Changelog

This is a curated GridWonk platform-change ledger. The v1.* and earlier headings below are historical platform milestone labels. The aligned v0.4.0 SDK, CLI, and MCP server packages were published to GitHub Packages on October 23, 2026 and passed the release workflow's clean-install check. This breaking package release removes legacy base64 uploads, AX optimization, and Queue Analytics methods, commands, and tools. Use matching package versions and review the utility integration migration guide. Unreleased entries below have not been assigned to a numbered platform milestone; package publication and completion of an integration's live acceptance checks remain separate.

One action on finding cardsCopy Anchor Link

Finding cards now offer Explain this finding, which replaces Ask the assistant. It shows the same verified source quotations.

Application packet review completionCopy Anchor Link

Completed packet reviews show Review Finished. Open Coverage to see which checks ran and what evidence an unfinished check needed.

Platform administrators can inspect recorded costs, receipt gaps, evidence reuse and check coverage under Monitoring → Packet reviews.

Per-check review outcomesCopy Anchor Link

New packet reviews may include a result for each declared check, with its outcome, findings and examined documents. The five meanings distinguish missing required information or a demonstrated problem, attempted but inconclusive checks, evidence-backed non-applicability, checks not evaluated with a reason, and no deficiency identified within completed checks. Partial evaluations keep valid findings and expose their unfinished scope. No outcome is utility approval; the separately planned full Checks table is not included in this contract change.

Unreleased — October 2026Copy Anchor Link

Review completeness and evidenceCopy Anchor Link

Packet reports show Review incomplete while declared checks remain unresolved, preserving valid deficiencies and severity counts. Unknown equipment and unreadable evidence are not marked N/A. Coverage explains checks not evaluated and partial evidence, including mixed readable/unreadable sheets or one-line sources. Older reports without recorded coverage remain explicitly unknown; no result implies utility approval.

Preview and save workspace appearanceCopy Anchor Link

Direct Owners and Admins of developer and utility organizations can preview Light, Brand color, and Dark brand schemes, select roles from source colors, and explicitly Save appearance to enable full branding. Supplemental discovery reads public website and PNG/JPEG/WebP logo evidence; it does not spend a logo.dev Brand API credit or approve a discovered logo for display. Dark schemes require a readable dark source color.

Already-enabled legacy themes use exact source fills on code release, with readable neutral text and surfaces. The prepared 20261027150000_organization_brand_appearance migration does not backfill selections or automatically activate a customer. Production migration, deployment, and customer acceptance remain separate steps. See Workspace appearance.

Consistent utility screening statusCopy Anchor Link

Utility screening started through REST, SDK, CLI or MCP now records a submitted application as screening before the review can finish. Completion moves it to screened; a startup failure restores its prior state. Draft package freezing and existing screening decisions are unchanged.

CLI first-key bootstrapCopy Anchor Link

auth bootstrap-key accepts an explicit --org flag before or after the subcommand. Missing or blank flags are refused without choosing a target from stored or environment settings, and --dry-run makes no network request. Server authorization is unchanged.

Confirmed Admin MCP actionsCopy Anchor Link

Protected Admin MCP adds invitation creation/resend/revocation, team roles, access status, join-request approval, membership expiry/removal, ownership transfer, branding reads/updates and model-assignment preview/apply tools. Existing user update and bulk approval/rejection/deactivation pairs gain the same credential- and state-bound approval, single execution and safe retry receipt. The catalog declares 45 tools before lane and feature filtering. Legacy direct model updates stay deprecated and session-only. Public MCP and administrator OAuth gain no mutation authority.

Internal management-key use defaults off behind ADMIN_MCP_REMOTE_MUTATIONS_ENABLED; the reviewed organization administration merge and all four database guards must be verified before a separately authorized activation. This implementation does not enable that flag, activate migrations or perform live mutations. Invitation/legal acceptance remains invitee-only, branding does not change sign-in domains, and model assignments retain catalog validation.

Utility notice interfacesCopy Anchor Link

The dependent notice stack adds application-bound REST, SDK and CLI workflows for drafting, editing, review, approval, return, revocation, sending and acknowledgment. Programmatic sends are restricted to current addresses on file. MCP adds only scoped list/detail reads; every notice write stays excluded. Responses distinguish pending or held delivery, provider acceptance and canonical status without claiming inbox delivery. These bindings are included in the published 0.4.0 packages. Each integration must still verify its own live authorization, workflow and delivery behavior; package publication does not complete those acceptance checks.

Embedded assistant loadingCopy Anchor Link

The console and utility workspace load the assistant's chat engine when it is first opened or asked a question. A brief Preparing assistant… message can appear on first use; a question submitted during loading waits without needing to be sent again. Loading failures support retry and dismiss, and pending questions can be canceled. Closing or minimizing retains the conversation in its current context. Assistant permissions, model routing and supported operations are unchanged.

Requirement metadata packagingCopy Anchor Link

Requirement metadata can read the names of supported checks and shared document-role labels without loading the equipment-evaluation code. Accepted check names, requirement validation, displayed labels and review behavior are unchanged. Equipment evaluation still uses the complete inverter, battery and PV certification catalogs; no catalog records or matching rules were removed.

Code highlighting bundlesCopy Anchor Link

Code blocks retain their existing light and dark themes, supported languages, embedded syntax, line numbers and copy behavior. Their lazy highlighter now declares only the two themes the component uses, so unrelated themes need not be included in its browser output. This does not narrow language support or preload the highlighter before a code block renders.

Requirements runtime packagingCopy Anchor Link

Review-application, SLD analysis and site-plan analysis use their published database requirements without carrying local pipeline JSON. Local source readers remain available to pipeline commands, with unchanged identity, hash/storage and drift checks. A postbuild guard checks the runtime exclusion and retains the complete JSON inventory for the publish-drift cron. No requirement content, publication state or reconciliation behavior is changed.

Chatbot settings display metadataCopy Anchor Link

The Gemini rollout card receives its canonical title and description from the server instead of importing the full capability registry into its browser code. Fallback text, rollout controls, status requests, and authorization are unchanged. No rollout stage, model assignment, or provider configuration is changed.

