Changelog

Copy Markdown

All notable changes to Lockspire will be documented in this file.

The format is based on Keep a Changelog, and versions follow Semantic Versioning.

1.6.1 (2026-10-20)

Bug Fixes

  • use shared repo runner for key re-encryption (#135) (170428a)

1.6.0 (2026-10-20)

Features

  • admin: clearer app wording and DCR lifetime fields (#123) (d44b95d)
  • admin: clearer app workflows, queue states and responsive themes (v1.42) (#129) (1cfafd0)
  • admin: describe admin pages in task and object language and route adopters through task-grouped guides (v1.41) (#122) (e67a489)
  • admin: refine the operator UI across apps, security, keys, consents and tokens (v1.40) (#122) (e67a489)
  • install: add mix lockspire.gen.kek and show Key protection status in admin (v1.44) (#132) (db33c47)
  • keys: encrypt private signing keys at rest (v1.43) (#131) (038df08)

Bug Fixes

  • admin: collapse nav into a menu on tablet and phone (#124) (4136972)
  • admin: keep policy sub-tabs on one scrolling row (#128) (5124369)
  • release: retain complete prepublish evidence (#120) (ef6e33b)

1.5.1 (2026-09-26)

Bug Fixes

  • 139-10: bind acceptance fixtures to one GSD runtime (61dec68)
  • 139-11: gate planning proof before ref movement (7dc0559)
  • 139-12: remove unused inventory tree local (3cd4a18)
  • 139-13: classify canonical phase completion (b8167e4)
  • 139-quick: match live completion parent state (ca7d421)
  • 139: accept the observed transition document baseline (e57f59b)
  • 139: accept the observed transition footer (75cb77f)
  • 139: align acceptance with phase records (118d55f)
  • 139: authenticate Release Please base advance (062ca6e)
  • 139: authenticate Release Please base advance (bcd6ba8)
  • 139: corroborate empty GitHub check rollups (3f02bb3)
  • 139: isolate snapshot relation scratch files (d6af63e)
  • 139: normalize branch snapshots to recorded refs (b2e1df1)
  • 139: repair exact-main acceptance gate (879da91)
  • 139: replay completion evidence in fixtures (3a480e8)
  • 139: run acceptance from a clean candidate worktree (af9db74)
  • 139: validate phase plan counts dynamically (3f799b4)
  • 260925-w7l: validate Phase 139 completion contract (bb317e0)
  • 260925-x8y: classify testing UAT as active (e63235a)

1.5.0 (2026-08-28)

