6.6.6 — Developer Application Deletion

v6.6.5 — Guest Organization Access Denial

October 15, 2026

• Denies Guest memberships from organization resource APIs, including members, invitations, and audit events.
• Omits Guest memberships from organization enumeration and session or bearer membership listings.
• Preserves the admin role hierarchy and no-access behavior on all admin routes. No migration or production setting changes.

v6.6.4 — Admin Role Management

October 15, 2026

• Adds People & Invitations, Access & Roles, and Activity pages under /admin-* using the existing Lucion ID session.
• Enforces the Owner, Admin, Manager, Member, and Guest management hierarchy in the server-side organization APIs.
• Adds protected member role/status and invitation actions with CSRF, passkey step-up, idempotency, and audit records.
• Preserves Guest denial, ownership transfer safeguards, tenant scoping, and noindex headers. No database migration or production setting changes.

v6.6.3 — Admin Route Hydration

October 15, 2026

• Scopes prerender hydration to the exact route that produced the static HTML.
• Known app routes served from the homepage fallback now mount the client app cleanly instead of hydrating unrelated homepage markup.
• Deploys the role-aware /admin workspace with the native Lucion ID session; Guest remains denied.
• Preserves noindex headers and server-side membership checks. No database migration or production setting changes.

v6.6.2 — Lucion Global Admin Workspace

October 14, 2026

• Adds the detailed /admin workspace backed by the signed-in Lucion ID session and active organization memberships.
• Shows role-specific context for Owner, Admin, Manager, and Member; Guest-only accounts are denied.
• Includes the external-app OIDC setup prompt with client ID and callback placeholders.

v6.6.1 — Organization Claim and Readiness Clarity

October 14, 2026

• Documents the consented OIDC organizations claim as active memberships normalized to admin or member, matching the UserInfo implementation.
• Clarifies that General Availability is a release lifecycle label and does not replace live capability, readiness, or launch rehearsal evidence.
• Shows live capability status as unavailable when the Trust Center cannot retrieve its current evidence, rather than presenting stale fallback claims as healthy.
• Moves the customer-facing changelog lead to the latest organization SSO and membership update while keeping release fingerprint maintenance out of the headline.

v6.6.0 — Complete Release Health Fingerprint

October 14, 2026

• Aligns the health endpoint release identity with the package, manifest, and public changelog.
• Preserves the Worker-served Replay QA ownership endpoint required by the release verification contract.

v6.5.9 — Release Fingerprint Alignment

October 14, 2026

• Aligns the health endpoint release name and date with the package, release manifest, and public changelog.
• Adds a release gate for health fingerprint title and date so the deployed version cannot carry a stale release identity.
• Keeps the Replay QA ownership nonce Worker-served so Pages returns the required plain-text response.
• No authentication behavior, database schema, or production capability gate changes.

v6.5.8 — Organization SSO Setup and Membership Claims

October 14, 2026

• Adds an organization SSO setup guide for using Lucion Identity as the OIDC provider, with issuer and discovery details.
• Extends the consented organizations claim to active memberships normalized as admin or member; connected applications must enforce their own tenant and role checks.
• Provides a copyable AI coding prompt and a step-by-step manual setup path, including domain verification, organization membership, app registration, and callback configuration.
• Keeps inbound external identity-provider configuration available under a separate advanced section.
• Keeps Stay signed in connected to the server-issued 30-day session and persistent secure cookies, with regression coverage across a later authenticated request.
• Lets Developer actions retry an unavailable session check so Create app can recover when Identity cannot confirm the current session. Application creation remains session-authenticated and step-up protected.
• No database schema change or production capability gate change.

v6.5.6 — First-Party API Access Hardening

October 14, 2026

• Limits first-party service keys to the implemented read-only organization and organization-member APIs; removes the unused permissions scope.
• Retains exact staff allowlisting, step-up, active organization membership, origin and CSRF checks, rate limiting, replay protection, one-time display, hash-only storage, and 7/30/90-day expiry.
• Provisioning stays disabled when the server-side staff email allowlist is empty. The AI or app runtime can use the API without a personal Lucion ID after staff provisions a key.
• Remote D1 already includes migration 0028, so this release requires no database migration.