Document browser fallback packagingCopy Anchor Link

Document fetching, link health checks, and SharePoint downloads now import the existing Playwright runtime library without its test runner. Browser resources are closed after partial setup or fetch errors, and response timers are canceled. The pinned version, URL and redirect guards, size limits, and accepted document types are unchanged. No provider configuration or customer data changes.

Runtime artifact packagingCopy Anchor Link

Public MCP no longer packages a development-only compiled procedure projection through the procedure-discovery path registry. The file and development audit metadata remain available. Runtime utility data is unchanged and protected by a postbuild trace check; no customer capability or discovery behavior is removed.

Native bundle diagnosticsCopy Anchor Link

The application pins Next.js 16.4.0 and replaces the Webpack-only analyzer with native Turbopack capture and export commands. A tested server-file inventory and the official bundle-optimizer skill support measured optimization work. The one-time dependency release-age exception does not change the repository's seven-day policy. This tooling change removes no application capabilities; local bundle measurements do not establish hosted size or performance savings.

Born-digital PDFs can be indexed from their own text (not yet switched on)Copy Anchor Link

When document intake starts keeping original PDFs instead of flattened copies, text recognition will first read the text a born-digital PDF already carries, inside the same isolated sandbox that renders pages, and use it when every page passes a quality gate (enough readable text, no invisible text layer, the extracted text matching what the page paints, and page geometry matching the rendered page). Such a document costs nothing to index and is never sent to the recognition provider. A scanned page, a page with an invisible text layer or a page the extractor cannot read fully sends the whole document to the existing recognition path. This engine is built and tested but no uploads use it until the intake switch lands.

Legacy 3 MB document upload removedCopy Anchor Link

The original single-file upload — a base64 PDF of at most 3 MB sent as JSON — is gone: the POST /api/v1/documents/upload route now returns 404, the console no longer falls back to it, and the SDK uploadDocument method, CLI docs upload command and local MCP upload_document helper are removed (a breaking change in the v0.4.0 packages published October 23, 2026). Nobody had used the API path in 120 days. Upload through packet intake (files up to 30 MB). Documents stored through the old path stay readable.

Text recognition keeps a dense page when one line cannot be located (v5, activation pending)Copy Anchor Link

A new text-recognition profile, v5, no longer discards a whole page because one line came back with a box that has no width or height. That line is dropped, the count is recorded in the audit (empty_text_boxes_dropped), and every other line on the page is kept. A page where every line is empty, or more than 5% of its lines (beyond one) are, is still rejected. The request sent to the provider and all size, usage and budget checks are the same as v4, and v1–v4 behave as before. v5 takes effect only after its reviewed configuration change is applied.

Text recognition accepts imperfect line numbering (v4, active since October 1)Copy Anchor Link

The not-yet-activated v4 OCR profile no longer rejects a page because the provider numbered its text lines imperfectly (one-based, with a gap, or with a duplicate). Line order was always derived from box position, so those numbers never changed saved output; the strict check could only turn a usable page into a failure, and did so three times on one production sheet. Such a page is now accepted and the run's audit notes it. Empty-box, schema, size, usage and spend checks are unchanged; earlier profiles keep their behaviour. Deployment, configuration activation and a verified customer retry remain separate steps.

Dense-page text recognition (activation pending)Copy Anchor Link

A separately versioned OCR profile accepts up to 1,000 validated text entries per page instead of 250. This addresses pages whose complete response was rejected by our internal line limit, even though the provider finished below its token allowance. Model, 65,536-token request, geometry checks, response-size ceiling and retry limits stay unchanged; no entries are trimmed. Existing jobs and historical results retain their settings. Deployment, configuration activation and a verified customer retry remain separate steps.

Packet cancellation and visible document findingsCopy Anchor Link

Authorized reviewers can use Review Actions → Cancel Packet Review to settle an active packet run without losing completed document findings. Cancellation prevents later results from that run; an already-running provider request may still finish, and an unconfirmed workflow stop produces a warning. Current document findings remain visible during running, failed or cancelled packet reviews and are labeled separately from whole-project results. Completed current packet results retain priority; stale versions and older successful document checks do not hide a newer failed document review. Deployment and customer recovery still require separate verification.

Time for large text-recognition responses to finish (activation pending)Copy Anchor Link

A separately versioned OCR profile keeps the 65,536-token response allowance and gives each page call up to eight minutes instead of two, so a full-size response is not cut off by the client timeout. The overall ten-minute limit per document run is unchanged, as are the model, text/location validation, retry limits and fallback policy. Existing jobs and historical results keep their original settings. It takes effect only after the reviewed production configuration is activated and does not automatically rerun failed documents.

More room for text-recognition responsesCopy Anchor Link

New Gemini OCR jobs use a separately versioned 65,536-token response allowance (activated 2026-09-29). Existing jobs and historical results keep their original settings. The model, text/location validation, retry limits and fallback policy are unchanged. This change does not automatically rerun failed documents or mark them complete.

Classifier usage accounting (release pending)Copy Anchor Link

Chatbot accounting separately records intent-classifier calls, retries and cache hits instead of mixing them into answer-model token totals. Missing measurements or prices remain unknown; estimated costs are not provider bills. This changes no model assignment, customer permissions or Max workflow and does not establish completed Claude Agent SDK retirement.

Eve usage and synthetic reportingCopy Anchor Link

Completed chatbot turns can recover late token measurements without repeating the answer or starting another model call. Missing or partial usage is explicitly marked unknown for total-cost estimation. Console synthetic accounts receive server-derived labels so their tests stay out of customer reports; this grants no additional permissions and does not backfill historical sessions.

Protected document recovery (activation and execution pending)Copy Anchor Link

Human platform operators can preview exact failed document targets, approve a bounded OCR or document-review recovery, and read sanitized status through protected Admin MCP/API operations. The approval binds the current organization, version, artifacts and model settings, a numeric incremental ceiling and an absolute deadline. Durable receipts preserve history and stop uncertain spending; an automatic whole-project-review hold prevents downstream work without new customer intent.

