Skip to content
stemmory
Start free

Changelog

What shipped

Stemmory releases several times a day. This is what actually shipped, in plain terms.

7 October 2026

3 — docs sync never quiet, no-source surfaces, one source one workspace, the update return, bypass close, security pins, pricing footnote (4 migrations)

  • Release 3 — main → release. Hand merge; no auto-merge. Migration-bearing: FOUR migrations apply in the release run's migrate step, in this order: 20261005000030_due_sync_projects_per_source, 20261006000010_unmap_clears_sync_state, 20261006000020_close_orgs_delete_bypass, 20261006000030_one_source_one_workspace. Backup warning: the usual pre-release snapshot per the runbook — 20261006000010 deletes orphaned sync_state rows (adyrix/stem's stale GitHub card among them, founder-ruled) and adds mapped_at to both mapping tables; 20261006000030 re-points nothing on existing rows (account_id null until each row's next reconnect) and replaces the Linear lookup index with a unique one.
  • Before the merge — pre-merge checks (read-only on production; founder re-runs at the merge)
  • HARD GATE for 20261006000030: select external_id, count(distinct org_id) from public.connections where provider = 'linear' and status <> 'revoked' group by external_id having count(distinct org_id) > 1; → must return 0 rows, or the migration's fail-closed block refuses and applies nothing. Coordinator's reads: 1 row at 15:20 IST on 2026-10-06 (adyrix + production-test on one Linear workspace), 0 rows after the founder's two production-test disconnects (19:55 IST and 23:40 IST on 10-06). Nobody may connect a Linear workspace another Stemmory workspace already holds between now and the migrate step (today's code does not refuse it).

5 October 2026

Release 2.1 — STEM-572, a reconnected GitHub installation resumes the docs sync (one migration; hand merge)

  • Release 2.1 — release PR, main → release, for STEM-572 (Tier 0) alone. Merge by hand; no auto-merge. Migration-bearing: one migration, 20261005000020_resume_sync_on_remap.
  • Pre-merge (founder)
  • Backup line (precautionary): the migration creates two AFTER ROW triggers (project_repos_resume_sync, project_teams_resume_sync) and two SECURITY DEFINER functions. No table, column, grant or existing function body changes; no backfill; no data write. The rollback twin drops the four objects.

5 October 2026

Release 2 — the import ladder, buy extra usage, comped period start, the legal publish (five migrations; hand merge)

  • Release 2 — release PR, main → release. Merge by hand; no auto-merge. Migration-bearing: five migrations apply in the release run's migrate step, in this order: 20261003000010_billing_purchased_credits, 20261003000020_billing_topup_intent_sweep, 20261004000020_billing_topup_purchase_by_transaction, 20261004000030_comped_period_start_and_pr_record_clear, 20261005000010_purchased_credit_settlement.
  • Before the merge — the founder's two Paddle steps and the pre-merge counts
  • At this hand merge — live Paddle destination (a live config write; no agent does this). In Paddle › Events › Notifications on the LIVE account, open the destination for /api/webhooks/paddle → Edit destination → add adjustment.created and adjustment.updated. Until this is done a refund keeps the credits; pnpm paddle:check-prod (read-only, live, founder-run) fails on exactly this.

3 October 2026

CR-1 — sign-up and sign-in no longer stick on the human check (STEM-550)

  • CR-1 (STEM-550, Tier 0), PR #1049. The sign-up and sign-in button no longer sticks on "Verifying you're human…" when the page is reached from a marketing page.
  • Every link that leaves the marketing pages ("Start free", "Sign in", the logo, the plan cards, the footer links, the section links) is now a full page load, so the destination always gets its own security policy. The marketing pages' policy is unchanged, byte for byte.
  • The human-check widget waits on the provider's script itself instead of a callback that did not fire after a back-and-forward.

2 October 2026

the import allowance in credits, refusals that stop, excerpts cleared in 24 hours, source files, the legal publish

  • The import allowance, as ruled after the cold run. A trial has 4,000 credits. Every meter and refusal uses one number, stated in credits. A scan that needs more than 90% of what remains is refused with what it needs and what remains. No import reads commits. Resume is not blocked by the hourly limiter. A refusal is shown as "stopped", not "failed". Documents have fenced code replaced before they are sent or stored, and an unchanged document is not re-drafted on a re-import.
  • The stored document excerpt is cleared within 24 hours in every workspace. A coded refusal that spent nothing leaves a bell notification and sends no email.
  • "Source files", not "source code", on every storage claim: the landing page, pricing, FAQ, import screens and the agent skill file.

