "description": "Security headers in Deploying SystemAuth",
          "commit": "0631cb0"
        },
        {
          "description": "The production checklist names each check's key and waiver",
          "commit": "32b5d63"
        },
        {
          "description": "Billing guide, with the upgrade from `marketplace/stripe`",
          "commit": "d5e6d5b"
        },
        {
          "description": "Production hardening and billing roadmap",
          "commit": "8cd6533"
        },
        {
          "description": "v0.27.0 release notes"
        }
      ],
      "dependencies": [
        {
          "description": "Add `github.com/plexusone/payforge` v0.1.0",
          "commit": "4f4b6a5"
        },
        {
          "description": "Add `github.com/plexusone/systemspec-pricingpackaging` v0.1.0",
          "commit": "4f4b6a5"
        },
        {
          "description": "Remove `github.com/stripe/stripe-go/v84`; payforge brings `stripe-go/v87` indirectly",
          "commit": "d5e6d5b"
        }
      ],
      "upgradeGuide": [
        {
          "description": "Set `tokens.hmac_secret` (at least 32 bytes, stable across deploys, for example `${SYSTEMAUTH_TOKEN_HMAC_SECRET}`); people sign in once more after the first deploy with it"
        },
        {
          "description": "Set `dpop.single_instance: true` when one instance serves SystemAuth, or `dpop.replay_cache_redis_url` when several do; set `appauth.Options.SingleInstance` for an application served by one instance"
        },
        {
          "description": "Move `client_credentials` clients to service accounts, or list `client_secret_client_credentials` in `production.allow`; likewise `bearer_token_clients` for `allow_bearer_tokens` clients"
        },
        {
          "description": "Migrate from `marketplace/stripe` to `billing` following the billing guide, and run the schema migration for the `sf_billing_*` tables"
        },
        {
          "description": "A person who signed up with one provider and now uses another whose email is not authoritative for the address signs in the original way"
        },
        {
          "description": "A reverse proxy must not overwrite `Referrer-Policy`: `same-origin` keeps the `Origin` header on same-origin form posts"
        }
      ]
    },
    {
      "version": "v0.26.0",
      "date": "2026-10-28",
      "highlights": [
        {
          "description": "`identity/appauth` assembles the relying party for an application in a few lines, with the same defaults everywhere: a required DPoP key, labelled configuration errors, memberships filtered to the application's roles, one request-authentication chain, and calls to SystemAuth for the signed-in person"
        },
        {
          "description": "Service accounts: automation that belongs to an organization, holds application roles there, and calls APIs with short-lived DPoP-bound tokens it gets by signing an assertion with a private key (the RFC 7523 JWT-bearer grant), managed with the `service-account` command and used from Go with `identity/serviceclient`"
        },
        {
          "description": "Refresh tokens survive a SystemAuth restart and work on every instance with `tokens.hmac_secret`, which rotates with `tokens.hmac_verification_secret`"
        }
      ],
      "added": [
        {
          "description": "`identity/appauth`: `Config` with `Validate` and labels a host can relabel, `ConfigFromEnv`, `ParseDPoPKey`, `ReadDPoPKeyFile` and `DPoPKeyCommand`",
          "commit": "d4f1f61"
        },
        {
          "description": "`appauth.New`: the relying-party client from metadata or discovery, the `/bff/*` handler, an application membership filter, `Middleware` and `Authenticate` returning a `requestprincipal.RequestPrincipal`, extra authenticators, `SessionToken` and `Transport` for calls to SystemAuth, and RFC 9728 resource metadata",
          "commit": "abd85d8"
        },
        {
          "description": "`pgstore.PrincipalStore` on a new `sf_rp_principals` table created by `EnsureSchema`, with `SetActive` and `Delete`; `NewStores` returns it",
          "commit": "6708140"
        },
        {
          "description": "`storetest.PrincipalStore`, a conformance suite for principal stores",
          "commit": "e79798a"
        },
        {
          "description": "`identity/serviceaccount`: service accounts in an organization with a `service_account` membership, keys generated as P-256 or supplied as ES256, RS256 or EdDSA, application roles, and disable, enable, delete and key revocation recorded as access changes; revoking a usable key ends the account's current tokens",
          "commit": "3f236a1"
        },
        {
          "description": "The JWT-bearer grant behind `oauth.jwt_bearer` (enabled, maximum assertion lifetime, token lifetime): self-issued assertions verified against a service account's keys, a DPoP proof required, replayed `jti` refused, tokens with the account as subject, the `orgs` and `principal_type` claims and no refresh token, under the reserved client `systemauth-jwt-bearer`",
          "commit": "78fc8ac"
        },
        {
          "description": "`identity/serviceclient`: signs assertions, requests DPoP-bound tokens with nonce retries, renews them before expiry, and adds proofs to API requests",
          "commit": "425235d"
        },
        {
          "description": "`relyingparty.BearerConfig.ServicePrincipals` and `VerifiedIdentity.Service`: an application creates a service account's local principal on its first request, and refuses a service-account token whose local principal is not of type service; `appauth.Options.ServiceAccounts` turns it on and accepts `relyingparty.ServiceAccountClientID`",
          "commit": "6a466d9"
        },
        {
          "description": "`serviceaccountcmd`, the `service-account` command (`create`, `list`, `show`, `disable`, `enable`, `delete`, `key add|list|revoke`, `role grant|remove`) that `systemauth` registers and a host mounts",
          "commit": "6168a12"
        },
        {
          "description": "`principal.Service.CreateServiceInTx` creates a service principal inside a caller's transaction",
          "commit": "aca6b61"
        },
        {
          "description": "`MemoryPrincipalStore.SetActive`",
          "commit": "6a466d9"
        },
        {
          "description": "`tokens.hmac_secret` and `tokens.hmac_verification_secret` (`TokenConfig.HMACSecret`, `HMACVerificationSecret`, `MinHMACSecretLength`): the secret signing authorization codes, refresh tokens and opaque access tokens, at least 32 bytes and expanded from the environment, and a second secret accepted but not signed with during a rotation",
          "commit": "54f81f9"
        }
      ],
      "changed": [
        {
          "description": "`approle` accepts `service_account` memberships, so service accounts hold application roles",
          "commit": "7e1535f"
        },
        {
          "description": "Token introspection includes the `orgs`, `orgs_truncated` and `principal_type` values the access token was issued with, for every principal",
          "commit": "7b154a2"
        }
      ],
      "deprecated": [
        {
          "description": "`appauth.Options.APIKeys`: command-line tools sign in with `identity/publicclient`, and automation uses service accounts (ADR-016)"
        }
      ],
      "fixed": [
        {
          "description": "`relyingparty.RequestAuthenticator` answers a cookie-authenticated cross-origin write with `403 CSRF_REJECTED` and no challenge, instead of a `401` that tells the client to sign in again",
          "commit": "662ffaa"
        },
        {
          "description": "Refresh tokens and authorization codes no longer stop working at every SystemAuth restart and on other instances when `tokens.hmac_secret` is set; without it SystemAuth warns that they will",
          "commit": "54f81f9"
        }
      ],
      "tests": [
        {
          "description": "`appauth` against an embedded SystemAuth requiring DPoP nonces: browser sign-in, cross-origin writes, a restart with the same key and stores, command-line tokens, another client's tokens, a bound token refused as Bearer, and calls to SystemAuth with `Transport`",
          "commit": "51647ea"
        },
        {
          "description": "The JWT-bearer grant end to end with P-256 and RSA keys: issuance, introspection, DPoP binding, and refusals for replay, expiry, overlong lifetime, missing `jti`, wrong audience, missing proof, revoked keys and disabled accounts",
          "commit": "9df9951"
        },
        {
          "description": "From command to application: an account created, granted a role and given a key calls an `appauth` API through `serviceclient`, loses the role's organization after the role is removed, gets no token once disabled, and is deleted with its issued tokens in place",
          "commit": "633812d"
        },
        {
          "description": "Codes and refresh tokens across a restart with and without `tokens.hmac_secret`, and a secret rotation through pre-staging, promotion, rollback and retirement",
          "commit": "8f67e3d"
        }
      ],
      "documentation": [
        {
          "description": "Authenticating an Application guide, including moving an existing principals table into `sf_rp_principals`",
          "commit": "86cfadf"
        },
        {
          "description": "Service Accounts walkthrough, and ADR-016 records the service account's JWT-bearer grant",
          "commit": "4aa14ce"
        },
        {
          "description": "The relying-party setup example sets the DPoP key; the `session/bff` and session pages point to `identity/appauth`",
          "commit": "86cfadf"
        },
        {
          "description": "Specs for application authentication and service accounts",
          "commit": "8fe4bc5"
        },
        {
          "description": "The API keys page shows a truncated sample key, and the API key, marketplace and Ent store examples use the `sf` prefix",
          "commit": "60e437f"
        },
        {
          "description": "The token HMAC secret and its rotation in Deploying SystemAuth and Rotating Keys and Secrets",
          "commit": "ea624df"
        },
        {
          "description": "v0.26.0 release notes"
        }
      ]
    },
    {
      "version": "v0.25.0",
      "date": "2026-10-27",
      "highlights": [
        {
          "description": "`relyingparty.Client.Transport` lets relying parties call SystemAuth's APIs, such as the managed-principal API with `mpclient`, with their people's DPoP-bound session tokens, which SystemAuth refuses as `Bearer`"
        }
      ],
      "added": [
        {
          "description": "`relyingparty.Client.Transport`: an `http.RoundTripper` that presents the token the caller set in `Authorization` with the `DPoP` scheme and a new proof when it is bound to the client's key (or opaque), as `Bearer` when unbound, refuses a JWT bound to another key with `ErrForeignDPoPToken` (SystemAuth refuses an opaque one), and retries once with SystemAuth's nonce when the request body can be sent again",
          "commit": "5538912"
        }
      ],
      "changed": [
        {
          "description": "The relying party's calls to userinfo, memberships and access changes go through `Transport`; a JWT access token is sent only once its signature verifies against SystemAuth's keys",
          "commit": "5538912"
        }
      ],
      "tests": [
        {
          "description": "Cover the transport for each kind of token, another key's token, and nonce retries with and without a resendable body; against SystemAuth, `mpclient`'s bound token is refused as `Bearer` and works through the transport, with and without nonces",
          "commit": "d5c5e4f"
        }
      ],
      "documentation": [
        {
          "description": "`mpclient`, Managed Principals, Relying Party and Calling APIs with DPoP: sending DPoP-bound session tokens to SystemAuth's APIs",
          "commit": "8940e2b"
        },
        {
          "description": "v0.25.0 release notes"
        }
      ],
      "security": [
        {
          "description": "`relyingparty.Client.Transport` reads a JWT's `cnf` binding only after its signature verifies against SystemAuth's keys and its issuer matches, so it makes no DPoP proof for a token SystemAuth did not issue; a forged token is refused with `ErrInvalidToken`"
        }
      ]
    },
    {
      "version": "v0.24.0",
      "date": "2026-10-27",
      "highlights": [
        {
          "description": "`identity/publicclient` lets command-line tools and other public clients sign people in to SystemAuth and call SystemForge-powered APIs with DPoP-bound tokens, for tools a deployment ships to its users and tools others write against it alike. Nothing is registered per person or machine: a key is generated at login and the tokens are bound to it"
        }
      ],
      "added": [
        {
          "description": "`publicclient.Login`: the authorization code flow with PKCE on a loopback redirect (RFC 8252, any port), a new P-256 DPoP key, ID token verification, and the key and tokens saved to a `Store`",
          "commit": "c669c68",
          "rmis": [
            "RMI-SYSTEMFORGE-186"
          ]
        },
        {
          "description": "`Session.Transport` and `Session.HTTPClient`: `Authorization: DPoP` with a proof bound to the access token (RFC 9449) on every request, refresh a minute before expiry, and one retry for `use_dpop_nonce` or `invalid_token`; the request body is closed on every path",
          "commit": "c669c68",
          "rmis": [
            "RMI-SYSTEMFORGE-186"
          ]
        },
        {
          "description": "`publicclient.Open` and `Session.Logout`: reuse a stored session, and revoke the refresh token and delete the credentials",
          "commit": "c669c68",
          "rmis": [
            "RMI-SYSTEMFORGE-186"
          ]
        },
        {
          "description": "`publicclient.Store` and `FileStore`: one owner-only file, refused when others can read it, written atomically and flushed with its directory so a crash cannot bring back a redeemed refresh token",
          "commit": "31ffdf7",
          "rmis": [
            "RMI-SYSTEMFORGE-186"
          ]
        },
        {
          "description": "`publicclient.Locker`, implemented by `FileStore` with `flock` or `LockFileEx`: processes sharing the credentials refresh and log out under the lock, and adopt tokens another process refreshed instead of redeeming the old refresh token, which SystemAuth would answer by revoking the login; the system releases the lock when its holder exits",
          "commit": "6eaa391",
          "rmis": [
            "RMI-SYSTEMFORGE-186"
          ]
        }
      ],
      "dependencies": [
        {
          "description": "`golang.org/x/sys` v0.49.0 is a direct dependency, for the operating-system lock",
          "commit": "6eaa391"
        }
      ],
      "documentation": [
        {
          "description": "Calling APIs with DPoP: command-line tools and other public clients, registration, storage and several processes",
          "commit": "1e82ecb",
          "rmis": [
            "RMI-SYSTEMFORGE-186"
          ]
        },
        {
          "description": "Calling APIs with DPoP: durable saves and the operating-system lock",
          "commit": "9c2e039",
          "rmis": [
            "RMI-SYSTEMFORGE-186"
          ]
        },
        {
          "description": "ADR-019 (proposed): the support UI, the requester's list of their own requests, and support tools built for agents first",
          "commit": "e0d1bf7"
        },
        {
          "description": "ADR-019: agents send a reply only after a person approves it",
          "commit": "ddce341"
        },
        {
          "description": "ADR-019: a support conversation keeps its reply address while it continues",
          "commit": "cad9289"
        },
        {
          "description": "v0.24.0 release notes"
        }
      ],
      "tests": [
        {
          "description": "Against an embedded SystemAuth that requires DPoP nonces and an API behind `relyingparty.BearerMiddleware`: login, calls with proofs, Bearer refused, refresh with rotation, processes sharing credentials, logout, refused logins, the file store, unlock failures and closed request bodies",
          "commit": "c84d638",
          "rmis": [
            "RMI-SYSTEMFORGE-186"
          ]
        }
      ]
    },
    {
      "version": "v0.23.0",
      "date": "2026-10-27",
      "highlights": [
        {
          "description": "`aauthrs` accepts auth tokens only from their rightful issuer: in four-party only the `Audience` Access Server, in three-party only a trusted Person Server issuing for itself, so a Person Server trusted for person tokens can no longer grant itself scopes that bypass the Access Server"
        },
        {
          "description": "`aauthrs` refuses a request signed for another server, so an agent's signed request cannot be replayed to a resource it was not meant for"
        },
        {
          "description": "Updates aauth-go to v0.3.0"
        }
      ],
      "breaking": [
        {
          "description": "`aauthrs`: an Access Server's auth tokens are accepted only when it is named in `Config.Audience`; listing it in `TrustedIssuers` no longer admits them, and a trusted issuer's auth token with `dwk` `aauth-access.json` is refused in three-party",
          "commit": "051e23b"
        }
      ],
      "upgradeGuide": [
        {
          "description": "A resource that accepts auth tokens from an Access Server sets `aauthrs.Config.Audience` to it; when the Person Server and Access Server share one origin, name it in both `TrustedIssuers` and `Audience`"
        },
        {
          "description": "An application that also depends on aauth-go directly reviews its v0.3.0 migration guide: agent identifiers must be in their provider's domain, and servers built on its `personserver` and `accessserver` stores gain new methods"
        }
      ],
      "security": [
        {
          "description": "`aauthrs` enforces who may issue an auth token, which aauth-go leaves to the caller; before, any issuer in `TrustedIssuers` was accepted with either `dwk`",
          "commit": "051e23b"
        },
        {
          "description": "`aauthrs` defaults `Signature.Authority` to the host of `Resource`, so a verified signature is bound to this resource; agent tokens carry no audience, so a request signed for another server could otherwise be replayed in agent-token mode",
          "commit": "4adc9f4"
        }
      ],
      "added": [
        {
          "description": "`aauthrs.Config.IsRevoked`, asked about every token once it and the request signature verify: a revoked token is a 401 `revoked_jwt`, unavailable revocation state a 500, as in aauth-go's `ResourceGuard`",
          "commit": "e9ac963"
        }
      ],
      "dependencies": [
        {
          "description": "aauth-go v0.2.0 to v0.3.0",
          "commit": "2eeeba0"
        }
      ],
      "documentation": [
        {
          "description": "The AI Agents (AAuth) guide covers `Audience`, the signature authority, `IsRevoked`, and choosing three- or four-party",
          "commit": "36d4c69"
        },
        {
          "description": "v0.23.0 release notes"
        }
      ],
      "tests": [
        {
          "description": "Cover the auth-token issuer rules in three- and four-party, a request signed for another server, and the revocation hook",
          "commit": "3ae1567"
        }
      ]
    },
    {
      "version": "v0.22.0",
      "date": "2026-10-25",
      "highlights": [
        {
          "description": "Invite-gated sign-up grows a deployment on purpose: operators create invite codes with use limits, expiry and cohort labels, members invite people from an allowance, every account records which invite admitted it, and an HTTP API serves admin and member pages"
        }
      ],
      "added": [
        {
          "description": "`signupgate.CodeStore`: invite codes stored as hashes and shown once, reserved with one conditional update so a code admits at most its use limit, redemptions for attribution, and member allowances with single-use member codes",
          "commit": "8ffe82f"
        },
        {
          "description": "`systemauth.WithSignupCodes`: the `/signup?code=` page and `invite_code` on provider sign-in carry a code to the sign-up gate; `SignupGateAborter` lets a gate give back a reservation when account creation fails",
          "commit": "89d2b55"
        },
        {
          "description": "`signupgate/signupapi`: operator routes for email invites, codes, the waitlist, allowances and joined accounts, and member routes for a person's own codes, with audit events",
          "commit": "1551e8a"
        },
        {
          "description": "`systemauthsvc` options `SignupCodes`, `SignupPage`, `MemberInvites` and `SignupAPI`, and `Service.SignupCodes` and `Service.SignupAPI`",
          "commit": "93915ad"
        },
        {
          "description": "Commands `code`, `allowance`, `waitlist invite` and `admin` (`principal/admincmd`) for operators, including granting the first platform administrator",
          "commit": "e75977e"
        },
        {
          "description": "Migration `0011` records who created a sign-up invite and when a waitlist entry was invited",
          "commit": "f7ee741"
        }
      ],
      "documentation": [
        {
          "description": "Invite-Gated Sign-Up guide",
          "commit": "bb60e66"
        }
      ]
    },
    {
      "version": "v0.21.0",
      "date": "2026-10-25",
      "highlights": [
        {
          "description": "Tokens are DPoP-bound by default: SystemAuth and the identity/oauth provider verify DPoP proofs (RFC 9449) at the token endpoint and bind access and refresh tokens to the proof's key, the relying-party, session and multi-app middleware accept a bound token only with a proof by its key, and the BFF presents tokens with proofs by the session's key; unbound bearer tokens remain only as an explicit per-client opt-out (`allow_bearer_tokens`)"
        },
        {
          "description": "Keys and secrets rotate N / N-1: JWT signing keys carry key IDs and pre-staged verification keys, and client secrets, BFF session sealing keys and SCIM tokens keep the current and previous value valid, so a rotation can be rolled back without signing anyone out"
        },
        {
          "description": "Built-in per-tenant SCIM tokens: the `scimtoken` store issues, rotates and revokes hashed tokens bound to one organization, and the packaged SystemAuth service serves SCIM 2.0 and token management with them"
        },
        {
          "description": "Revocations reach the ReBAC graph first: removing access deletes the relationships under advisory graph locks before the database change commits and fails when the graph refuses, a reconciler repairs the graph from the identity tables, and the packaged service runs in mode rebac"
        },
        {
          "description": "Each multi-app application connects with its own database login, verified at startup to be confined to its schema, reads the shared identity tables read-only, and is migrated by a separate step that keeps the owner login out of app servers"
        }
      ],
      "security": [
        {
          "description": "The Go directive was 1.26.6, which misses standard-library security fixes in net/http and HTTP/2, crypto/tls, crypto/x509, html/template, net/textproto and os that are reachable from this module; it is now 1.26.10, so dependent applications build with the fixes"
        },
        {
          "description": "SystemAuth issued only bearer tokens, which work for whoever holds a copy, and nothing on the resource side verified the DPoP proofs the BFF sent, so a stolen DPoP-bound token worked as an ordinary bearer token; tokens are now bound to a proven key and every SystemForge resource middleware refuses a bound token presented as Bearer"