Both OCR and review require qualified conservative pricing before provider dispatch. Public MCP, customer SDK/CLI, chatbot mutations and source-managed projects are excluded. Migration activation, pricing configuration, GitHub-sourced deployment, each paid diagnostic/recovery and communications remain separately approved. This implementation is not evidence of customer recovery or a repaired historical root cause. See Document troubleshooting.

Private packet review by default and controlled utility submissionCopy Anchor Link

Developers can prepare projects and run private packet reviews by default for released, full state/program utility packet setups; no rollout setting is required. Private review stays available after a utility accepts submissions, and review alone never sends the packet. This includes Delmarva's Maryland packet lane. Sending a packet through GridWonk requires both GridWonk and an authorized utility representative to accept the exact state and program, plus an active utility reviewer. Revocation stops new submissions while earlier frozen packages remain available, and developers already answering a deficiency notice can still resubmit to the same utility. Real-utility acceptance remains a separate gate for each state and program.

Salesforce installed-app packet submission (disabled)Copy Anchor Link

Layer 2 source adds private submission receipts, exact-version PDF checks, bounded direct uploads and finalization. The installed-app entry and model-processing gates remain closed. Native check-only validation passed 21 tests on September 26; no application was installed or activated. Results/history, retention and managed-package lifecycle remain later work requiring approval.

Split PDF after document assignment (application release pending)Copy Anchor Link

Eligible accepted 2–250-page PDFs can be split from More actions → Split PDF, including after document-type assignment or review and without a classifier hint. People confirm editable page ranges and document types. Originals and review history remain available; new documents require review. Confirmed pending or failed splits pause new reviews and submission, with Retry and Keep original recovery. Existing enablement and public APIs are unchanged. The database foundation is already activated in production; this entry does not establish application release or protected-demo activation.

Authentication cookie response handlingCopy Anchor Link

Cookie domain, path, expiry and cache headers survive the final refresh, redirect, rewrite and denial responses. Explicit same-origin logout clears known session cookies at both host and parent-domain scopes, including old chunks. Session rotation and expiry policy are unchanged. Trusted refresh writes also remove legacy host-only copies of the active session's chunks while preserving unchanged chunks at the configured domain. Read-only requests do not infer cookie scopes. This entry records source changes, not a production release.

Session inbox reliabilityCopy Anchor Link

The notification bell uses cancellable session-only reads and pauses in hidden or offline tabs. Sign-in expiry offers recovery without closing the workspace; account or organization changes pause notifications until the page context is restored. Failed updates no longer look successful, and valid administrator impersonation uses the existing organization resolver. Expected access refusals remain distinct from genuine service outages. All six workspace groups are included. This does not enable notification rollout flags or add public API-key access to the session inbox.

Server-error alert reliabilityCopy Anchor Link

Server-error alerts now coordinate duplicate suppression across servers using existing Redis. Successful delivery starts the fifteen-minute suppression window; failed delivery allows a retry on a later error after one minute. Every genuine error remains logged, and Redis outages retain bounded local alert delivery. Vercel links now target the current project. This source change does not itself change production configuration or establish deployment.

Console upload refresh recoveryCopy Anchor Link

Reserved console uploads can recover after a refresh in the same browser tab and account. Reselecting unchanged original files resumes the original document, CAD or ZIP identities and any pinned site-plan target; accepted files are not uploaded again. The local record stores identifiers and fingerprints, not file contents, filenames or upload credentials. Recovery checks fresh server bindings and reconciles uncertain completion before transferring bytes again. Dismissing the record does not cancel server work or clear an unfinished upload gate.

No database migration, public API, SDK, CLI or MCP operation is added. Deployment and live Layer 2 retesting remain separate acceptance gates; this entry does not unlock Layer 3.

Utility-owned packet repair (production activation pending)Copy Anchor Link

Review manifests, human confirmations, and native-CAD companions now use the existing packet-owner rule: the applicant organization when present, otherwise the utility. Direct write-capable utility staff can confirm their own editable packet evidence without creating a developer or granting developer access. Applicant isolation, exact version/hash checks, Salesforce ownership restrictions, and utility review billing are preserved. The four confirmation types remain human-authored and console-only; no public integration gains confirmation authority. Production migration approval, matching deployment, and the complete Layer 2 live acceptance gate remain pending. Layer 3 is not unlocked by this source change.

Eve remediation cutoverCopy Anchor Link

The dedicated remediation page now uses Eve behind the default-off REMEDIATION_EVE_ENABLED flag. Exact stored proposals, separate apply/document-replacement/Packet Review approvals, durable cursor replay, duplicate suppression, refresh restoration, and real cancellation replace the former Claude Agent SDK stream. The legacy remediation config, MCP bundle, prompt entries, and unused context endpoint are removed; the historical remediation-agent model/session key and Claude Max workflow remain.

New client-access notifications (disabled by default)Copy Anchor Link

New usable consultant grants can capture individual email work and persistent in-app alerts atomically. Eligible existing direct members are notified; current access is rechecked before display and dispatch. Console and Utility headers include the bell on desktop and mobile. Production migration, reviewed native-template publication, and rollout flags require separate approval. No historical grants are backfilled.

Finding answer validationCopy Anchor Link

Finding-card Ask the assistant answers now quote individually verified passages from the saved source edition. A restricted model can select passages, but the server validates the selection and renders the quotations; model-written interpretations are not displayed or saved. The answer does not guess governing section scope, equipment applicability, or whether a drawing passes. Clearing a finding starts a fresh conversational context so old answers are not reused as evidence.

This console-only change retains current access checks, model assignments, and Eve rollout controls. It adds no API, MCP, CLI, Slack, or Teams capability. Local regressions and this unreleased entry are not evidence of deployment or successful live acceptance.

Assistant replay hardeningCopy Anchor Link

Temporary reasoning summaries no longer display a serialized provider object or opaque signature. Empty, malformed, and redacted summaries are omitted. Saved-finding answers are instructed to cite verified document/page labels instead of constructing subsection numbers. These corrections do not change model settings or selected-finding evidence.