30 September 2026

Intelligence answers persist and refusals tell the truth; Checkout in the record; clean-up commands hardened

  • Intelligence answers are saved again: every grounded answer had failed after the model replied because the user turn was stored with a null citations field, so the panel showed "couldn't read · retry" over an answer that was already billed. The turn is now stored correctly, and an ask whose turn fails to store is never charged.
  • Intelligence refusals tell the truth: a refusal now says what actually happened (nothing in the record, nothing inside the selected feature with an "Ask the whole project" button, a fault on our side, or entries that do not answer), counts the selected scope only and includes tickets, ranks the subject of a question above filler words, and refuses a filler-only question before calling the model, unbilled.
  • The Checkout feature doc is in the record: billing/checkout with the decision "Checkout runs as an inline frame, not a redirect".

30 September 2026

product audit fixes — notifications reach the bell, honest pricing and privacy copy, graph aliases, Tier 2 polish

  • Every in-app notification now reaches the bell: import ready and failed, trial ending, allowance at 80%, workspace paused and resumed, a token's first use, a lost connection and a viewer over the limit are addressed to the right people at send time, and Preferences says what is actually on.
  • The import step's plan refusal links to Billing and offers a way back; the pricing page describes the six-hourly sweep and webhooks that have been running since August; the homepage vignette quotes a real recorded decision; page headers wrap on phones instead of pushing their button off screen.
  • The projects list flags the same attention state as the dashboard; viewers no longer see a review banner for a review they cannot perform; the command palette's Intelligence row opens the panel; a failed sign-in code keeps the typed email and consent tick.

28 September 2026

M8 waves 2–3 — Intelligence chat, dashboard cards, rail, billing checkout, landing bands and kit picks, light screenshots

  • The landing page reads as sections, and the marketing site takes the founder's workshop picks (STEM-481, #935). Landing sections now alternate between the theme's two surfaces, so the page no longer reads as one unbroken sheet. The closing call-to-action is a card with a photograph of a team laying out a feature tree. The pricing page's comparison grid sits in a card with alternating rows, bold plan columns and tick marks, and the billing notes are laid out two by two. The FAQ page shows one group at a time, with the five groups down the left. The footer is one card with the legal lines, "All rights reserved" and the wordmark as a watermark. The landing page's eight product screenshots now have light-mode versions for light-theme visitors (STEM-442).
  • Intelligence reads like a conversation (STEM-449, #926). The Intelligence panel's transcript uses a chat frame: your questions on the right in filled bubbles, answers on the left with the Stemmory mark at the top of the turn and the source chips underneath, short refusals in a muted bubble. The empty state offers example questions as chips. Answers can carry formatting (lists, emphasis, code) under strict limits: no images, no raw HTML, and links only to this site or to the answer's own cited sources. Streaming, Stop, the scope picker and the usage limits behave exactly as before. Screen readers hear "Answer complete" when an answer finishes instead of the text a second time.
  • Project cards tell you what a project is (STEM-444, #931). On the dashboard and Projects, each card now carries the identity line (repo · branch · Linear team), a status-coloured dot paired with an Active / Archived / Needs attention pill, and Decisions as the third figure. Decision rows name their origin ("GitHub · #634") instead of printing a URL. The stat cards show "+N since last import" and "+N this week" when there is something to say. A workspace with one project no longer clips that card at desktop width.

27 September 2026

phone nav sheet, visible filters, pricing-style plan switch, records polish (M8 wave 1) + blocking token guard

  • Phone visitors can reach the whole site (STEM-464, #922). Below tablet width the marketing header now has a menu button that opens a side sheet with Product, Pricing, FAQ and Contact, the theme switch, and Sign in / Start free. It closes on navigation and returns focus to the button.
  • Filters you can actually see (STEM-465, #922). The Active / Archived / All row on Projects and the All / Imports / People / Agents row on Activity are one shared underline control: the current filter is underlined in full ink, the others muted. They stay links, so a filtered view is still an address you can share and Back still works. On small phones the row scrolls instead of widening the page.
  • Choosing a plan looks like the pricing page (STEM-465, #922). On Billing → Choose a plan, Annual / Monthly is now the same centred pill switch as the public pricing page, with "2 months free, billed yearly" under it.