        },
        {
          "description": "`identity/token` bound tokens to whatever DPoP thumbprint its caller passed, so a caller that skipped proof verification could bind tokens to a key nobody had proved to hold; it now binds only to a `dpopproof.Proof` that a `Checker` verified"
        },
        {
          "description": "SystemAuth treated a token subject that was not a UUID or named no principal as active, so the tokens of a hard-deleted principal kept working; such subjects are now inactive and their token family is revoked"
        },
        {
          "description": "The embedded auth provider created a session for the `oidc` method without checking any token, so a caller passing a request-supplied method could sign in as any active user by email; it now verifies only passwords and returns `ErrUnsupportedAuthMethod` for other methods"
        },
        {
          "description": "Password authentication had no attempt limit and returned faster for unknown accounts, allowing unbounded guessing and account enumeration by timing; failures now lock an identifier (`ErrAccountLocked`) whether or not the account exists, and unknown accounts spend one Argon2id verification"
        },
        {
          "description": "A login session created for a managed principal could authorize any client, including ones that never allowed managed principals; `/oauth/authorize` and the token endpoint now refuse them for such clients"
        },
        {
          "description": "`POST /login-token` did not check where the form came from, so any site could sign a visitor into an account it controlled; the exchange now requires an allowed Origin or Referer"
        },
        {
          "description": "Signup created accounts without proof of the address and `SignupOrGetExisting` handed an existing unverified account to a verified login, letting someone pre-register another person's address; it now returns `ErrAccountEmailUnverified`"
        },
        {
          "description": "`UpdateHuman` kept the verified flag when callers such as federation sync changed a human's email, so an unproven address linked social logins and was published as `email_verified=true`; a changed email is now unverified"
        },
        {
          "description": "The invite API listed and answered invitations for the caller's email without checking that it was verified, so a principal claiming someone's address could see their invitations across organizations"
        },
        {
          "description": "Accepting an invitation did not check that the inviter could still invite, so a removed admin could rejoin through invitations sent to addresses it controlled; acceptance now requires the inviter's current authority, and removing or demoting a member revokes its pending invitations"
        },
        {
          "description": "Invite status writes were unconditional, so an accept racing a revoke or decline still created the membership, and revoking an accepted invite left the membership; every transition is now conditional on the invite being pending"
        },
        {
          "description": "Under RBAC a deleted organization stayed usable: its slug resolved, its members kept their roles and could add members and accept invitations; deleted organizations now resolve to nothing, give no roles and refuse membership writes (`ErrOrganizationDeleted`)"
        },
        {
          "description": "Any organization admin could add any principal, including another tenant's managed principals, as an active member without consent, and the answers revealed which principal IDs exist; direct adds now need `APIConfig.DirectAdd` or platform administration and refusals are indistinguishable"
        },
        {
          "description": "API key middleware built the principal from a valid key alone, so an organization-scoped key kept working after its owner was removed or deactivated; an owner check now runs on every request"
        },
        {
          "description": "identity/oauth `API.Middleware` accepted any token its storage held, regardless of the issuing client or whether the client or principal was still active; it now requires an accepted, active client and an active principal"
        },
        {
          "description": "`CreateDelegation` let any principal with `can_delegate` take over any agent, including another organization's or one already delegated; it now returns `ErrAlreadyDelegated` and `ErrCrossOrganization`"
        },
        {
          "description": "`GET /access-changes` returned every organization's changes to any client with `access_changes:read`, and back-channel deliveries went to every client; the feed is now scoped to each client's organizations"
        },
        {
          "description": "The contract audit stream state was process-wide, so a token allowed to configure one hosted application's audit stream could repoint or disable another's; the state now belongs to each `contract.API`"
        },
        {
          "description": "The embedded SpiceDB server listened on a local TCP port guarded by a key derived from the startup time, which another local process could guess to write relationships; it now uses an in-memory listener and a random 32-byte key"
        },
        {
          "description": "`CanAll` returned true for an empty action list in the rbac and SpiceDB providers, so a route registered with no actions allowed every authenticated caller; it now denies, and `RequireAllActions` and `RequireAnyAction` panic without actions"
        },
        {
          "description": "authzguardsql's `DefaultResourceBuilder` gave every entity and field the same ID-less resource, so a role granted `guardsql_field.read` could read every field and SpiceDB checks always failed; each entity and field now has a concrete resource ID and organization"
        },
        {
          "description": "Targeted feature flags were on for every caller that passed no evaluation context; a flag with targets or a partial rollout is now off without a subject"
        },
        {
          "description": "The observability middleware recorded full request URLs and raw paths, sending OAuth codes, API keys in query strings and invite tokens to the tracing backend; spans and metrics now carry the matched route pattern"
        },
        {
          "description": "productgraph took the event user from the `X-User-ID` request header and sent raw request paths, so callers could attribute events to other users; the user comes from the session and paths are recorded as route patterns"
        },
        {
          "description": "Marketplace seat assignment read and wrote `used_seats` outside a transaction, so concurrent assignments overran the seat limit; seats are now reserved with a conditional increment in a transaction"
        },
        {
          "description": "Stripe webhooks were verified with an empty key when no signing secret was configured, so a forged checkout event granted a license; verification now fails closed with `ErrWebhookSecretRequired`"
        },
        {
          "description": "Stripe subscription updates were ignored, so unpaid, paused or canceled subscriptions and portal seat reductions left licenses unchanged; licenses now follow the subscription status and quantity"
        },
        {
          "description": "The Redis sliding-window rate limiter could count two requests in the same millisecond as one, letting a parallel burst exceed the limit; each entry now has a unique random member"
        },
        {
          "description": "The BFF proxy forwarded dot segments, so `/api/../../other` reached the upstream outside its base path with the session's token; such paths are refused with 400"
        },
        {
          "description": "The BFF proxy ignored `HeadersToForward` and passed client identity headers such as `X-User-Id` and `X-App-ID` to upstreams; the list is now enforced and identity, routing and forwarding headers are stripped"
        },
        {
          "description": "BFF logout answered success when the session store failed, leaving the session and refresh token valid; it now answers 500 and keeps the cookie so the client can retry"
        },
        {
          "description": "BFF sessions were extended by every refresh and never expired from inactivity; sessions now have an idle timeout and a maximum lifetime"
        },
        {
          "description": "BFF per-endpoint rate limits shared one bucket per client and never matched under a mount prefix; each endpoint limit now has its own bucket and matches relative to the mount point"
        },
        {
          "description": "The BFF session cookie was named `sf_session` and could be shared across subdomains, letting a sibling subdomain set or overwrite it; it is now `__Host-sf_session` and always host-only"
        },
        {
          "description": "BFF proxy routes skipped the origin check for GET, HEAD and OPTIONS, so a cross-site top-level GET reached the upstream as the user; proxied safe methods are now origin-checked"
        },
        {
          "description": "The omnistorage BFF store dropped the site ID on update, logging users out at their first refresh and pushing operators to run without site isolation, and its default key prefix shared the per-user session index between applications; the site ID is kept, required for Redis, and scopes the default prefix"
        },
        {
          "description": "The omnistorage BFF store wrote access tokens, refresh tokens and DPoP private keys to Redis in plaintext; they are now sealed with a `SessionSealer`"
        },
        {
          "description": "The Ent BFF store encrypted session fields under one key with no associated data, so ciphertext could be moved between rows or columns and the key could not be rotated; fields are now sealed with key IDs and bound to the session and column"
        },
        {
          "description": "The session JWT service accepted HMAC secrets of any length and checked the issuer only when configured; it now requires an issuer and secrets at least as long as the hash output"
        },
        {
          "description": "multiapp's Ent hook set `search_path` at session level, so a pooled connection kept another application's schema, and schema names reached SQL unvalidated; the hook now uses `SET LOCAL` in a transaction and every schema path validates names"
        },
        {
          "description": "The rls migrator and policy SQL interpolated table, column, policy and role names unquoted; they are now quoted as identifiers"
        },
        {
          "description": "SCIM filters the store could not evaluate were dropped, so an unsupported filter matched every user and an identity provider could be handed the wrong account; such filters now fail with `invalidFilter`"
        },
        {
          "description": "SCIM PATCH stored a new password in plaintext and PUT never hashed it and echoed it back; both now hash, and no response carries a password or hash"
        },
        {
          "description": "SCIM group writes bypassed the organization service, accepting invalid or cooling-off slugs, renaming personal organizations and hard-deleting organizations without graph cleanup; they now go through the organization service"
        },
        {
          "description": "SCIM returned database and internal error text to clients; unexpected errors are logged and answered with a generic 500"
        },
        {
          "description": "SCIM bulk payload limits were advertised but not applied and every operation could run a bcrypt hash; the payload limit is enforced and password operations per request are capped"
        },
        {
          "description": "Deactivating a principal, demoting a member to collaborator, deleting a SCIM user and deactivating a human through SystemAuth storage left the principal's relationships in the authorization graph, so under mode rebac the access remained; each now removes them before committing"
        },
        {
          "description": "Revocations committed the database change before removing the relationship from the graph, so a failed graph write left access granted with no retry, and a late grant write could undo a concurrent revocation; revocations now remove graph access first and grants re-read the rows under graph locks"
        },
        {
          "description": "A file vault pointed at the keys directory kept the root key beside the keyring, so one backup held everything needed to decrypt connection credentials; root keys in or under the keys directory are refused"
        },
        {
          "description": "The OAuth client state cookie could be written without Secure or with an unsafe SameSite mode; it is now `__Host-sf_oauth_client_state`, Secure, HttpOnly and SameSite=Lax by default"
        },
        {
          "description": "The token endpoints parsed the request form before installing their 1 MB body limit; the limit now applies before parsing"
        },
        {
          "description": "The BFF omnistorage session store's Redis connection is refused for a server that is not on loopback unless it uses TLS with certificate verification and a password, so session IDs and sealed sessions no longer cross the network in clear text by default",
          "commit": "ca5266c"
        },
        {
          "description": "Connections' development egress setting lets provider requests reach only the address ranges listed, instead of every non-public address; link-local and cloud metadata addresses are refused even when listed",
          "commit": "506c9ed"
        },
        {
          "description": "The BFF session sealer and the relying-party store's row keyring sized their output from the plaintext length without an upper bound; both now refuse plaintext over 64 MiB",
          "commit": "eb05028"
        }
      ],
      "added": [
        {
          "description": "systemauth: DPoP proof checks at the token endpoint, DPoP-bound access and refresh tokens (`cnf.jkt`, `token_type` DPoP), `dpop_jkt` code binding, optional server nonces (`dpop.require_nonce`), a Redis replay cache (`dpop.replay_cache_redis_url`) and `dpop.resource_base_url` for routes behind a proxy"
        },
        {
          "description": "systemauth: per-client `allow_bearer_tokens`, the legacy exception that keeps unbound bearer tokens, stored in `sf_oauth_apps.allow_bearer_tokens`"
        },
        {
          "description": "systemauth: `keys.verification_keys` publishes previous and pre-staged signing keys in the JWKS for verification only, and a token's `kid` selects its key"
        },
        {
          "description": "systemauth: `EntStorage.RotateClientSecret` and `RevokeClientSecret`, keeping the current and previous secret and revoking older ones; `ClientSecretHasher` verifies bcrypt and Argon2id hashes"
        },
        {
          "description": "systemauth: `WithLockout` and `WithProviderLockout` for password lockout, `WithEntAuthzSyncer` and `WithEntLogger` for `EntStorage`, and `AccessChangeScope` with `AllOrganizations`"
        },
        {
          "description": "oauth: DPoP-bound tokens, `Config.KeyID` and `Config.VerificationKeys` for N / N-1 signing key rotation, `Config.JWTAccessTokens` for RFC 9068 JWT access tokens, `WithResourceBaseURL`, `WithAcceptedClientIDs`, `WithAnyClient` and `Config.AllowEphemeralKey`"
        },
        {
          "description": "identity/dpopproof: a DPoP proof checker with replay and stateless nonce checks whose `Proof` exists only after verification"
        },
        {
          "description": "relyingparty: `BearerConfig.DPoP` verifies proofs for DPoP-bound access tokens and `BearerConfig.AllowBearerTokens` opts in to unbound ones; `Client` proves possession of `Config.DPoPKey` in token requests"
        },
        {
          "description": "session/middleware: DPoP-requiring `HTTPAuth` family with `DPoPConfig`, `NewDPoPAuth`, `DPoPAuth.OptionalMiddleware`, `NewMemoryReplayCache` and `NewRedisReplayCache`; the bearer-only middleware remains as `HTTPAuthBearer` and its variants"
        },
        {
          "description": "session/middleware: `APIKeyMiddlewareConfig.OwnerCheck` and `ErrAPIKeyOwnerNotAllowed`"
        },
        {
          "description": "session/jwt: `Config.KeyID` and `Config.VerificationKeys` for signing key rotation, `ErrMissingIssuer` and `ErrWeakSecret`"
        },
        {
          "description": "bff: `SessionSealer` with `KeyringSealer` and `NewKeysSealer` for the omnistorage and Ent stores, `EntStoreDefaultKeyID`, `ErrSealerRequired` and `ErrSiteIDRequired`"
        },
        {
          "description": "bff: `IdleTimeout` and `MaxLifetime` (defaults 24 hours and 7 days) with `Session.LifetimeExceeded`, `Session.TokenType`, `RateLimitConfig.BasePath`, `OriginValidator.SafeMethodMiddleware`, `CookieConfig.Validate`, `InsecureCookieName`, `HandlerConfig.Logger` and `ErrInvalidProxyPath`"
        },
        {
          "description": "scim/scimtoken: per-tenant SCIM tokens (`sf_scim_tokens`) with issue, N / N-1 rotate, revoke, list and authenticate, a `CredentialFunc`, and an HTTP API under `/api/v1/organizations/{slug}/scim-tokens`"
        },
        {
          "description": "systemauthsvc: `Options.SCIM` serves SCIM 2.0 at `/scim/v2` with stored tenant tokens, `Service.SCIMTokens`, `Options.AuthzSyncMode`, `Service.Authz`, `AuthzReconciler`, and `Options.AuditStore` for key lifecycle and connection events"
        },
        {
          "description": "scim: `InternalError`, `BatchMembershipStore`, `Config.BulkMaxPasswordOperations` and `filter.MaxDepth`; scim/store `Config.Organizations` and `Config.Syncer`"
        },
        {
          "description": "identity/graphlock: transaction-scoped PostgreSQL advisory locks per organization and principal, and `Grant` for writing granted access under them"
        },
        {
          "description": "identity/graphstate: the single statement of which graph relationships the identity tables call for"
        },
        {
          "description": "authz/mode: the graph reconciler (`Result.Reconciler`, `Reconcile`, `RunReconciler`, `Stats`) with schedule settings in `authz.ModeConfig`, and `Result.SyncMode`"
        },
        {
          "description": "spicedb: `Client.ReadRelationships` reads by page as one snapshot and `DeleteRelationshipsExact` deletes a set in one request; authz `VocabularyRegistry.HasOrgFacet`"
        },
        {
          "description": "multiapp: `Config.AppDatabases`, `MigrationDatabaseURL`, `MigrationRole`, `AllowInProcessMigrations` and `AllowSharedDatabaseLogin`; `RoleProvisioning`, `ApplyRoleProvisioning`, `OwnerRoleSQL`, `DefaultSharedReadTables`, `NoSharedReadTables`, `RestrictedSharedTables`, `CheckDatabaseIsolation`, `VerifyDatabaseIsolation` and `EntConnHook.SetSchemaInTx`"
        },
        {
          "description": "cmd/multiappdb: print, apply and verify per-app database login provisioning, reading connection strings and passwords from named environment variables"
        },
        {
          "description": "invite: `WithAuthorizer`, `ErrNotPending` and `ErrInviterNotAuthorized`; organization `APIConfig.DirectAdd` and `ErrOrganizationDeleted`; delegation `ErrAlreadyDelegated` and `ErrCrossOrganization`"
        },
        {
          "description": "oauthclient: `StateManager.AllowInsecure` and `ErrInvalidStateCookieConfig`; startup warnings when cookies are not Secure in the BFF handler, relying-party BFF and social login"
        },
        {
          "description": "keys: `CheckRootKeyLocation`"
        },
        {
          "description": "marketplace/stripe: `ErrWebhookSecretRequired`"
        },
        {
          "description": "`systemauth keys accept-rollback --confirm` and `systemauthsvc.AcceptKeyRollback`, which open the connections keyring once accepting a restored or moved copy, or one from before its rollback state was authenticated",
          "commit": "2927336"
        },
        {
          "description": "Connections settings `egress_allow_prefixes` (CIDR ranges provider requests may reach in development) and `allow_http_egress`, with a startup warning when either is set",
          "commit": "506c9ed"
        },
        {
          "description": "`bff.OmniStorageConfig.AllowInsecureRedis` for a development Redis without TLS or a password, with a warning when set",
          "commit": "ca5266c"
        },
        {
          "description": "`bff.MaxSealPlaintext` and `bff.ErrPlaintextTooLarge`, and `pgstore.ErrValueTooLarge`, for data too large to seal",
          "commit": "eb05028"
        }
      ],
      "fixed": [
        {
          "description": "oauth: confidential clients authenticate with their stored bcrypt or Argon2id secret hashes, so `client_secret_basic`, `client_secret_post` and client credentials work"
        },
        {
          "description": "oauth: discovery lists only the `code` response type and the JWKS publishes the provider's key"
        },
        {
          "description": "systemauth: a token request for a DPoP-bound code with a missing or mismatched proof is refused before Fosite runs, so the code stays usable with every storage"
        },
        {
          "description": "systemauth: `EntStorage.CreateClient` returns the cleanup error when it cannot remove a half-created client"
        },
        {
          "description": "bff: tokens are presented with the scheme they were issued for, and refreshes prove possession of the session's existing key"
        },
        {
          "description": "bff: `NewHandler` applies cookie defaults field by field instead of replacing a config without a name, which dropped fields such as `AllowInsecure`"
        },
        {
          "description": "signup: an account created through an invite has its email marked verified"
        },
        {
          "description": "organization: generated slugs skip those in their cooling-off period, and rollback failures are reported instead of discarded"
        },
        {
          "description": "observability: a disabled instance creates noop metrics instead of panicking"
        },
        {
          "description": "session/middleware: API key usage recording failures are logged"
        },
        {
          "description": "marketplace: a license suspended by setting `ValidUntil` to the current time stayed valid at that same instant, which a coarse clock such as Windows' could observe; `ValidUntil` is now the first instant the license is no longer valid, in `License.IsValid` and `CheckPrincipal`",
          "commit": "d5b716b"
        }
      ],
      "removed": [
        {
          "description": "multiapp: `Config.DatabaseURL`; use `MigrationDatabaseURL` and `AppDatabases`"
        },
        {
          "description": "bff: `CookieConfig.Domain`; the session cookie is always host-only"
        },
        {
          "description": "contract: the package functions `RecordAuditEvent`, `GetAuditStreamConfig` and `IsAuditStreamEnabled`; use the methods on `*contract.API`"
        }
      ],
      "deprecated": [
        {
          "description": "bff: `StoreConfig.EncryptionKey`, which no store read; configure a `Sealer`"
        },
        {
          "description": "multiapp: `EntConnHook.SetSchemaFromContext`; use `SetSchemaInTx`"
        },
        {
          "description": "rls: `SystemForgeTables`; RLS on the identity tables breaks their cross-organization queries"
        },
        {
          "description": "productgraph: `HeaderUserID`; set the user from the authenticated session with `WithUserID`"
        }
      ],
      "breaking": [
        {
          "description": "systemauth: token requests without a DPoP proof are refused unless the client sets `allow_bearer_tokens`; tokens are DPoP-bound and must be presented with the DPoP scheme and a proof. Existing databases need `migrations/0010_oauth_app_allow_bearer_tokens.sql`. `EmbeddedOAuthProvider.UserInfo` refuses DPoP-bound tokens, and `AuthorizeIntrospectionCaller` also accepts the DPoP scheme"