Saved-finding assistant explanationsCopy Anchor Link

Ask the assistant now identifies the saved review finding instead of relying on its question text. The server checks access and loads the original requirement and cited source edition before answering. The visible selection survives follow-ups and retries until cleared. Missing or incomplete evidence stops the explanation rather than prompting a guess. Explanations distinguish utility text from common checks and do not decide whether the applicant's drawing passes.

This is a console-session change; it does not switch models, enable Eve, or grant other channels browser-session access. This unreleased entry is not evidence of deployment or live answer testing.

Salesforce recovery isolationCopy Anchor Link

The disabled Salesforce connector now preserves existing imports and result deliveries when an unrelated reviewer, mapping, or grant changes. Relevant revocations still invalidate saved work. During a source permission-check outage, mixed application lists retain ordinary and currently authorized applications, with explicit partial counts and retry guidance in the UI, API, SDK, MCP, and CLI. Sandbox acceptance and separate activation approval remain required.

Result delivery retries a temporary authorization-check outage within its existing ten-attempt limit. It checks current access before any Salesforce call; a revoked permission cancels delivery.

AX optimizer source removedCopy Anchor Link

AX execution and the optimization/canary interfaces are removed: the optimize CLI group, the SDK optimization methods, the optimization.* admin MCP tools, the optimization REST routes and the Prompt Ops Optimization/Canaries tabs. Prompt history, effective-instruction inspection, evaluation tools and historical database records remain. Cloud resources, delayed queue messages, sleeping workflows and historical tables are cleaned up under separate authorization; merging the source removal does not touch them.

AddedCopy Anchor Link

• Partner upload-batch lifecycle — Partner REST, SDK, CLI, hosted MCP, and local MCP clients can reserve, inspect, heartbeat, pair, cancel, and abandon ordered packet upload batches. Batch-bound single-file intake carries both batch identifiers, verifies the exact packet, owner, actor, declaration, state, and expiry under the packet lock, and keeps retries idempotent. Unfinished batches continue to block review and freeze. Creation provenance is stored immutably by an additive migration; the migration is not applied by this code change.
• Utility workspace v2 (feature-flagged) — With the utility-workspace-v2 feature enabled for a utility organization, /utility renders on the shared console shell: a rail of Applications, Notices, Rules & Sources (Packet Requirements, Procedures), and Analytics; a header that hosts the application's Overview · Documents · Review · Communications · History navigation and the Freeze package action for utility-owned applications still in intake; the jobs tray; and a Cmd/Ctrl+K destination palette. Addresses are ?view=… with &app=…&pkg=…&appview=… for an application; legacy ?tab= links upgrade in place. The feature is off by default, and the legacy six-tab shell renders unchanged when it is off.
• AX retirement evidence preparation — Local operator commands now export bounded, redacted log evidence and prepare an equivalent empty-overlay prompt reference. Neither command changes active prompts, uploads archives, or establishes the observation clock; completeness and production changes remain separately gated.

RemovedCopy Anchor Link

• Interconnection queue retrieval — Every surface that could retrieve interconnection queue data has been removed: the /api/queue/* REST endpoints, the search_queue and get_queue_stats MCP tools (hosted gateway and in-app assistant alike), the gridwonk queue CLI command group, and the SDK's searchQueueProjects, getQueueStats, getQueueProject, and listQueueDataCenters methods with their exported types. The search-queue and get-queue-stats capabilities are retired. This ships as the breaking v0.4.0 package release, and there is no replacement — ISO/RTO queue data is public, so use gridstatus directly. Unaffected despite the shared names: queue_statistics and the console utility selector that reads it, the utility application-queue statistics, and the Vercel Queues topics.
• Queue Analytics destination — The developer console's Analytics destination and both panels it hosted, Queue Analytics and Developer Portfolio Analytics, have been removed. ?view=analytics, the legacy ?tab=analytics and ?tab=queue-analytics links, and /console/queue-analytics now land on Projects. What is gone in that step is the console UI over the data, plus the developer portfolio rollups (utility-level application counts, average readiness, deficiency totals) and the portfolio CSV export.

ChangedCopy Anchor Link

• Projects API program declaration — POST /api/v1/projects, the create_project MCP tool, SDK createProject, and CLI projects create --declared-tier-slug now enforce the console's program rule: when the utility publishes two or more interconnection programs for the chosen track, declaredTierSlug must name one of them; when it publishes zero or one, the field is refused. Refusals return 400 INVALID_INPUT with the valid programs listed in error.details.programs as { slug, label } objects, so a client can discover the programs from the refusal and retry. An unreadable or misconfigured program publication returns 503 SERVICE_UNAVAILABLE (reason program_lookup_failed or program_publication_invalid) and creates nothing. The accepted program is stored on the project, returned as declaredTierSlug on every project read, and selects the rulebook the review runs against; it cannot be changed through PATCH, and a track change that would orphan a declaration (409) or land an undeclared project on a track that requires one (400) is refused. The v1 error envelope gained the optional error.details object, and retryable 503s carry retryAfter; the SDK exposes details and reason on every GridWonkError, and the CLI includes them in --json error output.