Features

  • 131-01: generate executable host routes (4eae42d)
  • 131-02: preflight packaged migrations (4dc96b9)
  • 131-03: expose safe consent render context (896a549)
  • 131-03: generate executable host consent (fcb08b8)
  • 131-04: atomically preflight install artifacts (fb16fcd)
  • 131-04: audit packaged migration inventory (119a6d4)
  • 131-05: generate default-profile smoke proof (a1d98c7)
  • 131-06: aggregate install verification diagnostics (de63513)
  • 131-07: defer generated consent context loading\n\n- Render a safe non-interactive consent status before authority resolves\n- Preserve host resolver context and existing approval completion flow\n (78c750e)
  • 132-01: add shared token semantic readers (9062934)
  • 132-01: expose expiry and confirmation readers (88d5e05)
  • 132-02: unify dynamic registration capability checks (c441dd9)
  • 132-02: validate direct client registration shapes (2e4917e)
  • 132-04: make generated resource authorization explicit (a5f6c65)
  • 133-01: lock clean-room package inputs (70d380e)
  • 133-01: redact clean-room failure evidence (4f7acc6)
  • 133-01: supervise clean-room origins safely (04baf14)
  • 133-02: add package-clean provider builder (a8d04ba)
  • 133-02: bootstrap bounded SaaS clients (0ac5764)
  • 133-03: add fixed confidential callback profiles (d5c0096)
  • 133-03: persist clean-room authorization transactions (95bdcc8)
  • 133-03: validate clean-client OIDC claims (9a6de07)
  • 133-04: prove clean-room SaaS bearer journey (c8ddc2c)
  • 133-05: prove clean-room negative wire matrix (2925027)
  • 133-05: prove refresh lifecycle over HTTP (281ed12)
  • 133-06: prove durable DPoP resource replay (2c5e2cf)
  • 134-01: route client creation through neutral lifecycle (4d3e59c)
  • 134-02: route RFC7592 lifecycle through neutral service (db2c9d2)
  • 134-03: inject neutral discovery route paths (ea8a00b)
  • 134-03: resolve discovery routes in web delivery (249f791)
  • 134-04: extract pure prefix utility (14fc287)
  • 134-05: adapt JAR results at protocol boundaries (66d79a9)
  • 134-05: add neutral request object results (9bfba74)
  • 134-06: return neutral protected-resource errors (cdd295d)
  • 134-07: add neutral token result compatibility (6d29ae4)
  • 136-01: classify Credo directive debt\n\n- scan source paths deterministically from repository root\n- expose exact file-wide and unnamed directive identities (2c55e0e)
  • 136-01: classify proof and diagnostic debt\n\n- identify active macro, archaeology, and count contracts\n- parse Dialyzer identities and routine diagnostic categories (3f59acd)
  • 137-01: enforce dependency graph truth (5406f9f)
  • 137-01: scan both shipped routers (05c5bca)
  • 137-05: lock immutable OIDF suite inputs (7d898eb)
  • 137-05: prepare verified OIDF suite inputs (bc24dce)
  • 137-06: align FAPI conformance evidence (e33190d)
  • 137-06: retain redacted OIDF receipts (c4a2e49)
  • ci: aggregate same-sha native coverage (70534a3)
  • ci: manage dependency graph gate prerequisites (18518ff)
  • deliver v1.37 prime-time readiness ratchet (75743cf)
  • release: bind publication to one verified artifact (44a380c)
  • release: prove exact clean-room package sources (5d83fdb)

