WinLayer Docs

Changelog

Complete update history — 971 product and development updates, most recent first.

Oct 29, 2026

  • ImprovedExpanded the public update history through October 29 to include the week’s implementation, development repairs, browser checks, performance experiments and release verification. Earlier entries are retained, and prepared work is identified separately from deployed changes.
  • ImprovedPrepared a graph-query optimization that removes duplicate source traversals after selecting each target’s top three observations. Six complete real-data results match; the measured query median falls from 4,179.5 to 3,249.3 ms. All 27 traversal scenarios, 18 reader/security checks and 25 graph unit tests pass. Full CI, image verification, deployment and representative-load acceptance remain open.
  • FixedCorrected recursive unit-test discovery across the five web and service workspaces. Quoted patterns include ten previously omitted API/web files, adding 28 passing cases for a total of 2,760 local unit passes. Node 22 and 24 reproduce the fix; assertions and application code are unchanged. This command change is not yet deployed.
  • ImprovedVerified the graph-cache candidate in full application CI: 2,732 unit passes, 520 full-browser passes, four plan passes and two viewer passes, with 86 declared skips and no browser failures or flakes. Security and Terraform jobs pass; the overall run still fails the required current D-2 evaluation-report gate. Subsequent command and query changes retain their separate verification status.
  • FixedPrepared immutable graph snapshots for new canonical opportunity computations. Publication captures the exact rows under locks, and lineage retains that history after graph changes or deletion while rejecting corrupt or borrowed proof. Old records receive no invented historical evidence. Snapshot and populated-migration regressions pass; application rollout remains pending.
  • FixedPrepared separate intelligence-version and source-evidence ownership for agent inputs and recommendation evidence. Missing, conflicting, malformed or foreign-workspace references remain incomplete instead of being concealed by another valid owner. The real database regression reproduces the overwrite and passes after the repair; application rollout remains pending.
  • ImprovedPrepared graph-overview reuse tied to the exact PostgreSQL snapshot, server identity and evidence activation or expiry, with a maximum lifetime of 30 seconds. Each request retains role checks, relation locks, copied results and the existing SQL deadline; application rollout remains pending.
  • ImprovedVerified the packaged graph reader against development data: all 33 compared outputs match across 661,433 current relationships. Sequential reuse takes 15.5–17.7 ms, while first and concurrent cache misses still take about 8–9 seconds. Six additional overview, network and recompete checks pass. These diagnostics do not satisfy the 1,500 ms p95 or representative-load gate.
  • ImprovedApplied additive migrations 0128 and 0129 to development through the standard migrator after rollback rehearsal. Migration history advances from 128 to 130 entries; all 63 existing intelligence versions retain their prior fields, and permissions, row-level security and existing graph indexes are preserved. Historical graph snapshots are not backfilled.
  • ImprovedVerified two real legacy records through the packaged lineage service after migration. Exact versions, original source URLs, repeatable hashes and cross-workspace denial pass. Missing historical evidence and forward outcomes remain explicitly incomplete; the read-only checks write no application records.
  • ImprovedBuilt and verified exact-source API, worker and web candidate images, including manifest/configuration digests, revision labels and non-root execution. Trivy and ECR each report zero high or critical findings. These candidate application images remain undeployed.
  • ImprovedVerified the existing serving website after the development migrations with 24 Playwright checks: 14 rendered desktop/phone pages and ten authentication-boundary probes. The Find homepage action and all 911 earlier changelog entries render correctly. This validates the serving versions and public access boundaries, not private customer acceptance of the newer candidates.
  • ImprovedRecovered development verification from real system-disk and DATA1 file-creation failures while retaining the original failed runs. Checks cover actual file creation and synchronization, private runtime storage and resource guards. Lossless compression of an inactive rotated log and removal of disposable dependencies recover space without changing acceptance thresholds or retained evidence.
  • ImprovedResumed the candidate web build after the existing policy-receipt and builder-space guards stopped it. Reclaiming about 4.26 GB of unused cache from the dedicated builder preserved completed API/worker images; all three final scans passed and the builder was stopped.
  • ImprovedPublished source-bound handoffs for packaged runtime verification, recursive test discovery and the graph-query optimization. Hosted Actions refused the later runs before executing job steps because of the account billing/spending restriction; local results are recorded separately and are not presented as hosted CI success.
  • ImprovedUpdated the completion record without accepting any new M1–M14 exit gate. Complete fresh Navy coverage, the full real-data outcome/learning loop, independent benchmarks and customer review, representative load/recovery/security checks, production billing and legal/client release approvals remain open. Temporary verification tasks are cleaned up and recurring ingest/graph schedules remain disabled.

Oct 28, 2026

  • FixedPrepared historical recommendation and score lineage that requires the saved graph projection version and complete-row hash. Exact signal revisions prevent borrowing another revision’s page evidence; changed, deleted, conflicting or unversioned proof remains incomplete. All 1,903 API unit tests and three related database suites pass, with original source URLs and tenant isolation checked on two real records.
  • FixedPrepared a canonical-publication race repair that rechecks graph references under row locks through the write. Retirement, rejection or deletion after the preliminary check blocks publication, while failure alerts survive rollback. All 25 focused unit tests and three database suites pass; CI now requires this regression.
  • FixedPrepared a Navy search repair that materializes full-text matches before recency selection, preserving filters, metadata matching, stable identities and the three-second limit. The candidate returns identical complete 350-record results in 137.8 and 272.5 ms diagnostic samples. The fix remains awaiting application rollout.
  • ImprovedPrepared opportunity-score disclosures linked to the exact immutable canonical object, version and row. New outputs pin source revisions; old records resolve only through unambiguous citation IDs. Four HTTP/browser cases and eight component cases pass; missing graph, document or page history remains visible. Application rollout remains pending.
  • ImprovedExercised 37 signed-in routes and 18 opportunity-tab interactions on the serving website. Navy award history and contractor overlaps work in desktop and phone browsers; interaction checks also preserved three actual search timeouts and missing lineage controls that led to the prepared search and disclosure fixes.
  • ImprovedVerified the serving homepage, changelog and sign-in routes in desktop and phone browsers, followed by 24 public/access checks. Find wording, the complete earlier changelog, authentication return paths and rejection of spoofed development identity headers are confirmed. Expected canceled prefetches are recorded separately; candidate application changes are not implied to be deployed.
  • ImprovedPrepared narrow graph-label indexes and exact selected-node lookups, replacing the full-table JSON label scan. All 24 reader scenarios, ten index/migration checks and six complete development-result comparisons pass. Median label-count time falls from 355.3 to 168.9 ms; complete graph p95 acceptance remains open.
  • ImprovedVerified the search/lineage, graph-label and publication candidates in separate exact-source CI runs. Each records 2,729 unit passes, 520 full-browser passes, four plan passes and two member passes, with 86 declared skips and no failures or flakes. Functional, security and Terraform jobs pass; the missing current D-2 report keeps each overall run failed.
  • ImprovedRecovered digest-matched archival copies of the two missing Navy budget books and verified immutable PDF/text objects in development. Disabled, pending source registrations retain 229 page anchors and earlier evidence through rollback, committed readback and unchanged replay. Archival recovery does not establish fresh official-source availability or source approval.
  • FixedPrepared budget summaries and initiative, investment and account labels that use their supporting quotation. Unsupported monetary or initiative claims no longer survive through summary text. The full-page audit also recovers omitted Navy dollar-scale and continuation exhibits; all 68 budget and 654 worker tests pass.
  • ImprovedAudited all 555 nonempty pages across both Navy books in 40 chunks, reusing 34 model responses and making six bounded additional requests. The resulting 242 proposals include 89 quote/program matches and 153 requiring review or an unambiguous quote anchor. None is represented as a published claim or independent benchmark label.
  • FixedPrepared stricter normal budget collection: the program must appear on the cited page, the quotation must be unique across the book, and it must belong to the actual model-input chunk. All 71 budget and 657 worker tests plus the collector/history database check pass; replay preserves the 242-proposal screening result without extra model calls.
  • ImprovedPrepared a 242-row Navy field-review worksheet with original values, exact document links and quotation status. Spreadsheet text is escaped, and reviewer/verdict fields remain blank. The worksheet is ready for review but does not replace independent E-1, C-4 or D-2 benchmark evidence.
  • ImprovedCompleted a read-only census of 1,329 historical budget signals and replayed 1,252 active claims across ten books and 2,394 pages. Results preserve 607 quote/program matches, 613 program-review flags, 32 repeated quotations and all 1,220 unique quote offsets. The separate review worksheet keeps original values and blank reviewer fields; flags are not automatic false-claim verdicts.
  • ImprovedVerified historical quotation-repair safeguards against original PDF/text/raw hashes, unchanged source identities and collection times. Seventeen unsafe applications are refused; rollback, tenant invalidation and zero-write replay pass. Monetary controls and shared owners remain excluded when replacement evidence does not meet grounding requirements.
  • FixedApplied the bounded historical quotation repair in development after rollback rehearsal: 23 claim holds, 21 withdrawn active links, 43 retired source-owned nodes and 251 retired edges. Readback covers 19 SQL opportunities and 18 graph nodes, including eight unsupported retirements. Replay writes nothing; nine repeated-quotation controls/shared owners stay outside the repair.
  • FixedPrepared canonical graph withdrawal when the final supporting source disappears, and prevented unrelated relationship references from reactivating retired nodes. Canonical identities and history survive; valid new support can reactivate the same master. All 669 worker tests, both database suites and 32 source-order permutations pass.
  • FixedPrepared deterministic analytics ownership after reproducing unchanged source replay changing office confidence from 80 to 88. Conflicting vendor owners are held for review, repeated observations cannot inflate distinct award/contact counts, and unresolved potential incumbents remain excluded. Regressions and full worker/database checks pass.
  • ImprovedRetained complete original logs and browser reports for budget CI, including permission, artifact-quota and evidence-extraction failures. One run records 2,715 unit passes but fails report custody; the corrected successor records 2,727 unit passes and 516 browser passes, plus four plan and two member passes. The D-2 report gate remains failed, and earlier failed conclusions are preserved.
  • FixedRefreshed generated budget and lineage source fingerprints and their dependent claim-registry hashes. All 1,349 feature rows, public claim content and acceptance states remain unchanged; registry and changelog checks pass. Original stale-registry and canceled-run evidence remains retained.
  • FixedPrepared a compatible Docker schema 2 recovery manifest with byte-identical configuration and all fifteen original layers. Both image scanners report zero high or critical findings. Bounded operators verify immutable tags, runtime digests and version-pinned private code; original failed pulls remain recorded.
  • ImprovedPrepared an inline graph node-identity query that preserves complete real-data results. Three paired samples improve relationship-summary median time from 3,546.2 to 3,244.8 ms; 23 reader scenarios and API types pass. Slower rollup and evidence-ranking alternatives were rejected. These samples do not close graph p95 acceptance.
  • ImprovedCompleted a controlled graph-capacity comparison against a temporary larger database copy with matching node/edge populations and indexes. Its first overview still reaches the original 15-second timeout; session-only memory/window alternatives also miss the target. No capacity upgrade or permanent tuning was adopted, and all temporary cloud resources were removed.
  • ImprovedRechecked the two missing current Navy PDF endpoints from the workstation and the actual AWS collector; both still reset the connection. Source availability and approval remain held. Archival evidence does not change the recorded source freshness, paused schedules or need for independent review.

Oct 27, 2026

  • ImprovedVerified the deployed web audit repairs through actual search, editable setup, graph traversal, company-intelligence preparation, retained solicitation PDFs, contact cards, grant destinations and four audit download formats. Twenty-one visible routes pass smoke checks. Qualification and capture correctly remain review-held where eligibility evidence is missing; no successful end-to-end capture is claimed.
  • FixedDeployed field-freshness handling that follows the selected provider through normalization and company-intelligence refresh. Old preserved evidence keeps its original collection date and remains stale; successful refresh no longer makes unsupported fields appear current. The full canonical lifecycle check covers the regression.
  • ImprovedVerified the bounded development Navy identity repair while preserving all 2,383 reviewed signals and 3,019 observations. The repair stages 2,351 usable sources, retains 32 identity holds and retires quarantined source projections and two disconnected legacy Navy nodes. Unchanged replay performs no writes.
  • FixedReconciled publication for all 718 reviewed development recompetes: 710 remain held candidates and eight meet the current rule. Prepared publication refresh without re-correlating evidence and atomic graph updates that preserve holds. Rollback, readback and evidence/lifecycle preservation pass; this is a bounded repair, not recovery of the entire queue.
  • FixedRepaired source contract identities in 589 correlated projections and resolved 14 opportunity identity conflicts across 29 canonical records. The final development closure preserves 16 masters, creates 13 through Graph Builder and retains alias/history records. All 718 reviewed canonical IDs, versions and publication states match after zero-change replay.
  • FixedWithdrew one obsolete unpublished derived recompete outside the 718-record repair scope after matching SQL and graph review. Rollback, audited readback and unchanged replay preserve evidence and unrelated work. The serving reader returns ten published recompetes in the bounded check.
  • ImprovedVerified table-specific graph maintenance without changing row counts, indexes, permissions or migration history. Automatic vacuum clears obsolete rows and all six actual application-reader checks complete within the existing 15-second deadline. Complete overviews still miss the 1,500 ms p95 target.
  • FixedPrepared explicit PostgreSQL bulk-event draining and grouped graph-label counts. Six complete count comparisons, 23 reader scenarios, the graph-builder database fixture and 649 worker tests pass. Exact-source API/worker images pass both scanners; sampled complete overviews remain about 8–10 seconds, so performance acceptance stays open.
  • FixedCorrected browser assertions to match incomplete company-profile guidance without inventing company facts. The corrected run records 516 full-browser passes, four plan passes and two member passes, with 86 declared skips and no failures or flakes. Four CI jobs pass; the missing D-2 live report keeps P0 failed, and the original four assertion failures remain retained.
  • ImprovedProfiled the exact serving graph reader using a restricted, read-only development task. Six complete result comparisons show that delaying entity display-name reads does not improve the median, so that alternative was rejected. Original query plans, deadlines and cleanup receipts are retained; no persistent settings changed.
  • ImprovedDeployed the Navy award-history wording and verified eight desktop/phone routes plus both Navy interactions with no console or network failures. All 911 earlier public updates remain visible. Follow-up signed-out checks preserve authentication return paths; hosted CI refusal is retained separately from the successful deployment and browser evidence.
  • ImprovedReproduced and corrected CI checkout access to shared Git objects using an independent clone with complete history and no shared object paths. Recovered stalled package fetching in the dedicated DATA1 builder while preserving its storage, memory limit and cache. The corrections and original failures remain recorded separately from final builds.
  • ImprovedUpdated development ingest/graph definitions to a scanned recovery image and retained an available previously deployed rollback image. Recurring schedules remain disabled. Queue backlog, fresh Navy source retrieval, Stripe live activation and independent release gates remain open.
  • FixedNine retained Navy records supported only by budget evidence are held as candidates instead of published recompetes when their evidence does not establish a qualifying contract end date.
  • ImprovedThe retained Navy budget signals now have graph paths to their programs and accounts, with original source evidence and page citations preserved.
  • FixedReviewed Navy budgets, notices and awards connect through a source-qualified Navy agency hierarchy. Source identifiers retain their original meanings, and existing program and account identities are preserved.
  • FixedSAM notices with the exact recorded Defense/Navy department path can resolve the Navy component when a subagency code is absent. Conflicting codes and incomplete or reversed paths remain withheld.
  • FixedThe reviewed Navy sources with quarantined identities no longer support active graph relationships. Their original records, observations and identity history remain available for review.
  • FixedValid supporting contractor records can replace details inherited from a quarantined source even when their source priority is lower. Unsupported capabilities are removed and the replacement is audited.
  • FixedThe agency graph describes recorded awards as award history rather than claiming that every listed contractor is a current incumbent.
  • FixedThe development graph overview loads again after graph-table maintenance. The Navy agency view now returns supported historical contractor awards.

Oct 26, 2026

  • ImprovedUpdated web image builds to reuse npm and Next.js caches, prefer integrity-checked cached packages and copy output with runtime ownership. Release dependency audits and image scans remain required. Build timing and exact-image verification were recorded rather than skipping the release checks.
  • ImprovedVerified the API/worker build optimization that installs only required service workspaces and preserves package caches. Exact application output and scan gates remain part of release verification.
  • FixedDeployed the requested temporary homepage text “Fin contracts I can win,” then restored “Find contracts I can win” after the follow-up correction. The final wording was checked on the rendered desktop and phone homepage, and original verification logs are retained.
  • FixedPatched the web framework after release image scans identified security findings, and retained the final patched-image verification. Package caching and shorter builds do not bypass image scanning.
  • FixedPrepared request-processing dependency fixes for body-parser, Multer, Zod and qs after a fresh scan found three high-severity issues. Seven request-boundary checks, web/service types and lint pass, and the final dependency scan has no high or critical findings. Clean-install resolution and original failed fixtures remain documented.
  • ImprovedFocused delivery and CI on the web application and its API, worker, database and shared services. Native mobile, Electron desktop and terminal/CLI products are deferred as requested. Desktop and phone browser verification, billing, security, data integrity and independent acceptance requirements remain in scope.
  • ImprovedCarried the previously published weekly changelog through October 21 into the web repair branch without dropping historical entries. Duplicate cherry-picked commits are reconciled to the same work in the weekly inventory.
  • ImprovedAPI and worker image builds install their own required workspaces, reuse integrity-checked package caches, and copy application output with its runtime ownership. They no longer install the web build toolchain or recursively change ownership across every dependency. Image scanning remains a release gate.
  • FixedGlobal and graph search separate full-text lookup from metadata matching, retain recent deduplicated results, and enforce a database query deadline. Additive metadata indexes prevent the observed unbounded search scans.
  • FixedCompleted setup opens the editable company profile. Empty contract feeds distinguish saved targeting from missing company context, and Home describes profile completeness without claiming bid readiness.
  • ImprovedOpportunity workspaces and contract discovery can explicitly prepare company intelligence through the existing source, graph, publication and review checks. Bounded discovery refresh uses the saved company targeting.
  • FixedSolicitation analysis can use a hash-verified preserved SAM notice and its public PDF attachments. Document identity, download size, permitted redirects and PDF hashes are checked, and the resulting analysis retains attachment citations.
  • FixedImported contact cards omit instructional text and malformed phone values while retaining valid public contact details. Original source evidence remains unchanged.
  • FixedGrant links route Simpler.Grants.gov UUID records to their actual public opportunity pages; legacy numeric Grants.gov links remain supported.
  • FixedAudit CSV, JSON, Excel and PDF actions download directly, avoiding failed page-prefetch requests. The homepage action reads “Find contracts I can win.”

Oct 21, 2026

  • ImprovedVerified in development: the API reporting, grounded budget extraction, and browser-demo rendering repairs are deployed. Desktop and phone checks covered the changelog, Developer Console, and embedded demo without console or relevant network errors.
  • FixedIn development: approved prediction history now reaches both opportunity assembly and source reconciliation. Unapproved or revoked history stays neutral, and the score retains its feedback explanation and sample-size checks.
  • FixedIn development: recompete publication now uses a current award ending within 12 months plus corroborating agency activity. Forecast dates cannot stand in for an award end, and inferred recompete hints cannot corroborate themselves.
  • ImprovedRecompete review checked all 718 published development records against the current detector. Nine qualify; 709 need correction or further review. The nine retained Navy recompetes lack an award end and remain queued for a bounded correction; this audit did not change them.
  • ImprovedPrepared the nine-record Navy correction with original evidence preservation, stale-plan rejection, whole-batch rollback, audit records, and retry checks. Eleven local operator scenarios passed; application to development is still pending.
  • FixedIn development: MCP requests use separate request-local servers and bounded body and tool inputs. Concurrent tenants with matching JSON-RPC IDs remain isolated; import routes and signed billing-webhook bodies retain their existing behavior.
  • ImprovedPrepared the original-plan PostgreSQL graph reader with a separate database-enforced read-only identity, explicit backend selection, and preserved Neo4j replay state. Traversal and privilege fixtures pass; the new reader and its additive migration registration await rollout.
  • ImprovedIn development: graph traversal uses covering indexes for incoming links, outgoing links, evidence selection, and overview identities. Fixture checks preserve accepted endpoints, current observations, deterministic winners, and the complete top-three evidence policy.
  • ImprovedIn development: teaming queries resolve office and agency links once per read snapshot. Three paired development-data comparisons preserved the complete results and reduced sampled query times from 11–13 seconds to about one second; representative load acceptance remains open.
  • ImprovedIn development: graph neighborhoods avoid a redundant filter while retaining scoped relationships and authoritative evidence ranking. Paired opportunity, agency, and contractor reads preserved the complete graphs and reduced sampled opportunity and contractor read times.
  • ImprovedIn development: the graph overview reuses accepted endpoint identities and limits degree aggregation to ranked agencies and contractors. All 54 paired results matched across nine query families; sampled overview median improved from 9.81 to 6.68 seconds, with the 1.5-second p95 target still open.
  • FixedIn development: derived graph analytics exclude expired relationships and retired or unaccepted endpoints, including unsupported office dominance. Fourteen added database lifecycle checks passed while preserving valid budget evidence.
  • FixedIn development: contact, vendor, contract-vehicle, and dependency-insight calculations use the same current-evidence rules. Nine additional database scenarios verify that stale evidence cannot keep unsupported metrics or insights active.
  • ImprovedPrepared graph-event recovery restricted to an explicitly reviewed list of at most 2,000 events. Seven database isolation and replay checks passed; the retained 880 Navy signals are scoped for recovery without consuming unrelated queue work.
  • ImprovedPrepared temporal graph recovery for expired and newly due relationships, with exclusive execution, reviewed inventory hashes, bounded batches, preserved history, and idempotent replay. Six fresh local scenarios passed; the development recovery has not run.
  • ImprovedGraph verification now runs the real Neo4j engine fixture as its native container user and waits for its actual health endpoint. Existing projection assertions remain in place.
  • ImprovedBrowser verification uses bounded private temporary storage, while complete reports stay with their tested source. Filesystem checks and repeated page-creation checks passed; failed and cancelled runs remain available for review.
  • ImprovedPrepared a DATA1-backed image builder with bounded disk and memory use. Filesystem mounting, restart, cleanup, and a network-disabled command-execution fixture passed, providing an alternative when the RAM-only builder lacks working space.
  • ImprovedGraph performance experiments retain their original query plans and complete-output comparisons. Slower query variants and memory changes were rejected, including the latest aggregate trial; the application timeout and 1.5-second p95 requirement stay in force.
  • ImprovedRelease verification refreshed graph evidence fingerprints and retained exact scan dispositions without changing feature statuses or security rules. Original failed checks, full reports, and cleanup records remain traceable.
  • ImprovedThe latest core candidate passed its security jobs and reached complete browser reporting, with 515 first-attempt passes, one retry-only pass, and 86 declared skips. Four plan checks and two member checks passed. The zero-flake gate rejected the run, so that core candidate was not deployed.
  • ImprovedProvider access was rechecked: a bounded Anthropic inference succeeded, while the saved SAM.gov key still returned an authentication error. The official Navy catalog and both missing books returned rejection pages in direct and isolated-browser checks; fresh source coverage remains open.
  • ImprovedFree graph-hosting capacity was checked against the measured development graph. Even the larger published AuraDB Free limits cannot hold the complete current graph; PostgreSQL recovery remains under validation without reducing the graph to fit the free tier.
  • ImprovedRelease status continues to show the remaining full-data graph-to-learning loop, independent benchmarks and customer reviews, representative load and recovery, production billing, and legal/client approvals. Prepared fixes and passing local fixtures do not close those requirements.

