# Changelog

All notable changes to Siteline are recorded here, newest first. Format based on
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/).

Two changelogs exist by design and must not drift:

- `changelog.json` (served at `/api/v1/changelog.json`) is the machine-readable
  version summary for API/agent consumers. It is scanner- and rubric-version
  centric and only carries releases that change the scan API or scoring.
- This file is the fuller human history. It mirrors every `changelog.json`
  version and additionally records commerce and infrastructure work that shipped
  without changing the scan API (so it has no `changelog.json` version).

`test/doc-consistency.test.mjs` asserts every `changelog.json` version appears
here.

## [3.1.2] - 2026-07-08

Documentation architecture and served-surface link fixes. No behavior change;
scanner 2.0.0 and rubric 2.3.0 unchanged.

### Added
- This file (CHANGELOG.md) as the backward-looking history, split from ROADMAP.md.
- Guardrail in `test/doc-consistency.test.mjs`: CHANGELOG.md must mirror every
  `changelog.json` version.

### Changed
- ROADMAP.md is now future-only — no current-state or delivered-product content.
- `/history/` timeline enriched (April paid-services launch, v2.5.0, v3.1.x); intro
  corrected to note the source repository is private, so the first-commit hash is
  stated provenance, not a public link.
- `docs/project-memory.md` product table: Monitoring "Live (self-serve Stripe)",
  Hosted API "Not self-serve (contact-gated)".

### Fixed
- Removed three `github.com/snapsynapse/siteline` links from the served
  `assistant-guide.txt` (private repo returns 404). The guide stays GuideCheck
  shape-conformant.

## [3.1.1] - 2026-07-08

Documentation and copy reconciliation to canon. No behavior change; scanner
2.0.0 and rubric 2.3.0 unchanged.

### Changed
- `agents.json` (+ `.well-known` copy) Hosted API now reads "$49/mo, not
  self-serve yet" (price set, offer contact-gated), replacing "candidate pricing".
- Reconciled prices and product state across internal repo docs, external
  agent-facing files, and site copy against the LocalBrain Master Pricing List
  (single source of truth). Every customer- and agent-facing surface was already
  correct on all six prices; drift was confined to internal docs and the vault.

### Fixed
- Stale internal claims: Monitoring $9→$19 in the self-assessment doc; Monitoring
  status planned→live and de-hardcoded test counts in project-memory; the stale
  rubric-roadmap "Current Gap" (docs/oss/portfolio overlays ship).

### Added
- `test/doc-consistency.test.mjs`: no retired prices on customer/agent surfaces,
  Monitoring priced at $19 where priced, no hardcoded test counts in durable docs.

## [3.1.0] - 2026-07-08

Additive served-surface and documentation fixes from the 2026-07-08 review.
Scanner 2.0.0 and rubric 2.3.0 unchanged.

### Added
- The OpenAPI specs document the `siteType` query parameter (11 public
  site-family values), covered by a contract test.

### Fixed
- `/api/v1/changelog.json` and `/api/v1/index.json` now serve JSON where they
  previously 404'd (files under `api/` are treated as functions). Moved to root
  paths with Vercel rewrites matching `/api/v1/openapi.json`.

### Changed
- Agent-facing docs reconciled: `llms.txt` lists Monitoring as a first-class
  service; `agents.json` no longer states a live $49/mo Hosted API price.

## [3.0.0] - 2026-07-07

Composite scan and grade-integrity release. Scanner 1.6.0→2.0.0; rubric held at
2.3.0 (weights, caps, and level thresholds identical).

### Added
- Composite scan: every result carries an attributed Cloudflare Agent Readiness
  protocol baseline (`external.cloudflare`) and open-standards conformance checks
  (`standards`: Graceful Boundaries passive evidence, GuideCheck
  `assistant-guide.txt` shape validation) alongside the SNAP judgment. Both
  panels are informational and never feed the score, grade, or level.
- First-claim history page at `/history/`.
- `/api/limits` carries proactive RateLimit headers.

### Fixed (grade integrity — changes grades for affected sites, hence major)
- `http://` input that 301-redirects to https is graded on the final URL (no
  more false F).
- HTML-shell responses at machine-resource paths count as absent instead of
  inflating agentic level.
- WAF classification is word-bounded and gated on thin pages.
- `robots.txt` is parsed into RFC 9309 user-agent groups so per-bot rules no
  longer leak into the `*` group.

### Security
- Endpoint auth hardened: unconditional `CRON_SECRET`, constant-time token
  compares, rate-limited outreach.