Bug Fixes

  • 126: bind releases to canonical CI (b3b1326)
  • 126: make release publication retry-safe (536eb1c)
  • 128-01: use adapter for access-token signing (e9b098a)
  • 128-02: default protocol stores to adapter (5403afa)
  • 128-03: use adapter in secure protocol paths (b355c81)
  • 129: make token issuance types truthful (c62fc83)
  • 129: preserve decoder failure boundary (a9ff0df)
  • 130: close release and proof gaps (a52c30d)
  • 131-01: make generated config truthful (e70d521)
  • 131-01: preserve upgrade route proof (850524c)
  • 131: close transaction recovery gaps (ce35107)
  • 131: CR-01 verify operator guard metadata (393afa1)
  • 131: CR-02 retain opted-in FAPI smoke on upgrade (8ea3fb7)
  • 131: CR-03 honor configured logout path (1d2da95)
  • 131: journal installer filesystem transaction (445e0ce)
  • 131: narrow operator mount verification claim (eef15ea)
  • 131: polish generated consent semantics (85b79ee)
  • 131: randomize generated OAuth smoke requests (03e7b6f)
  • 131: report manifest transaction status (af8545f)
  • 131: satisfy transaction static checks (4a65cfe)
  • 131: WR-03 randomize generated FAPI request values (2896b88)
  • 132-03: default protected DPoP replay to configured repo (894813f)
  • 132: CR-01 preserve exact audience bytes (6924204)
  • 132: reject partially malformed audiences (e48bcb8)
  • 132: simplify scope validation (390b714)
  • 132: WR-01 simplify JWKS parser rescue (563ea28)
  • 132: WR-01 validate public inline JWKS (574061b)
  • 132: WR-02 exercise semantic resource server seam (5597d9a)
  • 133-01: preflight clean-room dependencies (bd5f303)
  • 133-02: compile provider host overlays (1b2f744)
  • 133-06: complete durable DPoP replay proof (e4558ad)
  • 133-06: isolate nested clean-room tests (12a3b24)
  • 133: await protected resource after provider restart (7359d36)
  • 133: bind lifecycle resources at journey runtime (9368cde)
  • 133: CR-01 use configured clean-room database credentials (63246c5)
  • 133: CR-02 isolate real clean-room journeys (df8370b)
  • 133: CR-04 prevent login reflection and redirects (bb91670)
  • 133: isolate clean-room temporary ownership (63a366b)
  • 133: retain restarted provider for teardown (6274959)
  • 133: WR-01 protect client acceptance mutations (26d5e0c)
  • 133: WR-02 redact retained real journey evidence (d807c36)
  • 133: WR-03 exclude full journey from default suites (a93e42a)
  • 133: WR-03 make one clean-room proof authoritative (832de94)
  • 134: centralize client lifecycle writes (7143924)
  • 134: make architecture QA environment-stable (dbea66c)
  • 134: restore public boundaries and topology fitness (ea91cdd)
  • 135-08: preserve authorization-code error precedence (d97f857)
  • 135-09: keep internal dependency types out of docs (3727171)
  • 135-09: preserve atomic lifecycle behavior\n\n- compare lifecycle expiry timestamps chronologically\n- make family revocation idempotent and characterization deterministic\n (1bcbac8)
  • 135-09: retain reuse-family revocation semantics\n\n- keep reuse containment authoritative\n- limit idempotency filtering to operator family revoke\n (90237de)
  • 136-10: focus runtime noise contract (2a04436)
  • 136-10: make key cache startup quiet (002e09b)
  • 137: execute pinned OIDF conformance plans (9cbecdf)
  • 137: provision OIDF workflow inputs (01695e1)
  • acceptance: make clean-room migrations cold-start safe (835026b)
  • ci: isolate compatibility and conformance tests (fc87833)
  • ci: make external acceptance failures actionable (7b446da)
  • ci: make JOSE cache patch idempotent (5686853)
  • ci: preserve guarded milestone release automation (cd18f9a)
  • conformance: align pinned suite variants (e4c2ec2)
  • conformance: retain safe failure classifications (7e2fa3b)
  • conformance: terminate ephemeral provider traffic with tls (2685e40)
  • conformance: wait for complete ephemeral host setup (c1f8285)
  • dcr: issue credentials by client auth method (612a7b0)
  • dcr: preserve optional scope metadata (3938a4a)
  • docs: keep internal types out of public references (e2658ce)
  • install: avoid shadow migration status tables (da2dabb)
  • prove clean-room package install on Elixir 1.19 (d3ca3ca)
  • release: load pinned runtime as ESM (249adf1)
  • release: load pinned runtime as ESM (1022e8a)
  • release: upload the exact verified Hex artifact (4f73ec8)

1.4.0 (2026-07-28)

Features

  • demo: host-owned 404 page and working Disconnect for authorized apps (#75) (d5532d5)

Bug Fixes

  • ci: keep Release Please unblocked after a publish (#78) (ddf1b1b)
  • consent: reuse a remembered grant instead of duplicating it on re-approval (#77) (2e597ad)
  • deps: allow phoenix_live_view 1.2.x without forcing adopters onto it (#76) (6ecc37a)

1.3.0 (2026-07-28)