Oct 20, 2026

  • ImprovedVerified in development: 880 grounded Navy budget signals now retain 880 page citations, 880 raw snapshots, and 2,640 evidence links. Repeating the import created no duplicate signals or links; original collection dates were preserved.
  • ImprovedNavy document verification covered both retained FY2027 O&M and Weapons Procurement originals: 1,321 pages and all 96 planned budget-bearing chunks. Of 933 candidates, 880 had exact supporting quotations; 53 were rejected and 32 ambiguous funding fields were withheld.
  • ImprovedCapacity verification recorded the Navy import at 291.9 records per minute, below its 500-record target. That limitation remains visible alongside the successful evidence and duplicate-replay checks.
  • ImprovedThe approved development database expansion from 20 to 30 GiB completed. Concurrent graph-index builds and routine maintenance preserved graph rows and access controls, while temporary release storage moved to DATA1.
  • ImprovedVerified API-key quota behavior through the hosted gateway: 130 client calls matched 130 server executions and durable usage events, including eight rate-limit responses. Application-enforced limits no longer trigger extra gateway retries.
  • ImprovedDevelopment access checks covered 18 signed-out route redirects across desktop and phone and both rendered sign-in forms. All 86 declared browser skips were reconciled with their viewport, plan, member, or deployed-authentication coverage and remain reported as skips.
  • ImprovedVerified recovery of an overwritten and deleted raw-evidence fixture from its original S3 version with matching bytes and complete cleanup. Development HTTP and security-page checks were also repeated; wider recovery and independent security acceptance remain open.
  • ImprovedDevelopment focus now prioritizes the web application and its required backend. Native mobile builds and store-release work are manual and deferred, while desktop and phone-browser verification continues.
  • FixedPrepared a browser-demo rendering fix for GPU context loss. The embedded preview uses CanvasKit's supported CPU renderer, and the web-demo build preserves that setting. Ten desktop and phone-browser repetitions passed with all interactions and console-error checks retained; development rollout remains pending.
  • FixedPrepared core-loop reporting corrections so capture activation uses only work from the deciding workspace and PWin calibration includes only eligible outcomes. A new methodology version preserves older snapshots while excluding them from current results. Seven PostgreSQL checks pass; deployment and accepted customer KPI reports remain pending. Criteria: K-1.5, K-1.7, K-1.8.
  • FixedPrepared stricter budget evidence checks for source-supported NAICS codes and solicitation issuance dates, scaled monetary tables, and separately stated funding totals. Unsupported values stay unknown instead of contributing invented classifications, dates or funding to predictions. Criteria: C-3.3, C-3.4.
  • ImprovedPrepared schema-constrained budget extraction and a configurable, bounded response limit for dense documents. Truncated responses remain failures, and original responses are retained when a chunk is retried or subdivided. Criteria: C-3.2, C-3.3.
  • FixedPrepared a rate-limit response fix that identifies application-enforced limits to the gateway, preventing automatic retries in the proxy regression while preserving separate usage records for distinct requests. Hosted verification remains pending.

Oct 19, 2026

  • ImprovedVerified Stripe sandbox behavior for incomplete-payment expiry, payment recovery, and failed-renewal recovery. The earlier annual upgrade/downgrade, proration, signed-invoice, and duplicate-webhook evidence was reconciled; temporary fixtures were cleaned up and live billing approval remains open.
  • ImprovedVerified a fresh DOJ budget extraction against its original PDF pages: seven facts and five supported monetary values. The same release review covered 38 rendered development pages and 64 original screenshots.
  • ImprovedAPI-key lifecycle verification covered live and sandbox scopes, one-time secret display, rotation, immediate revocation, expiry, tenant binding, and durable usage accounting. Owned credentials and sign-in sessions were revoked after desktop and phone checks.
  • ImprovedConcurrent quota verification admitted exactly 120 of 200 requests across two independent database pools. Migration preservation, reset, clock skew, revocation while waiting, separate keys, tenant isolation, and database-unavailable behavior passed.
  • ImprovedContinuous integration now schedules workspace suites sequentially to avoid resource contention while retaining their assertions and deadlines. All 49 CLI tests passed on the same source, and graph-confidence fixtures use one fixed clock for active and expired relationships.
  • ImprovedObject-store test fixtures use per-run ownership and cleanup checks, preventing stale singleton containers from blocking later verification. Complete original browser reports and failed-run diagnostics remain separate from release acceptance.
  • ImprovedSecurity and release checks preserve original outputs, validated evidence checksums, dependency-scan freshness, and source-bound registry fingerprints. Historical records are retained when a later CI attempt fails or is interrupted.
  • FixedPublic API requests now share one durable quota per key across API instances and restarts. Revoked and expired credentials cannot consume a new allowance, and concurrent requests use the same database clock and counter while preserving tenant isolation.
  • FixedRate-limit rejections now retain the documented structured error response, remaining-request headers, and retry delay. Unavailable quota storage cannot silently grant requests through a local fallback.
  • FixedExisting API keys now follow the workspace's current subscription and live API entitlement. Canceled, incomplete, expired-trial, and suspended accounts cannot read workspace data; past-due accounts retain read access while paid runs and action approvals remain blocked. Restoring access does not require replacing an otherwise valid key.
  • FixedAPI and MCP action requests now require the key creator's current membership to be active. Disabled and pending memberships cannot approve or reject actions or use paid agent endpoints through a previously issued key.
  • FixedGraphQL responses now include the same request correlation IDs used by REST and MCP, allowing each response to be matched to its API usage record, including rejected requests.
  • ImprovedApplied and verified the reviewed budget correction in development: 60 records and 164 monetary fields corrected, two historical-only funding claims held, and eight control records preserved. The source documents and original observations remain available.
  • ImprovedRecalculated the affected development opportunity scores after the reviewed funding corrections. The run created 132 jobs and 120 score outputs while preserving the original 16 jobs and 12 scores; replay checks produced no duplicate changes.

Oct 15, 2026

  • ImprovedThe previous complete weekly changelog was carried into the core release without changing the implementation. Original historical-correction and rescoring rehearsals passed, and desktop and phone checks retained every earlier entry.

Oct 14, 2026

  • FixedPrepared a Developer Console fix that waits until tabs are ready before accepting the first click and preserves entered webhook details when switching tabs. Desktop and mobile browser regressions pass locally; rollout is pending.
  • FixedPrepared budget aggregation that counts a shared funding allocation once while retaining the separate program claims and their citations. This prevents overlapping AI initiative references from inflating opportunity funding totals; deployment verification is pending.
  • FixedPrepared a correction so saved intelligence versions identify the budget calculation actually used. Version-history and shared-allocation regression checks pass; rollout is pending.
  • ImprovedPrepared reviewed procurement-table corrections that distinguish quantity from cost, thousands from dollars, enacted funding from total funding, and FY2026 comparisons from FY2025 actuals. The repair covers 22 records and preserves the original source pages; live application is pending.
  • ImprovedPrepared a funding hold for two programs supported only by historical spending. Their original records remain available, while current opportunity links and dependent scores are withheld until current funding is supported. Local rollback and replay checks pass; live application is pending.
  • ImprovedPrepared source-specific repairs for 31 additional DOE, GSA, and VA budget records. The corrections preserve fiscal-year roles, appropriation or obligation basis, source precision, program scope, unknown values, and the citation supporting each amount. Eight reviewed control records remain unchanged; live application is pending.
  • ImprovedRelease verification now checks that the complete browser reports belong to the tested source and exact run before accepting their results. Report contents, original files, and separate full-workspace, plan, and member results remain available even when another check fails.

Oct 13, 2026

  • FixedOpportunity scores are now bound to the current company-profile revision as well as the current signal and evidence. A profile change during calculation prevents an outdated result from being published. The repaired API and a bounded scoring run were verified in development.
  • FixedBudget extraction now recognizes formatted currency values, including separators and explicit million or billion units, instead of silently dropping supported amounts. The repair passed source-bound regression checks and development verification.
  • FixedBudget amounts must occur in the quotation that supports the same claim. Ambiguous repeated quotations and unsupported monetary values are rejected, while the original document and page references remain available. Development verification passed; funding-role quality remains a separate review.
  • FixedPrepared extraction support for currency-scaled budget tables, including headings such as dollars in thousands and dollar amounts in millions. The repaired filter keeps all previously selected text and recovers omitted table chunks. Thirteen official books and 2,232 pages were checked; rollout is pending.
  • FixedPrepared source-health reporting that marks incomplete budget extraction as degraded and treats a document with no extractable chunks as a failure. Partial processing no longer qualifies as complete coverage; rollout and full-registry extraction remain pending.
  • FixedPrepared a funding-role guard that keeps a program increase or reduction from being presented as the total funding request. Replaying a real extraction clears unsupported totals while retaining supported values and their citations. A fresh run with the revised prompt remains pending.
  • FixedPrepared clearer opportunity wording for companies whose profile exists but whose qualification is not yet available: the page says Qualification pending instead of Profile required. Source checks pass; rendered rollout verification is pending.
  • ImprovedPrepared reviewed corrections for five VA records whose table values were stored in dollars instead of millions. The repair binds all 13 monetary fields to the original unit, fiscal-year, program-row, and net-budget-authority evidence. Original observations and collection dates are preserved; live application is pending.
  • ImprovedExtended the reviewed VA correction to two obligations-table records and six additional fields. Obligations remain distinct from budget authority, including the enacted-with-transfers comparison. Invalid units, years, funding bases, changed source rows, and conflicting targets are rejected; live application is pending.
  • ImprovedVerified a bounded development scoring recovery for six eligible budget and contract records in shared and company scopes. Sixteen jobs produced 12 persisted scores, repeated delivery made no duplicate change, and two quarantined controls produced no scores. Wider backlog recovery remains open.
  • ImprovedCompleted the saved federal-contract collection window and all four original dead-letter replays, retaining the earlier failures and collection checkpoints. Overlapping windows and retries are not counted as additional unique records; recurring source cadence remains under review.
  • FixedClosed a superseded SAM collection run through the guarded recovery path while preserving the newer run's ownership, quota state, and source-health evidence. This cleanup does not resolve the rejected SAM credentials.
  • ImprovedVerified the annual Growth subscription with a genuine paid Stripe test invoice and its signed webhook. The invoice matched the correct workspace. This is sandbox billing evidence; other plan cycles and live billing activation remain separate checks.
  • ImprovedVerified consumed-invoice replay handling against the development endpoint: a tampered signature was rejected, two signed duplicates made no change, and a Stripe retry completed. Retained redacted receipts stayed intact and a deleted test account was not recreated.
  • ImprovedBrowser verification now retains separate complete reports for workspace workflows, exact subscription-plan checks, and managed-member onboarding, preventing a later test step from replacing an earlier report.
  • FixedGenerated staff test credentials are masked before later CI steps can print their environment, preserving authentication diagnostics without exposing passwords, session secrets, or authenticator seeds.

Oct 12, 2026

  • ImprovedCompleted the reviewed historical budget repair in development: 294 histories were rekeyed, 74 ambiguous or unsupported histories quarantined, and 80 distinct claims restored. All 374 current claims were checked against their original source records and revision-bound quotations; original observations and collection dates remain preserved.
  • ImprovedOpportunity pages now explain when source records need review and withhold scores for quarantined evidence. Restored records retain their normal presentation. All 449 budget records and the three quarantine classes were checked on the development release, including desktop and mobile rendering.
  • FixedRescoring now retains every changed batch in a completed ingestion window and pages through all matching signals instead of stopping at 5,000. Replay and checkpoint checks preserve earlier work when a later batch changes nothing. The recurring worker rollout remains pending.
  • FixedScore calculation now uses only evidence from the signal's current revision and rejects quarantined identities. Signals are locked and rechecked before results are published, including a source correction or quarantine that arrives after selection.
  • ImprovedImplemented complete immutable graph-resolution decision snapshots, including known exact matches, aliases, newly resolved identities, unresolved candidates, and empty projections. Applied audits reference the exact snapshot used. Local checks pass; runtime graph measurement awaits restored graph access.
  • ImprovedPrepared read-only entity-resolution exports that retain the complete declared population and original evidence. Missing, stale, unapplied, quarantined, or unbound manual decisions block export instead of silently shrinking the population. Runtime graph measurement and independent review remain pending.
  • ImprovedAdded reproducible entity-resolution precision evaluation with frozen samples, explicit abstentions, and the original greater-than-98-percent threshold. Synthetic regression checks pass; real population labels and independent precision acceptance remain open.
  • FixedSubscription invoices can now be attributed before customer linking finishes. Conflicting workspace evidence is rejected rather than assigning an invoice to the wrong tenant, while supported signed invoice routes remain available.
  • FixedSigning in no longer reactivates a disabled workspace invitation. Access requires explicit reinvitation, and read-only members remain unable to change the company profile. Real identity-provider checks passed in development.
  • FixedConcurrent invitation claims now keep the member in the assigned workspace and preserve the intended role, preventing competing sign-in requests from creating the wrong membership.
  • FixedAPI usage is retained when a request transaction rolls back. Bounded development verification matched 124 actual server executions to 124 durable usage events across 122 client invocations, preserving retries and error responses rather than losing billable activity.
  • FixedManaged workspace members inherit the current company setup and open their role-appropriate home instead of being sent through owner-only company onboarding. Desktop and mobile checks passed with real owner and viewer sessions.
  • FixedCapacity verification now rejects missing or invalid evidence before sending load traffic. Negative timings, invalid counts, malformed cohort data, and ambiguous enablement values cannot produce a misleading readiness result. Representative deployment capacity remains a separate gate.
  • ImprovedVerified annual subscription upgrades from Growth to Growth Plus and downgrades back to Growth in the Stripe sandbox. Desktop and mobile pages matched the updated plan and entitlements. Proration previews preserved both changes without attempting a new payment; live billing activation remains separate.

Oct 8, 2026

  • ImprovedRelease notes now focus on what changed, with clear New, Improved, and Fixed labels and a complete dated history.
  • ImprovedBudget claim matching preserves distinct quoted claims and rejects incomplete extraction results. Local identity regression checks pass; rollout is still pending.
  • ImprovedBudget-history repair retains original observations and collection dates while tying quotations to the correct signal revision. Application replay passed locally; final readback and rollout are still pending.
  • ImprovedHistorical budget reconciliation separates recoverable claims from mixed, colliding, or unsupported histories, preserving the original evidence while quarantining uncertain records. This repair has passed a local application rehearsal; rollout remains pending.

Oct 7, 2026

  • FixedMarket Research evidence timestamps display consistently in UTC across desktop, mobile, and different browser time zones.
  • FixedOpportunity scores and qualification views stop using results calculated from superseded signal revisions.
  • FixedExpired opportunity intelligence is withheld from current views while its historical evidence remains available for audit.
  • FixedWithdrawn source relationships no longer feed current opportunity lists, capture selection, new outcome attribution, or predictions.
  • FixedWatchlist and Admin controls wait for initialization before accepting changes, preventing early input from being lost.
  • FixedDashboard sections opened during page loading retain their expanded state, and animated controls remain readable as they appear.
  • ImprovedHistorical contract-signal repairs preserve original observations and source documents. Ambiguous records stay quarantined, and incomplete collection remains visible in source health.
  • FixedNewly created and refreshed source observations retain the correct signal revision, including observations from internal and derived signals, while earlier observations remain unchanged.
  • FixedHistorical contract repairs update citations, source correlations, and stale opportunity intelligence together, preventing a partially repaired record from reaching downstream views.
  • FixedGraph cleanup retains relationships still supported by another source and selects the next eligible evidence link when the previous link is retired.
  • ImprovedGraph recovery processes bounded stages, preserves unchanged relationship history, and finishes cleanup after replacement relationships have refreshed. Complete graph reconciliation remains pending.
  • ImprovedGraph integrity checks can inspect large node and relationship sets through bounded, indexed pages using the dedicated reader account. Detected relationship mismatches remain unresolved until a complete comparison passes.
  • FixedFederal contract action dates normalize consistently during historical replay and current collection, preventing equivalent dates from producing different evidence values.

Oct 6, 2026

  • FixedScheduled reports recheck the creator's current workspace access and subscription before generation, so revoked access or a downgraded plan cannot keep producing restricted reports.
  • ImprovedReporting explains which plan and workspace role are required, including when the selected workspace view hides paid reporting features.
  • FixedSaved-report dialogs fit mobile screens while keeping their actions and report details accessible.
  • FixedApproved workspace deletion can complete its governed purge while preserving separate workspaces and shared reference data.
  • FixedFederal contract ingestion preserves full contract identifiers, distinct transactions, original source XML, and durable page progress across retries.
  • FixedMissing or invalid labor-rate values remain unknown instead of appearing as valid numeric evidence.
  • FixedCompact opportunity links keep a stable width, improving readability and preventing layout shifts. Previously issued short links and UUID routes redirect to the canonical link while preserving repeated query parameters.
  • ImprovedDependency and image-processing security fixes are included in the verified development release.
  • FixedScheduled report dispatch preserves the database's exact due time, allowing eligible reports to run reliably while concurrent dispatch and replay retain a single report.
  • FixedRestoring a subscription after an access-related reporting suspension leaves its schedule disabled until an authorized user explicitly re-enables it; earlier saved reports remain unchanged.
  • ImprovedAutomatic Morning Brief generation was verified at the normal local morning cutoff in AWS development. The next scheduled run reused the same daily version and preserved earlier briefs; representative tenant capacity remains unverified.
  • FixedContract graph relationships use agency and parent-award context, keeping contracts with the same short identifier separate while preserving transaction-level evidence.
  • FixedFederal contract ingestion retains the provider's agency names and rejects incomplete or unclosed source entries before advancing its collection checkpoint.
  • FixedResuming federal contract collection tolerates formatting-only page changes while detecting changed action content before continuing from a saved page.

Oct 5, 2026

  • FixedAgency forecast collection follows all VA result pages and reports freshness gaps when source coverage is incomplete.
  • FixedGrants and labor-rate collection reconcile returned pages and expose coverage limits instead of silently presenting partial results as complete.
  • FixedFederal Register searches accept valid zero-result responses, and OPM contracting information uses its current official location.
  • ImprovedInterrupted source collection retains its verified window and saved progress so a later run can continue without discarding completed work.
  • ImprovedScheduled reporting is active in AWS development on a 15-minute cadence after its required credentials and permissions are ready. Automatic invocation and repeated processing were verified; automatic email remains disabled.
  • FixedGraph recovery resolves obsolete collection requests against later recorded identifier rejections while preserving their audit trail and keeping invalid signals out of the graph.
  • ImprovedGraph access was restored in AWS development, with authenticated desktop and mobile views verified and bounded backlog recovery resumed. Final reconciliation remains open.
  • ImprovedBilling verification covers the deployed sandbox's subscription prices, add-ons, and required webhook events. Live-payment activation and independent billing acceptance remain pending.

Oct 1, 2026

  • FixedThe public changelog once again renders the complete evidence-backed release history instead of a 73-entry curated subset, restoring every August date and the current October 1 release group while retaining the release metadata recorded for each change.
  • ImprovedThe public changelog is now generated from every New, Improved, and Fixed row in this ledger, and CI rejects any future drift between the engineering source and the rendered history; verification, known-limit, and scope-decision records remain internal.
  • ImprovedIndependent E-1/C-4/D-2 execution now points to a byte-reproducible review archive with locked queues, custody records, conflict screening, signed-attestation forms and exact return checks; prepared data remains explicitly ineligible for acceptance until named qualified humans complete and sign it.
  • ImprovedIndependent security assurance now has a separate deterministic issue pack binding the AWS-dev target register, manual application/API pentest rules, findings and retest ledgers, assessor screening, incident tabletop roles, response runbook and action-closure records.
  • FixedNext.js moved from 16.3.4 to 16.3.8 to remove the critical `next/og` ImageResponse advisory, while Nest platform packages moved to 11.2.7 and Multer to 2.4.0 to remove the aborted-upload disk-write advisory; the production dependency audit now reports zero vulnerabilities.
  • ImprovedRemediated commit `e7e314ad56b8bbdb4dd755812fa3280d705038f5` is deployed to both AWS-dev App Runner services. API operation `fea0ed8cbe6e437981aca442a0eebff4` and web operation `23025be63edc43c18c87753f7d000a01` succeeded with their non-release configuration preserved.
  • FixedHosted security validation no longer treats the public RFC 6238 TOTP test vector or recorded AWS deployment identifiers as deployable credentials; pinned Semgrep now reports zero blocking findings and Gitleaks reports no leaks across the full review history.
  • FixedThe consolidated PR feature-freeze baseline now recognizes the already governed K-1 KPI service, the PR carries a current supported security declaration, and the deployment-runtime contract no longer checks for an obsolete inline migration command already covered by release-worker tests.
  • FixedClean-checkout CI now recognizes the web app's direct dependency on the shared contract package, so shared declarations finish building before the web typecheck begins instead of relying on a developer's existing `dist` directory.
  • FixedMigration safety now permits a narrowly proven add-nullable, exact-table backfill, then `SET NOT NULL` sequence while continuing to reject constraints on existing, unfilled or differently filled columns as contract operations.
  • FixedHosted browser acceptance now starts its managed-scan object store from a verified digest of the maintained Silo S3-compatible service, replacing the removed floating MinIO image while preserving the existing health and bucket-bootstrap contract.
  • ImprovedAWS release infrastructure now declares all three ECR repositories immutable, publishes only exact release tags, and uses idempotent digest-derived retention tags. The S3 backend and bucket default both use a rotating customer-managed KMS key, and restore drills explicitly inherit the encrypted source key and refuse an unencrypted source.