Unreleased — August 2026Copy Anchor Link

ChangedCopy Anchor Link

• gridwonk is the CLI command — The package installs two commands: gridwonk, the canonical one, and gridboost, the pre-rebrand name kept installed so existing scripts and aliases keep running. Both are the same launcher and behave identically; usage, help, examples, error hints, and the bash/zsh/fish completions all speak gridwonk, and completions register for that name. The local MCP server likewise installs as gridwonk-mcp alongside gridboost-mcp, and now reads GRIDWONK_* environment variables with a GRIDBOOST_* fallback, matching the CLI: an empty canonical value means "cleared" and does not fall back, and a conflict between the two warns once rather than silently picking one. Release binaries are named gridwonk-<platform>.
• MCP authentication retry containment — The aligned private packages move to 0.3.2. The local MCP connector treats modern bridge HTTP 401 and 403 responses as terminal authentication failures instead of retrying the same rejected credential through the legacy proxy. This removes the doubled public authentication traffic seen during the August 28 admin render incident; it does not replace correcting stale credentials or duplicate host registrations.
• Platform organization type is gridwonk — The organization_type database enum value gridboost was renamed to gridwonk, and the application code that accepted both labels during the rename has been removed. The visible effect is on the organization-type filter of the admin MCP organizations.list tool and the organization-create schemas: gridboost is no longer an accepted value and is rejected rather than silently ignored. Organization ids, memberships, grants, API keys, and every other org-scoped identifier are unchanged — only the type label moved, and the platform organization's own row moved with it.
• Workflow status responsible party renamed gridboost -> gridwonk — the responsibleParty field of the packet workflow status now reports gridwonk instead of gridboost for the automated pre-screen state; developer, utility, and null are unchanged. This completes the rebrand for a value that was missed because it is derived presentation state rather than a stored column, and is unrelated to the organization_type database enum. Renamed outright rather than dual-emitted because the field is emit-only — nothing accepts it as input — and no stored row, webhook subscription, or typed SDK field carried the old string. Consumers that string-compare responsibleParty against "gridboost" should compare against "gridwonk".
• GridWonk-named SDK classes and MCP server identifiers — The SDK's exported classes are now GridWonkClient, GridWonkSessionClient, and GridWonkError (and GridWonkTransport / GridWonkTransportError in the local MCP package). The former GridBoost-prefixed names remain exported as deprecated aliases of the same classes, so existing class-name imports keep compiling and instanceof keeps matching across both names; only the display string error.name changed, from GridBoostError to GridWonkError. Catch by class, never by name. Package specifiers now use the @gridwonk/* namespace. On the MCP side the local stdio fallback server now advertises itself as gridwonk (matching the modern bridge, which already did), the admin endpoint reports serverInfo.name gridwonk-admin-mcp and auth session-admin-or-gridwonk-management-key, and eleven tool descriptions say GridWonk instead of GridBoost. Tool names, input schemas, endpoints, and authentication are unchanged. The repo-local Codex plugin dropped its duplicate gridboost / gridboost-admin server entries, which registered the same two servers a second time under legacy keys.
• GitHub package namespace repair — Moved the SDK, CLI, and local MCP connector to @gridwonk/*, rewired the CLI to the canonical SDK dependency, and made publish failures and version drift fail closed. The immutable 0.3.0 CLI exposed a cross-package export mismatch during a clean registry install, so the corrected release is aligned at 0.3.1 and now installs the packed CLI against the published SDK before publication. The gridboost CLI executable remains available during its separate binary-name transition.
• Model catalog cron notifications — Removed the obsolete global-token Slack summary. Supported catalog changes continue to create deduplicated GitHub issues, and every lifecycle change remains recorded in model_sync_events.

Unreleased — July 2026Copy Anchor Link

RemovedCopy Anchor Link

• Legacy pre-rebrand webhook delivery header aliases — webhook deliveries now send only the canonical X-GridWonk-Event, X-GridWonk-Event-Id, X-GridWonk-Timestamp, and X-GridWonk-Signature headers. The X-GridBoost-Event, X-GridBoost-Event-Id, X-GridBoost-Timestamp, and X-GridBoost-Signature aliases, which had carried identical values during the rebrand transition, are no longer sent. Verified safe to remove: no webhook subscription has ever been created on the platform, so no delivery consumer could depend on them. The MCP X-GridBoost-Client-User-Id and X-GridBoost-Delegation-Token request headers and the legacy gridboost:// resource-URI scheme are unaffected and still accepted.

AddedCopy Anchor Link

• Hosted MCP partner packet tools — Nine hosted MCP tools now bind the existing packet intake, safe status, applicant document/text, review, workflow, and utility screening cores. partner.read and partner.write are enforced per tool in both discovery and dispatch; scoped sessions pin their exact scope set, broad keys cannot see packet tools, scoped tokens cannot see broad tools/resources/prompts, delegated-user membership and document visibility are re-proved, and unexpected internal errors stay server-side. Human Confirm/Correct role decisions remain off the model-facing MCP surface. No migration, rollout flag, or new processing system.
• Partner packet SDK, CLI, and docs surfaces — Ten @gridboost/sdk methods (createPacketIntake … getPacketScreeningStatus) and the gridboost packets CLI group (intake create/finalize/status, documents list/text/set-role, review start/get, status, screening) bind the partner packet REST lane, with getOAuthToken(expiresIn, scope) minting the required partner-scoped tokens. The initial July release deliberately withheld hosted MCP packet tools until the gateway gained per-tool scope enforcement; the newer hosted-MCP entry above records that follow-up. New public docs page api/packets plus CLI/MCP integration docs.
• Partner packet write API — Four partner-scoped write endpoints under /api/v1/packets/* (partner.write tokens only): Storage-native intake create (server-selected signed/TUS upload authorization, idempotencyKey deduplication, server-derived applicant org, cohort + editable-stage + write-authorization re-proof in the service transaction), intake finalize (object-existence proof, CAS idempotent, durable pipeline start), confirm/correct document content role (the console's exact locked write core: PR3.0a lock protocol, transaction-current write-access proof, artifact-pinned classification with stale-suggestion 409, append-only accept-vs-correct decision lineage), and packet review start (supported-utility check, fail-closed duplicate-spend guard with automatic-run reuse, 50-per-hour cap per user+organization). Writes are confined to the key organization (an org-A key cannot upload into org-B packets through a shared key creator); the review start is applicant-lane only and re-applies the console's per-document visibility policy so colleagues' private documents never enter a partner-started review; internal failure detail never crosses the boundary (generic 502). The console actions and partner routes execute one shared write core; consultant keys act with the granting organization's context, mirroring console granted sessions.
• Partner packet read API — Six partner-scoped read endpoints under /api/v1/packets/* (partner.read tokens only): intake status projection (confined to the key organization's own reachable submissions), sanitized OCR text + coordinates, the applicant-lane packet document list with classifier suggestions (applicant org and applicant-issued grantees only, with the console's exact per-document visibility policy applied), review-run detail with the cited deficiency report (access re-proved before any report bytes are read), canonical workflow status + immutable package list, and the utility-only package-bound screening status (UTILITY_APPLICATIONS_V2 cohort respected; read-only — adjudication stays in the console). Every endpoint reuses the exact console service cores and authorization predicates (org ownership, organization-access grants incl. applicant-org parity, resolver-verified version/package context), re-proves the key creator's membership per request, and collapses every refusal — including denials — to one anti-enumeration 404. No raw originals, signed storage references, service descriptors, or request-selectable resolver contexts are exposed.
• Partner access-token scopes — POST /api/v1/oauth/token now honors an explicitly requested scope parameter (partner.read, partner.write), embedding it as a signed claim; unknown scopes fail with invalid_scope instead of being silently dropped (the historically advertised api:read/api:write values stay accepted as no-ops). Confinement is two-way: partner routes refuse raw API keys and scope-less tokens, and ordinary non-partner routes refuse partner-scoped tokens — so a scoped token is strictly narrower than its key. Partner routes re-verify the key creator's active organization membership on every request by default, partner-scoped tokens are capped at 1 hour, and partner-route denials consume the per-key rate limit. The initial capability declaration kept hosted MCP excluded pending per-tool enforcement; that prerequisite is now satisfied by the hosted-MCP entry above. Legacy scope-less token exchange is byte-compatible.
• Applicant-packet mutation protocol — Submit, resubmit, link, attach, delete, role assignment, exact-content hydration, and remediation export writers now use one transaction and a canonical submission → link → document → version → package lock order with deterministic two-connection race proof.
• Applicant-document database write floor — Added actor-bound RLS policies, restricted direct authenticated update columns, database-stamped role audit fields, and ON DELETE RESTRICT for linked applicant documents. Production activation requires the separately applied 20260714150000_packet_document_write_access_floor.sql migration.
• Expanded utility-published procedure index — As of July 14, GridWonk had indexed 2,913 unique utility-published documents across 686 utilities. Indexed means found and stored; that indexed corpus had not been human-reviewed.