## [2.6.0] - 2026-05-30

### Security
- SSRF validation covers IPv4-mapped private IPv6 literals, DNS preflight for
  initial and redirect targets, and broader reserved/internal address ranges.
- Checkout return URLs canonicalized to https://siteline.to; hostile forwarded
  hosts fail closed before Stripe is called.
- Scanner response bodies byte-capped before parsing (`bodyTruncated` metadata).

## [2.5.0] - 2026-05-26

### Added
- Finding evidence: CTA ambiguity findings can include matched label text, href,
  selector, element type, and ambiguity rule.
- Static semantic-resource detection: `assistant-guide.txt`, `ontology.json`,
  `relationships.yaml`, and HTML service-desc/security/alternate machine links,
  reported under `informational.semanticResources` (no score impact).

### Changed
- Commerce profile precision: `Offer`/`SoftwareApplication` schema no longer
  imply ecommerce for portfolio/static sites without stronger transaction evidence.

## [2.4.0] - 2026-05-18

### Added
- F1 probe-evidence ledger: `result.evidence.probes[]` records
  url/status/content-type/duration/verdict/reason plus SHA-256 and a 512-byte
  excerpt for every check. Additive, no scoring change.

## [2.3.0] - 2026-05-18

### Added
- Standards Library v1: RFC 8288 Link headers, RFC 9727 api-catalog, RFC
  8414/9728 OAuth discovery + 401 WWW-Authenticate, MCP server-card, `/index.md`,
  Web Bot Auth signatures directory. Each is a content-validated,
  protocol-agnostic alternate folded into an existing Layer 2 purpose by
  best-score-wins. Layer 1 untouched, parity preserved.

## [2.2.0] - 2026-05-18

### Added
- Promise-relative Layer 2 with commerce-gated Transactability (9th purpose, max
  18) via a declarative content-validated pattern registry with site-declared
  subdomain following. Precision-gated to genuine purchase intent.

### Fixed
- Access-gate soft-block false positive (substantive-page guard).

## [2.1.0] - 2026-03-26

### Added
- Two-layer scoring model: SNAP fundamentals (floor) + Agentic Enablement
  (ceiling). 11 resources scored 0/1/2; level 0–4 caps grade at D/D/C/B/A.
- All non-success API responses include structured error/detail/why fields per
  Graceful Boundaries; proactive RateLimit headers on all endpoints.

## Commerce, monetization & infrastructure — 2026-04-20 to 2026-04-29

Shipped between 2.1.0 and 2.2.0. This work did not change the scan API, so it has
no `changelog.json` version, but it is the bulk of the paid-product and
operational surface.

### Added
- Stripe Checkout Sessions for one-time Audit ($899) and Workshop ($2,499); `/checkout-success/` noindex page; `/contact/` fallback.
- White-Label Reports as a contextual $499/mo founding agency subscription:
  `/white-label/` segmented page, subscription checkout, branded report-link
  helper at `/white-label/report-link/` (`?brand=&accent=` with validated hex).
- Monitoring launched as a $19/mo (or $199/yr) subscription offer for one public
  website.
- Embeddable SVG badges at `/badge/{resultId}.svg` (default, horizontal, dark,
  social variants); badge snippet in the report email.
- Homepage example chips + "Recently scanned" strip (weekly-refreshed cache) and
  "X sites scanned this week" counter; weekly benchmark scan of 50 curated
  domains; `/benchmark/` public page.
- Three SEO learn pages (`/learn/agent-readiness-scanner/`,
  `/learn/llms-txt-validator/`, `/learn/make-your-site-agent-usable/`);
  `/developers/` API docs page.
- Feedback loop: result-page NPS widget, exit-intent survey, monthly review
  ritual, founder-operated agency outreach composer.
- Rubric site-type overlays: profile framework plus evidence-gated `docs`,
  `oss-project`, and `portfolio` profiles; optional public site-type selector;
  `siteType` hint accepted/validated/logged; `force`/`refresh` cache bypass;
  rubric-delta in result envelope.

### Added (infrastructure)
- PostHog instrumentation (15 events) + Sentry on all serverless functions;
  `email_outbox` + retry drain + 30-day self-rescan email; Supabase migrations
  0001–0005 + RLS + pg_cron purge.
- CSP hardening (no `'unsafe-inline'` in `script-src`/`style-src`) + full
  security header suite; inline JS/CSS extracted; `X-Robots-Tag: noindex,follow`
  on `/results/*`.

## [2.0.0] - 2026-03-22

### Added
- V2: dynamic OG images, PDF export, MCP server, batch scanning, remediation
  routing, content-model signal, scan provenance, confidence scoring, CLI,
  durable records with Supabase.

## [1.0.0] - 2026-03-19

### Added
- Initial release: 4-pillar SNAP scoring (Signal, Navigate, Absorb, Perform),
  REST API, single-page scanner.