Sep 30, 2026

  • ImprovedExact changelog revision `802d2fd0cfcfe0ea5727a5ee94c8148cbd3a6eb9` is deployed to the AWS dev web service as `acceptance-802d2fd-20260930-changelog` at ECR digest `sha256:bc9dd2ef79362b607c384cc0ac01072fee69ed539ad6a7df18829414866ce3a2`. Trivy and the completed ECR scan report zero high or critical findings, App Runner operation `1f441c32bcd3436bab566b491a443601` succeeded, the service is running and its non-image source configuration is unchanged.
  • ImprovedLive AWS dev changelog verification now passes on desktop and mobile: HTTP 200, 73 rendered capability entries with 73 maturity labels, exact September 23-30 group counts, September 30 first, no horizontal overflow and zero console, page, HTTP or actionable request failures. Routine aborted Next.js root prefetches remain recorded separately.
  • ImprovedThe customer changelog now reconciles the September 23-30 delivery window into 61 dated capability updates covering billing, evidence lineage, company intelligence, search, briefs, administration, source collection, graph integrity, mobile synchronization and release governance. Every public item retains its recorded maturity metadata and excludes internal infrastructure mechanics.
  • ImprovedA machine-readable weekly inventory now binds this reconciliation to all 133 commits from `86903f04b54000a8d451dd8943dbd18292bb9398` through `5ba1089b2211e220d31a8278a9634e8863715cfb`, including commit date, exact SHA and subject. September 26 and 27 have no commits in the governed range and therefore do not receive invented release groups.
  • ImprovedA fresh local PostgreSQL reset, migration and seed produced six canonical materialized opportunities that exercise source evidence, graph context, qualification, scoring and customer-decision paths without relying on stale acceptance data.
  • FixedExisting scored-opportunity clients can continue using `/opportunities/scored`; the compatibility route now returns canonical Layer 3 evidence, qualification, score and decision state rather than a separate scoring model.
  • FixedAcceptance seed data now supplies complete evaluation records for the intelligence loop while preserving preliminary, withheld and source-gap states where the governing evidence does not support a released recommendation.
  • ImprovedThe full authenticated browser suite executed 500 checks across eight shards plus four exact plan-entitlement checks, with 504 passes, 86 declared conditional skips and zero failures. Rendered evidence covers core customer, owner, administrator, staff and mobile synchronization paths.
  • FixedStaff authentication tests now complete configurable API-backed MFA challenges and retain the distinct Admin, Developer and Customer Service permission boundaries instead of depending on a fixed local verification shortcut.
  • FixedDesktop and mobile layout regressions were corrected across revenue, radar, Morning Brief, operations, staff and lineage evidence views; long controls and evidence text remain readable within their containers.
  • ImprovedThe API unit regression completed 1,853 tests across all eight workspaces, with no failures, cancellations or unexpected skips.
  • ImprovedTwenty-two backend lifecycle command groups passed, including all 230 tenant-isolation cases, real Neo4j projection and reconciliation, governance, billing, signed webhooks, recorded SAM replay, source health and Layers 3-9 contracts.
  • FixedBilling lifecycle verification now detaches synthetic Stripe identifiers after test cleanup, while signed webhook retry checks remain restricted to the operator-scoped path used by the governed lifecycle.
  • FixedPublic OAuth callback checks now use the current framework dependencies and continue to prove callback validation, redirect correlation and protection of adjacent routes.
  • ImprovedLint completed with four retained Next.js navigation warnings, type checking passed in all eight workspaces and production builds passed in all six build workspaces.
  • ImprovedGenerated truth checks validated 37 product-truth rows, 24 public-claim rows, 1,349 Layer 1-9 feature rows and all 201 literal client acceptance rows while preserving 32 honestly thin evidence rows.
  • ImprovedFeature-freeze, failure-mode, agent-evaluation, debt, OpenAPI compatibility and migration-safety controls all passed against the final acceptance candidate; migrations 0091-0120 retain explicit safety classifications.
  • FixedThe production dependency audit has no unreviewed high or critical finding. `image-size` is pinned to 2.0.4 and the CSV, JSON, spreadsheet, PDF and PowerPoint export regression confirms valid output plus formula and prototype-pollution protections.
  • ImprovedPinned Gitleaks 8.30.1 scanned the complete 473-commit candidate history without an unignored finding; historical exceptions are restricted to exact commit-bound fingerprints rather than broad path exclusions.
  • ImprovedA separate scan checked 19 generated acceptance values across 6,102 bounded source and evidence files and found no retained generated secret.
  • ImprovedTerraform 1.15.8 initialized the locked AWS provider set, validated the infrastructure configuration and passed recursive format checks.
  • ImprovedFlutter analysis passed, 20 mobile tests passed, app-to-web and web-to-app pursuit synchronization passed, and release web plus arm64 debug Android artifacts built successfully.
  • ImprovedAWS dev returned HTTP 200 for the public landing page and changelog with no console errors, page exceptions, actionable request failures or horizontal overflow. This is deployed public smoke evidence; it does not claim that the September 30 review branch is deployed.
  • ImprovedThe final acceptance packet now contains checksummed evidence for clean-data setup, browser runs, backend contracts, static checks, mobile builds, infrastructure validation, dependency security and generated registries.
  • ImprovedIndependent-review sourcing now records public qualification evidence and outreach-ready materials across multiple practitioner channels while leaving assignment, returned work, payment and signed attestation fields empty until a qualified human accepts the engagement.
  • FixedGeneral-availability checks continue to fail closed when independent E-1 acceptance, usability sessions, penetration testing, incident exercise, SAM allocation, production provider recovery, capacity, legal approval or release-owner signature is missing.
  • ImprovedThe optional G-3.11 landing-page experiment is recorded as deferred for the P0-hardening phase. The current reviewed treatment remains, and any later experiment requires an approved hypothesis, metric, allocation, duration, stop condition and rollback plan.
  • ImprovedLegal and release decision records now bind future counsel and product-owner approvals to exact artifact hashes and an exact executable revision while leaving all signature fields unclaimed.

Sep 29, 2026

  • ImprovedA reversible AWS dev end-to-end run now verifies the customer loop from source evidence and canonical intelligence through graph context, withheld preliminary PWin, Pass, Watch, Pursue, owned task propagation and bounded no-bid learning. All 38 checks passed on desktop and mobile with zero console, page, bad-response or actionable network failures; mutable state was restored, production was unchanged and the independent U-1 sessions remain 0/3.
  • FixedThe consolidated acceptance registry now classifies prepared queues, rubrics, execution packets and issue-ready scopes as thin evidence instead of an ambiguous stub, while preserving their open independent-review boundaries. The latest Sprint 88 and Sprint 90 rows produce 169 real, 32 thin, zero stub and zero missing criteria.
  • ImprovedAWS dev now has separate passwordless Clerk test identities for the business-development, capture and executive U-1 sessions. Each account claimed the seeded Growth workspace, completed role-specific onboarding and rendered all six decision answers over HTTP 200 with zero console or page errors. Short-lived access is issued from tagged Secrets Manager state; this is account preparation and does not convert the still-pending 0/3 human sessions into acceptance.
  • FixedE-1 public candidate construction now merges every revision of a stable SAM notice instead of choosing one row wholesale, preserving the earliest exact source event date together with richer agency, NAICS, set-aside and source-history evidence. A fresh read-only AWS-dev export produced 226 exact-date/agency candidates across 18 agency-code strata, 1,290 public profile candidates, immutable source commitments and blank independent-review queues; it still reports zero accepted corpus rows until chronology, outcomes, authorization, splits and reviewers are independently verified.
  • ImprovedThe remaining external acceptance work now has one issue-ready pack: 391 C-4 award rows, 250 D-2 expert cases, E-1 profile/event/practitioner forms, a fixed AWS-dev six-answer usability target with three human-session records, independent pentest/retest rules of engagement, a five-role incident tabletop and ready-to-issue engagement briefs. The validator confirms zero assigned external roles and does not represent prepared forms as completed evidence.
  • ImprovedThe AWS-dev SAM.gov secret is explicitly designated and tagged for acceptance testing, while `winlayer-ingest:65` continues to enforce a shared maximum of 10 requests per rolling 86,400 seconds on its enabled six-hour schedule. The provider-assigned Opportunities account ceiling remains pending account-owner confirmation and production receives no allocation from this key.
  • FixedAWS dev Admin platform health now separates current intervention from retained audit outcomes. One content-validation rejection and two superseded ingestion failures remain visible while storage and workers correctly render healthy; the graph stays delayed for 100,947 pending work groups and reports zero actionable dead letters. Exact API commit `706d2f7` is deployed at ECR digest `sha256:da976436871fef232b36a29de6d0e83f8582ee57e938a960aa3a1ef7c8798fae`; Trivy found zero high or critical vulnerabilities, App Runner operation `439771a7e5ce4dff855cd081289839bc` succeeded, readiness returned 200, and authenticated Playwright recorded no browser failures.
  • FixedGeneral-availability preflight now fails closed unless an independently accepted E-1 hidden-holdout result is bound to both its immutable report SHA-256 and the exact evaluated code revision. Generated benchmark reports now retain that revision, and the production workflow exposes only the approval state and evidence identifiers required for the gate.
  • FixedStructured agency forecast signals now retain official source publication and update timestamps instead of dropping them during normalization. Source observation time remains a separate ingestion fact, preserving the chronology boundary required by controlled E-1 backfills.
  • ImprovedExact commit `2538541` is deployed to AWS dev worker task definitions ingest 65, budget 64, graph 47, and migration 17 at ECR digest `sha256:870c6392875caca15c720543a4157e75020bc72373199094a45deb5751805dfc`. The runtime image has zero HIGH/CRITICAL Trivy findings and zero ECR scan findings; a read-only ECS smoke retained a live VA update timestamp and the official Navy publication date while the graph schedule remained disabled.
  • FixedCompleted SAM scans with moving provider totals now repeat only unstable streams against the same fixed date window, preserve already reconciled streams, and advance only after every final row count matches a stable provider total. Focused tests pass 9/9 and the complete worker suite passes 445/445.
  • ImprovedAWS dev ingest now targets exact commit `e283feb` on task definition 64. Its ECR image has zero scan findings, a deployed smoke task proved unstable-only cursor reset, the six-hour schedule remains enabled, and the graph schedule remains disabled during the controlled rebuild.
  • ImprovedRead-only AWS dev evidence now retains the completed nine-stream September 17-18 SAM scan, the active September 17-29 cursor, all ten HTTP-200 requests in the current safeguard period, 17,535 stored SAM signals, and the distinct unverified account-role allocation boundary.
  • ImprovedC-8 lineage acceptance now uses the genuine three-page Navy NAWCWD FY2026 acquisition forecast instead of an `example.test` source. The live `.mil` PDF matches the frozen 235,814-byte fixture exactly, the cited Row 1 excerpt is verified on page 1, and the fresh-database lifecycle reaches that page through immutable recommendation, agent, intelligence, score, graph and signal revisions before continuing to decision, proposal, outcome and learning.
  • ImprovedRead-only AWS dev source evidence now supplies 391 FY2025 C-4 award candidates and a deterministic D-2 queue of 250 globally unique real SAM opportunities, exactly 25 per governed agent. Both packages retain official citations and immutable commitments while independent C-4 labels, D-2 expert judgments, live-run quota, model credit and acceptance remain explicitly open.
  • ImprovedA read-only AWS dev export now commits a minimized E-1 public candidate universe with 17,309 unique SAM event candidates and 1,288 public SAM/DSBS profile candidates, deterministic hashes, conservative field derivations, and machine-checked safeguards that keep independent sampling, hidden-holdout custody, chronology verification, profile attestation, and practitioner review explicitly open.
  • FixedPlatform customer-record updates now require a bounded audit reason before mutation and retain that reason with the resolved staff user, target tenant, request, and before/after values. A safe AWS dev no-change operation returned HTTP 200 and rendered its append-only audit evidence without browser failures.
  • ImprovedAWS dev source-health acceptance now proves alert-after-cadence, same-episode deduplication, recovery re-arm, a second alert, immutable persistence, and authenticated Admin visibility with the exact two alert IDs retained.
  • ImprovedThe deployed public data-source page now states the difference between registered implementation depth and runtime health, while the authenticated Admin view separately exposes current AWS dev family counts, timestamps, versions, record totals, gaps, and alerts.
  • FixedGraph rebuild finalization now preserves live projection rows created after the rebuild began instead of retiring them with the previous generation. Worker regression tests pass 444/444, the corrected image has zero high or critical scan findings, and sequential bounded rebuild runs continue on task definition 44.
  • ImprovedThe latest bounded SAM replay received seven HTTP 200 responses, inspected 5,476 notices, created 4,792, changed 6, left 678 unchanged, and stopped at the persisted provider quota boundary without hiding the account-level allocation gap.
  • ImprovedThe six remaining acceptance areas now have one evidence-backed closure board: AWS dev candidate volume is measured under an audited operator scope, developer security and browser preflights pass, current Stripe/SAM/provider boundaries are recorded, and every independent data, human, assurance, legal and release action has an exact owner handoff without invented acceptance.
  • ImprovedThe controlled blank-target Neo4j rebuild now continues through sequential one-hour AWS dev tasks that stop on any retry, dead letter, incomplete application, lock loss or integrity blocker while the recurring graph schedule stays disabled.
  • ImprovedA fresh developer security preflight passed four repository control checks, a zero-vulnerability production dependency audit, eleven non-destructive HTTP probes and desktop/mobile Playwright runtime checks; independent penetration testing and the five-person incident tabletop remain separate open gates.
  • ImprovedAWS dev now targets running AuraDB Professional instance `35eab348` with separate `winlayer_writer` and database-enforced read-only `winlayer_reader` identities. Live writer schema checks and reader write-denial checks pass, App Runner is healthy, graph-builder revision 43 is active, and the recurring graph schedule remains disabled while the governed blank-target rebuild and zero-drift reconciliation are completed.
  • ImprovedAuthenticated Neo4j Aura inspection identified the exact graph blocker: the approved `winlayer-dev` AuraDB Professional instance is suspended after trial expiry, its hostname remains unresolved, and reactivation requires an account-owner payment decision; the AWS graph schedule remains disabled.
  • ImprovedThe active AWS dev ingest task now has one sanitized receipt for its ten-request-per-day SAM reservation, 1,000-record page size, six-hour schedule, successful API response, and the still-distinct provider account-allocation boundary.
  • ImprovedD-2, C-4, E-1, U-1, penetration-test, incident-tabletop, legal, production-data and release-owner inputs now have fillable custody, participant, execution and approval records without presenting unassigned people or unsigned decisions as acceptance.
  • ImprovedThe optional G-3.11 landing-page experiment is deferred during P0 hardening; fresh AWS dev Playwright verification returned 200 at desktop/mobile widths with 48/48 reveals, no overflow or experiment markers, and zero actionable browser/network failures on the retained current treatment.
  • ImprovedThe 201-row acceptance registry now has 168 real-depth and 33 thin rows after AWS dev closure of B-6.5, C-2.5, and G-3.7, with zero stub or missing decision rows; this does not change the zero production-verified rows, open independent review, or 0-of-14 accepted milestone-gate result.
  • ImprovedGitHub Actions run 36505291206 targeted exact Sprint 76 commit `ac7ee36`; all six jobs received no runner and executed zero steps because GitHub reports an account payment or spending-limit blocker, while the local governance group passes 57/57.

Sep 28, 2026

  • ImprovedThe exact `7c5fadc` web image is retained and active in AWS dev; Playwright verified both final September 28 customer entries, OpenAPI, public documentation, and all three password-plus-TOTP staff roles with no actionable browser failures.
  • ImprovedOfficial budget PDF retrieval now uses browser-compatible, deterministic request headers; AWS dev can retrieve the six Army, HHS, Navy, and USDA documents that rejected the previous connector user agent or returned HTML.
  • ImprovedBudget candidate accounting now reconciles attempted, returned, failed, and skipped records per provider chunk, allowing one failed model chunk to remain visible without invalidating successful chunk receipts.
  • NewMonthly budget collection now derives bounded next-fiscal-year candidates from approved official URLs, probes for PDF signatures, and registers a published document as disabled and pending review instead of ingesting it automatically.
  • FixedThe generated OpenAPI v1 JSON is publicly downloadable without a customer session, and the public-route claim inventory now governs that contract endpoint explicitly.
  • ImprovedAWS dev now requires and successfully verifies separate TOTP credentials for Admin, Developer, and Customer Service staff roles; an invalid Admin code returns 401 and all three valid flows reach their role-bound panels.
  • NewA disposable AWS dev RDS point-in-time recovery restored the encrypted private database and verified 202 public tables plus representative budget, tenant, signal, and graph counts in 29 minutes before cleanup.
  • NewA disposable versioned S3 object was overwritten, deleted, recovered by version, restored as current with an exact SHA-256 match, and fully removed after the drill.
  • ImprovedThe final AWS dev budget run exited 0 with all 15 approved PDFs carrying checksums, byte counts, page counts, and parse timestamps; 14 model extraction batches remain explicitly degraded because the Anthropic account reported insufficient credit.
  • ImprovedThe exact tested worker digest now backs ingest task definition 62, budget 61, graph 42, and migration 14; ingest and budget schedules are enabled while the unresolved Neo4j target keeps the graph schedule disabled.
  • NewOfficial budget-document coverage now uses a governed database registry with review state, fiscal-year and agency coverage, checksum, size, page count, and collection receipts; the connector fails closed when required FY2027 families are absent.
  • NewCanonical opportunity intelligence now calculates six evidence-backed set-aside probabilities from qualified-vendor, geography, agency/office history, and market-research context, with a 200-award backtest contract awaiting the approved historical corpus.
  • ImprovedVehicle projections retain pool, category, SIN, track, and task-order scope; joint ventures retain type and resolvable member links; graph reconciliation reports coverage for both families.
  • NewAdmin crosswalk governance can add, approve, and reject NAICS/PSC pairs while pending and rejected pairs stay out of high-confidence scoring.
  • ImprovedForecast feedback records actual dates and window error, agency lifecycle patterns include solicitation-to-award timing, partner outcomes feed reliability, and no learning adjustment occurs without sample and approval gates.
  • NewA live-model agent evaluation harness requires 25 real expert-labelled opportunities for each of ten agents, measures five quality dimensions, rejects synthetic acceptance data, and gates future agent or prompt changes by exact code digest.
  • NewCI rejects unregistered TODO, FIXME, and implementation-placeholder debt while preserving a reviewed inventory for intentional markers.
  • ImprovedThe customer changelog is now a short maturity-labelled capability history, while the complete 667-entry forensic record lives only in this internal engineering ledger.
  • NewRecovery governance defines RPO/RTO, eight failure-mode contracts, PITR/S3/graph exercises, route performance targets, 100/500/1,000 queue cohorts, and an explicit maximum-tenant evidence field.
  • NewPublic API v1 documentation is generated from controller metadata, published as JSON and Markdown, and protected by a breaking-contract gate.
  • NewDatabase changes follow an enforced expand/migrate/contract registry that rejects edited history, sequence gaps, unsafe additive releases, and unapproved destructive changes.
  • ImprovedEvery governed source carries a freshness target; operator and Morning Brief views expose age, target, fleet coverage, and the same alert state used for source degradation.
  • ImprovedRepository, dependency, secret, static-analysis, and container checks now block high findings; runtime images use non-root users and credential encryption requires a customer-managed key.
  • NewAdmin, Developer Operations, and Support logins require separate role-specific TOTP codes in addition to their password, and legacy password-only sessions fail closed.
  • NewOpportunity Workspace shows what changed, why it matters, the supporting evidence, next action, owner, and due date together with direct lineage controls.
  • NewSeven immutable core-loop KPIs measure early lead time, decision precision, evidence coverage, decision speed, capture activation, forecast accuracy, and 70–80 PWin calibration with sample and methodology boundaries.
  • ImprovedCanonical intelligence separates company fit, hard eligibility, strategic attractiveness, competitive position, preliminary PWin, and evidence confidence; Radar and scoring docs expose the combination rule.
  • NewCanonical opportunity and Morning Brief values carry code-assigned Observed, Derived, Inferred, Predicted, Recommendation, or User-entered labels with citation/model validation.
  • ImprovedThe acceptance registry now maps all 201 literal review checkboxes, removes two obsolete rows, expands G-5 into four criteria, and retains local, AWS dev, production, and independent-review evidence separately.
  • NewThe Admin command center now reports live application, database, search, graph, storage, worker, API, integration, and notification health from operational evidence.
  • NewRevenue Operations now includes catalog MRR and ARR, customer LTV estimates, churn, expansion and contraction, plan and segment splits, six-month movement evidence, forecasts, margin estimates, and an executive risk view.
  • ImprovedStripe-driven subscription changes now append immutable before-and-after snapshots so future churn and expansion reporting includes provider events as well as operator changes.
  • NewCustomer administrators can inspect invoices and payment methods, extend Stripe trials, schedule cancellation, restore renewal, edit customer records, and review renewal, activity, and support history.
  • NewCustomer deletion now starts the governed export, approval, legal-hold, grace-period, cancellation, and verified-purge workflow with exact workspace confirmation instead of deleting immediately.
  • NewUsage Operations now shows storage consumption, approaching and exceeded limits, fair-use signals, and append-only monitoring, customer-contact, override, escalation, and resolution dispositions.
  • ImprovedAI Operations now separates qualification, capture, executive, learning, and other workloads and exposes recent per-customer workflow status, model, cost, latency, source, and review evidence.
  • ImprovedIntegration Operations now covers required Salesforce, HubSpot, Unanet, Deltek, Microsoft, Google, Slack, and Teams families with connected-account health, last synchronization, health checks, and error details.
  • NewAdmin Audit now supports cross-customer search, severity, actor, action, tenant, and date filtering plus formula-safe CSV export.
  • NewSupport Operations now classifies and manages tickets, customer-success work, escalations, refund and billing cases, and platform issues with priority, assignment, references, and resolution notes.
  • NewPlatform Settings now provides audited branding, platform defaults, notification preferences, plan-limit visibility, and editable customer-notification templates.
  • NewPlatform administrators can now create and manage feature rules across global, plan, customer, user, internal, and test-group scopes from the Admin console.
  • NewFeature releases now support scheduled activation and expiry, deterministic percentage rollout, dependency gates, lifecycle ownership, stable experiment variants, and adoption metrics.
  • ImprovedFeature changes now retain immutable before-and-after audit evidence, with one-click rollback and a reason-required emergency shutdown control.
  • NewThe Admin console now provides security operations for login activity, denied attempts, repeated-source alerts, observed MFA adoption, access and permission changes, and investigation dispositions.
  • ImprovedSecurity investigations now append reviewed, escalated, or dismissed dispositions to the audit trail without rewriting the original event.
  • FixedConcurrent Admin page requests now elect one authentication-telemetry writer, preventing a single sign-in from being counted multiple times.
  • FixedAn explicitly approved SAM.gov page-size change now replays only incomplete notice streams from page zero, preserving completed streams and the fixed date window so no records are skipped.
  • ImprovedAWS dev SAM.gov Opportunities collection now supports 1,000-record pages behind the existing durable cursor and request-reservation controls, while malformed replay settings fail closed.
  • ImprovedThe September 28 AWS dev snapshot records eight of nine configured SAM streams complete across 35 pages and 2,976 rows with zero consecutive failures; combined-view completion, stable-total replay, provider allocation, and independent acceptance remain open.