v6.5.5 — First-Party Lucion and Helios Integrations

October 14, 2026

• Adds the staff-only Identity Developer panel for provisioning service keys for Lucion and Helios apps.
• Requires an exact server-side staff email allowlist, recent step-up, active organization membership, and explicit organization selection; the feature is disabled when the allowlist is empty.
• Keys are short-lived, one-time displayed, hash-only, organization-bound, rate limited, and replay protected.
• The AI or app runtime can use the API without a personal Lucion ID; anonymous credential bootstrap is not available.
• Adds D1 migration 0028. Production access remains disabled until the Cloudflare staff allowlist secret is configured.

v6.5.4 — Confidential App Email Allowlist

October 14, 2026

• Lets confidential app owners manage up to 100 verified-email allowlist entries in Identity Developer and the documentation app-creation flow.
• Enforces the allowlist on the server during OAuth authorization; an empty list keeps existing access behavior.
• Changing the list revokes pending codes and existing app tokens so removed addresses lose access immediately.
• Accepts verified email addresses from any domain for now; no Lucion-only domain restriction is claimed.

v6.5.3 — Same-Origin Response Hardening & Search Rendering

October 14, 2026

• Removes the wildcard Access-Control-Allow-Origin header inherited from static asset responses at the Worker boundary.
• Verifies the homepage and public sitemap routes return server-rendered page content to non-browser fetchers, not only metadata and a JavaScript fallback.
• Preserves the documented API release-version header contract and keeps authentication, session, and production capability gates unchanged.
• No D1 migration or authentication behavior change.

v6.0.3 — MCP Connection Setup Reliability

• Fixes MCP OAuth discovery so Codex and other clients see both required permissions, including offline_access.
• Shows safe, distinct guidance for an incorrect MCP resource URL and a missing persistent-access permission without relaxing exact URL matching.
• Rewrites the setup guide with punctuation-safe copy blocks, Codex terminal commands, ChatGPT setup, permission explanations, troubleshooting, and secret-handling guidance.
• Adds regression tests for a copied trailing period and an omitted offline_access permission; no D1 migration is required.

v6.0.2 — ChatGPT & Codex MCP API-Key Connector

• Introduced the remote, OAuth Authorization Code + PKCE MCP connection.
• Requires explicit consent and limits assistant-created API keys to short-lived read-only scopes, with hash-only storage and one-time display.
• Added Identity Console controls to inspect and disconnect the user's own assistant grants.

v6.0.1 — Developer Key Password Step-Up

• Fixes Generate Key for password-authenticated Lucion IDs without requiring a passkey.
• Keeps passkey step-up available, preserves idempotent protected retries, and shows validation and security errors inside the key dialog.

v6.0.0 — Production Assurance

• Consolidates the validated v5.9.0 tenant-isolation and authenticated-journey evidence into the first v6 release.
• Publishes credential-free release evidence for protected identity flows while keeping manual browser, multi-tenant, and independent-assurance boundaries explicit.
• Preserves the sequential release policy: v5.9.0 rolls directly to v6.0.0.

v5.9.0 — Tenant Isolation Evidence

• Publishes a safe, versioned tenant-isolation evidence artifact covering session, bearer, authorization, SCIM, and Lyra tenant boundaries.
• Adds explicit cross-tenant regression checks to the release gate and credential-free live monitor.
• Separates automated structural evidence from the still-required authenticated multi-tenant exercise and independent assurance.

v5.8.9 — Safe Email Diagnostics

• Normalizes Resend delivery diagnostics before D1 persistence, logging, or customer responses.
• Unexpected provider or internal codes collapse to the safe provider_error classification without exposing response bodies.
• Preserves the v5.8.8 bounded provider-response boundary and all live identity/deployment evidence gates.

v5.8.8 — Resend Response Boundary

• Caps verification, invitation, and recovery provider responses at 131,072 bytes before JSON parsing.
• Fails closed on oversized upstream responses while retaining only the safe resend_response_too_large classification.
• Preserves the live response-policy, security-header, accessibility, source-syntax, identity security, and deployment evidence boundaries.

v5.8.7 — Response-Policy Verification

• Verifies JSON content types and no-store caching on live identity and release-evidence responses.
• Prevents stale release truth or identity state from being served through intermediary caches and reports only safe classifications.
• Preserves the live security-header, accessibility, source-syntax, identity security, and deployment evidence boundaries.

v5.8.6 — Live Security-Header Verification

• Verifies the headers actually returned by both production origins during the live release check.
• Fails closed on changed CSP, framing, content-type, download, cross-domain, origin-isolation, referrer, permissions, COOP, CORP, or HTTPS transport policies.
• Preserves the accessibility, source-syntax, identity security, and deployment evidence boundaries.