ChangedCopy Anchor Link

• Legacy validation creation surfaces retired — New site-control requirements, compliance, deficiency-location, and report-generation jobs can no longer be created through REST, agent execution, CLI, SDK, or the local MCP connector. Historical jobs remain readable, and packet intake Review is the supported deterministic replacement.
• Existing-document replacement safety — Exact-content hydration remains available, while byte-changing replacement returns HTTP 409 until centralized generation safety covers all asynchronous writers and current-result readers.
• Remediation source identity — Export creation pins document ID, content hash, and version; stale completion or promotion now fails atomically instead of using newer source identity or attaching an old artifact.
• Applicant-packet vocabulary and access boundary — Canonical packet roles and eight interconnection phases now fail closed across packet shapes and requirements, and applicant-packet reads and mutations are exposed through the domains/applicant-packets boundary. This is contract and access-layer work; it does not claim the later storage, UI, or model cutovers are complete.

Unreleased — June 2026Copy Anchor Link

AddedCopy Anchor Link

• NES interconnection deficiency detectors — Prototype detectors with an end-to-end Nashville Electric Service demo, including single-line-diagram graph extraction promoted to a vote-reconciled electrical-detector graph and canonical IEEE/NEC vocabulary.
• Packet prescreening (UI-first prototype) — New "Packet prescreen" tab in the utility workspace that previews missing-document and cross-document inconsistency checks before engineering review (illustrative, synthetic data). Added as a planned pipeline capability, bringing the manifest to 50 capabilities.
• Site-plan completeness analyzer — Promoted the NES site-plan prototype into the ADR-078 analyzer platform with an operator admin upload route, per-user rate limiting, and the planned analyze-site-plan capability.
• Milestone invoicing toolkit — /invoice skill plus the invoicing runbook and milestone-tracker guidance for milestone draws.
• React Doctor zero-warning operations — Added the post-zero internal runbook, report-only weekly full scan, changed-file regression guidance, ledger hygiene workflow, and attribution expectations for future React/Next/code-quality cleanups.
• Admin Operations surface — Added a platform-admin-only Admin > Operations tab for code quality, CI health, workflow checks, docs freshness, surface QA, and human-gated maintenance links.

FixedCopy Anchor Link

• Admin org access grants — Allow regranting previously revoked organization access and updating existing grants from the grant form.

ChangedCopy Anchor Link

• GridWonk brand + domain migration — Public app, docs, and marketing copy moved to gridwonk.com; legacy hosts now 301-redirect to it. Webhook deliveries send the X-GridWonk-Event, X-GridWonk-Event-Id, X-GridWonk-Timestamp, and X-GridWonk-Signature headers, with the prior X-GridBoost-Event, X-GridBoost-Event-Id, X-GridBoost-Timestamp, and X-GridBoost-Signature names kept as deprecated transition aliases; MCP accepts X-GridWonk-Client-User-Id and X-GridWonk-Delegation-Token, with X-GridBoost-Client-User-Id and X-GridBoost-Delegation-Token still accepted. Package scopes, GRIDBOOST_API_KEY, and legacy gridboost:// resource URIs remain compatibility identifiers, but legacy gb_live_ and gb_test_ API keys are no longer accepted; use gw_live_ or gw_test_ keys.
• Post-zero source of truth — Clarified that fresh React Doctor scan summaries after active ledger matching are the current source of truth; historical triage JSONL rows remain worklist evidence and may lag current scanner output.
• Capability manifest count refreshed — Parity checks now report 52 capabilities, 13 chatbot tools, 22 local stdio package tools, 22 admin MCP tools, 19 hosted public gateway tools, 3 resources, 1 resource template, 2 prompts, and 177 REST API routes.