        },
        {
          "description": "systemauth: a token subject must be a principal ID; tokens for other subjects are refused, and custom `Storage` implementations must implement `PrincipalActive`"
        },
        {
          "description": "systemauth: a client secret older than the two newest active secrets no longer authenticates"
        },
        {
          "description": "systemauth: `WithAccessChanges` takes an `AccessChangeScope`; without one `/access-changes` answers 501"
        },
        {
          "description": "systemauth: `EntStorage.UpdateHuman` with `Active` false fails, and the principal stays active, when the graph refuses to remove its relationships, and it records a deactivation access change"
        },
        {
          "description": "oauth: clients without `allow_bearer_tokens` must send DPoP proofs and present tokens with the DPoP scheme; `NewProvider` requires `Config.PrivateKey` or `AllowEphemeralKey`; `API.Middleware` panics without `WithAcceptedClientIDs` or `WithAnyClient`; `Provider.Session` returns `*systemauth.Session`"
        },
        {
          "description": "token: `IssueInput.DPoPJKT` and `RefreshInput.DPoPJKT` are replaced by `DPoP *dpopproof.Proof`, and bound tokens have `TokenType` DPoP"
        },
        {
          "description": "relyingparty: `BearerMiddleware` and `RequestAuthenticator` panic when `Tokens` is set without `BearerConfig.DPoP` or `AllowBearerTokens`, and always refuse a DPoP-bound token sent as Bearer; relying-party instances sharing sessions must share `Config.DPoPKey`"
        },
        {
          "description": "session/middleware: `HTTPAuth`, `HTTPAuthForAudience`, `HTTPAuthOptional`, `ChiAuth` and `ChiAuthOptional` take a `DPoPConfig`, return an error and refuse unbound tokens unless `DPoPConfig.AllowBearer` is set; the bearer-only middleware is renamed `HTTPAuthBearer` and its variants"
        },
        {
          "description": "session/middleware: `APIKeyMiddleware` panics without `OwnerCheck`, and `RequireAPIKey`, `RequireAPIKeyWithScopes` and `OptionalAPIKey` take an `APIKeyOwnerCheck`"
        },
        {
          "description": "session/jwt: `NewService` fails with `ErrMissingIssuer` without `Config.Issuer` and with `ErrWeakSecret` for an HMAC secret shorter than the hash output"
        },
        {
          "description": "multiapp: `AuthMiddleware` returns `(middleware, error)`, needs `MiddlewareConfig.JWTService` and `DPoP.ReplayCache`, and refuses unbound tokens unless `DPoP.AllowBearer` is set"
        },
        {
          "description": "multiapp: every app needs its own database login in `Config.AppDatabases`; `Config.DatabaseURL` is removed, `MigrationDatabaseURL` is refused without `AllowInProcessMigrations` or `AllowSharedDatabaseLogin`, `RegisterApp` fails when the app schema is missing, and an `AppAwareDB` serves one schema unless opened with `AllowSharedLogin` or `AsMigrationLogin`"
        },
        {
          "description": "multiapp: `RoleProvisioning` with nil `SharedReadTables`, and `multiappdb` without `--shared-table`, grant SELECT on the default shared identity tables; restricted tables are refused"
        },
        {
          "description": "bff: the default session cookie is `__Host-sf_session` (`sf_session` when insecure), `NewHandler` refuses invalid `__Host-` and `__Secure-` cookie configs, and `CookieConfig.Domain` is removed"
        },
        {
          "description": "bff: `NewOmniStorageStore` with the redis backend requires `SiteID` and a `Sealer` (or `InsecurePlaintext`), `NewOmniStorageStoreWithKVS` returns an error and requires both, and the default key prefix is `session:<SiteID>:`"
        },
        {
          "description": "bff: `NewEntStore` requires a `Sealer` or `EncryptionKey` (`ErrSealerRequired`) and writes sealed fields in a format earlier versions cannot open"
        },
        {
          "description": "oauthclient: the state cookie is `__Host-sf_oauth_client_state`; `SetStateCookie` returns an error, `NewStateManagerInsecure` takes a `*slog.Logger`, a `StateManager` is Secure unless `AllowInsecure` is set, and SameSite Strict or None is refused"
        },
        {
          "description": "organization, approle, resourcegrant, managedprincipal, principal: a revocation whose graph removal fails returns the error and leaves the database unchanged, also in `SyncModeEventual`; `approle.RemoveForMember` removes nothing on a graph error, and `resourcegrant.GrantInTx` may write to the graph before commit when lowering a grant"
        },
        {
          "description": "principal: `Deactivate` fails, and the principal stays active, when the graph refuses to remove its relationships; `Update` with `Active` false records a deactivation access change"
        },
        {
          "description": "organization: demoting a member to collaborator deletes their application roles in the organization, and admins can add members directly only when `APIConfig.DirectAdd` allows it"
        },
        {
          "description": "authz/mode: in mode rebac the reconciler removes the relationships of deactivated principals and collaborators' application-role relationships"
        },
        {
          "description": "scim/store: `DeleteUser` answers 409 for a user who actively manages other accounts; platform `CreateGroup` refuses an `externalId` that is not a valid, available slug, and `DeleteGroup` soft-deletes and refuses personal organizations"
        },
        {
          "description": "contract: `RecordAuditEvent`, `GetAuditStreamConfig` and `IsAuditStreamEnabled` are methods of `*contract.API` (`AuditStreamConfig` for the second)"
        },
        {
          "description": "systemauth: the connections setting `allow_private_egress` is removed; use `egress_allow_prefixes` and `allow_http_egress`",
          "commit": "506c9ed"
        },
        {
          "description": "bff: a redis backend whose `RedisURL` names a non-loopback server without `rediss://`, a password or certificate verification fails with an error wrapping omnistorage-core's `ErrInsecureConnection` unless `AllowInsecureRedis` is set",
          "commit": "ca5266c"
        },
        {
          "description": "keys: an existing connections keyring refuses to open after the upgrade until it is accepted once with `systemauth keys accept-rollback --confirm`, since keyforge v0.2.0 authenticates the keyring's rollback state; a keyring moved to a new host without that state needs the same",
          "commit": "89719ae"
        }
      ],
      "documentation": [
        {
          "description": "DPoP enforcement page: where proofs are checked, the bearer-token exception, the SCIM tenant token exception and the base URL each component builds a proof's `htu` from"
        },
        {
          "description": "Browser cookies page: every cookie's production and development names, attributes, development switches and refused configurations"
        },
        {
          "description": "Key rotation guidance for JWT signing keys, BFF session sealing keys, client secrets and SCIM tokens through a pre-stage step that survives rollback"
        },
        {
          "description": "Revoke-first graph sync, the reconciler and the packaged service in mode rebac in the authorization mode guide and designs"
        },
        {
          "description": "Multi-app database isolation: per-app logins, out-of-band migrations, the startup isolation check and provisioning with `multiappdb`"
        },
        {
          "description": "Built-in SCIM tenant token store, sign-up age scope, and the rls isolation model"
        },
        {
          "description": "Key management guide describes accepting a restored or moved keyring in SystemAuth",
          "commit": "b55d034"
        },
        {
          "description": "ADRs for customer-authorized, time-limited support access and for organization admins seeing their support request index",
          "commit": "40d5008"
        }
      ],
      "tests": [
        {
          "description": "The syncer recorder records every call and can fail removals alone, to check that a refused removal aborts a revocation"
        },
        {
          "description": "The managed-principal concurrency test builds its service with direct manager adds"
        },
        {
          "description": "The multi-app PostgreSQL fixture gives the logins it provisions a password, so the tests pass against a server that checks passwords",
          "commit": "611ee57"
        },
        {
          "description": "The redirect policy test covers more bypass forms: a triple slash, a leading space, `https:` without slashes and a NUL byte",
          "commit": "03e245b"
        }
      ],
      "infrastructure": [
        {
          "description": "Scan for known vulnerabilities with govulncheck on pushes to main and weekly"
        }
      ],
      "upgradeGuide": [
        {
          "description": "Build with Go 1.26.10 or later"
        },
        {
          "description": "systemauth: run `migrations/0010_oauth_app_allow_bearer_tokens.sql` on an existing database; clients must send DPoP proofs, or set `allow_bearer_tokens` on clients that cannot yet. Several instances share `dpop.replay_cache_redis_url`; behind a proxy that strips a prefix set `dpop.resource_base_url`"
        },
        {
          "description": "relyingparty: set `Config.DPoPKey` (shared by instances that share sessions) and `BearerConfig.DPoP` with a replay cache, or `AllowBearerTokens` for legacy clients"
        },
        {
          "description": "session/middleware: pass a `DPoPConfig` to `HTTPAuth` and handle its error, or switch to `HTTPAuthBearer` to keep accepting only bearer tokens; give `APIKeyMiddleware` an `OwnerCheck`"
        },
        {
          "description": "session/jwt: set `Config.Issuer` and an HMAC secret of at least 32, 48 or 64 bytes for HS256, HS384 or HS512"
        },
        {
          "description": "multiapp: handle the error from `AuthMiddleware` and set `MiddlewareConfig.JWTService` and `DPoP.ReplayCache`, or `DPoP.AllowBearer`"
        },
        {
          "description": "multiapp: provision a login per app with `RoleProvisioning` or `multiappdb`, set `AppDatabases` and `MigrationRole`, and run `multiapp.Migrate` with the owner login as a separate step; for local development set `AllowSharedDatabaseLogin` or `AllowInProcessMigrations`"
        },
        {
          "description": "bff: give the omnistorage store a `SiteID` and a `Sealer`, give the Ent store a `Sealer` or keep `EncryptionKey`, and drop `CookieConfig.Domain`; users sign in again when the cookie name, prefix or sealing changes"
        },
        {
          "description": "oauth: configure `Config.PrivateKey` and choose `WithAcceptedClientIDs` or `WithAnyClient`"
        },
        {
          "description": "systemauth: pass an `AccessChangeScope` to `WithAccessChanges` (`AllOrganizations` for one application), and make custom session providers return principal IDs"
        },
        {
          "description": "organization: allow governed principals through `APIConfig.DirectAdd`; reassign application roles after promoting a collaborator"
        },
        {
          "description": "scim/store: set `Config.Syncer` to the deployment's syncer"
        },
        {
          "description": "multiapp: to keep an app login without the shared identity tables, set `SharedReadTables` to `NoSharedReadTables` or pass `--no-shared-tables`, then apply the provisioning again"
        },
        {
          "description": "oauthclient: handle the error from `SetStateCookie` and pass a logger to `NewStateManagerInsecure`; flows in progress during the upgrade fail once"
        },
        {
          "description": "contract: call the audit stream functions as methods of `*contract.API`"
        },
        {
          "description": "With connections enabled, stop SystemAuth, run `systemauth keys accept-rollback --confirm` once with the server's configuration, then start it"
        },
        {
          "description": "Replace `allow_private_egress: true` with `egress_allow_prefixes` listing the ranges local fakes use, for example `[127.0.0.0/8]`, and `allow_http_egress: true`"
        },
        {
          "description": "Point the BFF omnistorage store at `rediss://` with a password, or set `AllowInsecureRedis` for a development Redis on a local network"
        }
      ],
      "dependencies": [
        {
          "description": "Bump `github.com/plexusone/connectforge` from 0.4.0 to 0.6.0",
          "commit": "8ce2f15"
        },
        {
          "description": "Bump `github.com/plexusone/keyforge` from 0.1.0 to 0.2.0",
          "commit": "89719ae"
        },
        {
          "description": "Bump `github.com/plexusone/omnistorage-core` from 0.5.2 to 0.6.0",
          "commit": "8ce2f15"
        },
        {
          "description": "Bump `github.com/plexusone/omnivault` from 0.5.0 to 0.6.0",
          "commit": "89719ae"
        },
        {
          "description": "Bump `github.com/grokify/oscompat` from 0.7.0 to 0.9.0",
          "commit": "89719ae"
        },
        {
          "description": "Bump `modernc.org/sqlite` from 1.60.1 to 1.61.0",
          "commit": "89719ae"
        },
        {
          "description": "Bump `github.com/authzed/spicedb` from 1.56.2 to 1.57.0",
          "commit": "b6db81c"
        },
        {
          "description": "Bump `github.com/grokify/guardsql` from 0.3.0 to 0.4.0",
          "commit": "b6db81c"
        },
        {
          "description": "Bump `github.com/plexusone/omniobserve` from 0.12.0 to 0.12.1",
          "commit": "b6db81c"
        }
      ],
      "changed": [
        {
          "description": "The organization and principal services log a failed graph write with the constant message \"failed to sync granted access to authz\" and the kind of change in a `change` attribute",
          "commit": "cc190c2"
        }
      ]
    },
    {
      "version": "v0.20.0",
      "date": "2026-10-23",
      "highlights": [
        {
          "description": "Access tokens are bound to the application they were issued for: relying parties, the session JWT service, and multi-app routing each refuse tokens minted for another application that shares the signing key"
        },
        {
          "description": "SCIM credentials are bound to one organization: a customer's identity provider provisions only its own members and cannot change the identity of users who also belong elsewhere"
        }
      ],
      "security": [
        {
          "description": "Relying-party bearer authentication accepted a SystemAuth access token issued to any other OAuth client, and an ID token, as an access token for the application, taking the organization memberships in its claims; `VerifyAccessToken` now requires a `client_id` claim from an accepted client and refuses typed non-access JWTs"
        },
        {
          "description": "The session JWT service's default validation (`ValidateAccessToken`, `HTTPAuth`, `HTTPAuthOptional`) accepted tokens for any audience, so applications sharing a signing key accepted each other's access and refresh tokens; tokens must now carry the service's `Config.Audience`"
        },
        {
          "description": "multiapp `AuthMiddleware` accepted a token minted for one app on every other app unless `AppAudiences` was set; a token on an app route must now be addressed to that app's ID by default"
        },
        {
          "description": "authzguardsql `PolicyBuilder.Build` turned a principal authorized for no entity into a GuardSQL policy with empty allowlists, which GuardSQL reads as unrestricted, so the least-privileged principals could query every entity and field; it now returns `ErrNoAuthorizedEntities`"
        },
        {
          "description": "authz `RequireResourceAction` checked a resource named in the request against the caller's role in the organization from their token, so a member of one organization passed resource checks for another organization's resources; the resource's organization now comes only from the extractor"
        },
        {
          "description": "The SCIM store had no tenant scoping, so any SCIM credential could read, change, delete and regroup every user and organization on the platform; each request is now bound to the credential's organization, and requests without a scope are refused"
        },
        {
          "description": "SCIM could rewrite the login email of a user who also belonged to other organizations, enabling account takeover; a tenant now changes email, name and photo only for users it provisioned that belong to no other organization, and manages only the membership of others"
        },
        {
          "description": "Deactivating an organization membership left the member's organization role, application roles and resource grants in the SpiceDB graph, so under the ReBAC authorizer a deactivated admin kept every permission; deactivation now removes them from the graph and reactivation writes them back"
        },
        {
          "description": "bff `RegisterHumaRoutes` registered stub handlers for logout, session and refresh; on a router shared with Huma, as documented, they took precedence over the mounted BFF handler, so logout answered success without ending the session and the stubs skipped the Origin check and rate limiter. It now only documents the routes"
        },
        {
          "description": "A connection's creator kept view, use, manage and share rights on it after leaving or being removed from the organization, and could grant themselves back in; creator rights now require current membership of the owning organization"
        },
        {
          "description": "BFF logout passed the client's cookie value to the session store's Delete even when no session matched; with the omnistorage kvs store, the value `user:<id>` deleted a user's session index, so \"log out everywhere\" and revoke-on-password-change missed that user's sessions. Logout now deletes only a session the store returns, and malformed cookie values are treated as no session"
        },
        {
          "description": "aauthrs accepted an agent token from any agent provider for any agent identifier, so a provider controlled by anyone could claim another domain's agents (for example `aauth:billing-bot@victim.example`); an agent token is now accepted only when the agent's domain is its issuer's host"
        },
        {
          "description": "SCIM wrote memberships directly, so suspending, removing or deleting a user skipped the authorization-graph sync, the access-change record that revokes existing tokens, and cleanup of application roles and resource grants; SCIM now changes memberships through the organization service and deactivates accounts through the principal service"
        },
        {
          "description": "SCIM could suspend, remove or delete an organization's owner, letting an identity provider lock a customer out of its own organization; it now refuses with 403"
        },
        {
          "description": "Re-adding a suspended member through SCIM restored their previous role, possibly owner or admin; a restored membership now gets the default role"
        }
      ],
      "added": [
        {
          "description": "relyingparty: `Config.AcceptedClientIDs` lists the OAuth clients whose access tokens an application accepts"
        },
        {
          "description": "systemauth: JWT access tokens carry the JOSE `typ` header `at+jwt` (RFC 9068)"
        },
        {
          "description": "multiapp: `MiddlewareConfig.AllowCrossAppTokens` accepts tokens for every app when that is intended"
        },
        {
          "description": "session/jwt: `Claims.HasAnyAudience` and `ErrMissingAudience`"
        },
        {
          "description": "authzguardsql: `ErrNoAuthorizedEntities`"
        },
        {
          "description": "authz: `WithResourceLookup` and `ResourceOrgLookup` load a resource's owning organization for `RequireResourceAction`, and `ErrResourceNotFound`"
        },
        {
          "description": "scim: `Scope`, `WithScope`, `WithTenant`, `WithPlatformScope`, `ScopeFromContext`, and `API.CredentialMiddleware` with `Credential` to bind SCIM requests to an organization or the platform"
        },
        {
          "description": "bff: `ValidSessionID` and `MaxSessionIDLength`"
        },
        {
          "description": "aauthrs: `Config.TrustedAgentIssuers` restricts which agent providers' tokens a resource accepts"
        },
        {
          "description": "scim/store: `Config.Memberships` and `Config.Principals` take the application's organization and principal services"
        }
      ],
      "breaking": [
        {
          "description": "session/jwt: `Config.Audience` is required; `NewService` returns `ErrMissingAudience` without it. Client-kind audiences (`bff`, `api`, custom) are added in front of the application audience instead of replacing it, and `ValidateAccessTokenWithAudience` with an empty audience checks `Config.Audience` instead of skipping the check"
        },
        {
          "description": "relyingparty: `VerifyAccessToken` accepts only tokens issued to `Config.ClientID` unless `AcceptedClientIDs` or `AccessTokenAudience` is set; client-credentials tokens from other clients must be listed"
        },
        {
          "description": "multiapp: without `AppAudiences`, tokens on app routes must carry the app's `AppID` as an audience"
        },
        {
          "description": "authz: `RequireResourceAction` no longer sets a resource's organization from the caller's token; extractor errors answer 400 for a missing or malformed ID, 403 for `ErrResourceNotFound`, and 500 otherwise"
        },
        {
          "description": "scim/store: the Ent store refuses requests without a provisioning scope. For a tenant, `active` is the membership's state, creating a user who exists elsewhere links them as a member, deleting a shared user removes only the membership, and groups cannot be created, renamed or deleted"
        },
        {
          "description": "connections: creator rights need an `Options.Authorizer` that implements `authz.OrgAuthorizer` (the rbac and SpiceDB providers do); with another authorizer, creators are decided by role and grants alone"
        },
        {
          "description": "bff: a custom `HandlerConfig.SessionIDGenerator` must produce IDs that `ValidSessionID` accepts (URL-safe characters, at most 256)"
        },
        {
          "description": "scim/store: SCIM refuses to deprovision an organization owner, restores memberships with the default role, and for a platform credential `active` deactivates the account through the principal service"
        }
      ],
      "deprecated": [
        {
          "description": "scim: `API.Middleware`, which binds no provisioning scope; use `CredentialMiddleware`"
        }
      ],
      "documentation": [
        {
          "description": "SCIM provisioning guide"
        }
      ],
      "upgradeGuide": [
        {
          "description": "session/jwt: set `Config.Audience` to a value naming the application. Access tokens issued before the upgrade are refused and clients refresh; refresh tokens issued without the audience require signing in again"
        },
        {
          "description": "relyingparty: list in `AcceptedClientIDs` every client, including the application's own `ClientID`, whose tokens the API must accept, such as service clients using client credentials; or set `AccessTokenAudience` for an API that many clients call with an audience"
        },
        {
          "description": "multiapp: mint tokens with `jwt.TokenOptions{Audience: []string{appID}}`, or set `AppAudiences` to the audiences your tokens already carry"
        },
        {