v5.8.5 — Accessibility Evidence

• Publishes structural accessibility evidence for keyboard navigation, visible focus, form-error associations, reduced motion, and documentation landmarks.
• Adds the artifact to the credential-free live monitor without claiming rendered WCAG, screen-reader, or assistive-technology conformance.
• Preserves the source-syntax, identity security, and deployment evidence boundaries.

v5.8.4 — Source Syntax Evidence

• Parses JavaScript, TypeScript SDK sources, and Python SDK sources in the release gate without emitting source contents.
• Records the syntax evidence boundary and does not claim unavailable Go, ESLint, TypeScript type-check, or browser trace tooling.
• Preserves the complete identity security and deployment evidence boundary.

v5.8.3 — Rollback Artifact Verification

• Adds an executable, host-restricted verifier for previously deployed Pages artifacts.
• Checks rollback health, rehearsal GO with transactional email, and the preserved Replay QA nonce without modifying production routing or data.
• Reports only safe rollback classifications and requires operator-supplied target/version values.

v5.7.7 — Route-Scoped Critical Asset Preloading

• Keeps the homepage hero preload on the homepage and removes it from authenticated and documentation shells.
• Adds a worker regression test so route-specific HTML cannot silently reintroduce the unnecessary critical-image request.
• Preserves true 404 handling, reduced-motion behavior, identity security gates, and the complete release evidence boundary.

v5.7.6 — Reduced Motion Hardening

• Removes nonessential animation, transition delay, and hover/focus translation when reduced motion is requested.
• Adds an accessibility regression check for the visual motion boundary.
• Preserves all identity, authorization, privacy, and release-gate controls.

v5.7.5 — Request Correlation Boundary

• Exposes only strictly validated server request IDs through the shared browser request helper for safe support correlation.
• Keeps diagnostic metadata non-authoritative and preserves single-attempt mutation behavior.
• Preserves bounded response bodies, safe error copy, and all identity security boundaries.

v5.7.1 — Capability Surface Network Resilience

• Routes trust, enrollment, recovery, security, authorization, and authentication capability requests through the shared bounded request boundary.
• Converts capability and recovery mutations to bounded single-attempt requests without automatic retries or response-body leakage.
• Preserves WebAuthn, password, exact-origin, CSRF, secure-session, tenant, and idempotency boundaries.

v5.6.9 — Status Page Network Resilience

• Routes public capability, readiness, and rehearsal reads through the shared bounded request boundary.
• Shows safe recovery copy for timeout, network, abort, and unavailable responses without exposing response bodies.
• Preserves credential-free evidence reads, fail-closed status mapping, and all production security gates.

v5.6.8 — Live Verification Reliability

• Bounds every live release-verification request so a stalled origin cannot leave the release gate hanging indefinitely.
• Exits explicitly after a successful verification while preserving fail-closed nonzero failure behavior and secret-safe classifications.
• Adds legacy-browser download hardening at the shared response boundary without changing authentication or authorization controls.

v5.6.5 — Modal Semantics & Focus Safety

• Extends the shared focus boundary across Developer dialogs and the permission-consent sheet.
• Applies dialog semantics to dynamically rendered modals while preserving accessible naming.
• Keeps Tab navigation contained and Escape close predictable without changing authorization boundaries.

v5.6.4 — Dialog Focus & Keyboard Safety

• Adds a shared focus boundary for the production API-key dialog.
• Keeps Tab navigation inside the credential dialog and supports Escape close with focus restoration.
• Preserves the server-side passkey step-up, CSRF, tenant, and idempotency requirements.

v5.6.3 — Accessibility Semantics & Keyboard Flow

• Adds skip navigation and a stable main landmark to the authenticated application shell.
• Exposes current navigation and selected console sections to assistive technology instead of relying on color alone.
• Adds keyboard movement across public navigation groups and menu items, including Escape focus return.

v5.6.2 — Network Resilience & Offline Recovery

• Bounds browser requests and classifies timeouts and network failures without exposing response bodies.
• Adds retryable unavailable states for authenticated console, Developer, organization, session, permissions, documentation, and release reads.
• Preserves single-attempt mutations and the explicit same-key Developer step-up retry, with a visible accessible offline notice.