Sep 25, 2026

  • ImprovedPublic claim traceability now classifies all 13 proxy-public route patterns, 47 rendered page paths, 36 documentation pages, three legal pages, and five shared claim or release components.
  • ImprovedResources, pricing, desktop and CLI, mobile demo, documentation, and shared footer surfaces now identify preview and demonstration capabilities while preserving separate deployment and independent-review requirements.
  • FixedPublic documentation and pricing pages no longer prefetch authenticated workspace destinations, preventing speculative signed-out requests from producing console and network failures.
  • FixedThe desktop and CLI page now points to the published @winlayer/cli 0.5.2 install command and labels its opportunity data as an illustrative demo while signed desktop installers remain pending.
  • ImprovedThe consolidated P0 acceptance registry now discovers every numbered evidence packet through Sprint 69 instead of stopping at a fixed sprint boundary, normalizes both matrix and manifest formats, and rejects stale generated output or unresolved evidence paths.
  • ImprovedThe current 135-row acceptance registry records 104 real, 29 thin, zero stub, and two missing local-depth rows with zero production-verified rows, preserving deployment and independent-review gates separately from developer evidence.
  • ImprovedOptimized-build browser acceptance now exercises 59 public desktop and mobile routes, direct status and Android artifact checks, signed-out navigation, visible maturity labels, console and network health, layout bounds, and 12 retained screenshots.
  • ImprovedThe September 14–25 release history is reconciled against the implementation and evidence packets while the original M1–M14 result remains 0 of 14 fully accepted gates.
  • NewMarket Research teaming, contact, program-matching, semantic, and NAICS/PSC figures now include an output-bound Why am I seeing this? receipt tied to their exact persisted graph or profile records.
  • ImprovedEach receipt now lists the exact calculation rule, retained graph entities or relationship keys, semantic resolution event or signal IDs, record version, and evidence limitations used by the displayed value.
  • FixedMarket Research receipts now fail visibly when retained identities are missing or when receipt output differs from the rendered record, and observational evidence is explicitly distinguished from a recommendation.
  • NewAll 12 Executive Command zones now include a response-bound Why this zone? receipt with the exact calculation rules, captured source records, source-coverage state, and calculation time.
  • ImprovedOpportunity contributors to executive aggregates now retain grouped persisted lineage, while governed recommendation rows keep their separate exact recommendation controls.
  • FixedExecutive zone receipts now fail visibly when a displayed persisted row lacks identity or when the receipt does not match the returned zone output, and live calculations are explicitly distinguished from persisted recommendations.
  • NewEvery saved Morning Brief figure now includes a receipt with the immutable briefing ID and version plus its exact stored query, object, recommendation, or partner citation chain.
  • ImprovedMorning Brief figures backed only by a saved query or object citation are now explicitly distinguished from universal recommendations, while recommendation IDs retain their separate decision lineage.
  • FixedMissing or malformed Morning Brief citation records now render a visible evidence gap instead of a generic evidence link that could appear complete.
  • NewEvery Global Search result now includes a Why this search rank? receipt with its exact source record, ranking time, query mode, and eight calculation factors.
  • ImprovedSearch rank receipts now preserve the exact query match, source relevance, confidence, freshness, workspace, graph relationship, mode, and company-profile contributions used for ordering.
  • FixedSearch rank is now explicitly labelled as navigation relevance rather than PWin or a bid recommendation, while signal and opportunity results retain their separate persisted decision-lineage control.

Sep 24, 2026

  • NewOwners and admins can now preview and explicitly approve a bounded reconciliation of legacy Strategic Growth Index snapshots into the universal recommendation spine.
  • ImprovedThe SGI reconciliation is dry-run by default, accepts named snapshot IDs and a bounded limit, records an audit receipt, and can be safely replayed without changing immutable score snapshots.
  • FixedLegacy SGI recommendations now retain the same eight reviewed-input revisions and visible source-page gap as new snapshots, while tenant isolation and role checks prevent unauthorized or cross-workspace backfill.
  • NewVendor Performance cards now provide a read-only Why am I seeing this? chain from each persisted metric through its contributing graph entities, relationships, signal revision, and raw source observation.
  • ImprovedVendor Performance materialization now retains every exact accepted graph edge used by award, agency, office, vehicle, subcontract, indirect IDV, and recompete calculations.
  • FixedHistorical accepted relationships remain resolvable after later graph retirement, while legacy metrics without retained edge keys show an explicit relationship evidence gap instead of appearing fully explained.
  • NewPersisted Market Intelligence graph insights now expose a read-only evidence chain from the calculated insight through the exact graph entities, retained projection relationships, latest signal revision, and raw source observation.
  • ImprovedGraph insight calculations now retain the exact accepted projection edge keys used by each score, so later evidence inspection can distinguish the admitted relationship set from nearby graph data.
  • FixedThe Market Research Why am I seeing this? control now orders graph insight, entity, relationship, signal, and raw observation records deterministically and never invents a source page when one was not retained.
  • ImprovedLocal acceptance checks now cover the new graph-insight lineage model, migration 0115, full graph-builder lifecycle, and desktop/mobile rendered Market Research controls; the remaining mixed intelligence metrics stay explicitly partial.
  • ImprovedReporting snapshots and deterministic assistant answers now materialize one tenant-scoped universal recommendation per immutable report run, keyed by a replay-stable snapshot hash and exact assistant question hash.
  • ImprovedGenerated reports expose the same recommendation identity in the report list, detail dialog, finding rows, and assistant answer; the lineage walk expands through stored report facts and signal revisions.
  • FixedLive, legacy, and unsaved reporting figures now show an explicit snapshot gap instead of inheriting a newer recommendation or implying a source page that was never attached.
  • ImprovedReviewed Agency Watchlists now retain the exact signal revisions, Agency Health and Opportunity Momentum factors, weekly brief, and immutable recommendation behind the displayed action.
  • ImprovedReviewed Competitor Watchlists now retain the exact award, recompete, protest, relationship, and company-profile version used by strength, growth, vulnerability, and personalized threat scores.
  • FixedStable watchlist reviews and generated actions reuse one recommendation history ID, while changed signal or company-profile inputs create a new immutable version without rewriting earlier decisions.
  • FixedUnreviewed, changed, and legacy watchlist results show an explicit lineage gap; ordinary page refreshes remain read-only and internal evidence references are not presented as external source pages.
  • ImprovedNew Executive Brief, opportunity, recompete, and proposal analyses now retain an immutable recommendation tied to the exact completed agent run and admitted intelligence-object versions.
  • ImprovedDashboard and radar briefs now provide a Why am I seeing this? control for the exact generated brief instead of resolving a separate current opportunity recommendation.
  • FixedCached brief replays reuse the same recommendation history, while older briefs without a recorded bridge show an explicit lineage gap.
  • FixedGrounded briefs preserve their internal evidence references without presenting them as external source pages; missing document and page evidence remains visible.
  • ImprovedCurrent partner readiness scores now retain the exact partner profile, stakeholder links, pursuit history, performance values, and five factor contributions that produced the displayed result.
  • ImprovedPartner fit rankings and teaming posture now provide a Why am I seeing this? control for the exact opportunity signal, company profile, partner version, and eight scored factors.
  • ImprovedTeaming Advisor answers now retain the exact question, managed-partner context, supporting evidence, four deterministic inputs, and immutable recommendation version behind each response.
  • FixedStable partner-analysis replays reuse the same history ID, while changed or legacy inputs without an exact snapshot show a visible evidence gap and never claim a source page that was not attached.
  • ImprovedEach new strategy comparison now retains the exact signal revision, company profile version, strategy weights, scoring context, eleven factor outputs, and immutable recommendation behind every displayed score.
  • ImprovedStrategy comparison scores and outcome-based weight proposals now provide a Why am I seeing this? control for their exact recommendation version and recorded inputs.
  • FixedApproving or rejecting a strategy weight proposal now records the same decision on its universal recommendation while preserving every earlier proposal and comparison snapshot.
  • FixedLegacy strategy records without exact recommendation lineage show a visible evidence gap, and reviewed inputs do not claim an external source page that was never attached.
  • ImprovedRelationship scores, influence, and next actions now retain one exact immutable input snapshot and recommendation reference whenever a contact or reviewed relationship record changes.
  • ImprovedThe relationship workspace now provides a Why am I seeing this? control that opens the exact recommendation version and seven recorded factors behind the displayed decision.
  • FixedNew interactions, stakeholder links, and outreach changes create new relationship decision history without changing or relabelling earlier score and action evidence.
  • FixedLegacy relationship decisions without recorded lineage now show a clear evidence gap, and operator-entered inputs do not claim an external source page that was never attached.
  • ImprovedEach newly saved company-profile version now retains its exact completion score, ten governed section inputs, personalization result, model version, and immutable recommendation reference.
  • ImprovedThe web profile and desktop settings now provide a Why am I seeing this? control that opens the exact recommendation version behind the displayed profile guidance.
  • FixedOlder profile versions without recorded lineage now show a clear evidence gap instead of inheriting a newer recommendation or appearing fully explained.
  • ImprovedProfile inputs entered by an operator are identified as reviewed manual inputs, while missing external source pages remain visible until genuine source documents are attached.

Sep 23, 2026

  • ImprovedLayer 9 learning scores now retain every contributing recommendation ID and exact immutable version, with one grouped Why am I seeing these learning scores? control for the displayed ranking.
  • FixedHistorical lineage controls now request the exact recommendation version that produced a result even after a newer version becomes current.
  • ImprovedLegacy learning contributors without exact version links remain visible through an explicit linked-versus-total coverage gap instead of appearing fully explained.
  • ImprovedLocal database and desktop/mobile browser checks verified the Layer 9 exact-version chain while leaving immutable ranking calculations and stored snapshots unchanged.
  • ImprovedNew Strategic Growth Index snapshots now materialize one tenant-scoped executive recommendation with immutable score-snapshot evidence, model/version metadata, and a stable history ID.
  • ImprovedThe SGI Why am I seeing this? control now shows the exact score version and all eight reviewed-input revisions, including the entered factor values and input hash.
  • FixedSGI and dynamic PWin no longer label typed operator values as external citations; until real source references are attached, coverage stays at zero and the source-page gap remains visible.
  • ImprovedConcurrent SGI replays converge on one recommendation per immutable snapshot, with local fresh-database and desktop/mobile browser verification recorded for the acceptance phase.
  • ImprovedRecommendation-backed fit, PWin, priority, forecast, brief, partner, grant, search, workbench, and desktop outputs now expose a consistent ‘Why am I seeing this?’ path to their recorded source chain.
  • ImprovedPortfolio, command-center, forecast, and desktop summary figures now list every canonical opportunity that contributes to the aggregate before opening each opportunity’s exact recommendation lineage.
  • FixedWorkspace evidence controls can resolve the current tenant-scoped recommendation from a signal or canonical opportunity without exposing another tenant’s record or silently substituting an unrelated version.
  • ImprovedAWS dev Stripe test-mode acceptance now covers a customer adding and selecting a replacement payment method through the hosted billing portal, with the new method applied to the exact subscription.
  • ImprovedA Growth customer can review and confirm a Growth Plus upgrade, return to Growth, inspect the resulting prorations, and schedule cancellation while access remains active through the paid period.
  • FixedStripe portal provisioning now exposes exactly the six Solo, Growth, and Growth Plus monthly and annual prices; sales-assisted Enterprise plans cannot enter the self-service change catalog.
  • ImprovedThe AWS dev billing lifecycle retains signed purchase, payment-method, plan-change, cancellation, and deletion evidence while removing disposable customer identities and payment payloads after verification.
  • ImprovedA card-backed Solo trial now has AWS dev acceptance evidence from activation through an accelerated test-mode conversion to active access and one paid $199 invoice.
  • FixedGuided setup persisted an honest profile-backed First Win brief before onboarding completed when no qualifying live opportunity was available, with a source-gap action instead of a fabricated pursuit.
  • ImprovedThe First Win snapshot remained unchanged across trial conversion, and disposable provider, application, and identity records were removed while signed lifecycle metadata stayed payload-redacted.
  • ImprovedAWS dev lineage verification now traces an exact recommendation version backward through stored intelligence, score, graph, signal, document, and citation records to page 101 of the existing VA FY2027 budget submission.
  • ImprovedA controlled acceptance lifecycle now verifies the deployed forward path from an attributed decision through capture, proposal, submission, outcome, and an acceptance-only learning record.
  • FixedA second recommendation version cannot inherit the first version's downstream records; foreign-tenant requests return 404, revoked keys return 401, and all disposable lifecycle rows are removed after verification.

Sep 22, 2026

  • FixedThe production web image now requires a Clerk publishable key during the Next.js build, preventing an authentication-enabled release from silently compiling without its public identity configuration.
  • FixedGraph Builder now sends conflicting exact identifiers to manual review and withholds their ambiguous nodes and relationships while continuing to process other evidence.
  • FixedScoped graph jobs now prepare events sequentially on their restricted database connection, preventing nested-savepoint failures during a bounded drain.
  • FixedLong-running graph jobs now retain a dedicated PostgreSQL advisory-lock connection, verify its backend and lock row around bounded work, and fail closed if ownership changes.
  • ImprovedThe corrected AWS dev worker applied 123,001 events across 7 bounded runs without new retries, dead letters, or projection blockers, drained the due queue, and matched PostgreSQL to Neo4j at 130,672 nodes and 324,672 managed edges. 7 exact-identifier reviews and governed validation policy remain open; production and independent acceptance have not occurred.

Sep 21, 2026

  • FixedGraph projections now enforce source-defined effective and expiration dates, stage future relationships outside traversal, retire expired relationships, and preserve the three strongest current evidence links per target.
  • ImprovedA controlled AWS dev lifecycle run retired 133,831 expired edges, deferred 19,568 future edges, and then matched PostgreSQL to Neo4j exactly at 96,698 nodes and 279,091 managed edges.
  • FixedGraph reconciliation now streams PostgreSQL projection keys inside the restricted worker transaction and verifies a distinct read-only Neo4j identity before comparing bounded counts and hashes.
  • FixedAgency forecast snapshots now select the exact current canonical record when a provider keeps its row ID but corrects its APFS identity, preventing a stale historical version from blocking collection.
  • ImprovedSAM.gov Opportunities ingestion now uses an operator-set request budget, commits every completed page, and stops with a resumable cursor when that budget is exhausted.
  • ImprovedScheduled AWS dev tasks and hosted releases now share one deterministic subnet contract, with the applied non-secret topology validated before release work begins.
  • ImprovedAWS dev worker releases now retain exact image, migration, tenant-isolation, source-health, graph-integrity, and controlled-ingestion evidence while keeping independent acceptance and production release status explicit.

Sep 19, 2026

  • ImprovedThe live landing-page Morning Brief now uses a compact hero presentation for source health, saved figures, preliminary PWin, next action, suggested partner, and citation disclosure without exposing the full workbench layout.
  • FixedThe landing-page Morning Brief now reads an explicitly published immutable snapshot from a dedicated AWS dev demo tenant, with recorded public-source citations and fail-closed publication checks.

Sep 18, 2026

  • FixedExplainability paths now retain a typed Opportunity endpoint even when a Signal shares its durable ID, and their key-order-stable hashes can be verified after PostgreSQL JSON normalization.
  • ImprovedRecommendation evidence, paths, outcomes, and learning now enforce exact tenant and recommendation-version lineage. Bounded runtime roles cannot update or delete immutable recommendation history.
  • FixedGraph reads return only the current recommendation version, outcome edges carry their source version, and existing outcomes cannot be reassigned to different recommendation lineage.
  • ImprovedCorporate transaction relationships now retain SEC filing URL, accession, excerpt, extraction method, event timeline, relationship confidence, and the reason for that confidence.
  • FixedCorporate graph claims reject ownership percentages outside 0–100 and require explicit validation before creating mentor-protégé nodes or relationships.
  • FixedOpportunity relationship projection now rejects malformed direction, confidence, and live-opportunity identifiers while preserving bounded solicitation and correlation anchors.
  • ImprovedRelationship-specific confidence now governs the persisted opportunity edge and its explanation instead of being kept only as an optional property.
  • ImprovedLayer 3 now returns all six governed opportunity relationship types with direction relative to the requested opportunity, evidence IDs, confidence, reason, and deterministic ordering.
  • FixedReciprocal symmetric opportunity relationships are deduplicated, asymmetric edges retain their orientation, typed fallback references no longer invent UUIDs, and inactive or future edges are excluded.
  • ImprovedAWS dev now uses separate restricted API, worker, operator, and migration database credentials with Terraform-managed secret access and preserved CloudFront CORS and Clerk redirect settings.
  • ImprovedAn in-environment AWS dev probe confirmed forced row-level security on all 145 tenant tables, cross-tenant write denial, bounded runtime roles, operator visibility, and blocked worker-to-operator escalation.
  • FixedRuntime-role provisioning is replay-safe under the bounded AWS RDS migration role: existing roles are inspected for forbidden attributes, reset to exact grants, and verified without superuser-only alterations.
  • ImprovedThe AWS dev API candidate passed App Runner and CloudFront health and readiness checks, applied all 105 migration journal entries, and kept the graph schedule paused for controlled reconciliation.
  • FixedThe web release image now builds the shared package before Next.js, preventing the production container build from failing when web code imports the shared intelligence contracts.
  • ImprovedThe public release history was reconciled against every September 14–18 Sprint packet, while AWS dev, production, and independent-acceptance evidence remain explicitly separated.

Sep 17, 2026

  • ImprovedA live 30-day SAM opportunity scan resumed across five pages and processed all 4,642 rows reported at completion, preserving immutable snapshots and page checkpoints with five successful provider requests.
  • FixedSAM entrypoints now use bounded database scopes for admission, quota, each signal and evidence write, page checkpoints, health, completion, failure, and audit records, preventing long-run PostgreSQL lock exhaustion.
  • FixedA moving SAM provider total now produces degraded incomplete health instead of a healthy result, and exact completed windows can restart from page zero without weakening incomplete-run recovery.
  • NewA source-specific VA forecast adapter now parses the VA slice of the Acquisition Gateway application with bounded pagination, identity checks, exact release dates, NAICS, value ranges, set-asides, and contracting offices.
  • FixedThe executable forecast registry now contains only four source-specific adapters—VA, HHS, Navy, and DHS. Sixteen generic HTML definitions without source-owned parsers were removed from active collection.
  • ImprovedThe generated product registry and catalog now distinguish executable adapters from configured source candidates and recorded-fixture coverage; no adapter is described as production verified.
  • NewAll 17 dispatchable source families now declare raw-record contracts and reconcile received, accepted, rejected, and filtered records without retaining provider values, request URLs, headers, or credentials.
  • ImprovedMissing raw identity or required provider fields now enter the persisted source-health schema-drift path used by operator views and downstream coverage facts.
  • ImprovedParser, duplicate, date-window, relevance, form, and result-limit drops now appear as intentional filters instead of silent loss, with provider-controlled telemetry keys irreversibly hashed.
  • NewEvery dispatchable source family now reports a bounded provider envelope with pages fetched, records fetched, changing provider totals, remaining pages, candidate attempts, skips, absences, and failures.
  • FixedPartial child requests and collection caps now degrade or truncate source health instead of presenting a complete run, and locally derived records no longer inflate provider counts.
  • NewA governed Layer 1–9 registry now inventories 1,349 documented contract atoms with owner, lifecycle status, evidence paths, remaining evidence, and independent-review state.
  • ImprovedAll 64 historical Layer 1–2 report rows now link to current source symbols and named assertions, giving all 1,349 registry rows literal code and assertion references without overstating semantic coverage.
  • FixedSAM Requests for Information now normalize to the explicit NEW_RFI event while Sources Sought retains precedence; direct assertions cover new, changed, expiring, protested, forecasted, funded, and awarded event classes.
  • FixedCorrected source-document text and parser upgrades now create immutable extraction versions even when the raw bytes are unchanged, while exact retries remain idempotent.
  • FixedLearning accepts only a verified tenant-owned outcome tied to the exact recommendation and current version; URLs, foreign outcomes, pending award matches, and caller-supplied confirmation flags cannot enter model feedback.
  • FixedMember, team, and business-unit workspace graph scopes now filter private partners by active scoped ownership, reject unknown scopes, and report distinct internal member counts.
  • ImprovedEvery projected graph node and relationship now retains the confidence basis derived from its source signal, including source-authority fallback when numeric confidence is absent.
  • FixedDerived office-dominance relationships now explain confidence using the observed award count and share, closing a missing-reason gap found during graph acceptance review.
  • ImprovedAll eight Stripe test-mode plan and billing-term combinations pass purchase and entitlement enforcement against disposable local state, including Solo limits, warnings, archival behavior, and Growth unlocks.
  • ImprovedA bounded live SAM slice returned 652 of 652 unique normalized opportunities, while local graph construction, a real Neo4j writer, reconciliation, tenant isolation, and logical restore checks passed.
  • NewAll nine Graph Analytics Engine categories now persist evidence-backed metrics and relationships and retire stale derived rows when their source evidence disappears.
  • FixedPrediction validation now excludes outcomes observed before prediction creation or after the evaluation clock, preventing look-ahead leakage.
  • FixedAccuracy, publication, scoring, and recommendation feedback now isolate predictive-trigger-v2 from older model versions instead of relabeling or consuming historical rows.
  • ImprovedProcurement-pattern evidence now persists all four intervals with transition counts, reliability, authority, model version, calculation window, and delayed validation behavior.
  • ImprovedAcceptance evidence now records the unresolved AWS dev graph backlog, authenticated billing boundary, restricted E-1 inputs, GitHub billing blocker, and independent-review dependency without converting local results into release acceptance.

