← Back to Hub

Changelog

Every notable change to the Resonance Hub — billing, entitlements, governance, and ecosystem updates. Format: Keep a Changelog. Governed by RCGF v1.0.

View on GitHubReleases

Unreleased

In progress

Track upcoming work here before it ships. Move entries under a new dated version heading at release time and reset each subsection to _Nothing yet._. Keep bullets short, imperative, and user-visible; link to the PR or issue where useful.

Added
  • Weekly outdated-pin audit (bun run deps:outdated, workflow
  • Slack notification for the audit (scripts/slack-outdated-pins.ts): posts the
  • Public Dependency Health page (/dependency-health): renders
  • Ready-to-merge update PR (bun run deps:apply, update-pr job): rewrites only
  • prebuild now runs bun install --frozen-lockfile first and stops with a
  • Pin failures now name the offending dependency and the exact version
  • Verify pinned dependencies CI job now runs on every PR (no path filter) so
  • E2E share/SEO head-tag assertions for the app not-found page
  • Lighthouse score gate for the app not-found page: bun run verify:lighthouse-not-found
ChangedNothing yet.
DeprecatedNothing yet.
RemovedNothing yet.
FixedNothing yet.
SecurityNothing yet.

v0.1.0

2026-07-12

Initial tagged snapshot of the Resonance Hub — the central billing authority, entitlement store, ROP telemetry sink, and governance surface for the Reson8 ecosystem (Creative Studio, ePublisher, SyncVision, YouTube Optimizer).

Added
  • Repository scaffolding
  • Public-facing README.md, LICENSE (Apache-2.0), SECURITY.md, CONTRIBUTING.md.
  • .github/CODEOWNERS guarding billing, governance, and security-sensitive paths.
  • .github/pull_request_template.md.
  • .github/ISSUE_TEMPLATE/ with bug, feature, and security-hardening forms plus a
  • docs/repo/resonance-hub-manifest.md — canonical description, topics, features,
  • Governance surface
  • /governance route rendering RCGF v1.0.
  • /rcgf and /legal/governance redirects to /governance.
  • src/lib/rcgf.ts pinned to the upstream resonance36912-cell/RCGF constitution.
  • docs/governance/rcgf-v1.0.md mirror of the source of truth.
  • Commercial model
  • Ecosystem passes (Creator / Studio / Business) and once-off PACK_CATALOG.
  • Per-app pricing routes (/creative-studio/pricing, /epublisher/pricing,
  • Relative /checkout?app=…&plan=… CTAs validated against SKU_CATALOG.
  • Billing authority (PayFast)
  • /api/public/payfast/itn webhook with signature verification, idempotency via
  • public.subscriptions with superseded_by upgrade/downgrade tracking and
  • Retry-failed-payment flow (retryPayfastLaunch server function + UI in
  • public.invoices with automated upserts, /account/invoices, receipt detail
  • Credit wallet + ledger, /account/billing, and /admin/billing portal.
  • Admin credit tooling
  • /admin/credits with server-side paginated ledger, filters (app, date range,
  • Deep-link from ledger rows to PayFast receipts via
  • ROP (Resonance Optimization Protocol) Phases 1 + 2
  • Hub schemas for apps, logs, and suggestions.
  • Public ingest routes with signature verification.
  • /admin/rop dashboard for triage.
  • Agent + operational tooling
  • Production MCP server at /mcp hardened via Supabase OAuth.
  • /tools/issue-triage, /tools/pr-status, /tools/tools.releases,
  • Security + supply chain
  • Hardened RLS on hub_apps; locked internal email helpers.
  • timingSafeEqual on cron and email webhook auth.
  • Dependabot config with drift-proof lockfile sync workflow.
  • Pinned js-yaml@4.2.0, react-email@6.6.8, @tanstack/zod-adapter@1.167.0
  • CI + verification
  • .github/workflows/verify-prebuild.yml running bun run prebuild
  • .github/workflows/security-scan.yml with CodeQL + Semgrep + SARIF summaries.
  • .github/workflows/verify-checkout-links.yml.
  • JUnit + LCOV artifact upload from the prebuild workflow.
  • Lighthouse CI audits and scripts/smoke-hub-routes.ts.
  • Public website
  • Custom domains wired: https://www.reson8.life and https://reson8.life.
  • Preview at https://id-preview--4e81bcd7-27d5-4200-87cf-73948cf6cb07.lovable.app.
  • Published at https://resonance-hub.lovable.app.
Fixed
  • /account/subscriptions no longer bounces signed-in users to / on refresh
  • Account page no longer mislabels every pass subscriber as "Studio Pass";
  • SyncVision no longer over-grants entitlements from ecosystem passes.
  • Zod v4 record schemas fixed in src/lib/rop/ingest-schemas.ts
Security
  • src/lib/app-registry.ts: renamed ALL_ACCESS_ENTITLEMENTS to
  • Every user-facing public.* table ships with explicit GRANTs alongside RLS.
  • Service-role usage restricted to verified webhook and admin paths only.