v5.6.1 — Developer Key Action UX

• Signed-out Developer actions now take visitors to sign-in instead of appearing inert.
• API-key creation validates the required key name and at least one permission before making a request.
• Successful sign-in can return the user to the Developer API-keys surface, while server-side passkey step-up and idempotency remain required for credential issuance.

v5.6.0 — Production Route & Icon Integrity

• Restored true HTTP 404 semantics for unknown HTML paths even when Cloudflare Pages supplied the SPA shell.
• Added route-specific noindex canonical metadata and branded favicon and Apple touch icon assets.
• Added source, packaging, MIME, and live route-integrity verification without changing the D1 migration boundary.

v5.5.9 — Developer Session Gate & API-Key UX

• Confirms the live server session before enabling Developer console actions and provides a clear sign-in path when opened signed out.
• Keeps API-key submission explicit and explains the passkey step-up that protects production credential creation.
• Preserves the v5.5.8 interactive step-up, idempotent retry, safe errors, and compact permission modal.

v5.5.8 — Developer Credential Step-Up UX

• Connects protected Developer console mutations to the existing production passkey step-up ceremony.
• Preserves the original idempotency key across the one-time retry after step-up verification.
• Replaces raw mutation failures with safe customer-facing messages and improves API-key permission selection.

v5.5.7 — Organization SSO and Lyra Advisory

Enabled verified-domain inbound OIDC organization SSO, self-scoped D1 membership reads, and the server-only Groq-backed Lyra advisory boundary.

v5.5.6 — Authenticated Console Stability

• Fixed the authenticated console white screen caused by a missing shared-shell icon import.
• Added navigation-icon regression coverage for lazy-loaded authenticated routes.
• Preserved the server-authoritative session, CSRF, passkey, password, and organization boundaries.

v5.5.5 — Authenticated Route Reliability

• Normalizes query-bearing client navigation so successful password and passkey sign-in reaches the requested Identity Console view instead of the 404 route.
• Preserves direct-refresh SPA resolution for authenticated routes and centers the account-ready confirmation surface across desktop and mobile layouts.
• Adds route-level regression coverage without changing session, CSRF, passkey, password, or authorization boundaries.

v5.5.4 — Cloudflare-Safe Password Proofs

• Fixes password account creation and passkey-plus-password enrollment on Cloudflare Workers by keeping each PBKDF2 operation within the platform limit.
• Preserves the 600,000-iteration effective work factor through six chained, domain-separated operations and keeps existing lower-iteration proofs compatible.
• Adds regression coverage without changing passkey verification, secure sessions, exact-origin checks, CSRF, or independent authentication gates.

v5.5.3 — Password Enrollment Recovery UX

• Corrects password-enrollment errors so account conflicts, expired setup, service failures, and password-policy failures are explained accurately.
• Adds an editable password field after email verification with a clearer requirements hint, visibility control, and polished retry state.
• Preserves server-authoritative credentials, secure sessions, exact-origin checks, CSRF, rate limits, lockout, and passkey availability.

v5.5.2 — Customer-Facing Authentication UI

• Removes internal release, runtime, provider, and credential-storage language from normal customer sign-in and account-creation flows.
• Adds verified-email password account creation and independent password sign-in while keeping passkeys available as an optional method.
• Preserves exact-origin checks, secure sessions, CSRF, rate limits, lockout, fail-closed gates, and the Replay QA security nonce.

v5.5.1 — Production-Only Console Shell

• Removes the remaining demo-only banner, static notification, and placeholder avatar from the authenticated production console shell.
• Removes local-preview fallback copy and Cloudflare runtime wording from production-facing authentication and enrollment surfaces.
• Adds regression coverage so production identity surfaces remain server-authoritative, fail closed, and free of browser-persisted identity state.

v5.5.0 — Server-Authoritative Production UI

• Removed browser-persisted identity, credential, permission, recovery, and organization preview state from production-facing surfaces.
• Loaded security capability, application permission, session, and organization state from authenticated server APIs with fail-closed unavailable handling.
• Removed Cloudflare runtime-status claims from the auth foundation and enrollment readiness panels while preserving live capability evidence and all security gates.

v5.4.6 — Developer API Read Surface

Added scoped bearer reads for owned applications, API-key metadata, audit activity, webhooks, and delivery state with bounded opaque cursors and metadata-only responses.

v5.4.5 — Complete SCIM User SDK Coverage

Added complete TypeScript, Python, and Go SCIM user lifecycle and discovery helpers while preserving ETag validators and keyed idempotency.