Unreleased — May 2026Copy Anchor Link

AddedCopy Anchor Link

• Shared submission access model — Clarified and documented the current multi-org lifecycle model: one organizations table with four org types, shared application_submissions rows using utility ownership plus developer applicant linkage, and consultant participation through organization_access_grants
• Project-first submit/resubmit lifecycle proof — Added the canonical architecture/docs story for current project state, immutable submission packages, utility screening, notices, revise/resubmit flow, and the browser-backed lifecycle proof/CI workflow that validates it
• PowerClerk status boundary docs — Documented the coexistence rule that PowerClerk status remains external provider state while GridWonk keeps canonical internal submission and review workflow semantics
• Project-first console workflow — Validation/results now require a selected project, while procedure documents, requirements, analytics, and draft uploads can remain projectless research.
• Procedure pipeline assess/update split — assess.ts now produces proposed artifacts for human review before update.ts --approve applies changes.
• Docs freshness contract runner hardening — The contract and skills layout validation now use a local TSX launcher that preserves Node 20.0+ compatibility while avoiding npx package resolution and tsx CLI IPC issues on newer Node runtimes.
• Canonical Capability Manifest contract enforcement — CAPABILITY_MANIFEST now tracks 49 capabilities across chatbot, public MCP, admin MCP, CLI, REST API, and SDK bindings, with derived surface identifiers for .well-known, admin API, UI, and docs-facing projections.
• Shared MCP tool definitions — Public MCP gateway, local @gridboost/mcp-server, and /.well-known/mcp.json now derive tool metadata from shared definitions instead of hand-maintained copies.
• Capability contract gate — npm run capabilities:contracts validates manifest uniqueness, public/admin MCP parity, .well-known discovery parity, REST route coverage, schema/description drift, CLI command bindings, SDK method bindings, UI/admin metadata, docs guardrails, and workflow guardrails.
• Admin chatbot settings metadata — The admin tool-settings API now reads capability-backed metadata so risk labels and permission groups stay aligned with tool contracts.
• Capability surface delta report — npm run capabilities:surface-report writes JSON and Markdown reports for CLI, SDK, UI/admin, docs, and derived surface deltas.

ChangedCopy Anchor Link

• Capability manifest count refreshed — Parity checks now report 49 capabilities, 13 chatbot tools, 22 local stdio package tools, 22 admin MCP tools, 19 hosted public gateway tools, 3 resources, 1 resource template, 2 prompts, and 171 REST API routes.
• Hosted MCP semantics clarified — The manifest mcpServer surface now means the hosted /api/v1/mcp gateway. Local stdio connector helpers such as assist, upload_document, and validate_document stay documented as @gridboost/mcp-server REST wrappers instead of public remote MCP tools.
• Discovery method sync — Procedure data sync now tracks discoveryMethod / discovery_method consistently between compiled artifacts and DB-facing update keys.
• Legacy console cron path retired — Console orchestration remains on Vercel Workflow/Queues; legacy cron processors for document notification, optimization dispatch, and webhook retry draining are no longer the active execution path.
• MCP remains a consumer surface, not the canonical owner. The manifest in lib/capabilities/manifest.ts owns capability identity and surface availability, while MCP adapters project that contract into protocol-specific tool catalogs.
• Documentation drift detection now tracks the capability manifest, shared MCP definitions, local MCP package tools, parity checker, surface report, repo instructions, and capability-alignment skill so capability docs are flagged when contract code changes.

v1.2.1 — March–April 2026Copy Anchor Link

AddedCopy Anchor Link

• Capability Manifest — Canonical registry (lib/capabilities/manifest.ts) tracking customer-facing capabilities across chatbot, MCP, CLI, API, SDK, admin, UI, metadata, and docs surfaces with CI parity check script
• Expanded chatbot tools — Added list_utilities, match_utility, search_queue, get_queue_stats to both web console and Slack chatbot via shared common-tools server
• MCP discovery catalog fix — .well-known/mcp.json expanded from 9 to 13 tools (added assist, chat, upload_document, validate_document); TOOLS metadata array synchronized
• Document Upload REST API — POST /api/v1/documents/upload with utility resolution and org-scoped storage; SDK upload client and CLI command
• AX Optimization Workflow Migration — Durable Vercel Workflow execution for prompt optimization with three-tier dispatch (Workflow / Queue / Inline)
• CLI Session-Backed Mutation Parity — Full write mutation coverage: admin users, orgs, chatbot settings, change subscriptions, monitoring
• CLI MCP/Chatbot Connectivity — Admin MCP route integration and expanded chatbot admin commands
• Workflow-backed console pipeline orchestration — Producer-safe migration for document digitization/compliance pipeline entry points with rollback-safe execution ownership
• Queue-backed eval dispatch — Durable eval-runs topic dispatch with idempotent send, terminal guards, and retry-exhaustion failure handling
• 5 new MCP gateway tools — query_deficiency_reports, get_job_status, search_queue, list_utilities, get_queue_stats
• Utilities List endpoint — GET /api/v1/utilities/list with state, type, query filters and pagination
• Multi-layer bot detection — Browser fingerprinting, behavioral signals, and IP reputation scoring at auth callback with suspicious signup detection cron
• Muni/coop distribution IX discovery — Claude-dispatch pipeline for municipal and cooperative utility interconnection procedures; the release-time snapshot stored 1,057 documents from 464 utilities. See the current Unreleased entry for the later indexed-corpus total.
• Platform threat model — Comprehensive security threat model documentation
• React View Transitions — Polished tab switching and navigation animations in the console using React's View Transition API
• Feedback-to-eval sync pipeline — Expert review feedback automatically converted to benchmark test cases; cron-triggered with auto-enqueue of eval runs
• Standalone CLI binary — Single-file gridboost binary via bun compile with automated GitHub Actions release workflow
• Slack bot OAuth + real-user linking — Complete OAuth install flow, workspace-to-org mapping, Slack user-to-GridBoost account linking
• Short-form expansion phase 2 — Playbook execution, shared jurisdiction module, validator completion (5/5), research gaps pipeline
• Security gating — Auth-gated partner discovery surfaces; package publish lifecycle workflow