Sep 16, 2026

  • NewExternal actions are now prepared against an immutable artifact version, approved by an attributed user, claimed durably, dispatched through a four-kind registry, and recorded through result or retry state.
  • FixedConcurrent external-action workers and replays execute a controlled provider action once, preserving approval lineage and preventing duplicate side effects.
  • FixedThe legacy graph entity resolver was removed; production master-entity inserts are confined to the governed Graph Builder path.
  • NewA versioned lineage spine supports authenticated backward and forward traversal from source pages through intelligence, recommendations, outcomes, and learning with tenant and exact-version filtering.
  • ImprovedRecommendation and Morning Brief interfaces expose evidence controls backed by the same stored lineage, while exhaustive deployed-surface review remains an independent acceptance item.
  • ImprovedPostgreSQL row-level security is enabled and forced on every UUID tenant table, with command-specific tenant policies and reviewed handling for shared and special-policy rows.
  • NewThe database inventory classifies every table without a tenant ID as platform-shared or specially governed, so a new unclassified table fails the isolation check.
  • ImprovedAPI requests, workers, service tokens, public shares, and staff operations use transaction-local roles and scope values; cross-tenant staff work requires an independently authenticated session and durable audit.
  • ImprovedMigration, API, worker, and operator credentials are separated, and runtime startup rejects superuser, BYPASSRLS, table-owner, unscoped, or otherwise unapproved sessions.
  • NewTerraform emits one versioned non-secret deployment-topology contract covering the applied AWS region, role, repositories, ECS network, migration task, and App Runner services.
  • FixedDeploy and owner-bootstrap workflows validate the topology contract and reject account, region, repository, network, ARN, origin, and line-injection drift instead of relying on embedded infrastructure values.
  • ImprovedOwner bootstrap now runs through the dedicated migration task and scoped operator database path, producing both database and application operator audits.
  • ImprovedEngineering reports now distinguish historical implementation from current acceptance, preserve the 0-of-14 M1–M14 gate result, and link claims to generated criterion evidence.
  • NewGenerated product-truth, feature-catalog, and public-claim registries now bind capabilities and visible claims to owner, status, code, tests, criteria, date, and remaining evidence.
  • NewA scoped runtime exporter can capture adapter version, health, last attempt, last success, and record count from an explicitly named environment while redacting secrets, quotas, cursors, and error content.
  • ImprovedPublic capability wording now identifies preview and demonstration capabilities and keeps preliminary scoring, simulated values, registered source counts, and verification boundaries visible.
  • NewAn active product-surface freeze now blocks undeclared expansion across CLI, desktop, mobile, GraphQL, MCP, integrations, workspaces, reporting, and developer surfaces until the named exit criteria are accepted.
  • ImprovedPull requests touching frozen surfaces must declare an allowed hardening or fix category, recognized criteria, and no product-surface expansion; CI compares exact rename-aware base and head revisions.
  • NewThe sealed E-1 benchmark contract locks early-recall, prediction, eligibility, ranking, evidence, forecast-window, and partner-usefulness thresholds behind a canonical configuration hash.
  • ImprovedE-1 validation now requires at least 200 events, eight agencies, 20–50 attested profiles, an exact 70/30 split, chronology controls, profile-pair coverage, two-practitioner coverage, and complete pair records.
  • FixedDevelopment-set results cannot become acceptance eligible; only sealed holdout runs can qualify, unresolved predictions remain in the precision denominator, and independent acceptance is always required.
  • NewA consolidated P0 requirement registry now tracks 135 unique acceptance rows with depth, capability status, owner, developer evidence, code and tests, production evidence, remaining gates, and reviewer state.
  • ImprovedA read-only VA portal investigation records the public form, report redirect, and login/error boundary without claiming unavailable forecast rows or a working provider schema.

Sep 15, 2026

  • NewCanonical OpportunityIntelligence now stores governed identity, state, evidence, scoring, decision, and lineage together with all nine important fields as individually statused values.
  • ImprovedEach opportunity field now carries value, status, confidence, observation time, source count, source IDs, explanation, and per-field freshness across known, inferred, predicted, unknown, conflicting, stale, and not-applicable states.
  • ImprovedThe Layer 3 lifecycle executes all 16 modules across six material families, appends immutable versions and structured diffs, preserves prior versions, and keeps exact replays idempotent without external fetches.
  • FixedConflicting eligibility evidence now blocks preliminary PWin as insufficient, while open-market vehicle access stays neutral in both scoring and explanation.
  • FixedCanonical opportunity list, detail, predicted, recompete, agency, and competitor routes now return the governed object; user-managed pipeline records use explicit managed routes and cannot alter canonical response shapes.
  • ImprovedAgents, workspace, notifications, executive briefs, outcomes, reporting, opportunity detail, desktop, and mobile now consume the same persisted canonical intelligence rather than recomputing missing scores.
  • FixedRelevance explanations remain attached to their named factors after PostgreSQL JSON reordering and expose weighted contributions that reconcile to the stored score.
  • FixedFlutter now reads canonical opportunities, preserves decimal scores and source signals, renders unavailable PWin as Unavailable, and ships an updated browser-demo bundle.
  • NewForecast, Agency, Competitor, Teaming, Proposal, and Relationship agents now own separate modules with admitted object families, evidence builders, strict schemas, gates, computations, tools, and fixtures.
  • ImprovedSpecialist agents compute governed results before prose and require the model to observe admitted inputs and evidence before submitting an explanation; prose cannot replace deterministic calculations.
  • ImprovedThe agent registry uses ten specification identities with compatibility aliases, normalized stored references, fixture coverage, model-tier assertions, and ten synchronized preview cards on the public page.
  • ImprovedQualification and PWin now share six decisions: pursue, monitor, defer, no_bid, needs_partner, and needs_more_info; historical qualify values migrate to needs_more_info.
  • NewQualification output now carries fit, risk, resource burden, required gaps, reasoning, next agent, and human-review state before downstream prose or routing.
  • NewA needs_partner decision starts one pending Teaming run automatically, while pursue creates a blocked Capture run and proposed approval; conflicting review flags are rejected.
  • ImprovedDownstream agent handoffs snapshot source run, output version, model, cost, gates, intelligence objects, evidence, qualification result, parent run, and handoff ID with replay idempotency.
  • NewAll 30 declared agent gates now have executable implementations returning PASS, FAIL, REVIEW_REQUIRED, or INSUFFICIENT_EVIDENCE with reasons, evidence, timestamps, and missing inputs.
  • ImprovedEvery declared gate runs and is stored before model invocation; failures and missing evidence block, review-required results create approvals, and approved gates must pass re-evaluation before claim.
  • ImprovedHard eligibility, partner identity, accepted-contract evidence, prediction publication, tenant relevance, and outbound-action approval gates have direct fixtures and fail-closed startup coverage.
  • ImprovedAudit Center and Approvals now show gate result, reason, evidence IDs, missing inputs, and evaluation time for blocked and review-required runs.
  • NewA mandatory Capability Broker intersects agent allowlists, tenant entitlements, user role, scoped approval, capability limits, run call limits, and run cost limits before exposing a tool.
  • FixedAPI startup now rejects missing tool implementations, missing executors, duplicate names, risk-tag mismatches, and capabilities absent from an agent allowlist.
  • ImprovedEvery allowed or denied tool invocation records tenant, run, agent, tool, capability, input hash, duration, estimated cost, decision, denial reason, approval, and execution-error state without copying raw input.
  • FixedSide-effecting tools remain unavailable until an approved record matches the same tenant, run, and capability; proposed or foreign-run approvals cannot authorize execution.
  • NewAgent publication now checks citation existence, sentence-level citation completeness, and entailment, using deterministic matching for extractable facts and a bounded judge for semantic claims.
  • FixedMaterial uncited, unsupported, contradicted, or nonexistent-citation claims fail closed with HTTP 422, block their run, require human review, create no artifact, and cannot enter caches or normal brief reads.
  • ImprovedAudit Center now exposes cited and supported ratios plus claim-level coverage, entailment, contradiction, missing-citation, and review-required details.

Sep 14, 2026

  • ImprovedSAM ingestion now resumes independently by notice type and page with fixed windows and page size, replaying only uncommitted work after persistence failure or restart.
  • FixedSAM quota admission is atomic per request, HTTP 429 defers work without consuming retry or dead-letter handling, and lease fencing and operator pauses survive worker restarts.
  • NewPer-source health now persists attempts, successes, counts, status history, latency, field drift, zero-result anomalies, failure episodes, deduplicated alerts, and recovery re-arming.
  • NewRecorded HHS and Navy forecast adapters parse source-owned fixtures, while source availability is exposed in Opportunity Intelligence, agent briefs, workspace, and operator views.
  • NewForecast snapshots and revisions now remain immutable and evidence-backed; unchanged replay is silent, changes retain before and after values, and failed, empty, or capped collections cannot create false removals.
  • NewA scheduled per-tenant Morning Brief now stores one daily versioned artifact with source collection counts, predicted and recompete opportunities, pipeline values, preliminary PWin, next actions, and a cited partner candidate.
  • ImprovedMorning Brief API, workspace, Markdown download, and unsent email draft read the same immutable saved content, and the recorded demo snapshot is selected explicitly.
  • NewA canonical signal taxonomy now derives opportunity deadline, set-aside, amendment, forecast-date, forecast-value, and forecast-set-aside changes from versioned records.
  • NewResolved award entities now emit incumbent, competitor-award, and recompete signals with inherited provenance, direct citations, graph work, deterministic timing, and idempotent replay.
  • ImprovedCompetitor-award signals remain tenant private and are emitted only for a matching watchlist or configured target market; unrelated tenants receive no private event.
  • NewConfirmed customer outcomes now enter an immutable tenant-private signal stream linked to their public signal, canonical opportunity, proposals, recommendations, and evidence.
  • FixedThe tenant-signal migration recovers valid legacy events, backfills missing outcome events, removes private outcome context from shared signals, queues existing awards for replay, and makes private event history immutable.

Sep 12, 2026

  • NewWinLayer CLI 0.5.1 is now published on npm and opens on a live next-decision board that combines workspace setup, ranked matches, pursuits, pending approvals, daily priorities, and plan capacity without starting an AI run.
  • NewThe terminal adds home and refresh for a fresh workspace snapshot, plus guide and the ? shortcut for a task-first chooser that does not require users to memorize commands.
  • ImprovedTerminal commands now show contextual next steps, elapsed request progress, private in-memory recent activity, and actionable recovery guidance while keeping the full home screen and composer inside an 80-by-24 terminal.
  • NewA saved terminal color preference lets users enable the full WinLayer palette for this app even when their shell exports NO_COLOR globally, while automatic mode continues to honor the standard preference.
  • FixedSaved terminal color choices stay separate from real environment overrides, so changing the preference reports the new value immediately.
  • NewWinLayer CLI 0.4.0 is now published on npm and adds a read-only workspace dashboard and a doctor command that checks Node, local config permissions, API health and readiness, credentials, and the active workspace.
  • NewTerminal automation now includes protected paginated exports in JSON, JSONL, CSV, and TSV, named browser destinations, safe non-secret settings, and completion scripts for Bash, Zsh, Fish, and PowerShell.
  • NewDevelopers can run scoped GraphQL queries, print the versioned schema, and preview or execute any active registry agent from the terminal. Agent dry-run previews do not start an AI generation.
  • FixedGraphQL opportunity, signal, forecast, contact, agency, and pipeline fields now adapt the current REST records and forward filters and pagination to the correct API arguments.
  • ImprovedCLI 0.4.0 release acceptance covers 48 tests, including the new automation workflows and a real 80-by-24 terminal, with another 19 focused API GraphQL and public-contract tests.
  • FixedWinLayer CLI 0.3.1 is now published on npm and keeps help, opportunity details, qualification briefs, and daily briefings inside narrow terminal windows, including long URLs and record identifiers.
  • FixedScripted model changes now persist when --json is requested, and logout accurately reports whether a browser session was revoked or a developer key was only removed from the local machine.
  • ImprovedCLI release acceptance now exercises every documented command against an isolated API, validates text and JSON output, covers all three sign-in paths, and drives the real interactive interface in an 80-by-24 pseudo-terminal.
  • FixedDesktop approval confirmation now opens in a separate review panel, so a repeated click on Approve cannot execute a recommendation.
  • ImprovedApproving or rejecting an agent recommendation now requires an explicit reviewed-evidence acknowledgement before the final decision control becomes available.
  • FixedThe reusable desktop browser audit now blocks approval mutations and fails if the check attempts to send one.

Sep 11, 2026

  • ImprovedA refreshed desktop workspace brings a spacious overview, colorful summary cards, cleaner opportunity search, a clearer pipeline board, and an analyst panel that opens when you need it.
  • NewDesktop now includes a saved light/dark appearance, opportunity search and sorting, keyboard search navigation, and consistent styling across tools, settings, and quick ask.
  • FixedDesktop navigation now follows back and forward history, filtered opportunity details stay in sync, pipeline bars reflect actual counts, and approval confirmations include Cancel.
  • NewThe public @winlayer/cli@0.3.0 package is now available on npm. Users with Node.js 20 or newer can install it with npm install -g @winlayer/cli and authenticate through the browser or device flow.
  • FixedPrepared CLI patch release 0.3.1 with corrected published-package install instructions and terminal version output synchronized with package metadata.
  • ImprovedDesktop 0.5.0 release artifacts were rebuilt for Linux AppImage, Linux DEB, and Windows NSIS. The Windows installer is cross-built with Wine; installers remain unsigned and native Windows/macOS acceptance is still required before broad release.
  • FixedDesktop Google sign-in now opens the user's normal browser for device authorization instead of embedding OAuth in Electron. The main process keeps the resulting credential in an HttpOnly cookie and never returns it to page JavaScript.
  • FixedDesktop device approvals now identify the requesting app as WinLayer Desktop while CLI requests retain their CLI label, so users can confirm which surface they are connecting.
  • NewThe authenticated dashboard now includes a first-login workspace tour that points directly at Home, Find contracts, My pursuits, Build response, Tasks & deadlines, Explore tools, and the dashboard priority card. Users can move through the tour with Next, skip it, or replay it with /dashboard?tour=1.
  • FixedDashboard tour scrims are now opaque and interaction-blocking. Outside clicks, target clicks, wheel input, and accidental page actions cannot dismiss or bypass the tour; only its controls or Escape can close it.
  • ImprovedThe public landing page now explains WinLayer in plain language for U.S. government contractors and presents the workflow as three clear moves: find fit, check evidence, and take action.
  • ImprovedThe workspace tour now focuses on the seven decisions and tools users need first, traps keyboard focus inside the tour, restores focus when it closes, and makes Explore tools and Replay workspace tour easier to discover.
  • ImprovedThe landing-page mobile app banner now waits before appearing and uses a smaller footprint so it does not compete with the primary signup action.
  • NewA privacy-friendly activation telemetry layer now records bounded page, signup, role-entry, dashboard-action, and tour events in structured server logs without collecting names, email addresses, query strings, or opportunity data.
  • ImprovedHome now gives each workspace role a suggested starting route, labels the active plan when access is explained, and keeps source-linked, estimate-only, human-decision guardrails visible beside the next recommendation.
  • ImprovedDashboard navigation now has an accessible skeleton loading state that preserves the page structure on slower connections, with responsive mobile behavior and reduced-motion support.

Sep 10, 2026

  • FixedThe landing hero headline now preserves the visible space between “Win more” and the rotating opportunity phrase. The deployed App Runner web image was smoke-tested on Home, Pricing, Terms, Privacy, and DPA with HTTP 200, no console errors or warnings, and no failed requests.
  • ImprovedLaunch acceptance now records the exact deployed web and API images, the latest graph reconciliation evidence, the current 14/38 GA preflight result, and the remaining external activation gates without marking legal, security, billing, provider, DNS, capacity, or owner approval as complete.
  • ImprovedGraph availability recovery is now recorded as complete: the hosted Neo4j read-only reconciliation matched PostgreSQL at 80,152 nodes and 213,085 relationships, and the later scheduled Graph Builder pass exited cleanly with no due events, errors, or integrity blockers.
  • ImprovedInternal staff applications were rechecked against the deployed environment: Developer Operations covers API-key creation, reveal-once handling, direct API calls, API Explorer, usage export, webhook lifecycle, and revoke cleanup, while Customer Service verifies status changes and restoration.
  • ImprovedProduction observability evidence now covers CloudWatch alarm health, SNS delivery to SQS and a human email recipient, Sentry injection on the running API image, and a controlled Sentry event with alert delivery.

Sep 9, 2026

  • FixedSecurity patching updated the web image-processing path and API dependency chain, including Next.js, Sharp, Hono, qs, multipart, XML, and HTTP-related packages. The production audit reports no unreviewed high or critical findings.
  • FixedOAuth callbacks now stay outside the wildcard customer-session middleware, and Google connection verification checks the granted Calendar scope so Drive and Calendar status reflects the real provider grant.
  • FixedDocument mapping and integration failure handling now redact provider internals while still giving operators enough information to distinguish a configuration problem from a customer authorization problem.
  • ImprovedThe graph evidence projection now remains PostgreSQL-authoritative through consistent streaming order, stable graph keys, and explicit reconciliation records instead of depending on incidental fetch order.

Sep 8, 2026

  • NewGraph source-review recovery can now repair only records with verified source anchors, raw-snapshot references, and unchanged content hashes, preserving historical rejection evidence while enqueueing safe graph updates.
  • ImprovedGraph reconciliation now verifies dedicated read-only Neo4j reader grants before accepting hosted recovery, keeping API graph reads separate from the Graph Builder writer credential.
  • FixedRecovered graph pagination and network visibility were hardened so large validation passes can be checked in bounded pages with fail-visible connection details.
  • FixedCached web builds now preserve the configured API origin, preventing a promoted frontend image from silently pointing at an older backend endpoint.
  • ImprovedLaunch gates now require concrete dependency, search, and live-source evidence. Quiet SEC polling is separated from provider failure, and Stripe subscription-item renewal dates map back to the billing state correctly.

Sep 7, 2026

  • FixedAWS release automation now writes App Runner and scheduler request payloads through private temporary files instead of fragile stdin piping, avoiding partial release calls and accidental secret exposure.
  • ImprovedScheduled worker promotion keeps ingest, budget, and graph schedules aligned with verified immutable images while retaining current and previous ECR aliases for rollback.

Sep 3, 2026

  • ImprovedHome, persistent workspace navigation, workflow guidance, Radar results, and opportunity utility links no longer preload every protected destination in the background. Slower connections now spend their bandwidth on the page the customer chose instead of speculative route fan-out.
  • FixedBrowser acceptance now guards both Home and Radar against background loading of unrelated protected pages while preserving normal click navigation, the compact opportunity route, desktop and mobile layouts, saved themes, and WCAG AA behavior.

Sep 2, 2026

  • ImprovedHome now leads with one recommended contract and the team's immediate deadlines. Metrics, recent changes, additional matches, pipeline flow, and shortcuts remain available in one expandable workspace section instead of competing with the daily decision.
  • ImprovedFind Contracts and every opportunity workspace now explain the saved result of Pursue, Watch, and Pass in plain language, including the explicit boundary that these choices organize WinLayer and never submit anything to an agency.
  • ImprovedOpportunity review now prioritizes company fit, estimated win chance, and response deadline. Ranking reliability and the reviewed-factor PWin model remain available behind clearly labeled optional disclosures for experienced capture teams.
  • FixedDesktop and mobile Chrome acceptance now protects the simplified journey, visible decision outcomes, compact opportunity navigation, optional expert scoring, WCAG AA, runtime console, failed-response, and horizontal-overflow contracts.
  • FixedThe server-rendered workspace now declares its default dark theme before the browser paints, preventing a transient light-token and dark-panel mismatch. Opportunity next-action controls use the shared purple action with a white label, hover, and keyboard-focus feedback, while desktop and mobile acceptance preserves an explicitly saved light theme and its visible purple back-to-top icon.
  • ImprovedEveryday workspace navigation is icon-led without decorative 01–04 labels, and both shell health indicators now use the concise Connected state.
  • FixedLegacy authenticated-workspace navy surfaces now inherit the current near-black hierarchy across shared-token panels and search dialogs, while semantic green, amber, and red states remain intact.
  • FixedLayer 6 PWin no longer carries a separate blue visual system. Its panel, eyebrow, score, scenario, action, hover, and keyboard-focus treatments now use the shared near-black and purple brand tokens, with browser regression covering the real workflow.
  • FixedMatching Strategy no longer uses an isolated navy-and-teal theme. KPI surfaces, fields, lists, comparison cards, dialogs, tabs, focus states, and supporting copy now follow the workspace's near-black, purple, and neutral hierarchy without repainting semantic status colors.
  • ImprovedThe full desktop and representative mobile route inventory now rejects visibly blue or navy large workspace surfaces while allowing imperceptible near-black channel variation.
  • FixedThe product-wide neutral-text guard no longer repaints every nested element. Purple actions and navigation, mint live and verified states, amber attention, red errors, and dedicated icon treatments retain their meaning across public, documentation, authentication, and workspace surfaces.
  • FixedLanding-page product previews inside light role sections are visible again: dark preview surfaces keep bright neutral copy while purple icons, mint live states, and selected controls retain their semantic palette.
  • FixedClerk email-verification digit slots now have a visible border, white field surface, dark input text, and purple focus ring instead of disappearing into the light authentication card.
  • ImprovedBrand browser regression now evaluates rendered contrast instead of demanding exact white or black, explicitly protects landing semantic colors and verification slots, and waits for the saved workspace theme before measuring a route.
  • FixedFirst Win's Generate brief and assistant actions now use the accessible purple action token. White labels remain above WCAG AA contrast both at rest and on hover instead of falling to 3.51:1.
  • ImprovedStrategic Growth Index now uses the workspace's near-black panel, metric-card, and input hierarchy instead of an inherited blue-gray surface. The Growth dashboard and Growth Plus portfolio presentations remain responsive and visually consistent.
  • FixedDedicated icon wrappers are no longer repainted by the neutral-text reset. Purple intelligence icons and semantic status icons retain their intended color, the executive AI tile can no longer combine legacy cream, lime, white, and square-corner styles, and pursuit lane counters no longer place white numbers on light-gray pills.
  • FixedDesktop and mobile browser regression now verifies the rendered Growth Index surface, Advanced intelligence icon, and executive AI icon tile together with page status, console and runtime errors, failed same-origin responses, and horizontal overflow.

Sep 1, 2026

  • ImprovedNeutral copy across the maintained public, authentication, documentation, legal, workspace, onboarding, desktop, and internal-staff surfaces—including preformatted API and activity payloads—now uses white on dark backgrounds and near-black on light documents instead of low-contrast gray. Semantic success, warning, and error colors remain distinct.
  • ImprovedPrimary actions now consistently use WinLayer purple, white labels, rounded corners, and visible hover and keyboard-focus feedback. Legacy lime, sharp-corner, and clipped treatments can no longer repaint Invite member or integration setup controls.
  • FixedA permanent brand regression inventory now checks 78 maintained desktop routes, 12 representative mobile routes, rendered neutral text, horizontal overflow, primary-action color and shape, and the exact rest and hover behavior of Invite member. The optimized production build passes all 92 active Chrome checks plus all 30 public WCAG 2.2 AA checks on desktop and mobile.
  • FixedEvery integration setup dialog now opens in the center of the visible browser viewport—even after the provider catalog has been scrolled—and tall forms scroll inside the dialog rather than appearing below the clicked control.
  • ImprovedIntegrations now uses high-contrast white for neutral page copy, table text, form labels, values, placeholders, controls, and dialog copy while preserving purple actions and semantic green, amber, and red states.
  • ImprovedOpportunity workspaces now use compact, collision-free Base58 links such as /o/FpSdMb3GTDbxpfaiMVEpR9 instead of exposing full UUIDs. Dashboard, Radar, Pipeline, onboarding, briefs, partner rooms, Copilot, command search, and desktop links all use the short route; existing UUID links redirect safely and preserve their query state.
  • NewPursue, Watch, and Pass now finish with an explicit saved outcome. Pursue creates one assigned qualification task with a due date, Watch confirms continued monitoring and alerts, and Pass records a reusable no-bid decision.
  • NewNo-bid decisions now require a plain-language reason and may include a note. The saved reason is visible in the pipeline, so teams can distinguish capability, eligibility, timing, value, capacity, duplicate, and other decisions.
  • ImprovedA capability-mismatch pass now updates that user's NAICS preference and lowers related future matches through the governed learning layer. The result names the exact number of current matches affected instead of claiming vague AI learning.
  • FixedDashboard recommendations no longer call a weak undecided match a strong candidate. The next-decision card prioritizes active pursuits or undecided matches scoring at least 65 and labels lower-fit active work as requiring fit verification.
  • ImprovedThe dashboard now shows the complete decision value loop—review source evidence, choose Pursue, Watch, or Pass, then receive a task, monitoring, or smarter ranking—and uses individual task language for Solo while retaining team language on multi-user plans.
  • FixedDesktop and mobile Chrome acceptance now exercises persisted Pass reasons, ranking feedback, Watch monitoring, idempotent Pursue task creation, pipeline visibility, plan-aware dashboard language, responsive dialog layout, accessibility, console errors, and failed network responses.
  • FixedThe release pipeline now updates both App Runner services to the exact immutable release image and verifies each configured SHA after rollout, instead of restarting whichever older revision was already configured.
  • FixedThe GitHub deployment identity now has the narrowly scoped App Runner update and ECR access-role permissions required by immutable-image promotion; release automation can no longer pass every build gate and then stop before rollout.
  • ImprovedShared mobile workflow labels, no-bid history, and decision-dialog details are now at least 12 pixels, while the download note in every public footer exceeds WCAG AA contrast instead of sitting just below the required threshold.
  • NewNew customers can now identify themselves honestly as an existing company, an independent professional, or someone exploring a federal market. A company name is required only for the company path.
  • ImprovedIndependent and exploration onboarding uses skills, NAICS research filters, and agency interests without claiming a SAM.gov registration, certification, contract vehicle, agency relationship, or bid eligibility.
  • NewResearch-only workspaces can inspect source evidence and save Watch or Pass decisions. Pursue, active capture, PWin presentation, and response-planning language remain unavailable until the customer adds a real company profile.
  • FixedThe Pursue boundary is enforced in the API as well as the interface, so a hidden, stale, mobile, or direct client cannot promote a personal research signal into an active pursuit.
  • ImprovedDashboard, Radar, opportunity detail, Pipeline, profile conversion, authentication guidance, and the shared workflow strip now use consistent research-first language for customers without a company.
  • ImprovedCustomers can add a company later from the research workspace. A saved legal company name unlocks company eligibility checks and pursuit controls without erasing prior research decisions.
  • FixedDesktop and mobile Chrome acceptance now completes both the company and no-company journeys, verifies persisted Watching state, confirms the absence of Pursue controls, and proves that a direct forbidden Pursue request is rejected.