v5.4.4 — SCIM Concurrency Validators

Added opaque ETag and meta.version validators, conditional reads, and stale-writer protection for individual SCIM users and groups.

v5.4.3 — Live Status Evidence

Connected the public status page to authoritative capability, readiness, and rehearsal evidence and made unavailable states fail closed.

v5.4.2 — API Versioning and Lifecycle Contract

Added explicit API lifecycle headers, fail-closed version negotiation, maintained SDK metadata, and the documented deprecation policy.

v5.4.0 — Organization Management SDK Coverage

Added named TypeScript, Python, and Go helpers for the full server-backed organization mutation surface with mandatory idempotency keys.

v5.3.9 — Organization Approval Console

Connected the Organization Console to the server-backed step-up and separation-of-duties approval workflow without executing approved actions.

v5.3.8 — Organization Audit Pagination

Added bounded opaque-cursor pagination to tenant-bound organization audit and approval reads and connected incremental audit loading.

v5.3.5 — Delegated Administration Console

Connected the scoped delegated-administration API to the server-backed organization console.

v5.3.4 — Scoped Delegated Administration

Added the tenant-bound, expiring, scope-enforced delegated-administration API and migration.

v5.3.0 — Federation Metadata Validation Boundary

Added bounded OIDC JSON and SAML 2.0 IdP metadata validation before activation with safe provider classifications and independent SAML protocol gating.

v5.2.9 — API Reliability Contract

Added bounded authentication-risk rate-limit metadata and SDK response metadata for request IDs, retry hints, and rate-limit state.

v5.2.8 — Federation Capability Contract

Separated inbound OIDC execution status from independently gated SAML protocol execution and added provider-level federation inspection.

v5.2.7 — SCIM Group SDK Coverage

Added official TypeScript, Python, and Go SCIM Group lifecycle helpers with keyed mutations and safe 204 handling.

v5.2.6 — SCIM Group Lifecycle Reliability

Added token-scoped replay-safe SCIM group replacement, patch, and deletion.

v5.2.3 — Organization Policy Enforcement

Mapped the live policy panel to runtime-enforced controls and added replay-safe policy updates and resets.

v5.2.2 — Organization Administration Console

Connected live role and application-assignment administration to guarded server APIs with replay-safe mutation boundaries.

v5.1.9 — Bearer Organization Read Contract

Added tenant-bound, scoped server-to-server organization reads and aligned the official TypeScript, Python, and Go SDKs with the bearer contract.

v5.1.8 — Organization Group SDKs

Added encoded organization group lifecycle SDK coverage before the administrative boundary was made explicitly browser-controlled.

v5.1.1 — Webhook Verification Tooling

Added portable TypeScript, Python, and Go helpers for raw-body HMAC verification with freshness and constant-time checks.

v5.1.0 — Privacy Operations Request Boundary

Added explicit, step-up/CSRF-protected, idempotent privacy deletion requests that remain pending for manual review and never delete automatically.

v5.0.9 — Operational Evidence Boundary

Separated runtime approval from manual continuity, incident, privacy, rotation, and external-assurance evidence.

v5.0.8 — SDK Privacy Export

Added privacy-export methods to the maintained TypeScript, Python, and Go SDKs with the dedicated identity.privacy.export grant.

v5.0.7 — Privacy Data Boundary

Added the scoped server-backed privacy export API with explicit credential and metadata exclusions.

v5.0.5 — Federation Discovery Boundary

Added exact-origin verified-domain discovery for active reviewed federation connections while keeping protocol execution gated.

v5.0.4 — Conditional Access Enforcement

Organization permission evaluation now enforces passkey, step-up, and bounded session-age policy before role permissions.

v5.0.3 — SDK Reliability

Expanded TypeScript, Python, and Go SDKs with bounded retries and safe request-ID/error metadata.

v5.0.2 — Developer Surface & Trust Center

Added maintained SDK entry points, a read-only CLI version fingerprint, the public Trust Center, and live Replay QA nonce verification.

v5.0.1 — Organization Lifecycle

Added server-backed member, group, role, application-assignment, invitation, verified-domain, and SCIM Group lifecycle controls with tenant isolation and owner protection.

v5.0.0 — Platform Maturity

Added the platform maturity foundation, guarded Lyra action boundary, federation metadata control plane, complete API contract, and release truthfulness gates while preserving the sequential release history from v1.3.0.