          "description": "authzguardsql: handle `ErrNoAuthorizedEntities` from `PolicyBuilder.Build` by refusing the query (for example with 403)"
        },
        {
          "description": "authz: replace `WithResourceID` with `WithResourceLookup` on routes whose access depends on the organization role, passing a lookup that returns the resource's owning organization"
        },
        {
          "description": "scim: authenticate with `CredentialMiddleware` and bind each SCIM credential to its organization (`Scope{OrganizationID: ...}`); give `Scope{Platform: true}` only to platform operator credentials"
        },
        {
          "description": "scim/store: pass the application's organization service (with its authz syncer) as `Config.Memberships` and its principal service as `Config.Principals`, so SCIM changes sync the authorization graph"
        }
      ]
    },
    {
      "version": "v0.19.0",
      "date": "2026-10-22",
      "highlights": [
        {
          "description": "SystemAuth asks a minimum sign-up age before a first upstream login creates an account, refusing anyone younger while keeping nothing about them",
          "commit": "34ae846"
        }
      ],
      "added": [
        {
          "description": "`social_login.signup_minimum_age`: SystemAuth asks a person's birth month and year on `/signup/age` before a first upstream login creates their account, refuses anyone younger while keeping nothing about them, and asks after the invite gate so an invite is used only once the age is confirmed; hosts set the wording with `Options.SignupAgePage`",
          "commit": "34ae846"
        }
      ],
      "documentation": [
        {
          "description": "Minimum sign-up age in the deployment and social login guides",
          "commit": "b8f07f8"
        },
        {
          "description": "Minimum Sign-Up Age guide: what a person sees, configuration, how the answer is decided, invite-only sign-up and limits"
        },
        {
          "description": "v0.19.0 release notes"
        }
      ],
      "tests": [
        {
          "description": "Minimum sign-up age: the birth-month boundary, refusal, single use, cross-origin answers and the invite gate",
          "commit": "3fde13c"
        }
      ],
      "upgradeGuide": [
        {
          "description": "To ask a minimum age at sign-up, set `social_login.signup_minimum_age`; `0`, the default, asks nothing, and accounts created before it are not asked"
        }
      ]
    },
    {
      "version": "v0.18.0",
      "date": "2026-10-20",
      "highlights": [
        {
          "description": "SystemAuth serves the organization console under `/console`, where organizations manage their connections to external services, signed in with the SystemAuth login session",
          "commit": "e901768"
        },
        {
          "description": "The connections API records the rotation mode chosen when connecting, from the provider manifest's guidance",
          "commit": "15f4b5d"
        }
      ],
      "added": [
        {
          "description": "`console` package: the connections API under `/console/api` with a login-session authenticator, session routes, return-address checks, and built pages served with a sign-in redirect; state-changing requests must be same-origin and every response carries a restrictive content security policy",
          "commit": "e901768"
        },
        {
          "description": "`console.web_dir` in the SystemAuth configuration; a console without social login is refused",
          "commit": "fbf6773"
        },
        {
          "description": "`systemauthsvc` mounts the organization console when configured, listing organizations from the `orgs` claim and including connections when they are enabled",
          "commit": "5e7f85e"
        },
        {
          "description": "Console session routes under `/console/bff` in the format `@plexusone/host` reads: `GET session`, sign-in redirects and `POST auth/logout`; each organization grants the `console` application the person's organization role",
          "commit": "25fc039"
        },
        {
          "description": "The console's session lists each organization's product roles and carries the app catalog, so the console's product switcher links back to the products",
          "commit": "4e2609a"
        },
        {
          "description": "`systemauth.Server.ValidateReturnTo` accepts a return address only where the sign-in redirect policy allows",
          "commit": "57307ca"
        },
        {
          "description": "`systemauth.Server.EndLoginSession` signs a person out as `POST /logout` does, for handlers that check the request's origin themselves",
          "commit": "4c74b57"
        },
        {
          "description": "Connect requests accept an optional `rotation` mode from the auth method's manifest, kept in the connection's metadata under `rotation`; an unlisted mode is refused",
          "commit": "15f4b5d"
        }
      ],
      "dependencies": [
        {
          "description": "Require `github.com/plexusone/connectforge` v0.4.0, whose manifests describe setup steps and rotation modes",
          "commit": "26aa9cb"
        },
        {
          "description": "Update dependencies",
          "commit": "bc28a82"
        }
      ],
      "documentation": [
        {
          "description": "ADR-018: the organization console on the SystemAuth host",
          "commit": "bc54dc6"
        },
        {
          "description": "Organization console guide: configuration, pages, session routes, API and linking from the app catalog",
          "commit": "a8fefa5"
        },
        {
          "description": "Connections guide covers setup steps, rotation modes and credential expiry"
        },
        {
          "description": "v0.18.0 release notes"
        }
      ],
      "tests": [
        {
          "description": "Cover the organization console, return-address checks, the session format, sign-in and sign-out, and product roles and the catalog in the session",
          "commit": "59a6a62"
        },
        {
          "description": "Cover recording the rotation mode",
          "commit": "194db85"
        },
        {
          "description": "Cover ending a login session from another handler"
        }
      ],
      "upgradeGuide": [
        {
          "description": "To enable the organization console, set `console.web_dir` to a build of `@plexusone/console`; social login must be configured"
        },
        {
          "description": "To offer the console from an application's chrome, list it in the app catalog with the ID `console`"
        }
      ]
    },
    {
      "version": "v0.17.0",
      "date": "2026-10-18",
      "highlights": [
        {
          "description": "Relying-party applications manage managed principals through SystemAuth: a `/managed-principals` API served by `systemauthsvc`, called with the manager's access token, and the `mpclient` Go client",
          "commit": "a76d041"
        },
        {
          "description": "Nobody becomes a manager without agreeing: managers other than the creator join by invitation or claim",
          "commit": "53a2655"
        },
        {
          "description": "The contract's identity, policy and audit operations refuse requests until the application is federated",
          "commit": "9883be5"
        }
      ],
      "added": [
        {
          "description": "SystemAuth built by `systemauthsvc` serves the managed-principal API at `/managed-principals` when managed principals are enabled, for relying parties calling with a manager's access token granted `systemforge:managed_principals`; `Options.AuditEmitter`, `ManagedPrincipalRates` and `ManagedPrincipalOptions`, and `Service.ManagedPrincipals()`",
          "commit": "a76d041"
        },
        {
          "description": "`managedprincipal.NewHandler` relying-party mode (`WithRequestClient`): the client is the access token's, creation names only the caller, unknown and unmanaged principals answer 403; `WithCodeRateLimit` for code routes; `GET /` (`Service.ListManagedBy`) and `POST /{id}/login-tokens`",
          "commit": "af30b5b"
        },
        {
          "description": "`managedprincipal/mpclient`, a typed client for the managed-principal API with errors wrapped in `*APIError`",
          "commit": "eaca813"
        },
        {
          "description": "`systemauth.Server.BearerAccess` and `BearerAuthenticator`: bearer access that carries the token's client, scopes and grant, adapted to `requestprincipal`",
          "commit": "c0c4e8d"
        }
      ],
      "changed": [
        {
          "description": "The contract's identity, policy and audit operations answer 403 until the application is federated; `Config.AllowUnauthenticatedStandalone` restores the open behavior for development and tests",
          "commit": "9883be5",
          "breaking": true
        },
        {
          "description": "`managedprincipal.Service.Create` accepts only the actor as manager and `AddManager` is refused with `ErrConsentRequired`, so managers join by invitation or claim; `WithDirectManagerAdds` keeps direct adds for administrator tooling",
          "commit": "53a2655",
          "breaking": true
        },
        {
          "description": "Issuing a login token requires `manage_credentials`",
          "commit": "bf1c347"
        },
        {
          "description": "The managed-principal handler answers 403 for an unknown or unmanaged principal, as for one the caller does not manage",
          "commit": "0124078"
        }
      ],
      "documentation": [
        {
          "description": "Managed principals guide covers the API on SystemAuth, its configuration and scope, and the client"
        },
        {
          "description": "INIT-SYSTEMFORGE-012 specification for managed principals in relying-party applications",
          "commit": "a18e9f1"
        },
        {
          "description": "v0.17.0 release notes; relying-party, embedding and README updates for the managed-principal API"
        }
      ],
      "tests": [
        {
          "description": "The connections test checks the error `RunJobs` returns when its context ends",
          "commit": "078231b"
        }
      ],
      "upgradeGuide": [
        {
          "description": "Standalone applications that serve the contract API: set `Config.AllowUnauthenticatedStandalone` in development and tests, or federate the application; identity, policy and audit operations otherwise answer 403"
        },
        {
          "description": "Code calling `managedprincipal.Service.Create` with managers other than the actor, or `AddManager`: invite those managers or issue a claim, or build the service with `WithDirectManagerAdds` for administrator tooling"
        },
        {
          "description": "Managers in roles registered with `WithRoles` can no longer issue login tokens; issue them as a guardian or educator"
        },
        {
          "description": "To let a relying party manage managed principals, enable `managed_principals` for the deployment and its client and add `systemforge:managed_principals` to the client's scopes"
        }
      ]
    },
    {
      "version": "v0.16.0",
      "date": "2026-10-14",
      "highlights": [
        {
          "description": "Connections can be reconnected in place, track what depends on them with bindings, and be shared with a principal through per-connection role grants",
          "commit": "5a4bf33"
        },
        {
          "description": "The connection library is renamed from connectionforge to connectforge; imports, tables (`connectforge_*`) and the key purpose (`connectforge.credential`) change, which is breaking for deployments that enabled connections in v0.15.0",
          "commit": "7eb410b"
        }
      ],
      "added": [
        {
          "description": "`POST .../connections/{id}/reconnect`, `GET`, `PUT` and `DELETE .../connections/{id}/bindings`, and `GET`, `PUT` and `DELETE .../connections/{id}/grants/{principal}`",
          "commit": "5a4bf33"
        },
        {
          "description": "`systemauthsvc` registers the `systemforge_connection` resource type so connection grants are role grants read by the role-based provider",
          "commit": "8f501c3"
        }
      ],
      "changed": [
        {
          "description": "Depend on connectforge instead of connectionforge; tables are now `connectforge_*` and credentials are sealed under the `connectforge.credential` purpose",
          "commit": "7eb410b",
          "breaking": true
        }
      ],
      "documentation": [
        {
          "description": "Connections guide covers reconnecting, bindings and grants; ADR-017 updated for the rename and the grant vocabulary",
          "commit": "0a5c80b"
        }
      ],
      "dependencies": [
        {
          "description": "Depend on connectforge v0.3.0",
          "commit": "787bb8a"
        }
      ],
      "tests": [
        {
          "description": "Cover reconnect, bindings and grants over the API",
          "commit": "26d6b64"
        }
      ],
      "upgradeGuide": [
        {
          "description": "Update imports from connectionforge to connectforge"
        },
        {
          "description": "Deployments that enabled connections in v0.15.0 must re-create connections or rename the tables and re-seal credentials; migrate does not copy rows or re-seal"
        },
        {
          "description": "Run `systemauth migrate` to create the `connectforge_*` tables"
        }
      ]
    },
    {
      "version": "v0.15.0",
      "date": "2026-10-13",
      "highlights": [
        {
          "description": "Key management: `keys` wires keyforge as the platform's one key library, with envelope encryption, rotation without re-encrypting, the root key read through omnivault, and key events sent to the audit trail (ADR-013)",
          "commit": "1f3095e"
        },
        {
          "description": "Connections to external services: `connections` composes connectionforge so organizations connect accounts at services such as a CDN or analytics product, with credentials sealed under managed keys and applications receiving an authenticated HTTP client, never the secret (ADR-017)",
          "commit": "5975b1e"
        },
        {
          "description": "A connections API at `/api/v1/organizations/{org}/connections`, enabled by the new `connections` configuration section and protected by `systemforge:connections:read` and `:write` scopes",
          "commit": "dfcd4ed"
        },
        {
          "description": "Invite-only sign-up: a gate on social login that admits only verified emails holding an invite, a consent-recording waitlist for everyone else, and `systemauth invite` and `systemauth waitlist` commands",
          "commit": "3471a81"
        },
        {
          "description": "App catalog: a host publishes the applications it runs, and the browser session lists it so each shell can show the products a person holds a role in, for a product switcher",
          "commit": "31cc7a9",
          "rmis": [
            "RMI-SYSTEMFORGE-169"
          ]
        },
        {
          "description": "Embedded SystemAuth emits the `orgs` claim with per-application roles, limited to the deployment's default entitlements",
          "commit": "cffe439"
        },
        {
          "description": "Fixed `rls.Helper.SetTenant` and `SetUser`, which failed on every PostgreSQL connection because `SET LOCAL` does not accept bind parameters",
          "commit": "6149cc1"
        },
        {
          "description": "No breaking changes; run `systemauth migrate` for the new tables"
        }
      ],
      "added": [
        {
          "description": "`keys` package: `Open`, `Seal` and `Open` over keyforge's single-host setup, with `VaultSource` reading the root key from an omnivault vault, and an audit sink that records lifecycle events without key material",
          "commit": "1f3095e"
        },
        {
          "description": "`connections` package: connectionforge's SQL store on the platform database with row-level security keyed on `owner_id`, credentials sealed by `keys`, deployment secrets read from omnivault, authorization through `authz`, and audit events to the platform trail",
          "commit": "5975b1e"
        },
        {
          "description": "`connections.RolePermissions` grants organization owners and admins view, use and manage on connections, and members view",
          "commit": "dfcd4ed"
        },
        {
          "description": "`connections.Handler`: the organization-scoped connections HTTP API (providers, list, connect, get, rename, test, disconnect) that never returns a credential and reports a refused view as not found",
          "commit": "dfcd4ed"
        },
        {
          "description": "`connections.MigrateSchema` creates the connection tables and enables row-level security without opening the keys, so `systemauth migrate` needs no root key",
          "commit": "dfcd4ed"
        },
        {
          "description": "`systemauth.Server.BearerPrincipal` and `WriteBearerError` authenticate API requests by bearer access token and scope with RFC 6750 responses",
          "commit": "ccc1d03"
        },
        {
          "description": "`connections` section of the SystemAuth configuration (`keys_dir`, `vault`, `root_key`, `allow_private_egress`), the `systemauthsvc.Options.Providers` registry, `Service.Connections` and `Service.RunJobs`",
          "commit": "7b51e06"
        },
        {
          "description": "`systemauth serve` runs the key lifecycle jobs while serving",
          "commit": "dfb3597"
        },
        {
          "description": "`systemauth invite add|list|revoke` and the `--invite-only` and `--signup-denied-url` flags, with `SignupInvite` (`sf_signup_invites`), the `signupgate` store and gate, and `systemauth.SignupGate` on social login",
          "commit": "3471a81",
          "rmis": [
            "RMI-SYSTEMFORGE-158"
          ]
        },
        {
          "description": "For host binaries: `systemauthsvc.Options.InviteOnly`, `SignupDeniedURL` and `WaitlistPage`, `Service.SignupInvites` and `Service.SignupWaitlist`, and the `signupgate/signupcmd` package with the `invite` and `waitlist` command groups to mount in a host's own CLI",
          "commit": "dc2af08",
          "rmis": [
            "RMI-SYSTEMFORGE-158",
            "RMI-SYSTEMFORGE-159"
          ]
        },
        {
          "description": "Sign-up waitlist: `/signup/waitlist` records an address with the consent text shown and its version, with `SignupWaitlistEntry` (`sf_signup_waitlist`), `signupgate.Waitlist` and `systemauth waitlist list [--csv]` and `remove`",
          "commit": "72ac85b",
          "rmis": [
            "RMI-SYSTEMFORGE-159"
          ]
        },
        {
          "description": "`appcatalog` package: `App` and an ordered, validated `Catalog`, with `Static` and `Remote` sources, the last cached and kept through an outage",
          "commit": "538133c",
          "rmis": [
            "RMI-SYSTEMFORGE-169"
          ]
        },
        {
          "description": "`systemauth.WithAppCatalog` serves the catalog at `/.well-known/sf-apps`; `relyingparty.BFFConfig.Apps` adds the catalog to `/bff/session` as `apps`, which a shell filters by the membership's `applications`; `systemauthsvc.Options.Apps` publishes a host's catalog and warns about entries with no registered vocabulary",
          "commit": "31cc7a9",
          "rmis": [
            "RMI-SYSTEMFORGE-169"
          ]
        },
        {
          "description": "`systemauthsvc.Options.Vocabularies` and `DefaultEntitlements` install an Ent-backed `orgs` claim source with application roles from `approle`",
          "commit": "cffe439",
          "rmis": [
            "RMI-SYSTEMFORGE-157"
          ]
        }
      ],
      "fixed": [
        {
          "description": "`rls.Helper.SetTenant` and `SetUser` use `set_config(name, value, true)`, which has the transaction scope of `SET LOCAL` and takes the value as a parameter; the previous `SET LOCAL ... = $1` was a PostgreSQL syntax error",
          "commit": "6149cc1"
        }
      ],
      "documentation": [
        {
          "description": "Guides for connections to external services and for key management, and sections for them in the deployment guide and README",
          "commit": "ee8b6d7"
        },
        {
          "description": "Deployment guide sections for invite-only sign-up with the waitlist, and for the app catalog",
          "commit": "2190863"
        },
        {
          "description": "ADR-017 on external connections, ADR-016 on no static API keys and ADR-015 on identifier policy, slug namespaces and portability",
          "commit": "cac014f"
        },
        {
          "description": "ADR-013 makes keyforge the platform's key library, with the key subsystem, rotation policy, hybrid encryption, FIPS 140-3 and post-quantum positions, rotation and recovery drills, and the crypto specification; ADR-011 and ADR-012 add purge, provisional accounts, dormancy and offload",
          "commit": "5460d4f"
        }
      ],
      "dependencies": [
        {
          "description": "Depend on keyforge v0.1.0, omnivault v0.5.0 and connectionforge v0.1.0",
          "commit": "0afbf7b"
        },
        {
          "description": "Update dependencies, including go-chi/chi/v5 v5.4.0, grokify/guardsql v0.3.0, omnistorage-core v0.5.2 and golang.org/x/crypto v0.58.0; `yaronf/httpsign` stays at v0.5.2 because v0.6 removed `NewJWSSignerV3`, which aauth-go v0.2.0 uses",
          "commit": "2ee29cc"
        }
      ],
      "tests": [
        {
          "description": "`rls` is checked against a real PostgreSQL server, and the connections store is checked as an ordinary database role, which row-level security applies to",
          "commit": "77b8d12"
        },
        {
          "description": "The connections API is exercised end to end against a fake provider, including that no response carries a token",
          "commit": "b9bb2db"
        }
      ],
      "upgradeGuide": [
        {
          "description": "Run `systemauth migrate` (or `systemauthsvc.Service.Migrate`) to create `sf_signup_invites` and `sf_signup_waitlist`. Existing tables are unchanged and no SQL migration file is needed"
        },
        {
          "description": "To enable connections, add the `connections` section, create the root key (`openssl rand -base64 32`) and store it in the vault, and back up `keys_dir` with the database. `systemauth migrate` then creates the `connectionforge_*` tables and enables row-level security on PostgreSQL"
        }
      ]
    },
    {
      "version": "v0.14.0",
      "date": "2026-10-11",
      "highlights": [
        {
          "description": "Managed principals: humans without an email, such as young learners, created and controlled by guardian and educator managers, who sign them in with QR-friendly login tokens; opt-in per deployment and per client (ADR-005)"
        },
        {
          "description": "Principal is the sole identity root: the legacy User model and its dependent tables are removed, so password login, social login, federation sync, and SCIM all resolve a person to the same principal (ADR-004)"
        },
        {
          "description": "Resource servers can authenticate AI agents with AAuth through a protocol-neutral request principal and authenticator chain shared with bearer, API-key, and BFF-session credentials"
        },
        {
          "description": "Fixed a panic on every ascending SCIM list sort, including the default order"
        },
        {
          "description": "Security: the marketplace, organization, and invite APIs act for the authenticated caller and check organization permissions, instead of trusting IDs in the request; invite tokens are stored hashed"
        },
        {