26 September 2026

the graph fills the screen with Floating, Tree and Radial views (STEM-471)

  • The project graph fills the screen, and you choose how it's laid out (STEM-471, #908). The graph canvas now runs from the sidebar to the edges of the window, with the title, search, filters and controls floating over it. A new View control in the top-right offers three layouts, remembered on your device:
  • Floating view (default): the layered map you know, now with the whole window to breathe in.
  • Tree view: the same map folded into rows, so every feature card is readable without zooming.

26 September 2026

import stops duplicating existing features (STEM-470) + dashboard follows the newest import (STEM-469)

  • Import no longer duplicates features you already have (STEM-470, #905). A re-import now recognises an existing feature when the proposal shares a linked doc path, the same title (case and spacing ignored, matched against existing roots or siblings under the same parent), or the same slug, and it does so for subfeatures too, not only top-level features. The check runs when the tree is drafted and again when you confirm, and it never merges two proposals into one existing feature. Deprecated features are left alone by the new checks. On the Stem project's last re-import this would have prevented all 18 duplicates.
  • The dashboard's import attention row follows each project's newest import (STEM-469, #902). A confirmed proposal no longer keeps "Review import" on the dashboard, and an older failed import no longer shows once a newer one has run.
  • CI: the baselines guard no longer reports a committed screenshot as missing on a loaded runner (a pipefail + grep -q race), which is what failed the previous release gate.

25 September 2026

hotfix — the dashboard no longer shows a stale "Review import" for a confirmed proposal (STEM-469); kit programme close-out docs

  • The dashboard's "Needs your attention" section no longer lists a confirmed import proposal as "Review import". Confirmation is recorded in import_jobs.confirmed_at while state stays proposal_ready; the query filtered on state alone, so a confirmed proposal was an attention row forever and linked to the confirmed view. Seen on production for Stem (confirmed 12 August). Fixed in #898 (STEM-469): the query filters confirmed_at is null and the row builder skips a confirmed proposal, both tested red-first.
  • Docs only: the kit adoption programme's closing record and the page-mapping reconciliation (#887), and the changelog entry for #896 (#897).

25 September 2026

promote main — kit adoption waves 0–6, one design system and one feedback vocabulary, auth shell, hero v2 (STEM-445…461)

  • One design system, end to end. Every button, field, select, menu, dialog, table, card and empty state in the app now comes from one set of primitives on one token scale: 32px controls, one radius scale, one hairline shadow, sentence case everywhere. The uppercase tracked labels are gone from every header and card.
  • Feedback you can trust. Every failure, refusal and empty state uses one vocabulary: a dot-marked line beside the control that failed, a section notice with Retry and a reference code when a whole section could not load, a table row that says "nothing here" under the real header, and a quiet "Saved" that fades. Screen readers get the right announcement for each.
  • Sign-in, sign-up and the MFA step in a split shell with slotted code fields. A real ⌘K palette on cmdk, real menus with tooltips and keyboard hints, an accessible member-remove dialog, avatars with brand fallbacks.

16 September 2026

promote main — UI polish wave, palette, E2E diet, Doors & Rooms docs (STEM-218)

  • Softer borders across the whole app, and a settings area that reads as one system: each subject in its own card, a quiet "Saved" that fades, a member count in the heading, and a failed load that names what failed and offers Retry.
  • Billing shows one allowance meter as a percentage, keeps your cached plan visible with a reference code when the payment provider is slow, and lists payments as Date, Description, Amount, Status; the import wizard has one heading, one footer and a landing card that shows the real state.
  • Activity gains All / Imports / People / Agents filters that live in the address and folds repeated system rows into one line; long decisions clamp with Show more; archived projects get a Restore banner; notifications and the 80% email now say "import allowance".