Aug 31, 2026

  • FixedSign-up and sign-in now keep the secure account form inside the first desktop and mobile viewport instead of placing the email fields below an oversized product story and setup explainer.
  • ImprovedThe new-customer path now states the selected activation terms and the exact sequence from account creation to payment, company-fit setup, and one evidence-backed Pursue, Watch, or Pass decision. Mobile uses a compact four-step progress rail while desktop keeps the full guide beside the form.
  • FixedCustomers who save a real pursuit during onboarding now open that exact opportunity instead of landing on a separate generic First Win dashboard that can say No match or Not modeled.
  • ImprovedThe post-onboarding opportunity handoff now confirms that the pursuit is saved, explains the immediate next step, and opens either a ready-to-use owner-and-due-date action form or the source-evidence workspace. Completed onboarding also replaces temporary header controls with a clear saved and next-step status.
  • FixedThe no-opportunity onboarding branch remains intentionally separate and continues to build an honest profile-backed First Win coverage brief without fabricating a pursuit.
  • FixedThe onboarding workspace header no longer contains controls that only look interactive. Search now filters the mounted opportunity with explicit result feedback, while the notification bell and account avatar open accessible status panels.
  • FixedThe Chapter 4 opportunity card now responds consistently to every advertised interaction: click or tap, drag and drop, keyboard activation, and the explicit Move card button all save the opportunity in Pursuing. After a move, both the summary and lane counts now agree on Radar 0 and Pursuing 1 instead of double-counting the card.
  • FixedOnboarding no longer sends customers without a ready sourced opportunity through two consecutive completion screens. Chapter 4 now explains that setup is saved, source syncing continues in the background, and future matches appear in Find contracts; one final action completes setup and opens the profile-backed starting brief. The resulting Guided Plan points to live source coverage instead of telling a completed customer to continue setup.
  • ImprovedThe onboarding access chapter now defines a contract vehicle as a government purchasing program rather than a physical vehicle, adds a plain-English description beside every displayed program and business-status acronym, tells customers to select only items they can verify, and provides a clear none-or-unsure path without hiding opportunities.
  • ImprovedThe agency-preference chapter now asks which federal agencies the customer wants to work with, explains that selections only prioritize matching contract opportunities, confirms that WinLayer will not contact agencies or claim relationships, and labels the step optional.
  • ImprovedOnboarding now explains that NAICS entry is optional, recommends matching codes automatically from the selected capability, and reserves manual entry for customers who already use a code in SAM.gov. The profile-preview SETUP badge is also optically centered.
  • ImprovedFirst-run onboarding now uses WinLayer's purple identity consistently across its guide, workspace preview, controls, progress, focus states, and opportunity pipeline.
  • FixedOnboarding fields, choices, cards, and actions now retain complete four-sided boundaries at every chapter and viewport. A retired onboarding stylesheet that repainted nested controls and visually erased their outer borders is no longer rendered.
  • ImprovedMobile release links are now store-aware. Validated public Google Play and App Store product URLs activate the providers' unmodified official badges; until publication, Android remains a clearly labeled direct APK and iPhone remains a clearly labeled TestFlight or browser-demo channel.
  • FixedDirect APK and browser-demo actions no longer borrow store artwork before those store listings exist, preventing preview channels from implying Google Play or App Store availability.

Aug 27, 2026

  • FixedCustomer sessions can no longer bypass billing-only or suspended-workspace enforcement merely because the customer email is also listed as a platform operator. Elevated recovery access now requires a separately authenticated staff session.
  • FixedDisconnected integrations no longer consume a plan connection slot. Capacity is calculated from active connections only, while disconnected records remain available for audit history.
  • FixedWorkspace search now keeps successful results on screen when the address bar query is synchronized. Updating the URL no longer starts a same-route server navigation that remounts the search experience.
  • ImprovedLayer 8 daily brief generation now confirms success immediately and refreshes the twelve intelligence zones without hiding the completed action behind a second data load.
  • ImprovedPlan activation, staff empty states, selected controls, and primary plan actions use stronger contrast and clearer payment-card language across light and dark themes.
  • FixedAdmin, Developer Operations, and Customer Service acceptance now covers every role-specific menu, mobile navigation, session boundary, safe action, and Customer Service conversation route with independent temporary staff identities.
  • FixedThe delivery pipeline now runs the customer Developer Portal and an exact Solo, Growth, Growth Plus, and Enterprise entitlement matrix in addition to the full authenticated browser suite.
  • FixedRelease linting now excludes the checked-in compiled Flutter demo bundle while continuing to enforce ESLint across authored web, API, worker, CLI, package, and browser-test source.
  • FixedThe public mobile demo now bypasses the customer identity runtime like every other marketing route, preventing background Clerk requests from delaying or blocking the interactive Flutter preview.
  • ImprovedAPI, web, and ingestion-worker runtime images now apply current Alpine security updates during release builds so patched system libraries are present before ECR promotion.
  • FixedThe deployed commercial catalog has been reverified in Chrome on desktop and mobile: all four plans, monthly and annual prices, annual savings, the Solo-only trial, paid Growth activation, plan limits, comparison rows, and purchase actions render without console, network, or horizontal-overflow failures.
  • FixedAll eight Stripe test-mode plan and billing-cycle purchases have been revalidated end to end. Exact invoice amounts, renewal intervals, webhook activation, numeric limits, provider access, capability refusal, and upgrades match the billing specification; live charges remain outside the evaluation environment until production Stripe credentials are activated.
  • ImprovedPublic identity-runtime acceptance now observes a bounded client-startup window instead of sharing one network-idle timeout across ten sequential deployed pages, eliminating false deployment failures without weakening Clerk-request detection.
  • ImprovedEvery public footer now exposes clear mobile release actions: Android downloads the hosted ARM64 APK, while iPhone opens the explicitly labeled browser demo until a validated official TestFlight invitation is configured.

Aug 25, 2026

  • ImprovedPricing now makes the real annual discount explicit: the twelve-month list value is crossed out, the ten-month annual total is shown beside the exact dollar savings, and Checkout terms still disclose the full amount due. No promotional price is fabricated.
  • FixedPlan purchase acceptance now buys every monthly and annual Stripe test product, verifies the exact invoice amount and renewal cadence, and exercises every numeric entitlement, capability gate, and representative integration boundary for Solo, Growth, Growth Plus, and Enterprise.
  • FixedSubscription activation now renders all three progress indicators as identical true circles. Public navigation uses the clearer Download and Start for free labels, and the desktop client page now leads with Download instead of build-language CTAs.
  • ImprovedSubscription activation now uses the full browser width instead of reserving a hidden workspace sidebar. A focused responsive checkout presents the selected plan, included capabilities, billing cadence, renewal terms, Stripe protections, and primary payment action together.
  • NewThe landing-page mobile banner now opens a real interactive Flutter browser demo for the iPhone experience. The preview is permanently labeled as demo data, keeps every action local, and explicitly says it is not TestFlight or an App Store build.
  • ImprovedAndroid remains a direct hosted ARM64 APK download. When a validated official TestFlight invitation is configured, the iOS banner action still upgrades automatically from browser demo to the signed test build.
  • FixedThe first-customer handoff no longer turns a conference notice, general agency page, news item, or award-history record into a pursuit. Only actionable opportunity sources enter the pipeline chapter; otherwise WinLayer saves the First Win brief and names the live source-coverage gap without inventing a contract.
  • ImprovedSignup now previews the complete first-customer path before account creation: secure activation, four short company-fit chapters, ranked source-backed matches when available, and an honest persisted First Win coverage brief when they are not.
  • ImprovedEvaluation deployments now replace the identity provider's intrusive development ribbon with a clear product-level notice that Clerk and Stripe are in test mode, accept test details only, and cannot collect a real payment.
  • ImprovedFirst Win now leads with the three highest-ranked opportunities and progressively reveals the remainder in groups of three, keeping the first decision focused without removing access to the full sourced recommendation set.
  • FixedThe 14-day free trial is now enforced as a Solo-only offer across pricing, signup, account activation, legal copy, and Stripe Checkout. Growth, Growth Plus, and Enterprise no longer receive trial days and clearly show the amount due before confirmation.

Aug 24, 2026

  • ImprovedNew owners now reach a persisted First Win brief before the generic command center. When live opportunity coverage is not ready, onboarding presents an honest customer-profile preview and a source-gap action plan instead of inventing a contract.
  • FixedClerk sign-in and sign-up no longer leave a blank account panel while the protected UI loads. Branded loading, degraded-service, and retry states keep the identity boundary understandable on slow or failed connections.
  • ImprovedPublic proof now links directly to the source inventory, scoring method, and governance controls, explicitly rejects fabricated customer logos and contract-win guarantees, and states the card-required 14-day trial terms before signup.
  • NewOwners receive an in-app billing warning seven days before a card-backed trial renews, with the exact end date and a clear no-renewal message when cancellation is already scheduled.
  • FixedTrial and paid subscribers now have a dedicated cancellation action that opens Stripe's subscription-specific cancellation flow, instead of requiring customers to find cancellation inside the generic billing portal.
  • FixedCancellations scheduled by Stripe's customer portal now suppress renewal messaging whether Stripe reports a period-end flag or an exact cancellation timestamp.
  • ImprovedTrial terms and landing-page proof labels now honor the 12px readability floor on desktop and mobile. The Android preview promotion is a compact bottom strip on phones, so it no longer covers the primary trial action while customers browse.
  • NewSelf-serve Solo, Growth, and Growth Plus accounts now enter a card-required 14-day Stripe trial before company personalization. Checkout discloses $0 due today, the exact renewal cadence, the trial end, automatic renewal, and cancellation path.
  • FixedNew workspaces no longer receive an indefinite unverified Solo trial. Payment-pending, expired, canceled, and invalid legacy trials are isolated to account and billing recovery, while Stripe-backed trials and explicitly expiring operator grants retain governed access.
  • ImprovedStripe subscription webhooks now retain authoritative trial start and end dates, Checkout requires a payment method for trial activation, and the workspace shows remaining trial days and the upcoming charge date.
  • NewWinLayer now exposes a real tenant-scoped remote MCP server so compatible AI clients can research opportunities, pipeline, signals, forecasts, contacts, agencies, graph relationships, governed intelligence, agents, and workspace capacity through the existing public API controls.
  • NewThe customer Developer Portal includes a Connect AI workspace with the deployment-specific Streamable HTTP endpoint, safe generic configuration, copy controls, a scope map, and a complete MCP guide.
  • ImprovedMCP tool discovery follows each API key's least-privilege scopes. Sandbox clients remain synthetic and read-only, while live AI runs and action decisions retain subscription, role, cost, evidence, rate-limit, audit, and tenant-isolation enforcement.
  • FixedCross-origin API configuration now allows the MCP protocol and session headers required by browser-based compatible clients while retaining the exact origin allowlist.

Aug 21, 2026

  • FixedCompleted owners now enter the active dashboard after onboarding instead of encountering a second full-page company setup wall. Optional profile improvement is presented below the daily decision, where it does not block productive work.
  • ImprovedOwners can finish onboarding by keeping a real opportunity in Radar or deliberately moving it into Pursuing. Invited and read-only members inherit the workspace company profile and receive a short role-aware introduction rather than repeating owner setup.
  • ImprovedFlutter deep links, approvals, artifacts, workflows, notifications, and pursuit decisions now share persisted state with the web application. Acceptance tests exercise the real API and clean up the records they create.
  • FixedMobile production builds now fail closed when configured with test Clerk credentials, insecure service URLs, or missing release-signing inputs instead of silently producing a misleading production artifact.
  • NewThe landing page now serves the actual ARM64 Android preview from a dismissible download banner. The preview remains clearly labeled as pre-store software while protected signing, physical-device acceptance, and store publication remain external release steps.
  • FixedDirect APK downloads no longer fail through the application router, and the mobile Support control remains visible and separate while the download banner is open.
  • ImprovedPlatform, Solutions, and Security card collections now have independent borders, consistent internal padding, and responsive 12–20px grid gaps instead of visually merging into one continuous block.
  • ImprovedEvery public footer destination, anchored section, primary action, and brand link is now included in desktop and mobile navigation acceptance, with overflow, console, HTTP, and network checks.
  • ImprovedThe changelog now records the August release by its actual workdays—August 10 through 13 and August 17 through 21—instead of collapsing all Layer 1–9, client, mobile, staff, and UX work under the final deployment date.

Aug 20, 2026

  • ImprovedAdmin, Developer Operations, and Customer Service now operate as independently authenticated internal staff applications with their own route boundaries, navigation, mobile layouts, and role-specific workflows rather than appearing in customer navigation.
  • FixedDeveloper navigation, API Explorer CORS, reveal-once key persistence, copy feedback, webhook lifecycle controls, and usage export now work across tab changes and the deployed web origin.
  • FixedCustomer Service sequential navigation, saved queue views, filtering, playbooks, case controls, and the mobile Clear filters action now remain available without malformed routes or stale state.
  • NewCustomer Success is now a real in-app conversation flow. A visitor message reaches the isolated Customer Service inbox, a staff reply returns to the same browser conversation, and the thread can be closed or reopened without falling back to email.
  • ImprovedThe chat launcher and panel moved to the bottom-left on desktop and mobile, with a cleaner composer, separate send action, visible disabled state, Enter-to-send, Shift+Enter for a new line, and no control overlap.
  • ImprovedThe landing hero now explains the product in direct customer language with an outcome-led “Win more” message, clearer proof, and primary actions for finding relevant federal opportunities.
  • NewThe landing headline rotates through federal contracts, strategic recompetes, high-fit task orders, and must-win pursuits while preserving layout stability and reduced-motion accessibility.
  • NewWinLayer Mobile was migrated to Flutter as the canonical cross-platform client. The previous Expo prototype is archived, while Android, iOS, and browser targets share the maintained application code.
  • NewThe Flutter client covers Home, ranked opportunities, pursuits, Build Response, document handling, tasks, Copilot, governed approvals, Inbox, account settings, and secure handoffs to advanced workspace tools.
  • ImprovedMobile and web now use the same governed API state. Automated synchronization changes a pursuit in Flutter, verifies it in the browser, changes it in the browser, reads it back in Flutter, and restores the original state.
  • NewGoogle sign-in now begins through the real Clerk OAuth flow in the Flutter browser client, and the application can load a real tenant instead of presenting fixture data as a live workspace.
  • ImprovedAndroid emulator, Flutter browser, API synchronization, responsive navigation, analysis, automated tests, and release-build checks were added to the mobile acceptance path. iOS source support is present; native signing and TestFlight still require Apple tooling and credentials.

Aug 19, 2026

  • ImprovedThe customer dashboard now separates first-time setup from the active daily workspace, leads with one obvious next decision, and keeps advanced intelligence behind progressive disclosure.
  • NewThe daily decision view now explains why the leading opportunity matches, shows assigned tasks and deadlines, highlights recent changes, and adapts its priorities to the member's role.
  • ImprovedWorkspace navigation now exposes the core Find → Pursue → Build → Improve journey first, with specialist tools grouped behind More Tools and explicit explanations for plan-restricted destinations.
  • FixedSaved Briefs no longer lists empty placeholder captures, unavailable forecast amounts show “Value pending,” and unverified forecast signals explain that verification is in progress instead of exposing broken actions or internal contract errors.
  • NewLearned-evidence controls now open a real disclosure with sources, record count, model, date, and reasoning rather than rendering as inert text.
  • FixedThe five workflow steps and their primary actions now use complete readable labels and valid destinations on desktop and mobile; an additional Activity-page overflow was removed during the navigation audit.
  • ImprovedPublic, customer, staff, plan-gated, and responsive route sweeps now check headings, horizontal overflow, console failures, unsuccessful responses, mobile actions, accessibility, and connected role boundaries rather than treating HTTP 200 alone as a healthy page.

Aug 18, 2026

  • ImprovedDesktop 0.5.0 now opens a purpose-built purple decision command center instead of wrapping the web dashboard. Command Center, Radar, Pipeline, Intelligence, Approvals, search, and the compact analyst are shaped for a persistent desktop workspace.
  • FixedWorkspace Settings, specialist tools, Help, and every role-visible desktop navigation destination now stay inside the desktop shell instead of falling back to the browser sidebar and header.
  • ImprovedDesktop company settings now provide connected profile tabs inside the persistent client, while repaired intelligence links and destination adapters preserve tenant, role, evidence, and approval context.
  • ImprovedDesktop typography now uses an 11px minimum with 12–13px normal interface text, a wider navigation rail, and responsive compact layouts instead of over-compressing labels into unreadable 6.5–10px text.
  • FixedCLI slash-command completion now places the selected command into the prompt when Tab is pressed and reserves Enter for execution. Repeated palette use, history, aliases, natural-language dispatch, approval actions, and authentication are covered by interactive tests.
  • ImprovedCLI 0.3.0 was rebuilt as a responsive purple command center with live workspace status, searchable commands, compact opportunity and pipeline cards, readable narrow-terminal records, model selection, and clear progress for slow API calls.
  • FixedThe CLI connection and ready states now share one stable full-width layout, eliminating the oversized empty canvas, second spinner, inconsistent 82-column cap, and duplicate startup dashboard.
  • FixedThe terminal command center now uses a disposable alternate screen so loading output and blank scrollback cannot remain above the ready interface, while normal command results continue to scroll after startup.
  • ImprovedTerminal branding now uses compact slanted WinLayer slabs that scale down on narrow or short terminals instead of oversized ASCII lettering or a pixelated bar-chart mark.
  • ImprovedVisible product branding now consistently uses “WinLayer” across web, onboarding, desktop, CLI, authentication, and documentation; lowercase remains only for technical commands, packages, schemes, domains, and headers.
  • FixedThe public Support launcher is now anchored to the viewport corner on desktop and mobile, aligns with its open panel, and stacks safely with the scroll-to-top control.

Aug 17, 2026

  • ImprovedA final Layer 1–9 scope-parity record now covers all 1,525 PDF pages and 125,978 extracted words, records Layer 9's intentionally blank final page, and separates engineering-controlled delivery from licensed feeds, provider credentials, and production owner acceptance.
  • NewDesktop and CLI were restored as supported Layer 1–9 clients after the client-boundary review, while the unrelated source-code IDE, project file store, and coding-agent editor remain removed from the product.
  • NewPackaged desktop artifacts now provide a dedicated Electron client with secure bridge controls and the same governed workspace data, roles, evidence, and APIs used by the web product.
  • NewCLI 0.3.0 now provides secure browser/device authentication, scoped Layer 1–9 commands, JSON automation, guarded mutations, aliases, shell mode, and packaged installation without claiming that an unpublished npm build is generally available.
  • ImprovedThe first CLI visual rebuild replaced the oversized neon-green startup banner with a compact WinLayer workspace, quick-start actions, searchable slash-command palette, and a clean purple prompt.

Aug 13, 2026

  • ImprovedThe second PDF-backed acceptance pass closed the remaining engineering-controlled Layer 1–9 gaps and deployed the accepted implementation while retaining explicit external gates for licensed providers, live commercial credentials, legal approval, and production sign-off.
  • ImprovedLifecycle and tenant-isolation acceptance expanded to 228 checks across the governed layer contracts, with customer, staff, onboarding, intelligence, agency, and company-profile browser coverage.
  • FixedCompany-profile hydration and Solo-plan Intelligence failures were corrected so authenticated pages render deterministically across the supported browser and subscription states.
  • ImprovedThe deployed Graph Builder scheduler now runs on its five-minute cadence alongside the accepted web, API, database migration, and staff-client release.

Aug 12, 2026

  • ImprovedFirst-run onboarding was rebuilt as four short learn-by-doing chapters over the real workspace, replacing the long setup form with one decision at a time and a persistent source-backed opportunity card.
  • NewOnboarding fit, agency, access, and teaming choices now update the same opportunity in place, and the final step can move it into the saved workspace pipeline through mouse, touch, or keyboard interaction.
  • ImprovedThe onboarding surface now uses the WinLayer purple visual system, clearer hierarchy, glass panels, responsive layouts, animated progress and feedback, reduced-motion support, and accessible focus behavior.
  • ImprovedCustomer, Admin, Developer, and Customer Service planes were connected and verified against the shared API and tenant data while retaining separate authentication and cross-role access boundaries.
  • ImprovedLayer acceptance was recalibrated against all nine source PDFs—1,525 pages and 125,978 extracted words—instead of relying on earlier internal closure summaries, exposing the remaining live-source and provider-activation boundaries before final acceptance.