          "description": "The simple and SpiceDB authorization providers grant the same organization and manager permissions, held to the base schema by a parity test and a shared conformance suite"
        },
        {
          "description": "Organizations without a plan: a first social login creates the person's personal organization, slugs are reserved, renamed with a cooling-off period and aliases, a personal organization converts to a team, and what an organization may use comes from its marketplace subscriptions and licenses (ADR-006)"
        },
        {
          "description": "Application roles per member, entitled through the marketplace, carried in the `orgs` claim and on invites, with relying parties reading memberships from claims by default (ADR-007)"
        },
        {
          "description": "Real-time invalidation of access: access tokens default to 10 minutes and are capped at 15, every access-reducing change is recorded, and relying parties refuse tokens issued before it, with polling, replay and back-channel delivery (ADR-010)"
        },
        {
          "description": "Resource-scoped collaborators: the `collaborator` organization role, resource grants with a standard viewer, contributor and maintainer ladder in both authorization modes, and invites that target one resource (ADR-008)"
        },
        {
          "description": "The authorization mode is configuration: the `authz` key selects `rbac` or `rebac`, and `authz/mode.New` builds the provider, syncer and grant store (ADR-008)"
        },
        {
          "description": "Management is derived from manager relationships; a manager can release a principal, a self-managed human can be invited to be managed or decline, and managing operations are authorized and served over HTTP (ADR-009)"
        },
        {
          "description": "Editor and viewer are no longer organization roles, and the organization `plan` column is removed; run migrations 0004 to 0009 on existing PostgreSQL databases"
        }
      ],
      "security": [
        {
          "description": "Marketplace checkout took the purchaser from the request body, so anyone could start a purchase in another principal's name for any organization",
          "commit": "7cf758e"
        },
        {
          "description": "Marketplace listing, license, and seat endpoints acted on any IDs a request named; they now check the caller's permissions on the owning organization",
          "commit": "bbac538"
        },
        {
          "description": "The organization API listed every organization and let any caller read, change, or delete organizations, change members, and transfer ownership; it now authorizes each operation",
          "commit": "08bd206"
        },
        {
          "description": "Invite management needed no permission, and anyone holding an invite link could accept it as any principal; invites are now managed with invite_member and accepted only by the addressee",
          "commit": "236c0e9"
        },
        {
          "description": "Invite tokens were stored in plain text, so a leaked table or backup could accept invites; they are stored as SHA-256 hashes",
          "commit": "7ccc80e"
        },
        {
          "description": "SpiceDB principal and organization cleanup ignored failures and missed editor and manager relations, leaving access behind while reporting success",
          "commit": "22f7b28"
        },
        {
          "description": "Refresh-token rotation was not atomic and its revocation error was discarded, so a refresh token could be used more than once; refreshing near expiry also reset a session to seven days, extending it indefinitely. Rotation is now atomic, a family keeps its first expiry, and reusing a rotated refresh token revokes the family",
          "commit": "2a3c8cd"
        },
        {
          "description": "Stripe checkout granted licenses for sessions completed with an unpaid delayed payment, a malformed seat count produced an unlimited seat-based license, and cancelled subscriptions kept their licenses",
          "commit": "fa2a57d"
        },
        {
          "description": "Deactivating a principal left its access tokens valid and let its refresh tokens keep issuing new ones for up to the family's absolute lifetime; SystemAuth and identity/token now refuse an inactive principal's tokens wherever they are used or refreshed, and revoke the family",
          "commit": "ebe913d"
        },
        {
          "description": "Revoking an agent's delegation gave it unrestricted access, constraints that did not overlap allowed everything, and delegation expiry and action limits were never stored; delegation now fails closed and enforces every constraint",
          "commit": "284806d"
        },
        {
          "description": "UpdateHuman granted or revoked platform administration without syncing it, so a revoked administrator stayed one in SpiceDB",
          "commit": "5e002b3"
        },
        {
          "description": "SignupWithInvite let anyone holding an invite link join under any email, and SignupOrGetExisting returned an existing account for an unverified email",
          "commit": "e6d07df"
        },
        {
          "description": "SystemAuth's default session provider and identity/oauth's authorization endpoint took the user from an X-User-ID request header, so anyone who could reach the endpoint could obtain an authorization code, and tokens, for any user; header identity is now an explicit, gated opt-in and the default authenticates nobody",
          "commit": "645c151"
        },
        {
          "description": "identity/oauth granted every requested scope to every client without consent; non-first-party clients now need a consent check",
          "commit": "ef7ea3d"
        },
        {
          "description": "SCIM listing and search never asked the authorization hook, so any caller with a token could dump every user and group, and the provider's default hook allowed everything; listings are authorized and the default denies",
          "commit": "0e3dd33"
        },
        {
          "description": "The federation identity sync endpoint trusted any well-formed request and acted on its body, letting an unauthenticated caller link to and then deactivate or rewrite any account by email; it and the lookup endpoint now require a FederationAuthenticator and are not registered without one",
          "commit": "d57bf0f"
        },
        {
          "description": "Rate limits keyed on client-supplied X-Forwarded-For and X-Real-IP, so a client could evade a limit by rotating the header or poison a victim's; they key on the direct peer, and forwarded headers are believed only from configured trusted proxies, here and in the BFF client IP handling and the API key middleware",
          "commit": "3019061"
        },
        {
          "description": "The in-memory rate-limit store grew without bound from attacker-chosen keys, the middleware failed open on storage errors, and the login token endpoint keyed on raw client_id values; the store is bounded, the middleware fails closed, and only registered clients get a bucket",
          "commit": "3019061"
        },
        {
          "description": "Token introspection accepted any valid access token or any client's Basic credentials, public clients included, as the caller's credential; it now requires a confidential client or a token with the introspect scope",
          "commit": "5e6dba0"
        },
        {
          "description": "The default storage accepted every client-assertion JWT ID as new, so a captured private_key_jwt assertion could be replayed until it expired",
          "commit": "2ae4f56"
        },
        {
          "description": "BFF cookies lost Secure and HttpOnly when a CookieConfig omitted them; both are now unconditional unless AllowInsecure is set for development",
          "commit": "d1d897c"
        },
        {
          "description": "Cookie-authenticated writes through relyingparty.BearerMiddleware skipped the same-origin check, allowing cross-site requests",
          "commit": "ebf1095"
        },
        {
          "description": "JWT validation accepted tokens with no expiry and ignored the issuer; the contract middleware did the same and skipped the audience check without an app ID",
          "commit": "7061c67"
        },
        {
          "description": "Client secret validation revealed whether a client ID existed by error message and timing, and lockout counted differently spelled identifiers separately, restarting the count",
          "commit": "30bd958"
        },
        {
          "description": "multiapp's SchemaDB left a schema's search_path on pooled connections, which could carry one application's schema to unrelated code, and ForSchema interpolated unvalidated names into SQL",
          "commit": "012e2db"
        },
        {
          "description": "The BFF proxy forwarded the browser's session cookie upstream when a ProxyConfig was built by hand; Cookie, Authorization, and DPoP headers are now always stripped",
          "commit": "3c54fc2"
        },
        {
          "description": "multiapp trusted the X-App-ID header, so with a shared signing key a token for one app authenticated requests for another; MiddlewareConfig.AppAudiences binds tokens to the routed app",
          "commit": "73e0d19"
        },
        {
          "description": "API keys could be read, revoked, or deleted by ID alone, requested any scope including the wildcard when no allow-list was set, and ignored MaxKeysPerUser",
          "commit": "0a3cf11"
        },
        {
          "description": "Lockout let a burst of parallel guesses exceed MaxAttempts; Lockout.Begin reserves the attempt before the credential is verified",
          "commit": "43c3818"
        },
        {
          "description": "Concurrent BFF refreshes spent one refresh token several times, which token reuse detection treats as theft; refresh is now serialized per session",
          "commit": "a77d8df"
        }
      ],
      "breaking": [
        {
          "description": "Removed Ent schemas and packages user, membership, oauthaccount, refreshtoken, apikey, serviceaccount, and serviceaccountkeypair, with the Organization memberships, api_keys, and service_accounts edges and OAuthToken.service_account_id",
          "commit": "05d78ae"
        },
        {
          "description": "systemauth.Storage user methods are replaced by CreateHuman, GetHuman, GetHumanByEmail, GetHumanByExternalIdentity, LinkExternalIdentity, UpdateHuman, and DeleteHuman on one HumanPrincipal type; systemauth.User, LoginPrincipal, ErrUserNotFound, and ErrUserExists are removed in favor of HumanPrincipal, ErrPrincipalNotFound, and ErrPrincipalExists",
          "commit": "d054dc7"
        },
        {
          "description": "OAuthApp.owner references Principal; statically configured clients are owned by a service principal at the fixed system ID instead of a synthetic user",
          "commit": "12f2494"
        },
        {
          "description": "OAuth tokens and authorization codes drop user_id and the user edge in favor of the subject column; OAuthConsent.user_id becomes principal_id",
          "commit": "16f7f9f"
        },
        {
          "description": "SCIM users are human principals and group membership uses PrincipalMembership; users provisioned before this release are not visible through SCIM",
          "commit": "6a12bae"
        },
        {
          "description": "An existing PostgreSQL development database must run migrations/0002_drop_legacy_user_tables.sql before starting this version; fresh databases need no migration",
          "commit": "97282d7"
        },
        {
          "description": "The default BFF session cookie is sf_session instead of the Core-era cf_session; browsers holding the old cookie sign in again. Applications that set CookieConfig.Name are unaffected",
          "commit": "94868b5"
        },
        {
          "description": "organization.Service ListMembers and ListMemberships exclude inactive memberships unless IncludeInactive is passed, and take variadic ListOption arguments",
          "commit": "3f80884"
        },
        {
          "description": "mixin.UserBase and mixin.MembershipBase are removed",
          "commit": "8c95e08"
        },
        {
          "description": "Human.email is optional: a human without one is a managed principal with the identifier human:<id>. HumanPrincipal.Email, principal.Human.Email, and contract identity types treat it as optional; existing creation paths still require an email",
          "commit": "e89af69"
        },
        {
          "description": "Marketplace checkout buys as the authenticated caller for an organization the caller may buy for, and answers 501 until marketplace.WithPurchaseAuthorizer or WithAuthorizer is configured; purchaser_id is optional, deprecated, and must equal the caller",
          "commit": "7cf758e"
        },
        {
          "description": "Marketplace listing and license operations answer 501 until marketplace.WithAuthorizer is configured and require an authenticated caller; only published listings are readable anonymously; owner_id and assigned_by are optional, deprecated, and must equal the caller",
          "commit": "bbac538"
        },
        {
          "description": "Organization API endpoints require an authenticated caller and, except creating an organization and checking a slug, answer 501 until APIConfig.Authorizer is set",
          "commit": "08bd206"
        },
        {
          "description": "Invite API endpoints require an authenticated caller and organization endpoints answer 501 until APIConfig.Authorizer is set; accepting and declining require the invite to be addressed to the caller's email; inviter_principal_id, principal_id, and the email query are optional, deprecated, and must match the caller",
          "commit": "236c0e9"
        },
        {
          "description": "Invite tokens are stored hashed and invite.Invite no longer has a Token field; the token is only in InviteResult.InviteURL. Existing PostgreSQL databases run migrations/0003_hash_invite_tokens.sql when deploying",
          "commit": "7ccc80e"
        },
        {
          "description": "spicedb.BaseSchema is now authz.BaseSpiceDBSchema: members hold contribute rather than edit on an organization, and editors are recognized",
          "commit": "8762bc6"
        },
        {
          "description": "authz.RelationshipSyncer gains AddPrincipalManager and RemovePrincipalManager; credential.Service gains IssueLoginToken and VerifyLoginToken; managedprincipal.Gate implementers also provide LoginTokenPolicy",
          "commit": "8acce83"
        },
        {
          "description": "identity/token reports typed errors (ErrInvalidAccessToken, ErrInvalidRefreshToken, ErrRefreshTokenReused, ErrDPoPMismatch, ErrScopeNotGranted)",
          "commit": "2a3c8cd"
        },
        {
          "description": "marketplace.LicenseService gains GetByStripeSubscriptionID; Stripe webhook endpoints should also subscribe to checkout.session.async_payment_succeeded",
          "commit": "fa2a57d"
        },
        {
          "description": "delegation errors are typed and an agent without a delegation is denied; signup's SignupOrGetExisting requires SignupInput.EmailVerified to return an existing account, and SignupWithInvite requires the invited email",
          "commit": "284806d"
        },
        {
          "description": "systemauth.WithUserIDHeader is removed; use WithTrustedUserIDHeader with a RequestGate (TrustedProxyNetworks or TrustAllRequests), social login, or your own SessionProvider. DefaultSessionProvider authenticates nobody by default",
          "commit": "645c151"
        },
        {
          "description": "identity/oauth's authorization endpoint refuses requests until WithUserAuthenticator or WithTrustedUserIDHeader is set, and third-party clients are refused until WithConsent is set",
          "commit": "ef7ea3d"
        },
        {
          "description": "session/ratelimit: IPKey and the Limiter default no longer read X-Forwarded-For or X-Real-IP (use ForwardedIPKey or ForwardedClientIP behind proxies), the middleware answers 503 on storage errors unless WithFailOpen is given, and MemoryStorage returns ErrTooManyKeys when full",
          "commit": "3019061"
        },
        {
          "description": "session/bff: TrustProxy and TrustCloudflare do nothing without TrustedProxies or CloudflareIPRanges; session/middleware no longer reads forwarding headers for API key usage addresses unless an IPExtractor is given",
          "commit": "a253f24"
        },
        {
          "description": "scim: a provider without WithAuthorizationHook answers 403 to every request; DefaultAuthorizationHook is deprecated for AllowAllAuthorizationHook",
          "commit": "0e3dd33"
        },
        {
          "description": "systemauth: NewFederationEndpoints registers the sync and lookup routes only with WithFederationAuthenticator; introspection callers need a confidential client or the introspect scope",
          "commit": "d57bf0f"
        },
        {
          "description": "session/jwt and contract: tokens without exp are refused, and jwt refuses another issuer when Config.Issuer is set; relyingparty.BearerMiddleware requires an allowed Origin and JSON body for cookie-authenticated POST, PUT, and DELETE",
          "commit": "7061c67"
        },
        {
          "description": "credential.ValidateClientSecret returns ErrInvalidClientCredentials for every rejection; multiapp.AppAwareDB.ForSchema returns an error",
          "commit": "30bd958"
        },
        {
          "description": "identity/apikey: Get, Revoke, and Delete take the owning principal and report other keys as not found; a service with no AllowedScopes grants no scopes unless AllowAnyScope is set; RevokeInOrganization added for organization administrators",
          "commit": "0a3cf11"
        },
        {
          "description": "rls: Helper.SetTenant and SetUser return ErrNotInTransaction for *sql.DB and *sql.Conn; Middleware.SetRLSContext no longer touches the database and Middleware.WithTx scopes a transaction",
          "commit": "ba68c75"
        },
        {
          "description": "The organization `plan` column and `organization.Plan` constants are removed from the schema, service inputs, list filter, API and SCIM group provisioning; organization responses carry an `entitlements` list instead. Existing PostgreSQL databases run migrations/0004_drop_organization_plan.sql",
          "commit": "5172a12",
          "rmis": [
            "RMI-SYSTEMFORGE-129"
          ]
        },
        {
          "description": "`editor` and `viewer` are no longer organization roles: the roles are owner, admin, member and collaborator, every membership path refuses any other value, and the base schema gains the `collaborator` relation and `list` permission. migrations/0008_drop_editor_viewer_roles.sql maps stored `editor` to `member` and `viewer` to `collaborator`, including pending invites",
          "commit": "18b3a32",
          "rmis": [
            "RMI-SYSTEMFORGE-139"
          ]
        },
        {
          "description": "Every path that creates or changes a membership validates the role against owner, admin, member and collaborator and answers ErrInvalidRole otherwise",
          "commit": "24edc0b",
          "rmis": [
            "RMI-SYSTEMFORGE-139"
          ]
        },
        {
          "description": "The marketplace SpiceDB fragment no longer redefines `principal` and `organization`; it attaches to the base organization through a `marketplace_org` facet carrying use, billing and purchase. Compose it with MergeSchema, which places the base schema first",
          "commit": "3774596",
          "rmis": [
            "RMI-SYSTEMFORGE-139"
          ]
        },
        {
          "description": "Entitlement checks fail closed: an approle service with no entitlement source entitles no organization to any application. Configure marketplace.EntitlementSource through marketplace.ApproleOptions, or use approle.EntitleAll in development and tests",
          "commit": "2d11968",
          "rmis": [
            "RMI-SYSTEMFORGE-131"
          ]
        },
        {
          "description": "Relying parties read memberships from SystemAuth claims by default (ClaimsMemberships); LocalMemberships is no longer picked up implicitly from the principal store and is for development and tests only",
          "commit": "5cd6dd9",
          "rmis": [
            "RMI-SYSTEMFORGE-133"
          ]
        },
        {
          "description": "The default access token lifetime drops from 15 to 10 minutes, and a configured lifetime above 15 minutes is refused at load; per-client lifetimes are capped at 15 minutes",
          "commit": "d20202b",
          "rmis": [
            "RMI-SYSTEMFORGE-135"
          ]
        }
      ],
      "upgradeGuide": [
        {
          "description": "Run the migrations against an existing PostgreSQL database, in order: 0004_drop_organization_plan, 0005_subscriptions_per_listing, 0006_invite_app_roles, 0007_oauth_app_backchannel_logout_uri, 0008_drop_editor_viewer_roles and 0009_invite_resource_target. Each is idempotent. Fresh databases need none of them. Then run `systemauth migrate` for the new tables sf_app_roles, sf_slug_reservations, sf_access_changes, sf_resource_grants and sf_manager_invites"
        },
        {
          "description": "Replace uses of the organization plan with entitlements: remove `Plan` from organization inputs and filters, and read `entitlements` from organization responses. Supply APIConfig.Entitlements with marketplace.EntitlementSource; carry a paid tier over as a subscription or license"
        },
        {
          "description": "Replace `editor` and `viewer` in your own role tables, vocabularies and invites with `member` and `collaborator` (or resource roles); stored memberships are mapped by migration 0008, which records an access change for each active membership it changes"
        },
        {
          "description": "Configure entitlements for application roles: build the approle service with marketplace.ApproleOptions(marketplace.EntitlementSource(...)), and declare applications free to everyone with marketplace.WithDefaultEntitlements. Without them no organization is entitled to anything, and marketplace.WarnIfNoEntitlements logs a startup warning"
        },
        {
          "description": "Relying parties that depended on LocalMemberships must pass it explicitly. The default reads the `orgs` claim; use ClaimsOrRemoteMemberships to fall back to /oauth/userinfo/memberships when the claim is truncated or absent"
        },
        {
          "description": "Pass a revocation cache to BearerMiddleware and NewBFF to refuse tokens issued before an access change; feed it with accesschange.ToSink in one process, the poller across replicas, or back-channel delivery across deployments. Review any configured access_token_lifetime against the 15 minute cap"
        },
        {
          "description": "Build the authorization provider from configuration with `authz/mode.New(ctx, cfg.Authz, mode.Deps{...})` and pass its Syncer to the identity services. The `authz` key defaults to `rbac`. The `authz/simple` and `authz/spicedb` forwarding packages remain deprecated and will be removed in the next major release; import `authz/rbac` and `authz/rebac/spicedb`"
        },
        {
          "description": "When switching to `rebac`, write existing memberships, application roles and resource grants into the graph through the syncer before serving requests, and write the composed schema (embedded instances always receive it; remote ones only with `write_schema`)"
        }
      ],
      "added": [
        {
          "description": "identity/requestprincipal: a protocol-neutral RequestPrincipal, an Authenticator interface, and middleware that tries authenticators in order and challenges with every protocol when none recognizes the request",