Features

  • 108-01: add semantic admin design tokens (a08c2ca)
  • 108-01: tokenize admin CSS interaction styles (44539d4)
  • 108-02: add safe admin row and action primitives (b68d7b5)
  • 108-02: add structural admin primitives (8be147b)
  • 108-03: migrate admin filter bars (2c83e64)
  • 108-03: migrate admin hero and metric primitives (ba86255)
  • 108-03: migrate copy-once secret panels (219d380)
  • 109-01: polish token support investigation (bcb7853)
  • 109-02: polish consent support investigation (a72ed2f)
  • 109-03: recompose operations queues (86c2dd9)
  • 109-04: polish DCR onboarding and IAT flows (b1a29b2)
  • 109-05: polish keys and client actions (173b7d6)
  • 110-01: expand admin proof demo state (2db3e18)
  • 111-01: add explicit adoption demo bind IP option (f7adec3)
  • 111-01: derive demo endpoint URL and issuer from base URL (167a742)
  • 111-02: derive developer callback URL from demo base URL (b69b557)
  • 111-02: derive seeded demo URLs from base URL (4bf58d9)
  • 111-02: label adoption smoke URL drift assertions (3a58a61)
  • 112-01: add default demo compose stack (0bf5183)
  • 112-02: add docker startup readiness wrapper (420afc6)
  • 113-01: add direct compose conflict controls (c7f38c5)
  • 113-01: add scoped demo reset docs (3afdf61)
  • 113-02: add optional Traefik adoption demo routing (8b0b1ae)
  • 114-01: print redacted adoption demo startup info (3e09e4e)
  • 114-02: add adoption smoke wrapper (34a8398)
  • 115-01: add scoped adoption demo cleanup helper (19f07b9)
  • 115-01: add volume-preserving demo stop helper (5ecae2e)
  • 115-02: add deterministic CI hygiene contracts (0653eca)
  • 115-02: add local demo hygiene checks (41fb3fd)
  • 115-03: align adoption demo lifecycle docs (8794089)
  • 119-01: recompose client detail panes (adcc7b2)
  • 119-02: group DCR policy workflow (688e085)
  • 119-03: align IAT onboarding workflow (671cb20)
  • 119-03: align support detail hierarchy (d114204)
  • 119-04: render device and interaction queues as read-only lists (0759773)
  • 119-04: render logout deliveries as read-only list (df8c544)
  • 120-02: add rendered HTML assertion helper (86260f9)
  • 120-02: support read-only route control assertions (9969717)
  • 120-03: satisfy docs boundary contract (5d5343c)
  • 121-02: add route scorecard parser helper (75a8856)
  • 122-01: convert consent index to dense support flow (13149b1)
  • 122-01: convert token index to dense support flow (7f15950)
  • 122-02: polish token detail investigation actions (977281d)
  • 122-03: polish consent detail investigation actions (ce8fcf0)
  • 123-01: implement pressure-first interaction rows (eca93f2)
  • 123-02: implement pressure-first device authorization rows (9599882)
  • 123-03: implement logout delivery support truth (e90efb9)
  • 124-01: implement client configure hierarchy (a90336e)
  • 124-02: implement DCR IAT onboarding confirmation (b4d0a12)
  • 124-03: implement key lifecycle hierarchy (42a314d)
  • 124-04: implement policy posture review flow (e03a03f)
  • 124-05: add non-DCR policy posture summaries (3d3d8d9)
  • 125-01: implement shared fixture matrix (189c394)
  • 125-01: render internal stress matrix proof (4c2f357)
  • 125-02: implement global proof guardrail contracts (ba3264b)
  • 125-02: implement rendered html assertion helpers (de6eb5d)
  • 125-06: implement browser evidence parser (8f8e35c)
  • admin: polish v1.28 operator experience (4558388)
  • admin: Upgrade UI/UX with BEM design system and components (f2b573b)
  • brand: add brand book and re-skin admin UI to Signal Cyan identity (3a23a49)
  • harden adoption, prefix storage, and CI (f3ace6d)

Bug Fixes

  • 109: correct logout delivery metrics (1534496)
  • 109: revise plans based on checker feedback (2f639eb)
  • 109: revise plans based on checker feedback (4f8945a)
  • 110-05: prevent client route mobile overflow (a55bac7)
  • 110-05: wrap inline admin code values (6db0c0c)
  • 112-01: run demo image from repo mount (a4d5d1b)
  • 112-02: keep docker startup output minimal (67cd5e6)
  • 112-02: make demo image install noninteractive (d7c97ac)
  • 112-02: run demo compose through startup wrapper (01c061d)
  • 112-02: use available demo base image (01bfe4a)
  • 113: bind demo database override to loopback (a6a4749)
  • 113: revise conflict-control plan feedback (b3d1015)
  • 113: tighten validation feedback latency (d0417ec)
  • 114: close adoption demo startup review findings (22cf8c7)
  • 116: revise inventory lab plans (36da81a)
  • 117-01: render component lab empty fixtures (db6b9d7)
  • 119: resolve plan checker artifacts (221ad36)
  • 120-01: point logout support pivot at supported route (be9a328)
  • 120: resolve code review proof warnings (d3beec5)
  • 121: WR-01 reject invalid admin follow-up exceptions (07b4627)
  • 121: WR-02 reject duplicate scorecard fields (da03bd1)
  • 121: WR-03 broaden secret evidence guard (a5eff43)
  • 122: correct token family reuse action states (00e379e)
  • 122: revise plans based on checker feedback (d4b55e5)
  • 123: revise plans based on checker feedback (26df814)
  • 125-06: make browser evidence patterns portable (4e5abb4)
  • close v1.30 demo reprint audit gap (ea516df)
  • deps: resolve 13 security advisories blocking CI (#70) (f805e6e)
  • resolve post-merge conflicts from wave 3 (31f58f6)
  • test: Fix integration test regressions and add seeding helpers (41667e1)
  • types: Fix Dialyzer warnings around token formatting and signing keys (6a5f880)