9 September 2026

promote main — M12 · Error & interrupt pages (STEM-218)

  • release: promote main → release — M12 · Error & interrupt pages
  • Routine main → release promotion per docs/runbooks/release-day.md §6, carrying the whole M12 milestone (all 19 tickets Done, milestone sweep "SHIP WITH FIXES" with the fixes merged — see the milestone comment in Linear), the STEM-365 CI tiering, the STEM-366 Next.js 16.3.3 bump, and the hygiene lane.
  • What ships (PRs since the last promotion, #734)

7 September 2026

Workspaces hotfixes — rail follows the URL, email guard, invites in seconds (STEM-361, STEM-363, STEM-362)

  • the rail and workspace switcher follow the workspace in the URL instead of the last server render: switching or creating a workspace updates the header, the checked item, every rail link and the role-gated rows without a reload. Review findings applied (sibling test for the new api/rail/workspace route, a confirmed fetch that was discarded, a stale sync timestamp after a switch).
  • lib/email/send.ts refuses reserved/fixture recipient domains outright (permanent, non-retryable, logged at info) and refuses the real provider outside production unless EMAIL_REAL_SEND=1; the same guard on the sign-in OTP and e-mail-change chokepoints applies only where a real provider would send (the first CI run proved the unconditional form broke local sign-in); CI asserts no job hands the app a Resend key; scripts/lane-env.sh strips it. Closes the 46.67 % bounce-rate incident at the code level.
  • an invite's email leaves with the invite (bounded after() drain, idempotent) instead of on the next five-minute cron tick.

7 September 2026

M11 · Workspaces — orgs become workspaces, /w/:slug/ routes, per-project visibility (STEM-335)

  • Phases 1–5 of the Workspaces feature (STEM-322 … STEM-335, all Done or code-complete on main):
  • orgs.kind + create_workspace (cap 3 owned team workspaces, 3/24 h); project visibility open|restricted with project_members and private.visible_project_ids() in RLS; lib/authz as the one authorization module with two CI guards; billing_accounts; /w/:workspaceSlug/ on every app route with legacy 302s until 2026-12-04; the workspace switcher and create dialog; hashed invite tokens + /invite/:token; Members & roles per the spec (Viewer everywhere, role ceiling, read-only 11×4 matrix, billing owner-only); project-settings tabs with the Access tab; visibility on every surface with 404-not-403 proven byte- and timing-identical; OAuth state bound to the workspace; eleven audit events and nine telemetry events; the H5 visual pass (112 baselines), H6/H7 + axe, three journeys in CI.

4 September 2026

Waves 17 + 18 — systemic UI fixes, dashboard + graph per docs/ux, one workspace and one installation per project

  • Wave 17 — UI polish batch 1 (#655, STEM-315)
  • Every hand-rolled checkbox replaced by the shadcn Checkbox with a positioned wrapper; the shell no longer scrolls on project settings, members, account and five more routes (guard: shell-scroll.spec.ts).
  • One PageHeader per route (eyebrow = section, H1 = page; workspace name never a title), enforced by a filesystem-enumerating test over all 35 pages; /projects/<slug>/import canonical with /review and the write-back router redirecting to it.

3 September 2026

Wave 16b — enforce the nonce CSP with a report-only twin, nothing else

  • What ships — one change, on purpose
  • the nonce Content-Security-Policy on app routes flips from report-only to enforcing, with a Content-Security-Policy-Report-Only twin carrying the identical policy retained so any post-flip regression still reports to /api/csp-report and the drain. Report-route caps doubled for the doubled volume. Tests reversed to pin the new premise; click journeys added on a marketing page and an app page to catch the "renders fine, every handler dead" failure mode. SECURITY.md §6/§9 updated.
  • Founder rulings 2026-09-03 (STEM-211): 1a probe proved the reporting channel on the live deployment; 2a 3.4-day zero-violation window accepted; 3a enforce + twin; 4b this release carries nothing else, so a Vercel instant rollback of it reverts only the CSP; 5a CI's Database job is the "journeys under enforce" evidence; 6b Paddle checkout under the policy is done live after this deploys.

3 September 2026

Wave 16a — graph ceilings wired honestly, off-page-one citations anchored, UX workshop docs

  • six post-forest CI reads recorded honestly (the review caught a censored subset), the first-node ceiling (13,000 ms) asserted at runtime, the layout reversion detector pinned as a literal 7,026 ms that no future read can ratchet. STEM-302 verified and closed; STEM-191 stays open on two proxy-only bullets.
  • an Intelligence citation to a decision older than page one now opens /decisions at that decision's group, anchored and scrolled into view; unknown or foreign ids fall back to page one with byte-identical output; "← Most recent" on any non-first page. Verified and closed.
  • the 2026-09-03 UX workshop bundle under docs/ux/ (docs only).