          "commit": "780ef1a"
        },
        {
          "description": "relyingparty.NewRequestAuthenticator adapts bearer authentication (SystemAuth access tokens, API keys, BFF sessions) to the request authenticator chain",
          "commit": "d86c3f0"
        },
        {
          "description": "identity/requestprincipal/aauthrs authenticates AI agents at resource servers with AAuth: message-signature and token verification, an issuer allowlist checked before key discovery, per-route scopes, and AAuth-Requirement challenges",
          "commit": "afd69bb"
        },
        {
          "description": "migrations/0002 creates the system service principal, reassigns OAuth apps owned by legacy users, and drops the legacy tables and columns on existing PostgreSQL databases",
          "commit": "97282d7"
        },
        {
          "description": "A repository-wide test fails on references to the retired legacy identity model in code or current documentation",
          "commit": "2b45328"
        },
        {
          "description": "identity/clientassertion records used client-assertion JWT IDs in sf_client_assertion_jtis for replay protection",
          "commit": "bd8af95"
        },
        {
          "description": "store.Config.TrustProvisionedEmail, off by default, marks emails written through SCIM as verified so social login can link to provisioned users",
          "commit": "ce3ea97"
        },
        {
          "description": "identity/pgschema applies PostgreSQL-only schema objects; the migrate step adds a unique index on lower(email) in sf_humans",
          "commit": "03c314a"
        },
        {
          "description": "The members endpoint accepts includeInactive to list deactivated memberships",
          "commit": "3f80884"
        },
        {
          "description": "identity/managedprincipal creates managed principals with their managers in one transaction, maintains manager relationships with a last-manager guard, and audits every action",
          "commit": "7f4fda8"
        },
        {
          "description": "ManagerRelationship (sf_manager_relationships) and ManagerClaim (sf_manager_claims) Ent schemas",
          "commit": "93a7ecf"
        },
        {
          "description": "Deployment managed_principals settings and the per-client managed_principals flag, both off by default, checked through Server.ManagedPrincipalsAllowed",
          "commit": "12373d7"
        },
        {
          "description": "login_token credentials: issued by a manager, hashed, verified in constant time, single-use option, with lifetimes from the request, the client's login_token_ttl, or the deployment default (30 days) under a ceiling (400 days); single-use tokens last 20 minutes",
          "commit": "1f1c11b"
        },
        {
          "description": "POST /login-token exchanges a login token for a SystemAuth login session, with identical responses for every failure and per-address and per-client rate limits (WithLoginTokenRateLimit)",
          "commit": "f839fd4"
        },
        {
          "description": "ID token and userinfo claim managed: true for managed principals, and relying parties read it into VerifiedIdentity.Managed",
          "commit": "f839fd4"
        },
        {
          "description": "Managers list and revoke a managed principal's login tokens, login sessions, and token families, individually or all at once, through managedprincipal.Service or NewHandler",
          "commit": "4acc46a"
        },
        {
          "description": "Guardian claims: a manager issues a single-use code that makes a human with an email a guardian; AttachVerifiedEmail turns a managed principal into an ordinary human",
          "commit": "faf4bc3"
        },
        {
          "description": "Base schema relations guardian and educator on principal with manage_account, manage_credentials, view_profile, and manage_managers; authz.ManagerRolePermissions and simple.WithManagerRoleGetter",
          "commit": "8acce83"
        },
        {
          "description": "authz.OrgRolePermissions and the PermOrg* actions name the base organization permissions both providers evaluate",
          "commit": "fdfe9eb"
        },
        {
          "description": "providertest.RunOrgPermissionTests and RunManagerRelationTests hold providers to the base schema's grants",
          "commit": "e4279a8"
        },
        {
          "description": "marketplace.PurchaserChecker and stripe.WithPurchaserChecker refuse checkout to managed principals",
          "commit": "3abd5fb"
        },
        {
          "description": "marketplace.WithAuthorizer, WithPurchaseAuthorizer, OrgRolePurchaseAuthorizer, and WithCallerResolver configure how the marketplace API authorizes callers",
          "commit": "7cf758e"
        },
        {
          "description": "organization.MembershipRoleGetter backs the simple provider with active memberships; APIConfig.Authorizer and Caller configure the organization and invite APIs",
          "commit": "08bd206"
        },
        {
          "description": "requestprincipal.PrincipalUUID resolves the caller's SystemForge principal ID",
          "commit": "57c531b"
        },
        {
          "description": "spicedb.Client.DeleteRelationships deletes relationships by filter",
          "commit": "22f7b28"
        },
        {
          "description": "migrations/0003 converts stored invite tokens to hashes",
          "commit": "7ccc80e"
        },
        {
          "description": "CI runs the PostgreSQL tests against a database service and the SpiceDB provider tests with the integration tag; SF_TEST_PG_REQUIRED makes a missing database fail rather than skip",
          "commit": "a5af409"
        },
        {
          "description": "systemauth.PrincipalStatus lets storage report whether a token's principal is active; Ent and memory storage implement it",
          "commit": "ebe913d"
        },
        {
          "description": "Agents store allowed actions, allowed scopes, and a delegation expiry",
          "commit": "404b72c"
        },
        {
          "description": "systemauth.RequestGate, TrustAllRequests, and TrustedProxyNetworks; oauth.WithUserAuthenticator, WithTrustedUserIDHeader, WithLoginURL, and WithConsent",
          "commit": "ef7ea3d"
        },
        {
          "description": "jwt.ValidateAccessTokenForAudience and middleware.HTTPAuthForAudience; ratelimit.PeerIP, ForwardedClientIP, ForwardedIPKey, WithMaxKeys, WithFailOpen; systemauth.WithLoginTokenClientIP, FederationAuthenticator, SharedSecretAuthenticator, and AuthorizeIntrospectionCaller; scim.DenyAllAuthorizationHook",
          "commit": "3019061"
        },
        {
          "description": "session/jwt: TokenOptions.Audience addresses one token to its own audience",
          "commit": "9b46bda"
        },
        {
          "description": "multiapp: MiddlewareConfig.AppAudiences binds tokens to the app a request is routed to",
          "commit": "73e0d19"
        },
        {
          "description": "identity/security: Lockout.Begin and Attempt reserve a login attempt before verification",
          "commit": "43c3818"
        },
        {
          "description": "A first GitHub or Google login creates the person's personal organization and owner membership in the same transaction as the principal, and an existing principal without one gets it on its next login; the slug is the GitHub username or the email local part, with a numeric suffix on collision (ADR-006). signup.SlugForLogin, signup.CreatePersonalOrgInTx and signup.EnsurePersonalOrgInTx expose the derivation and the in-transaction creation",
          "commit": "1d6f996",
          "rmis": [
            "RMI-SYSTEMFORGE-124"
          ]
        },
        {
          "description": "Reserved slugs: organization.ReservedSlugs lists names no organization may take, WithReservedSlugs adds product names, and signup avoids them; a managed principal's slug is a manager-entered value or a generated adjective-noun-NN, never its email (signup.SlugForManaged)",
          "commit": "6c456ab",
          "rmis": [
            "RMI-SYSTEMFORGE-125"
          ]
        },
        {
          "description": "Personal organization rules: a personal organization has one member, its owner, and refuses members, invitations, SCIM membership and ownership transfer with ErrPersonalOrganization unless the role is collaborator",
          "commit": "8988ccf",
          "rmis": [
            "RMI-SYSTEMFORGE-127"
          ]
        },
        {
          "description": "Slug rename with a cooling-off period (default 7 days, WithSlugCoolingOff), reservations in sf_slug_reservations, and aliases through ResolveSlug so old links keep working",
          "commit": "f8c679a",
          "rmis": [
            "RMI-SYSTEMFORGE-126"
          ]
        },
        {
          "description": "organization.ConvertToTeam turns a personal organization into a team in one transaction and creates a new personal organization under the handle",
          "commit": "1569de1",
          "rmis": [
            "RMI-SYSTEMFORGE-128"
          ]
        },
        {
          "description": "Entitlements derived from the marketplace: organization responses carry an `entitlements` list built from active subscriptions, valid licenses and default entitlements, and subscriptions may be per listing (migration 0005)",
          "commit": "c43fedf",
          "rmis": [
            "RMI-SYSTEMFORGE-129"
          ]
        },
        {
          "description": "Entitled applications: a listing may name an application, and marketplace.ApproleOptions maps subscriptions, licenses and marketplace.WithDefaultEntitlements to applications with seat limits from seat-based licenses",
          "commit": "2d11968",
          "rmis": [
            "RMI-SYSTEMFORGE-131"
          ]
        },
        {
          "description": "Application roles: the AppRole schema (sf_app_roles) and the approle service to assign, change and remove a role per principal, organization and application, with endpoints under /organizations/{slug}/members/{principal_id}/app-roles",
          "commit": "9e8d94a",
          "rmis": [
            "RMI-SYSTEMFORGE-130"
          ]
        },
        {
          "description": "Application roles reach the authorization graph through the optional authz.AppRoleSyncer",
          "commit": "b530c81",
          "rmis": [
            "RMI-SYSTEMFORGE-150"
          ]
        },
        {
          "description": "The `orgs` claim in ID tokens, access tokens and userinfo, and a paginated GET /oauth/userinfo/memberships",
          "commit": "6b52b99",
          "rmis": [
            "RMI-SYSTEMFORGE-132"
          ]
        },
        {
          "description": "relyingparty membership sources: ClaimsMemberships, RemoteMemberships, ClaimsOrRemoteMemberships and ProvisioningMemberships",
          "commit": "5cd6dd9",
          "rmis": [
            "RMI-SYSTEMFORGE-133"
          ]
        },
        {
          "description": "Invitations carry application roles to grant on acceptance, validated against entitlements and seats (migration 0006)",
          "commit": "1b178fd",
          "rmis": [
            "RMI-SYSTEMFORGE-134"
          ]
        },
        {
          "description": "sf_access_changes and the accesschange package record every access-reducing change in the transaction that makes it and announce it to a sink",
          "commit": "2c3082e",
          "rmis": [
            "RMI-SYSTEMFORGE-135"
          ]
        },
        {
          "description": "Access changes are recorded for member removal and deactivation, organization and application role changes, ownership transfer, principal deactivation and session or token revocation",
          "commit": "f92470f",
          "rmis": [
            "RMI-SYSTEMFORGE-135"
          ]
        },
        {
          "description": "relyingparty.RevocationCache, and BearerMiddleware and the BFF refuse tokens issued before an access change, after a clock-skew margin",
          "commit": "975b3a5",
          "rmis": [
            "RMI-SYSTEMFORGE-136"
          ]
        },
        {
          "description": "Access-change poller, replay after a restart, suspect-start mode and the GET /access-changes endpoint with the access_changes:read scope",
          "commit": "4c0d2ce",
          "rmis": [
            "RMI-SYSTEMFORGE-137"
          ]
        },
        {
          "description": "Back-channel delivery of access changes as OpenID Connect Back-Channel Logout tokens to clients that register backchannel_logout_uri (migration 0007), and relyingparty.BackchannelHandler to receive them",
          "commit": "986a1cf",
          "rmis": [
            "RMI-SYSTEMFORGE-138"
          ]
        },
        {
          "description": "Access-change reasons form an open, validated registry",
          "commit": "529a999",
          "rmis": [
            "RMI-SYSTEMFORGE-155"
          ]
        },
        {
          "description": "The resource-role ladder (viewer, contributor, maintainer) and the ResourceGranter contract",
          "commit": "d95eaca",
          "rmis": [
            "RMI-SYSTEMFORGE-140"
          ]
        },
        {
          "description": "Resource grants stored in sf_resource_grants and mirrored to the graph; the role-based provider consults and manages them",
          "commit": "8187a9a",
          "rmis": [
            "RMI-SYSTEMFORGE-140"
          ]
        },
        {
          "description": "The relationship-based provider writes grants as relationships and lists resources by lookup, and vocabulary fragments validate collaborator-able definitions",
          "commit": "68a498e",
          "rmis": [
            "RMI-SYSTEMFORGE-141"
          ]
        },
        {
          "description": "Resource-targeted invites: an invite can name a resource type, id and role, and accepting it creates the collaborator membership and the grant together (migration 0009)",
          "commit": "8b399cc",
          "rmis": [
            "RMI-SYSTEMFORGE-142"
          ]
        },
        {
          "description": "The `authz` configuration key with `rbac` and `rebac` modes, ModeConfig and SpiceDBConfig",
          "commit": "537714b",
          "rmis": [
            "RMI-SYSTEMFORGE-143"
          ]
        },
        {
          "description": "authz/mode.New builds the configured provider, relationship syncer and grant store from a ModeConfig, with Close",
          "commit": "dac2d76",
          "rmis": [
            "RMI-SYSTEMFORGE-143"
          ]
        },
        {
          "description": "Management is derived from active manager relationships rather than from the absence of an email; a managed identity may carry an email",
          "commit": "eea12c3",
          "rmis": [
            "RMI-SYSTEMFORGE-144"
          ]
        },
        {
          "description": "Release a principal from management, invite a self-managed human to be managed, and decline a manager invitation",
          "commit": "6471f2b",
          "rmis": [
            "RMI-SYSTEMFORGE-145"
          ]
        },
        {
          "description": "A manager invitation can be declined by the invitee",
          "commit": "f5bef03",
          "rmis": [
            "RMI-SYSTEMFORGE-156"
          ]
        },
        {
          "description": "Authorized managed-principal operations, deletion with erasure and an HTTP API for managing operations",
          "commit": "1b65fa3",
          "rmis": [
            "RMI-SYSTEMFORGE-152"
          ]
        }
      ],
      "changed": [
        {
          "description": "`authz` providers are named for their mode: role-based `authz/rbac` (formerly `authz/simple`) and relationship-based `authz/rebac/spicedb` (formerly `authz/spicedb`), so another engine can sit beside SpiceDB under the same mode",
          "commit": "f1f3c0a"
        },
        {
          "description": "Federation sync records the federation identity as an ExternalIdentity; creating an identity for an existing email links it so later updates and deletes resolve to the same principal",
          "commit": "d054dc7"
        },
        {
          "description": "Human email uniqueness is enforced case-insensitively on create and update in SystemAuth and SCIM, matching the case-insensitive lookups",
          "commit": "d054dc7"
        },
        {
          "description": "SCIM userName is not case-exact (RFC 7643): lookups, uniqueness, and eq and co filters ignore case",
          "commit": "6a12bae"
        },
        {
          "description": "SCIM memberships honor the active flag, and deleting a user who belongs to a group removes the memberships instead of failing",
          "commit": "6a12bae"
        },
        {
          "description": "Creating an organization through the API makes the caller its owner, and every organization with an owner gives it an owner membership",
          "commit": "faedc5a"
        },
        {
          "description": "Listing organizations returns the caller's organizations, or all of them for platform administrators",
          "commit": "08bd206"
        },
        {
          "description": "SCIM no longer lists, reads, changes, deletes, or groups managed principals",
          "commit": "18431bb"
        },
        {
          "description": "Signup requires a bare email address",
          "commit": "a76a721"
        },
        {
          "description": "Unused stale Argon2id secret checkers are removed from the identity packages",
          "commit": "b85abc4",
          "rmis": [
            "RMI-SYSTEMFORGE-149"
          ]
        }
      ],
      "deprecated": [
        {
          "description": "`authz/simple` and `authz/spicedb` forward to `authz/rbac` and `authz/rebac/spicedb` as deprecated packages for one release; importers should move to the new paths",
          "commit": "f1f3c0a"
        },
        {
          "description": "mixin.HumanMixin, mixin.OAuthAccountMixin, and mixin.RefreshTokenMixin: applications should authenticate through SystemAuth and link local records by sf_principal_id",
          "commit": "80dcf1b"
        },
        {
          "description": "spicedb.BaseSchema: use authz.BaseSpiceDBSchema",
          "commit": "8762bc6"
        },
        {
          "description": "identity/security: Lockout.CheckAndRecord in favor of Begin",
          "commit": "43c3818"
        },
        {
          "description": "rls: EntHook.SetContextFromContext, ContextInjector, ConnWithRLS, NewConnWithRLS, and GetConnWithRLS, which cannot take effect outside a transaction",
          "commit": "ba68c75"
        },
        {
          "description": "The `authz/simple` and `authz/spicedb` forwarding packages will be removed in the next major release; use `authz/rbac` and `authz/rebac/spicedb`",
          "commit": "dac2d76",
          "rmis": [
            "RMI-SYSTEMFORGE-143"
          ]
        }
      ],
      "fixed": [
        {
          "description": "SCIM user and group listing panicked on every ascending sort, including the default order",
          "commit": "7f0e320"
        },
        {
          "description": "The identity/oauth Fosite storage dropped any subject that was not a UUID; tokens and authorization codes now record the subject",
          "commit": "16f7f9f"
        },
        {
          "description": "CreateClient reported every constraint failure, such as a nonexistent owner, as ErrClientExists; it now does so only for a duplicate client ID",
          "commit": "57ece18"
        },
        {
          "description": "Federation sync no longer discards lookup errors, and a delete reports synced only for an identity that was never linked",
          "commit": "d054dc7"
        },
        {
          "description": "rls.SetupTestTenant and SetupTestUser inserted into tables that no longer existed; they now create organizations, human principals, and principal memberships, and report cleanup failures",
          "commit": "40fc9b9"
        },
        {
          "description": "rls.SystemForgeTables named a table that no longer existed, so MigrateSystemForge failed; it now names sf_principal_memberships",
          "commit": "012db98"
        },
        {
          "description": "identity/oauth.NewProvider panicked on construction because its storage no longer satisfied Fosite's interfaces; it now does, checked at compile time",
          "commit": "5e36fc3"
        },
        {
          "description": "identity/oauth never recorded a token family, so revoking refresh and access tokens had no effect; tokens record their request as the family and rotation retires the exchanged refresh token",
          "commit": "5e36fc3"
        },
        {
          "description": "SystemAuth failed to record client-assertion JWT IDs under foreign-key enforcement, breaking private_key_jwt client authentication and leaving assertions replayable",
          "commit": "bb78cf8"
        },
        {
          "description": "Changing a user's email through SCIM no longer keeps the previous address's verification",
          "commit": "ce3ea97"
        },
        {
          "description": "The marketplace, organization, and invite APIs panicked at registration because list filters used pointer query parameters",
          "commit": "52be74e"
        },
        {
          "description": "The simple provider denied every organization permission check, because its permission names did not match the ones it looked up",
          "commit": "fdfe9eb"
        },
        {
          "description": "SpiceDB GetRole reported editors as non-members",
          "commit": "8762bc6"
        },
        {
          "description": "A managed principal's first sign-in to a relying party failed for lack of a verified email",
          "commit": "b6f214a"
        },
        {
          "description": "In-memory stores, password login, and federation sync could match or adopt a human by an empty email",
          "commit": "ca80678"
        },
        {
          "description": "Invite emails are matched case-insensitively",
          "commit": "236c0e9"
        },
        {
          "description": "organization.Service.Create failed for an organization without a plan instead of defaulting to free",
          "commit": "6b3f405"
        },
        {
          "description": "GetMembership reports a missing membership as organization.ErrMembershipNotFound",
          "commit": "faedc5a"
        },
        {
          "description": "identity/credential reports failures to record a credential's use and corrupt stored hashes (ErrCorruptCredential) instead of discarding them, and CreatePassword no longer creates a second password when its lookup fails",
          "commit": "43ac1ff"
        },
        {
          "description": "identity/oauth's authorization code exchange always failed and its tokens lost their subject; its grant storage now delegates to SystemAuth's, enforcing PKCE and redirect URIs and detecting code replay and refresh-token reuse",
          "commit": "f2f71da"
        },
        {
          "description": "A signup that failed after creating the user left an account with no organization whose email could not sign up again",
          "commit": "e6d07df"
        },
        {
          "description": "principal type-specific updates changed shared fields before checking the type, and CreateAgent accepted a missing or inactive delegating principal",
          "commit": "5e002b3"
        },
        {
          "description": "identity/oauth.NewAPI panicked on every call because the Fosite interceptor was added after routes",
          "commit": "ef7ea3d"
        },
        {
          "description": "The federation lookup handler read its path parameter with net/http's PathValue, which chi does not populate",
          "commit": "d57bf0f"
        },
        {
          "description": "The memory rate-limit store panicked when used after Close, and discarded windows after a fixed hour whatever their period",