Aug 11, 2026

  • NewThe complete Layer 1–9 engineering pilot was deployed to the AWS development environment with web, API, database migrations, health/readiness checks, and scheduled graph processing.
  • ImprovedAuthenticated QA acceptance now opens all 29 customer modules, real opportunity and agency details, public desktop and mobile routes, protected-route behavior, plan gates, and connected workspace data.
  • NewThe customer Developer workflow now has live browser acceptance for API-key creation, reveal-once handling, scoped calls across six resources, revocation, and restored account state.
  • FixedStrategy and shared authenticated timestamps now render deterministically in UTC, removing timezone-dependent hydration failures on reports, profile, opportunity, and strategy surfaces.
  • ImprovedBrowser coverage was expanded to staff access, plan gates, developer workflows, accessibility, typography, overflow, authentication, and desktop/mobile mutation paths instead of treating skipped suites as complete acceptance.
  • ImprovedRelease checks now include repository and lifecycle tests, production builds, authenticated search load gates, live console/network monitoring, and clean restoration of QA plan, role, and API-key state.
  • NewA GA activation handoff now lists the remaining external credentials, provider authorizations, legal and security approvals, branded DNS, billing activation, and the exact places where owners must configure them without placing secret values in documentation.

Aug 10, 2026

  • ImprovedThe owned Layer 1–9 developer specifications were read page-by-page as the release acceptance source: 1,525 PDF pages in total, with extractable-text coverage recorded and the intentionally blank final Layer 9 page distinguished from unreadable content.
  • ImprovedLayer 1 Signal Intelligence now covers governed source ingestion, normalized signals, immutable provenance, revisions, deduplication, scoring, correlation, review queues, replay, dead letters, graph readiness, and secured operational APIs.
  • ImprovedLayer 2 Procurement Knowledge Graph now includes source-independent fingerprints, temporal graph entities and relationships, a durable outbox and sole Graph Builder, entity resolution, corporate lineage, outcome feedback, analytics, traversals, and explainable predictions.
  • ImprovedLayer 3 Opportunity Intelligence now exposes the complete intelligence catalog with evidence lineage, confidence, lifecycle controls, graph enrichment, governed APIs, and responsive customer views.
  • ImprovedLayer 4 Agent OS now supports governed agent lifecycles, immutable reviews, PWin and bid decisions, notifications, idempotency, interrupts, audit history, and the connected agent workspace.
  • ImprovedLayer 5 Execution now implements the documented response workflows, evidence-linked documents and artifacts, acceptance criteria, immutable audit ledger, tenant isolation, redaction, and human approval before external effects.
  • ImprovedLayer 6 Workspace Intelligence now provides agency and competitor watchlists, comparisons, scoring, actions, permissions, auditing, persistence, APIs, and responsive decision views.
  • ImprovedLayer 7 Exchange now supplies the governed API, webhook, OAuth, document, CRM, collaboration, and automation integration plane while clearly keeping credentialed third-party activation dependent on provider authorization.
  • ImprovedLayer 8 Executive Intelligence now implements the executive modules, recommendation contracts, dashboard zones, scenario and governance controls, and fail-closed learning eligibility.
  • ImprovedLayer 9 Learning now provides governed outcome capture, learning modules and types, leaderboards, award monitoring, recommendation feedback, drift controls, rollback, and bounded optimization.
  • ImprovedFresh-database migration, repository tests, typechecks, production builds, desktop/mobile browser rendering, tenant isolation, and lifecycle suites were established as the repeatable local acceptance baseline before deployment.

Aug 7, 2026

  • NewEvery recompete now carries an Incumbent Replacement Opportunity Score, so capture effort goes where an incumbent can actually be displaced rather than where a contract merely expires. A long record of repeat awards counts against displaceability more than any single weakness counts for it, and a score built from too little evidence is reported as insufficient rather than presented as confident.
  • NewThe Bid/No-Bid Portfolio Advisor answers which subset of pursuits to bid given finite capture capacity, not simply whether each one is attractive alone. Because capture effort is a fixed pool, adding a pursuit is declined when it would spread the team thinner and lower expected value across the whole portfolio.
  • NewPartner Strategy reports the relationships worth investing in across the pipeline, and flags the same partner as a concentration risk when a large share of pursuits depends on them. A partner filling a gap nobody else fills outranks a better-performing but replaceable one.
  • NewExecutive Recommendation Memory records what leadership decided and what followed, surfacing repeated choices that have consistently gone badly. Choosing not to bid and then not winning never counts as a win, so a costly no-bid habit stays visible instead of looking successful.
  • NewDebrief Intelligence turns government debriefs into reusable knowledge, ranking findings the way source selection ranks them and preserving evaluator language verbatim. Strengths are captured alongside weaknesses, and a theme is only called a pattern once it recurs across distinct pursuits.
  • NewCompetitor Watchlist tracks named competitors by UEI and answers what changed since you last looked, rather than restating their current position. The baseline advances only when someone actually reviews an entry, so a background refresh cannot consume the change you were meant to see.
  • NewA procurement calendar consolidates every pursuit deadline, rolls dates that fall on a weekend or federal holiday forward to the next business day while keeping the solicitation's stated date visible, and flags weeks where two pursuits with shared owners come due together.
  • NewDocuments are now connected by provenance rather than resemblance, so when an amendment lands you see the drafts that actually derive from the solicitation instead of documents that merely read alike. Structured identifiers are extracted with source offsets; risks and win themes are named as requiring model review rather than guessed.
  • NewResource and capacity planning reports utilisation above 100% at its true value instead of capping it, and treats a skill held by one available person as a single point of failure rather than as coverage.
  • NewTask-order forecasting predicts the next order an agency will place against a vehicle from observed ordering cadence, widening the window when ordering is irregular and predicting nothing at all once a vehicle nears its ceiling.
  • NewSCIM user provisioning brings Microsoft Entra ID, Okta, and Google Identity to their full launch capability: joiners, leavers, and attribute changes flow from your directory. Removed users are deactivated rather than deleted so audit history survives, platform roles are never overwritten by the directory, and a sync that would deactivate most of your members is refused pending review.
  • NewOutreach drafting produces introductions, meeting requests, industry-day follow-ups, and bounded Day 1/7/30 sequences. Once a solicitation is open or under evaluation, program-side contacts are withheld and only the contracting officer is offered, because approaching program staff mid-procurement is improper.
  • ImprovedQualification now runs a hard gate before any AI reasoning begins, so an opportunity you are not eligible to hold is refused rather than analysed. A gap a teaming partner can close still permits teaming and discovery work; a set-aside you cannot hold stops the pursuit outright.
  • ImprovedAgent work is queued by urgency instead of arrival order. Deadline proximity outranks scores, so a solicitation closing this week runs ahead of relevance scans for opportunities nobody will bid, and procurement events that invalidate queued analysis force it to be redone.
  • ImprovedSet-aside predictions now apply Rule of Two evaluation against the responding vendor pool rather than inferring from what the agency did previously, and only ever predict a move toward narrower competition.
  • ImprovedOrganizational Conflict of Interest screening compares your existing contracts against a pursuit and separates conflicts that a firewall can mitigate from those that cannot, so a disqualifying conflict is found before capture money is spent rather than by a competitor's protest.
  • ImprovedLearning from recorded outcomes now moves any scoring factor by at most five percent per action, so one unusual win cannot over-prioritise an agency or NAICS while a genuine pattern still converges.
  • ImprovedNotification effectiveness is measured by time to action rather than open rate, with suppressed alerts excluded from every rate so the suppression policy is not mistaken for an engagement problem.
  • ImprovedStrategic reasoning and long-form generation now run on Claude Opus 5.
  • FixedIntelligence objects whose graph references no longer resolve are refused before they reach downstream analysis and recorded with the reason, instead of being passed on with links that silently point at retired entities.
  • FixedA graph acceptance check compared event timestamps against a hardcoded date and began failing once that date passed, reporting a defect in correct code. Verification now runs against the real clock.
  • FixedA database migration was missing its journal entry and therefore never ran, leaving code writing to a column that did not exist. Migration verification now provisions a fresh database and confirms each table exists before use.

Aug 6, 2026

  • FixedBilling now follows the client subscription specification exactly: API credentials are included with eligible plans and are no longer sold as a separate API-key pack. New checkout, pricing, documentation, and Stripe setup paths expose only seats, integration capacity, and proposal-analysis packages; grandfathered Stripe items remain honored.
  • NewA dependency-free Northstar customer portal now demonstrates the commercial API end to end: a plan-provided sandbox or live credential stays server-side while the customer's branded website renders ranked opportunities, pipeline decisions, forecasts, agencies, and subscription usage from real WinLayer endpoints.
  • NewThe standard Layer 7 launch set is now executable at its documented levels: Salesforce, HubSpot, Microsoft 365, Google Workspace, Teams, Slack, Make, Zapier, and n8n at Level 3; Dynamics, Unanet, SharePoint, OneDrive, Google Drive, Box, Dropbox, and DocuSign at Level 2.
  • NewSalesforce, Dynamics, and Unanet now join HubSpot in the governed CRM sync plane with constrained provider URLs and identifiers, tenant-defined field and stage mappings, deterministic conflict policies, per-record provenance, cursors, health, retry, replay, and provider-native follow-up tasks.
  • NewGoogle Drive, SharePoint, OneDrive, Box, and Dropbox provide bounded document discovery and upload actions, while DocuSign provides envelope discovery and human-reviewable draft creation through the same encrypted OAuth and audit boundary.
  • NewEnterprise workspaces can request Entra, Okta, or Google Identity SAML/OIDC activation with validated issuer, domain, protocol, and group-to-role mappings; customer endpoints store public configuration only and never accept identity-provider secrets.
  • ImprovedThe public developer API expands from opportunity and pipeline basics to nine documented resources—opportunities, detail, pipeline, signals, forecasts, contacts, agencies, relationships, and intelligence—with one bounded opaque-cursor contract and deterministic sandbox coverage for every resource.
  • ImprovedAPI keys now expose 13 least-privilege scopes, keep sandbox credentials read-only and expiring, meter denied requests, and present the expanded scope and endpoint catalog consistently in the Developer Portal and documentation.
  • ImprovedTerraform, the protected GA workflow, the redacted readiness command, environment template, and activation handoff now carry Salesforce, Dynamics, Box, Dropbox, and DocuSign app credentials in addition to HubSpot, Google, and Microsoft without printing secret values.
  • FixedWorkflow, intelligence-object, and agent-run detail routes now share one RFC-compliant UUID validator, so valid identifiers reach their records and malformed identifiers fail cleanly instead of being rejected by a broken expression or crashing the database.
  • FixedDevelopment seeding now restores the seeded tenant plan, settings, member profiles, roles, and statuses on every run, preventing plan-gate and role tests from inheriting state from an earlier suite.
  • FixedContacts and Partner Workspaces now own their dark-theme variables inside their CSS modules, keeping the standalone production build as dark and readable as development; the complete authenticated WCAG 2.2 AA matrix passes on desktop and mobile.
  • FixedUSAspending award correlation now resolves the global award identity before agency-scoped similarity, so awarding-agency and funding-agency observations attach to one governed Live Opportunity instead of colliding during live ingestion.
  • ImprovedSAM.gov Opportunity and Entity requests now use bounded exponential retries for timeouts, rate limits, and server errors while still failing immediately on permanent credential or request errors.
  • ImprovedRelease acceptance now passes 605 repository tests, 152 production-build typography and overflow routes, 26 authenticated accessibility routes, and 112 public and functional browser contracts with zero current failures.

Jul 31, 2026

  • FixedAWS releases now verify and activate the configured internal staff service principal after migrations, so the standalone Administration, Developer, and Customer Service applications can load their real API-backed controls instead of an offline fallback.

Jul 30, 2026

  • FixedStandalone staff sign-in buttons now meet WCAG AA contrast, and mobile Guided Plan export, sharing, and regeneration actions retain readable labels instead of collapsing to icon-only text.
  • ImprovedFederal-source deployment smoke checks now keep an unavailable optional source fully visible in ingestion runs and dead-letter evidence without allowing that third-party outage to block unrelated application releases.
  • FixedThe final local closure acceptance now applies all 68 migrations to the development database, starts the real Nest API with zero compile errors, verifies every Layer 3–9 catalog over HTTP, proves the independent Admin boundary on graph operations, passes 575 repository tests, passes lint and all 7 monorepo typecheck tasks, and completes 152/152 desktop/mobile typography and overflow route checks.
  • NewThe Layer 1–9 closure pass adds canonical, persisted control planes for 12 intelligence outputs and 16 engines, 10 governed agents, 23 execution components, 26 workspace modules, 28 integration targets, 15 executive modules, and 10 learning modules.
  • NewLayer 1 now preserves versioned attachment manifests, item-level parser state and quarantine, source acceptance results, immutable citations for every supported record family, and formula-versioned signal strength, confidence, urgency, relevance, evidence, half-life, decay, and effective score.
  • ImprovedAgency forecast intelligence now uses a governed 17-source multi-agency registry with reviewed official government URLs and adapter versions instead of a DHS-only catalog.
  • NewAmbiguous signal correlation now has a Platform Admin review queue plus reason-backed link, create, reject, merge, split, replay, and source-removal reconciliation with append-only history.
  • NewFull graph rebuilds now use tracked generations, wait for every projection child, preserve integrity evidence, retire stale PostgreSQL and Graph-Builder-managed Neo4j records safely, and retain every orphan retirement decision.
  • NewExact PostgreSQL-to-Neo4j reconciliation now compares stable node IDs, edge keys, counts, and hashes through a separately provisioned reader identity and records bounded missing or extra samples.
  • FixedThe API no longer accepts or falls back to the Graph Builder's Neo4j writer credential. Graph reads require NEO4J_READ_* and reject mutation Cypher before it reaches the database.
  • NewCanonical intelligence, agent, execution, scenario, and learning APIs now expose lifecycle, evidence, review, approval, interrupt, retry, dead-letter, replay, drift, rollback, and governance state instead of only feature-local result shapes.
  • ImprovedThe Layer 1–9 compliance report now separates code-backed implementation from licensed feeds, provider authorization, live Aura acceptance, production sample thresholds, and client-owned sign-off; external work is never mislabeled as complete.
  • FixedFresh disposable PostgreSQL acceptance applies all 68 migrations and now covers ingestion cursor/failure/dead-letter behavior plus Graph Builder projection, terminal failure, replay, deterministic rebuild children, and integrity preflight.
  • NewGraph Builder passes now emit a bounded PostgreSQL integrity preflight covering accepted node/master and edge-endpoint consistency, expired active edges, inactive-master residue, queue state, and sampled offending edge keys. A dangling accepted projection blocks the worker; remote Neo4j comparison remains explicitly pending its dedicated read-only account.
  • NewLayer 2 Program Matching now resolves budget, forecast, SAM, and award program names through structured agency/office/program-office/program-code/budget/NAICS/PSC scope plus optional pgvector semantic comparison. Cross-agency links are blocked, ambiguous candidates remain separate, and unavailable embeddings are labeled structured-only rather than implied.
  • ImprovedBilling now follows the client Billing & Subscription Management specification as the commercial source of truth: Solo, Growth, Growth Plus, and Enterprise replace the former preview labels across pricing, Checkout, workspace billing, legal copy, documentation, and entitlement tests.
  • FixedCustomer billing now exposes only business capacity and account controls; AI workflow volume, delivery-processing volume, internal costs, and renewal-likelihood scoring are restricted to Platform Administration as required by the billing specification.
  • FixedConcurrent proposal analyses now use one auditable monthly reservation ledger, preventing a completed run from being briefly counted twice and ensuring Solo receives all 10 included analyses before add-on capacity is used.
  • NewPlatform billing governance now tracks per-company AI workflow categories, integration jobs, report/email/webhook delivery attempts, document and archive growth, proposal artifacts, knowledge-graph activity, custom company records, historical opportunity records, and fair-use flags.
  • FixedUsage thresholds now enter the workspace notification center for owners and administrators at 75%, 90%, and 100%, with direct actions to archive inactive pursuits, review seats or integrations, buy analysis capacity, or compare upgrades.
  • FixedProposal-analysis packages and reservations no longer use AI-credit terminology anywhere in the active schema or application; customers purchase business outcomes and never tokens or AI credits.
  • ImprovedSubscription Health now uses explicit authenticated-user activity, and internal governance separates CRM, calendar, email, API-sync, external-import, historical-pursuit, archived-opportunity, proposal-archive, award-history, and activity-log counts.
  • NewPursuit capacity now follows the documented lifecycle exactly: Qualified, Capture, Proposal Development, and Submitted count; Watching, Won, Lost, No Bid, Archived, and Cancelled release capacity, with an editable stage control in every opportunity workspace.
  • NewSeat governance now distinguishes pending invitations, active users, and disabled users. Active and pending members consume plan capacity; disabled members remain auditable without consuming a seat.
  • ImprovedPlan-aware integrations now match the contract: Solo receives Make and Zapier; Growth adds HubSpot, Salesforce, and Unanet; Growth Plus receives every standard provider; Enterprise can commission custom providers. Provider access and connection counts are both enforced by the API.
  • NewCustomer-account creation can now sync to WinLayer's CRM through a signed webhook with pending, synced, failed, and not-configured states plus an operator retry action.
  • ImprovedRetention jobs now apply the subscription's 12-month, 24-month, or unlimited archive boundary while respecting tenant governance policy and legal holds; records are archived rather than deleted.
  • ImprovedCanceled and incomplete subscriptions preserve read access to existing work but reject new mutations until reactivation, while billing and account-recovery routes remain available.
  • NewWorkspace owners and administrators now have a dedicated customer Developer Portal for creating reveal-once sandbox or production API keys, reviewing request usage, managing signed webhooks, and copying scoped integration quickstarts.
  • ImprovedAPI access follows the commercial plan directly. Active-credential limits are security and service-protection controls rather than customer billing units, and API keys are not sold separately.
  • FixedCustomer API-key and webhook routes once again use the workspace session and tenant boundary, while internal Developer Operations moved to its own staff-only route, cookie, capability allowlist, and login.
  • FixedDeveloper limits are enforced and displayed consistently across browser and API flows, including total keys, sandbox keys, live access, webhooks, revocation, secret reveal-once behavior, and request metering.
  • NewA customer Developer Portal guide now documents every console view, operational credential limits, live and sandbox credentials, key rotation, webhook safety, and the hard boundary between customer access and internal Developer Operations.
  • ImprovedNew API credentials now open in a non-dismissible reveal-once warning that explains secure storage, provides an explicit copy action, and requires the user to confirm the secret is saved before it disappears.
  • ImprovedReadable typography now has a product-wide 12px minimum across public, documentation, workspace, and staff surfaces, backed by a live 75-route browser regression that also checks horizontal overflow.
  • ImprovedPlatform Administration now includes seven focused work areas for customer accounts, revenue operations, service escalations, source health, audit evidence, and staff access controls, plus subscription-risk and plan-mix views.
  • NewDeveloper Operations now includes a safe API explorer, copyable cURL requests, endpoint usage and webhook-delivery health, an event catalog with signing and retry details, and cURL, Node.js, and Python quickstarts.
  • ImprovedCustomer Service now includes saved queue views, SLA and follow-up warnings, case-age context, sorting, copyable case identifiers, and implementation, migration, training, and priority-support playbooks.
  • FixedStandalone staff consoles keep their own role-scoped sessions and API boundaries while presenting larger text, responsive navigation, accessible controls, and true-dark desktop and mobile layouts.
  • NewThe Procurement Knowledge Graph now has a durable PostgreSQL outbox, separately scheduled sole-writer Graph Builder, governed 32-label temporal projection, retry/dead-letter/replay controls, and deterministic rebuild requests instead of API-time Neo4j writes.
  • NewEntity resolution now follows exact IDs, known aliases, bounded deterministic similarity, and manual review; unresolved relationships are suppressed until an independently authenticated Platform Administrator records a reason-backed link, create, or reject decision.
  • NewMarket Intelligence now materializes the four Layer 2 higher-order analytics—Growing Agency, Emerging Program, Vehicle Dependency, and Contract Concentration Risk—with evidence IDs, score, confidence, risk, calculation window, and stale-result retirement.
  • ImprovedThe market-insight engine suppresses inactive or low-confidence evidence, weak samples, and ambiguous agency, vendor, or vehicle links. Financial concentration uses obligations only with complete award coverage and otherwise falls back to award count.
  • NewThe Layer 2 NAICS ↔ PSC Crosswalk Engine now learns governed many-to-many mappings from repeated USAspending, SAM.gov, and historical-award pairings, retains inactive weak evidence for review, and protects Platform Admin refinements from automated overwrite.
  • ImprovedSignals with a sourced PSC now preserve naics_original, expose naics_inferred and crosswalk_confidence separately, project visibly labeled inferred graph relationships, and apply confidence-weighted relevance and partner matching without granting source-code credit.
  • NewThe Layer 2 Vendor Performance Graph now materializes the client-specified total awards, observed obligations, average award size, agency/office/vehicle reach, subaward and prime counts, and evidence-proven recompete wins from accepted PostgreSQL graph evidence.
  • FixedVendor performance never substitutes missing financial evidence with $0 or treats a generic teaming edge as a subaward. Recompete wins stay unknown until an award-stage opportunity and explicit follow-on, replacement, or consolidation lineage prove them.
  • NewThe Teaming Intelligence Graph now materializes observed prime-to-subcontractor history from canonical accepted subawards, including shared contracts, agencies, sourced relationship value, value coverage, confidence, and bounded evidence IDs. It is available in Market Intelligence and through the authenticated graph API.
  • FixedA generic Vendor-to-Vendor relationship, recommendation, or company-name similarity can no longer be presented as historic teaming. Past-performance records require canonical subaward issuer, recipient, and contract evidence and retire when their evidence becomes inactive.
  • NewContact Relationship Intelligence now materializes relationship strength, accepted procurement-appearance count, distinct award count, last-seen date, confidence, and bounded evidence-edge IDs from Contact → Contract or Task Order evidence. The dedicated API and Market Intelligence card label it clearly as procurement-pattern recognition, never lobbying or personal influence scoring.
  • FixedVehicles and IDV parent contracts are now separate graph entities, with Vehicle → IDV Parent → Task Order lineage, vendor IDV ownership and performance edges, and financial fields retained on the correct award record.
  • NewSAM and agency contacts, GAO protests, USAspending subawards, corporate parent identities, and SBA joint-venture or mentor relationships now project as lean, source-backed graph nodes and temporal edges.
  • NewAuthenticated graph APIs now expose the documented opportunity, vendor, agency, likely-recompete, and teaming traversals with bounded parameters and explicit not-configured behavior.
  • NewThe scheduled Graph Builder now calculates explainable vendor dominance, contact-award frequency, likely recompetes, potential teaming partners, and bidirectional competitor relationships from accepted source edges, while retiring stale derived results.
  • NewEach workspace now has a tenant-isolated graph overlay for its company, tracked agencies and vendors, watched or captured opportunities, and managed partners; private choices remain in PostgreSQL and never leak into the shared Neo4j reference graph.
  • ImprovedEvery projected graph node now carries source-backed confidence and a reason, while temporal relationships expose start/end dates, provenance, confidence, last-seen state, and active retirement state.
  • NewThe Procurement Pattern Engine now calculates observed budget-to-forecast, forecast-to-RFI, RFI-to-sources-sought, and sources-sought-to-RFP timing by agency and program, with exact sample counts and the documented low, medium, and high reliability multipliers.
  • NewPrediction learning now preserves the original predicted solicitation date, matches real releases across agency, NAICS, PSC, date, and keywords, records actual date and error days, and publishes reproducible global and agency accuracy.
  • NewUniversal recommendations now store an immutable ordered evidence path for every version, while verified outcomes retain tenant-private opportunity, recommendation, proposal, executive-decision, partner, agency, vehicle, and forecast lineage.
  • FixedThe procurement graph no longer treats a subagency code as an office or flattens vehicle scope into one string: Agency → Subagency → Office → Program Office → Program and Vehicle → Pool → Domain → Track → SIN → Award Holder are now distinct, source-backed hierarchies with resolved parent UUIDs.
  • NewSource-backed opportunity lineage now records replaced-by, related, follow-on, competing, consolidated, and split relationships through stable IDs only; reciprocal connections, direction, confidence, and reason survive Graph Builder replay while title-only guesses are suppressed.
  • ImprovedBudget Account graph nodes now retain resolved agency/program UUIDs, numeric fiscal year, Treasury account, requested and enacted amounts, deterministic procurement relevance, immutable source-document reference, and timestamps; extracted account codes and dollars must appear in the official source text.
  • NewCorporate lineage now preserves parent/subsidiary ownership, acquisitions, reciprocal mergers, rebrands, spin-offs, divestitures, business units, corporate families, JV leadership, mentor-protégé agreements, and original/current award holders with temporal evidence.
  • FixedParent Company, Subsidiary, Acquired Entity, Divested Entity, and Joint Venture are role labels on one canonical Vendor instead of duplicate company records; a UEI/CAGE continues to resolve to exactly one legal entity.
  • ImprovedVendor graph records now retain the complete client capability contract: revenue tier, socioeconomic status, SBA certifications, DSBS keywords, primary NAICS portfolio, capability statement, source systems, timestamps, parent UEI, and resolved parent UUID.
  • NewCertification history is temporal and replayable: expired, graduated, and renewed periods connect one Vendor to one canonical certification type without overwriting earlier evidence.
  • ImprovedGraph contacts now retain email, office phone, role, title, source systems, timestamps, and resolved agency/office UUIDs; current and previous Vendor employment remain separate, dated relationships with historical titles.
  • NewUSAspending contract actions are now immutable, separately fingerprinted signals: transaction/modification IDs, action date/type, funding/scope/administrative/period/option classification, and source amounts remain connected to the canonical Contract or Task Order.
  • ImprovedContract financial state now retains current and all-options value, ceiling, obligations, outlays, remaining potential, latest obligation date, transaction and modification counts, and an explicit completeness level; unknown original base values are not invented.
  • FixedThe Graph Builder now merges repeated node observations by source authority, preventing a thinner lower-authority award action from erasing stronger vendor capability, certification, or corporate-lineage evidence.
  • NewContract Vehicles now includes the Layer 2 IDV ceiling dashboard: source-backed ceiling, observed task-order obligations, remaining runway, utilization, vendor-pool usage, completeness, confidence, and calculation warnings.
  • FixedTask-order financial values can no longer be copied onto the parent Vehicle, and sparse same-authority observations no longer erase an existing non-empty graph property with null.
  • ImprovedIDV calculations never invent runway when ceiling evidence is missing, and HIGH confidence is blocked until a source explicitly certifies the observed task-order population as complete.