1.2.0 (2026-05-27)

Features

1.1.2 (2026-05-27)

Bug Fixes

  • align support truth for CIBA and JAR (#36) (fc6baa6)

1.1.1 (2026-05-27)

Bug Fixes

  • isolate test config for logout worker (#32) (ffd922a)

1.1.0 (2026-05-26)

Added

  • Automatic DPoP-Nonce challenge and retry support across the shipped Lockspire-owned DPoP surfaces and the canonical Phoenix protected-route pipeline.
  • Dynamic Client Registration and RFC 7592 management support for the existing logout propagation metadata fields.
  • A narrow client_secret_jwt direct-client authentication slice on the shipped Lockspire-owned endpoints that already reuse the shared verifier.
  • Shared remote-jwks_uri diagnostics plus mix lockspire.doctor remote-jwks and matching admin support surfaces for the shipped private_key_jwt and JARM remote-key story.

Changed

  • The canonical advanced-setup support contract now aligns runtime behavior, admin wording, doctor output, and public docs for remote jwks_uri, mTLS setup, logout propagation, and the protected-route plug pipeline.
  • The public support posture now reflects one near-complete embedded-provider story rather than an actively expanding feature roadmap; new milestones should be trigger-based and evidence-driven.

Fixed

  • Release-truth docs now describe the shipped Phoenix protected-route plug pipeline and stop treating it as future work.

Features

  • 91-01: add shared remote jwks diagnostics taxonomy (13064b7)
  • 91-01: align jarm remote jwks diagnostics (0fbd363)
  • 91-01: normalize private_key_jwt remote jwks incidents (93c71a5)
  • 91-02: add remote jwks doctor surface (445f511)
  • 91-02: surface remote jwks truth in admin client detail (a26dce5)

Bug Fixes

  • phase-91: wire remote jwks operator diagnostics (ce8f313)

1.0.0 (2026-05-07)

Added

  • Canonical Phoenix-first install and onboarding documentation.
  • Executable onboarding proof for the generated host seam.
  • Release-readiness CI, package metadata, changelog, and workflow scaffolding.

Changed

  • The checked-in 1.0.0 release-candidate contract keeps mix.exs, .release-please-manifest.json, CHANGELOG.md, and the expected root tag lockspire-v1.0.0 on one embedded-library release story before authenticated publish proof begins.
  • Hex-facing package metadata, release configuration, and changelog posture now describe one lockspire package and defer authenticated publish evidence to the protected hex-publish lane.

0.2.0 (2026-04-24)

Features

  • 09-02: extend preview posture contract coverage (70107c8)

Bug Fixes

  • 10-01: restore contributor gate proof (20d53f7)

0.1.2 (2026-04-24)

Bug Fixes

  • release: make recovery lane publishable (cd5e40d)
  • release: run hex tasks before docs (046a14c)

0.1.1 (2026-04-24)

Bug Fixes

  • 08-01: harden trusted release lane contract (ed52b00)
  • ci: bootstrap test db in fast lane (bcb2ce3)
  • ci: provide postgres for fast checks (6b9d761)
  • test: avoid brittle key detail id assertion (a550cbb)