3 September 2026

Wave 15 (take 2) — audit gate fix on top of #636: fast-uri/qs pins

  • Why a second release PR
  • #636 merged to release but its run (33686755116) failed the Dependency audit (blocking on release) gate — four new high advisories in the transitive fast-uri — so migrate and deploy were skipped and production is still on the Wave 14 release (41700a8). This PR promotes the fix on top; the Wave 15 code from #636 is already on release and ships with it.
  • What ships (delta on top of #636)

3 September 2026

Wave 15 — Intelligence add-on sellable, ticket citations, workspace ⌘K, forest layout, CI hardening

  • Operator customers can now buy Stemmory Intelligence as an add-on from /billing/subscription: an attach card mirroring the extra-seat block, amount verbatim from Paddle's preview, inline confirm, and a remove that schedules to 30 minutes before renewal so the cron beats Paddle. Both actions require a billing admin plus AAL2 step-up; a pending removal suppresses plan-switch controls so it can't be silently discarded; the end date shown is the renewal day.
  • Intelligence answers now cite tickets as a fourth source kind, and an integration test proves every cited id belongs to the scoped project. Decision citation chips land on their #decision-<id> anchor on /decisions, every member of a grouped card included. Seed fixture FK ordering fixed.
  • ⌘K in workspace scope now searches the project list (the last open STEM-168 bullet). Palette recents are cleared on log out, sign-out-everywhere and account deletion. New owner/admin setting show_origin_user (default off) controls whether activity rows name the linked account; the feed's read never selects origin and the renderer never prints it unless it is on, both pinned by binding tests and pgTAP.

2 September 2026

Wave 14 — Intelligence completes, add-on truth, activity writers, worker layout, isolation proven

  • Intelligence rounds out: answers stream with a Stop that keeps what arrived and still meters what was spent; questions can narrow to one node's subtree; owners get /settings/intelligence (enable, project scope, agent-decisions-as-sources, retention, allowance %) and every knob is enforced server-side; ⌘K hands the typed question straight into ⌘J.
  • leaving Portfolio now offers to keep Intelligence for $15/mo (never pre-ticked, amounts verbatim from Paddle); the pricing page stops calling shipped features "Not built yet", with a structural test that fails if that ever drifts again.
  • activity now records sync runs, decisions and member joins (the feed shows real history); the ⌘K palette tells the truth about Intelligence availability and ignores held keys; decisions pagination accepts non-v4 ids.

1 September 2026

release guards read Paddle ids from Vercel; changelog job lands via PR

  • the release guard reads production's Paddle price ids from Vercel at run time, so a price lives in one place and the live-catalogue check reports on what production actually charges.
  • the changelog job lands its entry through its own auto-merged pull request instead of a direct push that protected main refuses; the entry for the 1 September price-correction release is included.

1 September 2026

Sonnet 5 stays $2/$10 — price row corrected, live margin guard, changelog job fixed

  • Sonnet 5's price stays $2/$10: the $3/$15 row scheduled for 1 September (an increase Anthropic withdrew) is superseded, so usage metering, credits, the breaker and invoice reconciliation cost every call at the real rate again.
  • the margin-floor guard now reads the live model_prices row instead of a pinned dollar figure, so the next real re-price trips CI rather than passing silently.
  • the changelog job can read release PRs (it failed on its first run), the Wave 13 entry is on /changelog, and Fluid Compute is recorded as verified ON.

1 September 2026

Wave 13 — graph at scale, Intelligence, activity + ⌘K + share links, digest + changelog, infra truth, audit retention

  • the graph mounts only what is in or near the viewport; a 500-root project no longer builds ~4,400 DOM nodes before the first one is interactive, and the minimap steps aside above 500 nodes.
  • Intelligence: ask a question about one project's record and get an answer whose every citation resolves to a real node or decision, or no answer at all; ⌘J opens it, threads persist per project, and plans that do not include it see a stated Gate.
  • workspace and project Activity feeds over the record that was being written but never read; a ⌘K palette scoped to the project's nodes, decisions and actions; revocable read-only share links that serve a snapshot, never a live read.