Jul 29, 2026

  • NewThe public footer now links to clearly labeled App Store and Google Play early-access paths, backed by an honest iOS and Android roadmap that does not imply either mobile app is already published.
  • NewA landing-page-only customer-success widget now provides setup, API, plan, documentation, and support paths; it uses customer-success email today and activates a configured HTTPS live-chat provider without following users through the signed-in workspace.
  • NewAdministration, Developer Operations, and Customer Service are now independently authenticated staff applications: each has its own username/password login, HMAC-signed HttpOnly cookie, eight-hour session, responsive shell, navigation, and API route allowlist. They do not initialize Clerk, inherit customer roles, or share access with one another.
  • FixedCustomer workspace owners and administrators no longer receive links or module grants for internal Admin, Developer, Customer Service, or staff-access routes; a paid plan or Clerk session can never become a staff credential.
  • NewPlatform Administration now brings real cross-customer account creation, subscription and entitlement changes, custom plans, capacity grants, commercial adjustments, suspension controls, source health, and operator audit evidence into one control plane.
  • ImprovedThe Developer console now leads with credential, request, error, latency, and webhook health while retaining reveal-once scoped API keys, usage exports, endpoint scopes, and signed webhook management.
  • ImprovedCustomer Service now operates as a dedicated cross-company case queue with live triage counts, search and status filters, persisted case-state changes, requester communication, progressive loading, and platform-operator-only access.
  • NewThe pricing experience now exposes the complete product value: 60 plan highlights, 40 linked capabilities across eight operating areas, 38 exact entitlement comparisons, a six-step operating loop, and four purchasable capacity add-ons.
  • ImprovedPlan names now follow a familiar SaaS progression—Free, Basic, Pro, Business / Team, and Enterprise—while stable internal plan IDs preserve existing subscriptions, Stripe mappings, checkout links, and entitlement history.
  • ImprovedFree is now a focused, enforced preview: the top 12 personalized live opportunity matches, 3 active pursuits, 1 user, 1 grounded analysis per month, a read-only Copilot portfolio pulse, 30-day retention, and no API keys, webhooks, integrations, document ingestion, secure exports, or paid Copilot runs. Basic unlocks the complete working loop.
  • FixedCapture, recompete, proposal, solicitation, and response-artifact generation now consume the same grounded-analysis allowance, while Copilot Q&A and Daily Growth generation require the paid Copilot entitlement in both browser and API flows.
  • ImprovedProvider-dependent and sales-assisted promises are labeled honestly: OAuth needs customer authorization, Enterprise SSO needs production identity-provider setup, custom integrations are scoped with the WinLayer team, and GovCloud planning does not claim GovCloud hosting.
  • NewA dedicated Free-plan acceptance suite now proves the exact limits and paid-feature denials against the running API, then verifies matching Pricing, Billing, Radar, Workbench, First Win, and Copilot states in desktop and mobile browsers with console, network, and overflow checks.
  • ImprovedFive responsive plan cards now connect directly to free sign-up, monthly or annual paid selection, enterprise sales, product documentation, plan comparison, and authenticated add-on management without dead controls.
  • FixedRecurring seat, API, and integration add-ons now have a dedicated billing destination: new buyers include quantities during Checkout, while existing Stripe-managed subscribers enter the subscription-update portal without being forced onto another plan.
  • ImprovedPublic pricing and authenticated billing now use the same enforceable plan language for pursuits, users, analyses, API keys, integrations, webhooks, retention, intelligence modules, enterprise controls, and support.
  • ImprovedPublic pages, documentation, legal routes, onboarding, CLI authorization, and workspace surfaces now begin closer to their headers, while public and shared-report footers use readable type and larger interaction targets.
  • FixedCompact partner scores, initials, metadata, and PWin-lift badges now preserve WinLayer purple in dark mode while meeting WCAG 2.2 AA contrast on desktop and mobile.
  • NewPlan intent now survives public pricing, Clerk sign-up, mandatory workspace onboarding, and the final billing decision, including monthly or annual selection.
  • NewCheckout returns are verified server-to-server against Stripe before WinLayer confirms payment or activates subscription and grounded-analysis entitlements.
  • NewThe Stripe customer portal now supports plan changes, prorations, promotion codes, payment methods, tax details, invoice history, cancellation reasons, and cancel-at-period-end lifecycle management.
  • ImprovedBilling now presents the selected plan first, shows the exact annual total and savings, explains Stripe verification and invoice access, and preserves the choice after a cancelled checkout.
  • ImprovedStripe Checkout now collects B2B billing and tax identity details, accepts configured promotion codes, and uses idempotency keys to prevent duplicate sessions on retry.
  • ImprovedWorkspace owners can see whether billing is disabled, in test mode, or live without exposing credential material; test mode is explicitly labeled so test payments are never mistaken for revenue.
  • FixedA delayed or missed webhook no longer leaves a paid buyer in limbo: the verified return path safely reconciles the Checkout Session and expanded subscription while webhook processing remains authoritative and idempotent.

Jul 28, 2026

  • NewGuided First Outcome path connecting company evidence, ranked recommendations, a human Pursue / Watch / Pass decision, accountable execution work, and the first evidence-backed deliverable in one workflow.
  • NewMandatory personalized first-run onboarding now captures each user's role, company profile, capabilities, certifications, target agencies and markets, growth goals, and operating preferences before opening the workspace.
  • NewA five-stage Setup → Discover → Decide → Build → Improve journey now guides users across 46 workspace pages with plain-language next actions, completion states, prerequisites, and useful empty and error states.
  • NewLive recommendation progress now connects pursuit decisions, tasks, documents, capture artifacts, workflows, grounded AI outputs, and approval actions to the current First Win brief.
  • NewTransparent workspace value proof for connected evidence, decision coverage, reusable deliverables, sourced weighted value in motion, and a clearly labeled conservative estimate of planning time returned.
  • ImprovedThe Guided Plan now leads with one next-best recommendation, explicit evidence and response-clock signals, in-place decision controls, and direct paths into the evidence workspace, capture output, and teaming validation.
  • NewA first-30-minutes workspace guide and contextual upgrade offer explain how to reach the first useful outcome and which paid capabilities extend it.
  • ImprovedPublic pricing now uses one enforced five-plan catalog, explains the Guided First Outcome available on every plan, and keeps plan names and entitlements consistent with billing.
  • ImprovedFirst Win, onboarding, dashboards, menus, and status surfaces now use true black, WinLayer purple actions, accessible green success states, clearer typography, and responsive desktop and mobile layouts.
  • ImprovedGA readiness is now reproducible through a feature catalog in HTML and PDF, an acceptance report, and a strict automated readiness workflow.
  • FixedOpportunity and execution links now open the real opportunity evidence workspace, including links retained inside older immutable First Win snapshots.

Jul 27, 2026

  • NewBusiness / Team desktop workspace with native window chrome, persistent window geometry, deep links, tray access, approval badges, and native notifications.
  • NewTransparent desktop agent console that names each tool before it runs and shows a safe, auditable projection of the result instead of hiding the reasoning workflow.
  • NewPrivate, persistent assistant threads scoped to the current tenant and user, with model tiers described by outcome: Quick, Balanced, and Deep analysis.
  • NewDesktop project workbench with folder upload, a safe project tree, syntax-highlighted editing, and bounded agent access to attached documents and project files.
  • FixedPublic-site text and muted labels were rebalanced so essential copy remains readable across dark marketing surfaces.

Jul 26, 2026

  • NewSecure browser device authorization for the CLI, with browser sign-in, API-key sign-in, and headless login choices instead of requiring a pasted key by default.
  • NewA persistent, branded interactive terminal opens when running bare winlayer, with command history, slash help, suggestions, a live command palette, and scriptable subcommands retained.
  • NewGrounded multi-turn workspace Q&A in the CLI through ask and chat, including opportunity, pipeline, evidence, and growth-analysis questions.
  • NewSelectable terminal chat tiers and a /model command let users choose faster or deeper analysis while preserving grounding, usage metering, and provenance.
  • NewThe same grounded analyst is now available from the browser Copilot and the desktop shell, sharing one product capability across web, terminal, and desktop.
  • NewDesktop assistant shortcut Ctrl+Shift+A / Command+Shift+A, tray access, shared authentication, the WinLayer app icon, and version 0.2.0 installers.
  • ImprovedPublic landing, pricing, download, and documentation navigation were redesigned; the starter offer is consistently presented as Free.
  • FixedThe desktop shell now opens the actual WinLayer product instead of the marketing site, and packaged installers include the native tray and window icon.

Jul 24, 2026

  • NewGlobal WinLayer Copilot with a live portfolio pulse, route-aware guidance, grounded Daily Growth reviews, prioritized opportunity decisions, and quick links into the core pursuit workflow.
  • NewHuman approval queue for agent-proposed pipeline actions: authorized users review, confirm, approve, or reject each change, with execution and decisions retained in the audit trail.
  • NewThe current purple WinLayer mark, wordmark, favicon, documentation identity, and light/dark logo variants now form one consistent brand system.
  • ImprovedThe growth workspace was rebuilt around a compact collapsible navigation rail, persistent light and dark themes, a top-bar moon/sun control, readable menus, and responsive mobile navigation.
  • ImprovedLong opportunity, intelligence, workbench, partner, contact, and operations collections now use progressive Load more controls instead of dense pagination.
  • ImprovedProduction reliability now covers retryable integrations and webhooks, raw-source snapshot retention, grounded brief fallbacks, tenant export lifecycle, storage lifecycle, and ingestion recovery.
  • FixedNotification and profile menus close on outside interaction, protected-route transitions avoid noisy prefetch failures, and mobile tool drawers close after navigation.

Jul 23, 2026

  • NewTenant document uploads enter quarantine and are scanned with Amazon GuardDuty before parsing, search, or AI use; rejected files remain unavailable and are removed safely.
  • NewPublic Platform, Solutions, Resources, and Security pages, plus shared marketing navigation and a complete public footer, expand WinLayer beyond a single landing page.
  • NewBeginner-friendly workspace home and quickstart now explain the product in plain English, show the four-step growth flow, and point each user to the next useful action.
  • NewTerms, Privacy, and DPA engineering routes are available as prominently labeled DRAFT counsel scaffolds; they are not represented as finalized legal agreements.
  • ImprovedMarketing and authenticated workspace surfaces were rebuilt as a federal growth command operating system with clearer hierarchy, denser intelligence, and stronger mobile behavior.
  • ImprovedProposal artifact versions are serialized consistently, and PDF and Markdown export behavior is covered by end-to-end verification.
  • ImprovedNext.js was upgraded from 15 to 16 and patched dependencies were pinned to close known high-severity framework and image-processing vulnerabilities.
  • FixedManaged scanning, clean-database acceptance, deterministic test workspace setup, operator surfaces, assistive heading spacing, and transient deployment recovery were hardened.

Jul 22, 2026

  • NewComplete commercial subscriptions with Stripe checkout and webhook synchronization, plan entitlements, operator controls, and tenant billing state.
  • NewPurchasable extra seats, API and integration packs, one-time proposal-analysis packages with expiry and safe reservation accounting, and enterprise implementation, migration, training, and support requests.
  • NewFederal Register became the fifth core intelligence source, detecting procurement-related agency intent, program changes, proposed rules, and actionable comment deadlines before a solicitation.
  • NewVA FY2027 budget documents joined GSA budget sources, expanding pre-solicitation budget intelligence across priority agencies.
  • ImprovedWCAG 2.2 AA is enforced through the full JSX accessibility ruleset and automated axe gates; the authenticated workspace audit was reduced from 22 known violations to zero.
  • NewA repeatable load-test release gate now measures liveness, readiness, search latency, throughput, failures, and timeouts against explicit preview and general-availability budgets.
  • ImprovedA GovCloud compatibility review and patched image-processing dependencies document deployment constraints and close known security issues without claiming an authorization WinLayer does not hold.

Jul 18, 2026

  • NewCapture and proposal artifacts can be exported as real PDF or Markdown documents with version metadata, structured sections, compliance matrices, citations, and source traceability.

Jul 17, 2026

  • NewPlan entitlement gates and a Governance Console for tenant export, deletion requests, retention controls, legal holds, compliance evidence, and auditable lifecycle actions.
  • NewRole-shaped workspaces for owners, executives, growth leaders, capture managers, proposal teams, analysts, operators, and viewers, with capability-aware navigation and actions.
  • NewOperations Center with shared tasks, milestones, deadlines, calendar views, assignments, workload, team capacity, dependencies, comments, and activity history.
  • NewGlobal Search Center across opportunities, agencies, contractors, contacts, partners, agreements, documents, reports, tasks, and workspace records with explainable ranking.
  • NewReporting Center with executive, pipeline, revenue, capture, proposal, competitive, and agency intelligence; historical trends, evidence-linked findings, custom templates and widgets, schedules, truthful delivery status, and deterministic reporting questions.
  • NewImmutable report distribution through real PDF, Excel, CSV, and PowerPoint exports plus expiring, revocable, download-gated public share links.
  • NewAudit Center with a live tenant event feed, entity history, approval evidence, explainable AI decision log, security events, deterministic audit questions, and PDF, Excel, CSV, and JSON compliance exports.
  • ImprovedMeaningful mutations now retain bounded before/after state, reason, actor, request ID, and source IP; elevated security events enter the existing per-user notification center.
  • NewPartner Workspace with tenant-owned organization profiles, explainable opportunity matching, authoritative SAM/SBA discovery, performance history, NDAs and teaming agreements, JV and mentor-protege records, secure opportunity rooms, and an evidence-backed teaming advisor.
  • ImprovedPartner profiles, agreement responsibilities, and room content now participate in tenant-aware global search; agreement expirations and room deadlines appear in the shared operations calendar.
  • NewContact and Relationship Workspace with managed stakeholder records, meeting intelligence, relationship and influence scores, agency heat maps, opportunity coverage gaps, watchlists, outreach actions, and an evidence-backed advisor.
  • ImprovedManaged contacts and meeting notes now participate in tenant-aware global search, while relationship follow-ups appear in the shared calendar and archived records no longer affect live rollups.
  • NewCompany configuration center for identity, eligibility, capabilities, NAICS/PSC, agencies, vehicles, geography, performance, partners, growth goals, resources, and notification policy.
  • NewProfile completeness, company archetype, matching-signal inventory, actionable gaps, and explainable profile-aware global-search ranking.
  • NewFirst Win experience with a generated growth position, fit and preliminary PWin, executive briefing, teaming paths, next-30-days plan, PDF export, and expiring secure sharing.
  • NewOpportunity Strategy Center with relevance models, fit evidence, pursue/watch/pass decision support, portfolio recommendations, and strategy-aware agent context.
  • ImprovedThe authenticated product received its first full SaaS workspace redesign, including faster route navigation, clearer density, responsive layouts, and consistent role-aware controls.
  • FixedNew sign-ups are routed through onboarding and receive an isolated personal workspace on first login; profile saves use optimistic versions and audited tenant isolation.

Jul 16, 2026

  • NewDocument intelligence pipeline for tenant uploads: PDF, DOCX, text, and Markdown ingestion; parsing, chunking, embeddings, semantic retrieval, provenance, and solicitation-aware grounded search.
  • NewCapture Execution Workbench for evidence review, solicitation requirements, compliance matrices, generated capture and proposal artifacts, human review, and multi-step workflow state.
  • NewSecure enterprise integrations with encrypted credential storage, OAuth lifecycle, provider health and retry controls, webhook adapters, and an operator-facing integrations console.
  • NewExecutive portfolio intelligence with pipeline health, revenue scenarios, risk concentration, investment recommendations, portfolio optimization, and evidence-backed executive planning.
  • NewOutcome Center with award matching, win/loss learning, scoring calibration, feedback preferences, and explainable model-performance evidence.
  • NewDeveloper sandbox with expiring wl_test credentials and deterministic synthetic opportunity and pipeline data.
  • NewExplicit API scopes, live-only agent/action boundaries, and tenant-scoped per-key request, error, and latency analytics with redacted export.
  • ImprovedDeveloper console now manages credential environment, scopes, expiration, usage, and webhooks across desktop and mobile.
  • FixedEvery authenticated workspace route is protected consistently, protected-route prefetch errors are suppressed, and live-intelligence and release-pipeline failure handling is hardened.

Jul 15, 2026

  • NewFirst WinLayer CLI with login, workspace identity, scored opportunities, opportunity lookup, pipeline access, grounded briefs, executive briefs, agent discovery, usage reporting, JSON output, and environment or one-command key overrides.
  • NewAPI-key authenticated AI agent endpoints use the key creator's current tenant role and the same plan gates, permissions, cost controls, grounding, metering, and audit path as the web product.
  • NewDaily Growth Agent v1 runs a bounded plan → act → observe loop over read-only growth tools and returns a prioritized, evidence-grounded briefing with proposed actions.
  • NewFirst human-gated autonomous action flow: the agent proposes a pipeline change, an authorized user approves or rejects it, and approved changes execute through the normal audited pipeline service.
  • NewPublic CLI download page, shared marketing header, and the first public pricing page established the product's install and commercial entry points.
  • ImprovedAutomated CI/CD now builds, scans, publishes, migrates, deploys, and smoke-tests the AWS release path instead of relying on manual image-tag changes.

Jul 14, 2026

  • NewDocumentation site — multi-page docs with search, on-page TOC, breadcrumbs, syntax-highlighted code with copy buttons, guides, and this changelog.
  • NewDocs deep-dives with system diagrams — architecture, scoring flow, webhook delivery, recompete phases, and the two-plane security model; plus profile-tuning and recompete playbooks.
  • NewNotification center — per-user read/dismiss state, mark-all-read, unread badge; persists across sessions.
  • NewAccount menu in the top bar — identity, quick links, sign out.
  • NewOnboarding wizard — 7-step guided profile setup with industry templates; new sign-ups land there.
  • NewAgency profiles (/agency/…) — award value, top incumbents with share, open opportunities, protests, contacts, and vehicles for any agency, one page.
  • Improved⌘K now searches live data — agencies open their profile, opportunities deep-link into the radar.

Jul 13–14, 2026

  • NewInteractive knowledge-graph view — force-directed agencies ↔ contractors network, weighted by awards.
  • NewCommand palette (⌘K), lucide icon system, recompete forecast chart, toast notifications.
  • NewPublic REST API v1 — opportunities, single lookup, pipeline (CRM sync) — with reveal-once API keys and per-key rate limiting (120/min, 429 + Retry-After).
  • NewOutbound webhooks — HMAC-signed deliveries on pursuit decisions, SSRF-guarded, self-serve on /developer.
  • ImprovedGAO protest connector now parses RSS/Atom and JSON feeds and degrades gracefully on anything else.
  • FixedDatabase migration 0008 re-created existing objects and omitted the webhooks table — fresh installs now migrate cleanly.

Jul 12–13, 2026

  • NewContact Intelligence — deduplicated contracting-officer directory extracted from opportunity notices.
  • NewVehicle Intelligence — GWAC / IDIQ / schedule detection (SEWP, CIO-SP, Alliant, OASIS+, MAS…) ranked by activity.
  • NewProtest Intelligence — sustained GAO protests surfaced as re-opportunities, per-agency sustain rates.
  • NewSBA DSBS enrichment — teaming-partner recommendations gain capability profiles and explainable fit scores.
  • NewOutcome detection (/outcomes) — award matching against tracked solicitations.

Jul 9–12, 2026

  • NewGrounded AI agents — capture, recompete, proposal-prep, and executive briefs with cite-or-omit evidence packs.
  • NewBudget-document intelligence — predicted opportunities extracted from Congressional Budget Justifications, months before SAM.gov.
  • NewKnowledge graph (Neo4j), PWin engine, recompete radar, pipeline board, executive command center.
  • NewPlatform foundation — multi-tenant workspaces, RBAC, append-only audit log, signal ingestion from SAM.gov / USAspending / Grants.gov.