          "commit": "3019061"
        },
        {
          "description": "A login with no usable characters in its username gets a neutral slug",
          "commit": "7eaa539",
          "rmis": [
            "RMI-SYSTEMFORGE-124"
          ]
        },
        {
          "description": "Accepting an invite syncs the new membership to the authorization graph",
          "commit": "47b0cd9",
          "rmis": [
            "RMI-SYSTEMFORGE-151"
          ]
        },
        {
          "description": "Principals and organizations created by social login are registered with the authorization syncer",
          "commit": "d3566cf",
          "rmis": [
            "RMI-SYSTEMFORGE-147"
          ]
        },
        {
          "description": "Signup creates the principal and personal organization in one transaction",
          "commit": "cc58377",
          "rmis": [
            "RMI-SYSTEMFORGE-148"
          ]
        },
        {
          "description": "The application-role seat limit is checked under a lock so concurrent assignments cannot exceed it",
          "commit": "8521c37",
          "rmis": [
            "RMI-SYSTEMFORGE-153"
          ]
        },
        {
          "description": "A managed principal is never a valid manager",
          "commit": "88b8c7b",
          "rmis": [
            "RMI-SYSTEMFORGE-144"
          ]
        },
        {
          "description": "Authorization checks for AddManager, RemoveManager and Release run inside the row-locked transaction",
          "commit": "66ff372",
          "rmis": [
            "RMI-SYSTEMFORGE-154"
          ]
        },
        {
          "description": "Managing operations record the accurate access-change reason",
          "commit": "d94f453",
          "rmis": [
            "RMI-SYSTEMFORGE-155"
          ]
        },
        {
          "description": "The resource schema helper keeps `owner` and `delete`",
          "commit": "3fba5d6",
          "rmis": [
            "RMI-SYSTEMFORGE-139"
          ]
        },
        {
          "description": "Assigning an application role with no seat left answers 409 instead of 500",
          "commit": "cbb810e",
          "rmis": [
            "RMI-SYSTEMFORGE-146"
          ]
        }
      ],
      "documentation": [
        {
          "description": "ADRs live in `docs/design/adrs/` with an index of statuses, under a Design section in the docs nav; ADR-006 (organization lifecycle), ADR-007 (memberships and entitlements as claims), ADR-008 (resource-scoped collaborators, with rbac/rebac guidance) and ADR-009 (management is a relationship) are added",
          "commit": "4ee73c5"
        },
        {
          "description": "ADR-004 (retire legacy User; Principal as the sole identity root) and ADR-005 (managed principals and manager relationships), with specs for INIT-SYSTEMFORGE-007 and INIT-SYSTEMFORGE-008"
        },
        {
          "description": "Identity, OAuth, integration, and getting-started documentation rewritten for the principal model; the schema reference is generated from the Ent schema"
        },
        {
          "description": "The service-accounts page states that the RFC 7523 JWT-bearer grant is not implemented; the migration guide states that only Argon2id password hashes can be imported"
        },
        {
          "description": "Resource servers accepting AI agents via AAuth",
          "commit": "00b495f"
        },
        {
          "description": "Managed principals guide, with the email exception, login token security, and base manager relations added to the users, account security, and authorization conventions docs",
          "commit": "6f9cd36"
        },
        {
          "description": "Architecture pages for organizations, managed principals and authorization describe the implemented behavior",
          "commit": "287ffaf",
          "rmis": [
            "RMI-SYSTEMFORGE-146"
          ]
        },
        {
          "description": "Guides for invites, application roles and entitlements, collaborators and resource grants, organization slugs, personal-to-team conversion, access-change invalidation and the authorization mode",
          "commit": "940fd7e",
          "rmis": [
            "RMI-SYSTEMFORGE-146"
          ]
        },
        {
          "description": "Feature specifications moved from docs/design to docs/specs",
          "commit": "30d9c8f",
          "rmis": [
            "RMI-SYSTEMFORGE-146"
          ]
        },
        {
          "description": "INIT-SYSTEMFORGE-011 specifications for the organizations initiative",
          "commit": "f41140a"
        }
      ],
      "dependencies": [
        {
          "description": "Update dependencies",
          "commit": "37c0aaf"
        }
      ],
      "tests": [
        {
          "description": "The test person-server client uses an explicit HTTP client",
          "commit": "e0f1773"
        }
      ]
    },
    {
      "version": "v0.13.0",
      "date": "2026-10-06",
      "highlights": [
        {
          "description": "`identity/systemauthsvc`: embed SystemAuth in a host binary with config loading, production checks, migrations, client bootstrap and health"
        },
        {
          "description": "Production safety checks enforced by `systemauthsvc.New`, not only by the command"
        },
        {
          "description": "`Service.Metadata()` lets in-process relying parties skip network discovery"
        },
        {
          "description": "Configuration overrides apply before defaults and validation; SystemAuth configuration can be loaded from bytes"
        }
      ],
      "added": [
        {
          "description": "`Server.OpenIDConfiguration()` and `Server.Ready(ctx)` on the SystemAuth server",
          "commit": "d4e1834"
        },
        {
          "description": "`identity/systemauthsvc` exported SystemAuth service setup for host binaries",
          "commit": "77e642b"
        },
        {
          "description": "`systemauth.DecodeConfig` and `DecodeConfigFile` decode configuration without validating",
          "commit": "af3891e"
        },
        {
          "description": "`systemauthsvc.LoadConfigBytes`; `LoadConfig` validates after overrides",
          "commit": "974b8b0"
        }
      ],
      "changed": [
        {
          "description": "`cmd/systemauth` builds the server through `systemauthsvc`; flags and defaults unchanged, production-refusal message reworded",
          "commit": "adf9268"
        }
      ],
      "documentation": [
        {
          "description": "Verified email design: ADR-003 and INIT-SYSTEMFORGE-006",
          "commit": "9786049"
        },
        {
          "description": "Embedding SystemAuth in a host binary",
          "commit": "7a7e5f5"
        },
        {
          "description": "`LoadConfigBytes` and override ordering",
          "commit": "f52d8f2"
        }
      ]
    },
    {
      "version": "v0.12.0",
      "date": "2026-10-06",
      "highlights": [
        {
          "description": "Social login on SystemAuth: GitHub/Google login routes, principal upsert keyed by provider subject with verified-email linking, hardened `__Host-sf_login` session, state CSRF + PKCE, allowlisted redirects"
        },
        {
          "description": "Session and token lifecycle: refresh-token rotation with reuse detection and absolute expiry, logout with token revocation, consent page"
        },
        {
          "description": "OpenID Connect: ID tokens, optional RS256 JWT access tokens, and the `/oauth/userinfo` endpoint"
        },
        {
          "description": "`identity/relyingparty`: reusable OIDC relying party with `sub` → `sf_principal_id` linking, `/bff/*` cookie sessions, and bearer middleware for JWTs and API keys"
        },
        {
          "description": "Durable stores: Ent-backed SystemAuth login sessions, login state and consent grants; `identity/relyingparty/pgstore` encrypted PostgreSQL session stores with key rotation"
        },
        {
          "description": "Production-deployable `systemauth` binary: PostgreSQL via pgx, signing key from a secret, health checks, and a production mode that refuses unsafe configuration"
        }
      ],
      "breaking": [
        {
          "description": "Removed the unused duplicate `session/oauth` package; use `identity/oauthclient`",
          "commit": "51f85fd"
        },
        {
          "description": "`cmd/systemauth` without `--dev` refuses to start without a signing key, an https issuer, and a persistent database, and rejects `insecure_cookies`",
          "commit": "bd65215"
        },
        {
          "description": "Refresh tokens rotate on every use; presenting a rotated refresh token returns `invalid_grant` and revokes the token family",
          "commit": "2c72979"
        },
        {
          "description": "OAuth codes and tokens record a `subject`; auth-code `user_id` becomes nullable; run `systemauth migrate`",
          "commit": "6ed9b76"
        }
      ],
      "added": [
        {
          "description": "`identity/oauthclient`: provider `Connector`, `User.EmailVerified`, and a pluggable single-use `StateStore`",
          "commit": "178063d"
        },
        {
          "description": "`ExternalIdentity` entity (`sf_external_identities`) linking principals to upstream logins",
          "commit": "9d2f589"
        },
        {
          "description": "SystemAuth principal directory and external-login account linking (verified-email linking only)",
          "commit": "ae8a363"
        },
        {
          "description": "`social_login` configuration with redirect allowlist",
          "commit": "9ae2eb5"
        },
        {
          "description": "`__Host-sf_login` session store and hardened cookies",
          "commit": "35b8ba3"
        },
        {
          "description": "GitHub/Google login routes on SystemAuth",
          "commit": "a1e4310"
        },
        {
          "description": "Logout and consent pages",
          "commit": "3644e1b"
        },
        {
          "description": "OpenID Connect UserInfo endpoint",
          "commit": "adbb5b7"
        },
        {
          "description": "OIDC ID tokens, optional JWT access tokens, and `idp_hint`",
          "commit": "d83b627"
        },
        {
          "description": "`identity/relyingparty` OIDC client and principal linking",
          "commit": "2f2ef88"
        },
        {
          "description": "Relying-party `/bff` cookie-session handler and bearer middleware",
          "commit": "c0c6f5d"
        },
        {
          "description": "Signing key loaded from a secret with a key ID, and `/healthz` / `/readyz`",
          "commit": "d496386"
        },
        {
          "description": "Production-deployable `systemauth` binary with PostgreSQL via pgx and env/flag configuration",
          "commit": "bd65215"
        },
        {
          "description": "Ent schemas for login sessions, login state and consent grants",
          "commit": "52b21a5"
        },
        {
          "description": "Ent-backed SystemAuth login session, login state and consent stores, used by default with database storage",
          "commit": "311ce3a"
        },
        {
          "description": "`identity/relyingparty/pgstore` PostgreSQL session and login-state stores with AES-256-GCM encryption at rest",
          "commit": "0369dd5"
        },
        {
          "description": "`pgstore.Keys`, `KeysFromEnv`, and `NewStores` for shared session-key loading and rotation",
          "commit": "64bde37"
        }
      ],
      "changed": [
        {
          "description": "Relying-party memberships come from a `MembershipSource` fed by SystemAuth claims; sessions track `sid` for future back-channel logout",
          "commit": "f34b05d"
        },
        {
          "description": "`cmd/systemauth` logs whether social login state is database-backed at startup",
          "commit": "b286d70"
        }
      ],
      "fixed": [
        {
          "description": "Refresh-token rotation with reuse detection; reused refresh tokens no longer crash the server",
          "commit": "2c72979"
        },
        {
          "description": "Query-escape the return URL in `DefaultSessionProvider` redirects",
          "commit": "50743ec"
        },
        {
          "description": "Update configured OAuth clients that already exist in the database on startup",
          "commit": "ca517d3"
        },
        {
          "description": "Generate the relying-party seal nonce in a dedicated buffer (sealed format unchanged)",
          "commit": "fcce545"
        }
      ],
      "documentation": [
        {
          "description": "Centralized social login design: ADR-002 and INIT-SYSTEMFORGE-005",
          "commit": "66a0103"
        },
        {
          "description": "Social login guide",
          "commit": "c897f21"
        },
        {
          "description": "Logout, consent, and refresh-token rotation",
          "commit": "db3ced2"
        },
        {
          "description": "SystemAuth endpoints and UserInfo",
          "commit": "d999cd7"
        },
        {
          "description": "Federating applications to SystemAuth (relying-party guide)",
          "commit": "13afdf0"
        },
        {
          "description": "SystemAuth production deployment guide",
          "commit": "6e5f979"
        },
        {
          "description": "Production stores for SystemAuth and relying parties",
          "commit": "ec75da4"
        },
        {
          "description": "`NewStores` and environment-based key rotation",
          "commit": "b3dda5d"
        }
      ],
      "dependencies": [
        {
          "description": "Update Go module dependencies",
          "commit": "612a247"
        }
      ]
    },
    {
      "version": "v0.11.0",
      "date": "2026-10-02",
      "highlights": [
        {
          "description": "coreauth -> systemauth: the identity/auth server package, binary, bootstrap user, JWKS key id, env var, and observability metric namespace all rename; the parallel CoreControl naming is retired in favor of the same name"
        },
        {
          "description": "cf_ table prefix -> sf_: all 26 identity tables, via the Ent schema annotations"
        },
        {
          "description": "API-key visible prefix cf_ -> sf_: newly issued keys read sf_live_.../sf_test_..."
        },
        {
          "description": "Unified cross-app principal-link field: PrincipalMixin's sf_principal_id replaces the divergent core_control_principal_id / core_auth_principal_id spelling"
        }
      ],
      "breaking": [
        {
          "description": "identity/coreauth -> identity/systemauth import path; cmd/coreauth -> cmd/systemauth binary; CoreControlConfig and related types renamed to SystemAuthConfig etc.",
          "commit": "d97bdde"
        },
        {
          "description": "All cf_* tables renamed to sf_*; migrations/0001_rename_cf_to_sf.sql provided for an existing dev database with data to keep",
          "commit": "5f78037"
        },
        {
          "description": "identity/apikey.DefaultPrefix and identity/credential.APIKeyPrefix move from cf_ to sf_; dev-issued cf_-prefixed keys must be reissued",
          "commit": "385fe99"
        },
        {
          "description": "PrincipalMixin's SSO-federation link field renamed to sf_principal_id; consumers on core_control_principal_id or core_auth_principal_id must rename and regenerate Ent",
          "commit": "5734a60"
        }
      ],
      "documentation": [
        {
          "description": "README Database Tables and Migration Strategy sections updated to sf_*"
        }
      ]
    },
    {
      "version": "v0.10.0",
      "date": "2026-09-06",
      "highlights": [
        {
          "description": "Module path moved from `github.com/grokify/systemforge` to `github.com/plexusone/systemforge`; the GitHub repository was transferred to the plexusone org"
        },
        {
          "description": "Cross-app authorization vocabulary contract (`AppVocabulary`) and registry so Forge platform apps share one role/permission/scope convention"
        },
        {
          "description": "Shared SpiceDB base schema (`principal`/`organization`/`platform`) with a composition helper for app-contributed fragments"
        }
      ],
      "breaking": [
        {
          "description": "Module path changed to `github.com/plexusone/systemforge`. Update imports from `github.com/grokify/systemforge/...` to `github.com/plexusone/systemforge/...` (the API is unchanged); the old path still resolves via GitHub's repository-transfer redirect but will not receive new tags",
          "commit": "852744b"
        }
      ],
      "added": [
        {
          "description": "`authz.AppVocabulary` contract and `VocabularyRegistry` validating app-name format, `{app}:{resource}:{verb}` scope naming, role-hierarchy coverage, and `{app}_`-prefixed SpiceDB definitions",
          "commit": "7886093"
        },
        {
          "description": "`BaseSpiceDBSchema` and `VocabularyRegistry.ComposeSpiceDBSchema`, assembling the platform base plus every registered app fragment and rejecting duplicate definitions",
          "commit": "d61bc4f"
        }
      ],
      "fixed": [
        {
          "description": "Close a line-anchored regex bypass in SpiceDB schema-definition detection: a fragment packing two `definition`s onto one physical line hid the second from both the `{app}_`-prefix check and the duplicate-shadowing check, while the raw fragment was still concatenated verbatim into the composed schema — letting an app silently redefine a reserved or foreign definition",
          "commit": "3f43040"
        },
        {
          "description": "Exclude `github.com/KimMachineGun/automemlimit` v1.0.0, which removed `memlimit.SetGoMemLimitWithOpts` and broke the build via `jzelinskie/cobrautil/v2/cobraproclimits`",
          "commit": "a64fce1"
        },
        {
          "description": "Reference the shared `plexusone/.github` CI workflows at `@main` (with `check-latest: true` added upstream) instead of a stale pinned tag, so `go.mod`'s required Go patch version resolves correctly",
          "commit": "1e27a9a"
        }
      ],
      "documentation": [
        {
          "description": "Publish the `INIT-SYSTEMFORGE-001` (unified Forge authorization/IAM/shell) and `INIT-SYSTEMFORGE-002` (grokify-to-plexusone migration) initiative specs",
          "commit": "fd97642"
        }
      ],
      "dependencies": [
        {
          "description": "Bump `github.com/authzed/spicedb` from 1.56.0 to 1.56.1",
          "commit": "84b83e4"
        },
        {
          "description": "Bump `google.golang.org/grpc` from 1.83.1 to 1.83.2",
          "commit": "1c54f67"
        },
        {
          "description": "Additional transitive dependency updates via `go get -u ./...`",
          "commit": "c86ca67"
        }
      ]
    },
    {
      "version": "v0.9.0",
      "date": "2026-08-23",
      "highlights": [
        {
          "description": "DPoP (RFC 9449) extracted to the standalone `github.com/grokify/goauth/dpop` package; consumers must update their import path"
        },
        {
          "description": "GuardSQL authorization adapter (`authzguardsql`) consolidated into SystemForge"
        },
        {
          "description": "OpenAPI 3.1 spec with an interactive Scalar API reference in the docs site"
        }
      ],
      "breaking": [
        {
          "description": "The `session/dpop` package has been removed; DPoP now lives at `github.com/grokify/goauth/dpop`. Update imports from `github.com/grokify/systemforge/session/dpop` to `github.com/grokify/goauth/dpop` (the API is unchanged). The session/bff layer that binds DPoP to sessions remains in SystemForge",
          "commit": "1892c0d"
        }
      ],
      "added": [
        {
          "description": "`authzguardsql` adapter mapping GuardSQL schemas/policies to SystemForge authorization (`PolicyBuilder`, `ResourceBuilder`, `DefaultResourceBuilder`); depends on `github.com/grokify/guardsql`",
          "commit": "cc789a7"
        },
        {
          "description": "OpenAPI 3.1 specification and a Scalar interactive API reference",
          "commit": "b271108"
        }
      ],
      "changed": [
        {
          "description": "bff reverse proxy migrated from the deprecated `httputil.ReverseProxy.Director` to `Rewrite` (Go 1.26 SA1019), propagating the session via the outbound request context",
          "commit": "1892c0d"
        }
      ],
      "documentation": [
        {
          "description": "Add a query policy engines guide and integrate it across the docs",
          "commit": "434862c"
        },
        {
          "description": "Integrate the interactive API docs into site navigation",
          "commit": "293eb0b"
        },
        {
          "description": "Document the authzguardsql adapter and the guardsql rename",
          "commit": "ac300af"
        },
        {
          "description": "Update README shields",
          "commit": "9b8c673"
        }
      ],
      "dependencies": [
        {
          "description": "Bump `github.com/authzed/spicedb` from 1.54.0 to 1.56.0",
          "commit": "7624e7f"
        },
        {
          "description": "Bump `google.golang.org/grpc` from 1.81.1 to 1.83.0",
          "commit": "8b6beab"
        },
        {
          "description": "Bump `github.com/redis/go-redis/v9` from 9.20.1 to 9.22.0",
          "commit": "2511c16"
        },
        {
          "description": "Bump `github.com/danielgtaylor/huma/v2` from 2.38.0 to 2.39.1",
          "commit": "5c7efaa"
        },
        {
          "description": "Bump `golang.org/x/crypto` from 0.53.0 to 0.55.0",
          "commit": "ad7951e"
        },
        {
          "description": "Bump `github.com/mattn/go-sqlite3` from 1.14.46 to 1.14.50",
          "commit": "35e8528"
        },
        {
          "description": "Bump `github.com/plexusone/omniobserve` from 0.11.0 to 0.12.0",
          "commit": "af41e73"
        },
        {
          "description": "Additional dependency and toolchain updates",
          "commit": "2065044"
        }
      ]
    },
    {
      "version": "v0.8.0",
      "date": "2026-06-21",
      "highlights": [
        {
          "description": "Organization ownership transfer with transaction-safe implementation"
        },
        {
          "description": "OmniStorage session backend with Redis support and size limits"
        },
        {
          "description": "SpiceDB API compatibility fix for v1.54.0+"
        }
      ],
      "added": [
        {
          "description": "Organization ownership transfer functionality with TransferOwnership method",
          "commit": "7be89d8"
        },
        {
          "description": "POST /organizations/{slug}/transfer-ownership API endpoint",
          "commit": "7be89d8"
        },
        {
          "description": "TransferOwnershipInput type for transfer configuration",
          "commit": "7be89d8"
        },
        {
          "description": "OmniStorage session store backend with memory and Redis support",
          "commit": "3493416"
        },
        {
          "description": "Session size limits and per-user session limits with auto-eviction",
          "commit": "3493416"
        },
        {
          "description": "Site isolation for multi-tenant session management",
          "commit": "3493416"
        }
      ],
      "fixed": [
        {
          "description": "SpiceDB client API compatibility with v1.54.0+ using grpc.NewClient",
          "commit": "4aa41ae"
        }
      ],
      "documentation": [
        {
          "description": "Session management overview with architecture diagram",
          "commit": "b3d0cd6"
        },
        {
          "description": "BFF sessions documentation with store interface and backends",
          "commit": "b3d0cd6"
