xarmian 2ef63e3b25 fix(oauth): introspection describes only the caller's own client's access tokens (BUG-3398) (#1791) ...

* fix(oauth): introspection describes only the caller's own client's access tokens (BUG-3398)

Claude-Session: https://claude.ai/code/session_01Q9WssCjFuHjSfLABoW4tmS

* test(oauth): two clients share the test redirect URI (BUG-3398)

Claude-Session: https://claude.ai/code/session_01Q9WssCjFuHjSfLABoW4tmS

* test(server): the census names the shared introspection caller reader (BUG-3398)

Claude-Session: https://claude.ai/code/session_01Q9WssCjFuHjSfLABoW4tmS

2026-10-05 11:51:01 -04:00

..

accesskick

feat(server): revoking access re-checks live connections immediately (#1744)

2026-10-02 19:43:19 -04:00

appfetch

feat(apps): per-endpoint webhook delivery state, a per-install rate cap, and a 24 h drop (TASK-3408, SPEC-6 U10c) (#1783)

2026-10-05 00:02:49 -04:00

appmanifest

feat(apps): app install staging: apps/1 manifest, fetch policy, pending reservations, preview (TASK-3397, U8a) (#1770)

2026-10-04 07:19:07 -04:00

appstore

feat(apps): app webhook events name the install that wrote them (TASK-3411, SPEC-6 U10d) (#1781)

2026-10-04 21:36:33 -04:00

artifact

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

attachments

feat(appstore): app attachment upload, read rule and caps behind FencedTx (TASK-3396, U7a) (#1768)

2026-10-03 21:31:44 -04:00

billing

feat(admin): add /api/v1/admin/billing-stats proxy + cloud client (TASK-827) (#266)

2026-04-27 14:42:53 -04:00

buildtools

fix(scripts): install-refresh asks git in the caller's checkout, not the server's cwd (BUG-3403) (#1790)

2026-10-05 05:52:30 -04:00

cli

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

cmdhelp

feat(playbook): match free text to an active playbook via the decision provider (TASK-3120) (#1429)

2026-09-22 11:28:57 -04:00

collab

feat(materialize): recover unsaved editor sessions into items.content (TASK-2198 U4) (#1683)

2026-09-30 11:03:07 -04:00

collections

fix(project): a collection's own abandoned_options decide what the changelog, standup and reports count as shipped (BUG-2347) (#1464)

2026-09-23 12:52:46 -04:00

config

feat(chatgpt): serve OpenAI's domain challenge at /.well-known/openai-apps-challenge (TASK-3321 G4) (#1717)

2026-10-02 04:08:52 -04:00

decision

feat(playbook): match free text to an active playbook via the decision provider (TASK-3120) (#1429)

2026-09-22 11:28:57 -04:00

diff

feat(history): version rows carry their writer, line counts and create marker, plus a per-version diff endpoint (PLAN-2348 U2) (#1691)

2026-09-30 10:02:41 -04:00

email

feat(auth): social claim of a never-verified account, provider subjects, cloud-only sidecar routes (TASK-3351) (#1760)

2026-10-03 12:15:04 -04:00

events

fix(events): a resume from exactly the discarded peak is refused after a counter-backwards reset, instead of being handed the new sequence as though it followed (BUG-3206) (#1530)

2026-09-25 02:35:38 -04:00

idspace

refactor(events): one home for the asymmetry, one assertion for the count (BUG-2736)

2026-08-22 20:48:58 +00:00

items

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

jsonscan

fix(server): the request-body gate reads tokens with jsontext, so a NUL behind a repeated key or beside 1e999 is refused, and a repeated request member is refused on every body (BUG-2812) (#1550)

2026-09-25 21:48:30 -04:00

kernelevents

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

links

fix(documents): the rename cascade decides a link by the wiki grammar, so a legacy title containing | \ or ] keeps its links and no longer rewrites a link to another target (BUG-2806) (#1572)

2026-09-26 10:52:41 -04:00

logging

feat: add readiness probe and structured logging (TASK-161)

2026-04-05 15:02:54 +00:00

materialize

test(materialize): two CI reds were test instruments, not the product (TASK-2198) (#1694)

2026-09-30 13:13:13 -04:00

mcp

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

metrics

feat(apps): app webhook delivery behind an in-flight fence, signature v2 (TASK-3408, SPEC-6 U10b) (#1780)

2026-10-04 20:35:13 -04:00

models

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

netpolicy

fix(netpolicy): one outbound address policy for URL import and webhooks (#1738)

2026-10-02 17:09:12 -04:00

oauth

feat(oauth): delegated sign-in for installed apps through the issuance barrier, shipped closed (TASK-3399, SPEC-6 U5b-1) (#1779)

2026-10-04 19:22:21 -04:00

redisdial

fix(redis): honour the caller's context on TLS dials (BUG-2754) (#1198)

2026-08-25 00:27:27 -04:00

redisns

docs: thirteen claims about code that had moved under them (BUG-2736)

2026-08-22 19:28:17 +00:00

server

fix(oauth): introspection describes only the caller's own client's access tokens (BUG-3398) (#1791)

2026-10-05 11:51:01 -04:00

store

fix(store): every write that reads its row back does so inside its transaction (TASK-3406) (#1805)

2026-10-05 11:27:18 -04:00

testtmp

fix(test): test temp dirs stop leaking into /tmp (BUG-3412) (#1786)

2026-10-05 04:50:02 -04:00

textguard

refactor(store): delete the NUL SUSPECT path, now that the predicate sees a NUL behind a repeated key (BUG-3220) (#1561)

2026-09-26 01:09:03 -04:00

urlimport

fix(netpolicy): one outbound address policy for URL import and webhooks (#1738)

2026-10-02 17:09:12 -04:00

watchevents

feat(server): workspace_access_changed on the user stream when an existing account gains or loses a workspace (TASK-3272) (#1636)

2026-09-28 10:05:51 -04:00

webhooks

feat(apps): per-endpoint webhook delivery state, a per-install rate cap, and a 24 h drop (TASK-3408, SPEC-6 U10c) (#1783)

2026-10-05 00:02:49 -04:00