        },
        {
          "description": "Ownership transfer documentation in memberships guide",
          "commit": "f7218a1"
        }
      ],
      "dependencies": [
        {
          "description": "Bump go from 1.26.2 to 1.26.4",
          "commit": "0333e6b"
        },
        {
          "description": "Bump github.com/authzed/authzed-go from 1.9.0 to 1.10.0",
          "commit": "0333e6b"
        },
        {
          "description": "Bump github.com/authzed/spicedb from 1.52.0 to 1.54.0",
          "commit": "0333e6b"
        },
        {
          "description": "Bump github.com/danielgtaylor/huma/v2 from 2.37.3 to 2.38.0",
          "commit": "0333e6b"
        },
        {
          "description": "Bump github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0",
          "commit": "0333e6b"
        },
        {
          "description": "Bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0",
          "commit": "0333e6b"
        },
        {
          "description": "Bump github.com/mattn/go-sqlite3 from 1.14.44 to 1.14.46",
          "commit": "0333e6b"
        },
        {
          "description": "Bump github.com/plexusone/omniobserve from 0.9.0 to 0.11.0",
          "commit": "b2a4c49"
        },
        {
          "description": "Add github.com/plexusone/omnistorage-core v0.5.0",
          "commit": "b2a4c49"
        },
        {
          "description": "Bump github.com/redis/go-redis/v9 from 9.19.0 to 9.20.1",
          "commit": "b2a4c49"
        },
        {
          "description": "Bump golang.org/x/crypto from 0.50.0 to 0.53.0",
          "commit": "b2a4c49"
        },
        {
          "description": "Bump google.golang.org/grpc from 1.81.0 to 1.81.1",
          "commit": "b2a4c49"
        }
      ]
    },
    {
      "version": "v0.7.0",
      "date": "2026-05-10",
      "highlights": [
        {
          "description": "BREAKING: Renamed project from CoreForge to SystemForge"
        },
        {
          "description": "ProductGraph integration for event correlation and tracking"
        },
        {
          "description": "Session invalidation with memory and Redis stores"
        },
        {
          "description": "Account lockout protection for identity module"
        }
      ],
      "changed": [
        {
          "description": "BREAKING: Renamed project from CoreForge to SystemForge - update all imports from coreforge to systemforge",
          "commit": "dc9b68f"
        }
      ],
      "added": [
        {
          "description": "ProductGraph client for event correlation and tracking",
          "commit": "cf8aa54"
        },
        {
          "description": "ProductGraph integration with observability module",
          "commit": "df5c013"
        },
        {
          "description": "Session invalidation with MemoryStore and RedisStore implementations",
          "commit": "b4077b1"
        },
        {
          "description": "Account lockout protection in identity module",
          "commit": "500fd61"
        }
      ],
      "fixed": [
        {
          "description": "Session IsExpired flaky test on Windows due to time resolution",
          "commit": "e332cfa"
        },
        {
          "description": "golangci-lint errcheck, gosec G115, staticcheck SA1019 issues",
          "commit": "16cfbe1"
        },
        {
          "description": "gosec G710 open redirect and G124 insecure cookie lint issues",
          "commit": "d8de86f"
        }
      ],
      "documentation": [
        {
          "description": "Observability overview documentation",
          "commit": "98b3669"
        },
        {
          "description": "ProductGraph task tracking documentation",
          "commit": "9ce6db1"
        },
        {
          "description": "ProductGraph integration design documents",
          "commit": "062b663"
        }
      ],
      "dependencies": [
        {
          "description": "Bump github.com/plexusone/omniobserve from 0.8.0 to 0.9.0",
          "commit": "2fd164e"
        },
        {
          "description": "Bump google.golang.org/grpc from 1.80.0 to 1.81.0",
          "commit": "2e809c5"
        },
        {
          "description": "Bump github.com/mattn/go-sqlite3 from 1.14.42 to 1.14.44",
          "commit": "4e17458"
        },
        {
          "description": "Bump github.com/authzed/spicedb from 1.51.1 to 1.52.0",
          "commit": "17b7839"
        },
        {
          "description": "Bump github.com/redis/go-redis/v9 from 9.18.0 to 9.19.0",
          "commit": "b85b324"
        },
        {
          "description": "Bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2",
          "commit": "15bbb86"
        },
        {
          "description": "Bump github.com/invopop/jsonschema from 0.13.0 to 0.14.0",
          "commit": "7bd75e2"
        }
      ]
    },
    {
      "version": "v0.6.0",
      "date": "2026-04-12",
      "highlights": [
        {
          "description": "Multi-app platform infrastructure for running multiple SaaS apps on shared backend"
        },
        {
          "description": "Schema-per-app PostgreSQL isolation with X-App-ID header routing"
        },
        {
          "description": "SystemForge identity and session integration for multiapp deployments"
        }
      ],
      "added": [
        {
          "description": "Multi-app server with `MultiAppMode` and `SingleAppMode` deployment options",
          "commit": "a6ab2aa"
        },
        {
          "description": "AppBackend interface for composable app registration with lifecycle hooks",
          "commit": "a6ab2aa"
        },
        {
          "description": "Schema-per-app database isolation using PostgreSQL schemas (`app_` prefix)",
          "commit": "a6ab2aa"
        },
        {
          "description": "X-App-ID header routing for multi-tenant request dispatch",
          "commit": "a6ab2aa"
        },
        {
          "description": "Redis and in-memory cache implementations with app-scoped prefixes",
          "commit": "a6ab2aa"
        },
        {
          "description": "SystemForge identity integration with JWT claims extraction and validation",
          "commit": "fb0ed5f"
        },
        {
          "description": "Session management helpers for multi-tenant deployments",
          "commit": "fb0ed5f"
        },
        {
          "description": "Ent client factory for schema-isolated database connections",
          "commit": "fb0ed5f"
        },
        {
          "description": "HTTP middleware for authentication and tenant context propagation",
          "commit": "fb0ed5f"
        },
        {
          "description": "Example app backend implementation demonstrating AppBackend interface",
          "commit": "0895fe0"
        }
      ],
      "security": [
        {
          "description": "Generic 404 responses for missing/invalid X-App-ID to prevent enumeration attacks",
          "commit": "1c85471"
        }
      ],
      "documentation": [
        {
          "description": "Multiapp architecture documentation with deployment patterns",
          "commit": "3078737"
        }
      ],
      "dependencies": [
        {
          "description": "Bump github.com/mattn/go-sqlite3 from 1.14.40 to 1.14.42",
          "commit": "0f2e7b5"
        },
        {
          "description": "Bump golang.org/x/crypto from 0.49.0 to 0.50.0",
          "commit": "0b29ec0"
        }
      ]
    },
    {
      "version": "v0.5.0",
      "date": "2026-04-05",
      "highlights": [
        {
          "description": "Audience-aware JWT tokens for BFF vs API client separation"
        },
        {
          "description": "Ent-backed stores for API keys and BFF sessions with AES-256-GCM encryption"
        },
        {
          "description": "Reusable Ent schema mixins for API keys and BFF sessions"
        }
      ],
      "added": [
        {
          "description": "Audience-aware JWT tokens with `GenerateBFFTokenPair` and `GenerateAPIToken` methods",
          "commit": "8978a57"
        },
        {
          "description": "AES-256-GCM token encryption for BFF sessions with `Encryptor` type",
          "commit": "c101b1f"
        },
        {
          "description": "Ent-backed BFF session store with automatic expired session cleanup",
          "commit": "c101b1f"
        },
        {
          "description": "Ent-backed API key store with `EntClientInterface` for app integration",
          "commit": "efeecfb"
        },
        {
          "description": "APIKey Ent mixin with fields for key management (prefix, hash, scopes, environment)",
          "commit": "cda9b50"
        },
        {
          "description": "BFFSession Ent mixin with encrypted token fields and session metadata",
          "commit": "cda9b50"
        }
      ],
      "documentation": [
        {
          "description": "JWT audience separation guide for BFF vs API tokens",
          "commit": "4144c80"
        },
        {
          "description": "Ent-backed session store integration guide",
          "commit": "4144c80"
        },
        {
          "description": "API key Ent store implementation documentation",
          "commit": "4144c80"
        },
        {
          "description": "OAuth client package documentation",
          "commit": "4144c80"
        },
        {
          "description": "Design documents for JWT audience and Ent stores features",
          "commit": "00d784d"
        }
      ],
      "dependencies": [
        {
          "description": "Bump github.com/authzed/spicedb from 1.50.0 to 1.51.0",
          "commit": "877e4fc"
        },
        {
          "description": "Bump entgo.io/ent from 0.14.5 to 0.14.6",
          "commit": "05045ba"
        },
        {
          "description": "Bump github.com/danielgtaylor/huma/v2 from 2.37.2 to 2.37.3",
          "commit": "3a13c57"
        },
        {
          "description": "Bump github.com/mattn/go-sqlite3 from 1.14.37 to 1.14.38",
          "commit": "6a7265e"
        },
        {
          "description": "Bump google.golang.org/grpc from 1.79.3 to 1.80.0",
          "commit": "d1e33e4"
        }
      ]
    },
    {
      "version": "v0.4.0",
      "date": "2026-03-23",
      "highlights": [
        {
          "description": "Backend for Frontend (BFF) package with session management, rate limiting, and API proxy"
        },
        {
          "description": "Public profile fields for users and organizations enabling directory listings"
        },
        {
          "description": "Huma framework integration for OpenAPI schema generation in BFF endpoints"
        }
      ],
      "added": [
        {
          "description": "BFF HTTP handler with session creation, API proxy, and CSRF protection",
          "commit": "76b618a"
        },
        {
          "description": "Token bucket rate limiter with per-endpoint overrides and standard headers",
          "commit": "3d4962b"
        },
        {
          "description": "Client IP extraction with Cloudflare and proxy header support",
          "commit": "4b60e87"
        },
        {
          "description": "Huma API integration for BFF with OpenAPI schema generation",
          "commit": "02c57fc"
        },
        {
          "description": "Public profile fields for HumanMixin (slug, headline, bio, social links)",
          "commit": "a4a52b7"
        },
        {
          "description": "Public listing fields for OrganizationBase (tagline, description, website)",
          "commit": "156ff92"
        }
      ],
      "documentation": [
        {
          "description": "BFF pattern documentation with architecture and integration examples",
          "commit": "92590b0"
        }
      ],
      "infrastructure": [
        {
          "description": "Updated shared CI workflows to Go 1.26.x only",
          "commit": "126ca83"
        }
      ],
      "dependencies": [
        {
          "description": "Bump github.com/authzed/spicedb from 1.49.2 to 1.50.0",
          "commit": "2961a24"
        },
        {
          "description": "Bump google.golang.org/grpc from 1.79.2 to 1.79.3",
          "commit": "f5da6f8"
        },
        {
          "description": "Bump github.com/mattn/go-sqlite3 from 1.14.34 to 1.14.37",
          "commit": "8200aea"
        }
      ]
    },
    {
      "version": "v0.3.0",
      "date": "2026-03-14",
      "highlights": [
        {
          "description": "Vendor-agnostic observability integration with OmniObserve (Datadog, New Relic, Dynatrace, OTLP)"
        },
        {
          "description": "SaaS marketplace infrastructure with Stripe billing and seat-based licensing"
        },
        {
          "description": "Redis-backed rate limiting with sliding window and token bucket algorithms"
        },
        {
          "description": "OAuth client management and provider abstraction for CoreAuth"
        }
      ],
      "added": [
        {
          "description": "Observability package with OmniObserve integration for metrics, traces, and logs",
          "commit": "8b08c3f"
        },
        {
          "description": "Marketplace package with Stripe subscription and seat-based licensing",
          "commit": "736cca3"
        },
        {
          "description": "OAuth client management service in `identity/oauthclient`",
          "commit": "2bd40be"
        },
        {
          "description": "CoreAPI rate limiting package with policy-based controls",
          "commit": "be156d1"
        },
        {
          "description": "Redis-backed rate limiter with sliding window algorithm",
          "commit": "4de27f5"
        },
        {
          "description": "Marketplace Ent entities: License, Listing, Subscription, SeatAssignment",
          "commit": "daed5ba"
        },
        {
          "description": "CoreAuth provider abstraction layer for pluggable authentication",
          "commit": "6e3698d"
        },
        {
          "description": "JWT claims enhancement with audience and issuer validation",
          "commit": "7e343ee"
        },
        {
          "description": "Session middleware improvements with context utilities",
          "commit": "0ab89cf"
        }
      ],
      "documentation": [
        {
          "description": "Authorization PRD and TRD design documents",
          "commit": "cc4e0cd"
        },
        {
          "description": "Marketplace PRD design document",
          "commit": "cc4e0cd"
        },
        {
          "description": "CoreAPI and CoreAuth documentation",
          "commit": "cc4e0cd"
        }
      ],
      "dependencies": [
        {
          "description": "Upgraded OmniObserve to v0.8.0 with unified entry point",
          "commit": "6cd1a68"
        },
        {
          "description": "Added Stripe Go SDK v82 for payment processing",
          "commit": "6cd1a68"
        },
        {
          "description": "Added Redis client for rate limiting",
          "commit": "6cd1a68"
        }
      ]
    },
    {
      "version": "v0.2.0",
      "date": "2026-03-08",
      "highlights": [
        {
          "description": "SpiceDB authorization provider for Zanzibar-style relationship-based access control (ReBAC)"
        },
        {
          "description": "Principal-based identity model supporting humans, agents, applications, and service principals"
        },
        {
          "description": "SCIM 2.0 user provisioning with SystemForge-compliant patch operations"
        },
        {
          "description": "Identity-authorization sync automatically maintains SpiceDB relationships on identity changes"
        }
      ],
      "added": [
        {
          "description": "SpiceDB authorization provider with embedded and remote modes",
          "commit": "1bdab84"
        },
        {
          "description": "Principal identity model with type-specific extensions (Human, Agent, Application, ServicePrincipal)",
          "commit": "beb1dba"
        },
        {
          "description": "GitHub-style organization system with owner, admin, member roles",
          "commit": "f10369c"
        },
        {
          "description": "SCIM 2.0 user provisioning endpoints with filter, patch, and bulk operations",
          "commit": "e0da6c7"
        },
        {
          "description": "Coreauth authentication server with Fosite-based OAuth 2.0",
          "commit": "0462153"
        },
        {
          "description": "Credential and token management service for principals",
          "commit": "b7cbbd7"
        },
        {
          "description": "Standardized API contract module with consistent error handling",
          "commit": "2f78fae"
        },
        {
          "description": "Coreauth CLI for server and key management operations",
          "commit": "af33be0"
        },
        {
          "description": "User schema extended with profile fields (locale, timezone, avatar)",
          "commit": "4c300f5"
        },
        {
          "description": "RelationshipSyncer interface for identity-authorization integration",
          "commit": "0d6b81e"
        },
        {
          "description": "No-op syncer for deployments without SpiceDB",
          "commit": "0d6b81e"
        },
        {
          "description": "SpiceDB integration tests with embedded server",
          "commit": "b77e366"
        }
      ],
      "changed": [
        {
          "description": "OAuth 2.0 implementation refactored for principal-based identity",
          "commit": "09b1146"
        }
      ],
      "removed": [
        {
          "description": "Casbin authorization provider (replaced by SpiceDB)",
          "commit": "0c01487"
        }
      ],
      "documentation": [
        {
          "description": "SpiceDB setup guide for embedded and remote modes",
          "commit": "1bdab84"
        },
        {
          "description": "SpiceDB schema reference with permission inheritance model",
          "commit": "1bdab84"
        },
        {
          "description": "Authorization integration patterns and middleware examples",
          "commit": "0d6b81e"
        },
        {
          "description": "Updated module documentation for v0.2.0",
          "commit": "4d676b1"
        }
      ]
    },
    {
      "version": "v0.1.0",
      "date": "2026-02-28",
      "highlights": [
        {
          "description": "Batteries-included Go platform module for multi-tenant SaaS applications"
        },
        {
          "description": "Complete identity management with users, organizations, and memberships"
        },
        {
          "description": "Full OAuth 2.0 server implementation using Fosite with PKCE, client credentials, and JWT bearer grants"
        },
        {
          "description": "Session management with JWT, DPoP (RFC 9449) proof-of-possession, and BFF pattern"
        }
      ],
      "added": [
        {
          "description": "User accounts with email and Argon2id password hashing",
          "commit": "0c48782"
        },
        {
          "description": "Organizations for multi-tenant applications with name, slug, plan, and settings",
          "commit": "0c48782"
        },
        {
          "description": "Memberships with flexible role-based user-organization relationships",
          "commit": "0c48782"
        },
        {
          "description": "OAuth account linking for GitHub and Google providers",
          "commit": "0c48782"
        },
        {
          "description": "API key service for machine-to-machine authentication with scopes",
          "commit": "42ce852"
        },
        {
          "description": "OAuth 2.0 server using Fosite with Authorization Code + PKCE grant",
          "commit": "91bac6c"
        },
        {
          "description": "Client Credentials grant for service-to-service authentication",
          "commit": "91bac6c"
        },
        {
          "description": "Refresh Token grant with rotation and theft detection",
          "commit": "91bac6c"
        },
        {
          "description": "JWT Bearer grant (RFC 7523) for service account authentication",
          "commit": "91bac6c"
        },
        {
          "description": "Service accounts with RSA/EC key pairs for non-human identities",
          "commit": "91bac6c"
        },
        {
          "description": "Token introspection (RFC 7662) and revocation (RFC 7009) endpoints",
          "commit": "91bac6c"
        },
        {
          "description": "JWT service supporting HS256, RS256, and ES256 algorithms",
          "commit": "1a09a05"
        },
        {
          "description": "DPoP (RFC 9449) proof-of-possession token binding implementation",
          "commit": "1f68df0"
        },
        {
          "description": "Backend for Frontend (BFF) pattern with server-side sessions",
          "commit": "bc6b81e"
        },
        {
          "description": "GitHub and Google OAuth social login handlers",
          "commit": "70a85cc"
        },
        {
          "description": "JWT Bearer and API key authentication middleware",
          "commit": "a15ac17"
        },
        {
          "description": "Role-based access control (RBAC) with organization-scoped permissions",
          "commit": "3aed18f"
        },
        {
          "description": "Casbin provider for advanced policy rules",
          "commit": "3aed18f"
        },
        {
          "description": "Simple provider for lightweight permission checking",
          "commit": "3aed18f"
        },
        {
          "description": "HTTP middleware for route protection (Chi and stdlib)",
          "commit": "3aed18f"
        },
        {
          "description": "Feature flag engine with boolean, percentage, and user list flags",
          "commit": "d7a0bcb"
        },
        {
          "description": "Organization-scoped feature flag evaluation",
          "commit": "d7a0bcb"
        },
        {
          "description": "In-memory feature flag store for development and testing",
          "commit": "d7a0bcb"
        },
        {
          "description": "PostgreSQL RLS policy generation and session variable helpers",
          "commit": "803db13"
        },
        {
          "description": "Tenant isolation for multi-tenant data separation",
          "commit": "803db13"
        },
        {
          "description": "Ent ORM integration with transaction helpers for tenant context",
          "commit": "803db13"
        }
      ],
      "infrastructure": [
        {
          "description": "GitHub Actions CI workflow for build and test",
          "commit": "e2f98d5"
        },
        {
          "description": "GitHub Actions lint workflow with golangci-lint",
          "commit": "e2f98d5"
        },
        {
          "description": "Dependabot configuration for Go modules and GitHub Actions",
          "commit": "e2f98d5"
        }
      ],
      "documentation": [
        {
          "description": "Comprehensive MkDocs documentation site with Material theme",
          "commit": "a52d6d6"
        },
        {
          "description": "Getting started guides: installation, quickstart, configuration",
          "commit": "a52d6d6"
        },
        {
          "description": "Identity module documentation: users, organizations, memberships, API keys",
          "commit": "a52d6d6"
        },
        {
          "description": "OAuth 2.0 documentation: apps, authorization code, client credentials, service accounts, tokens",
          "commit": "a52d6d6"
        },
        {
          "description": "Integration guides: existing apps and migration",
          "commit": "a52d6d6"
        },
        {
          "description": "API reference and Ent schema documentation",
          "commit": "a52d6d6"
        },
        {
          "description": "PRD and TRD design documents for authentication and OAuth",
          "commit": "aad6a32"
        },
        {
          "description": "README with badges, quick start examples, and module structure",
          "commit": "ac04664"
        }
      ]
    }
  ]
}