ChangedCopy Anchor Link

• Cron-to-Vercel-Queues migration complete for all async dispatch (evals, optimization, webhooks, notifications, feedback)
• Chatbot core extracted to shared pipeline (lib/chat/chatbot-core.ts) with thin route adapters
• Async job ownership uses explicit execution metadata to prevent cron/workflow contention
• Drizzle schema synced with live database; rebaselined snapshot v4
• Optimization pipeline execution inlined for clarity; queue test rewritten
• 26 code quality findings resolved across auth, eval, AX, CLI, and pipeline modules
• API validation and CLI auth wrappers unified across v1 endpoints
• ix_procedure_documents.region migrated to state (NOT NULL)
• React best practices applied to console validation, documents, and utility views

FixedCopy Anchor Link

• API hardening: jobs reads, upload utility resolution, compiled utility catalog bundling
• SDK upload client hardened with retry logic
• Jobs.mdx duplicate content block removed
• Corrected compliance metadata key mismatch (capacityMw -> projectCapacityMw)
• Security hardening sweep (12 PRs) — Admin RLS, document archive access, SSRF protection, org membership RLS, credential cleanup, admin auth enforcement, chat admin flag derivation, Slack installer fallback blocking
• Pipeline fixes — CAISO/ERCOT data corruption, Southern Company OASIS override URL, artifact merge bug
• SEO: unblocked _next/static/ in robots.txt for Google rendering
• Auth mismatch on v1/openapi redirect path
• Slack callback jsdom import crash; admin Add to Slack error handling; DM reply identity and thread session fixes
• Chatbot requirementText display and requirements query spec field
• CLI structured JSON error preservation for SDK fallbacks
• CI: publish OOM fix, MCP server build heap increase

v1.1.0 — February 2026Copy Anchor Link

AddedCopy Anchor Link

• External API v1 — Full REST API for programmatic access, including agent execution, document validation, async job management with SSE streaming, requirements listing, and webhook CRUD with retry logic
• API key authentication — HMAC-SHA256 key-based auth with per-key rate limiting and organization scoping
• Access grants — Cross-organization grant model for consultant access with project-level scoping, expiration dates, and soft-delete revocation
• Consultant access hub — UI for managing grants and switching between client organizations
• Change monitoring pipeline — Automated detection of utility requirement changes with webhook notifications, email alerts, and dashboard integration
• Document visibility controls — Per-document access settings with org-level defaults and document-level overrides
• Email notifications — Branded templates for change alerts, organization invitations, weekly digests, and welcome emails
• Claude 4.6 model support — Opus 4.6 and Sonnet 4.6 with adaptive thinking and effort parameter control
• Chatbot memory resume — Conversation continuity across sessions with org-type-aware content

ChangedCopy Anchor Link

• Nine new database migrations for grants, webhooks, audit logging, change monitoring, and document visibility
• Security hardening with SSRF prevention, path traversal protection, and RLS gap closures
• Enhanced procedures discovery agent with municipal web search support
• Org-aware tool allowlists for the chatbot agent

FixedCopy Anchor Link

• E2E test stabilization for console discovery, PDF upload, and integration tests
• Multiple rounds of review remediation across gates 1 through 5

---

v1.0.6 — February 2026Copy Anchor Link

AddedCopy Anchor Link

• Utility workflow management — Complete end-to-end utility workflow with multi-organization architecture supporting four org types (utility, developer, consultant, gridboost)
• Application intake — Batch upload and automated screening pipeline for interconnection applications
• Deficiency notice system — Email delivery with remediation workflow and developer acknowledgment
• Realtime updates — Live application status synchronization via Supabase realtime subscriptions

ChangedCopy Anchor Link

• Foreign key cascade prevention (6 keys changed from CASCADE to RESTRICT)
• Enhanced RLS policies with applicant visibility for cross-org access
• Updated multi-org architecture documentation

FixedCopy Anchor Link

• All 31 security review findings resolved (3 high, 8 medium, 11 low, 9 info)
• SQL injection prevention, rate limiting, TOCTOU race condition prevention, and email header injection protection
• 992 tests passing with expanded utility workflow coverage

---

v1.0.4 — February 2026Copy Anchor Link

AddedCopy Anchor Link

• Admin organization management — Organization listing with filtering, search, detail views, and member management
• User impersonation — Admin support workflow for debugging user-specific issues with full audit trail

ChangedCopy Anchor Link

• Strengthened multi-entity access controls and organization scoping
• Standardized admin table components and UI patterns

---

v1.0.3 — February 2026Copy Anchor Link

AddedCopy Anchor Link

• Skills infrastructure — Community skill integration with security-focused review tools
• Evaluation bridge — Automated benchmark result import to admin performance dashboard
• Slack export automation — Direct API access with rate limiting, pagination, and incremental export

ChangedCopy Anchor Link

• Database schema split from monolithic file into 9 domain-specific modules
• Dropped 34 unused indexes and added 3 FK covering indexes (34% reduction)
• Resolved 14 RLS multiple permissive policy warnings

---

v1.0.1 — January 2026Copy Anchor Link

AddedCopy Anchor Link

• Chatbot settings dashboard — Admin controls for MCP server management, tool permissions, and configuration presets
• Gemini model support — Google Gemini integration with task-based model routing
• Dynamic MCP server loading — Intelligent server selection based on query classification

ChangedCopy Anchor Link

• Digitization review tabs load 97% faster with lazy loading
• Improved chatbot query classification for better tool routing

---

v0.20.0 — December 2025Copy Anchor Link

AddedCopy Anchor Link

• EIA-861 canonical data source — Authoritative utility database with 1,329 utilities and data quality scoring
• Municipal utility discovery — Extended procedures discovery to city-owned and district-owned utilities
• Realtime resilience — Auto-reconnection with exponential backoff, subscription gap bridging, and network recovery
• Utility state resolution — Centralized helper resolving 92% of utilities to their correct regulatory jurisdiction

ChangedCopy Anchor Link

• Enhanced procedures discovery agent for both IOU and municipal utilities
• Restructured utility data model with EIA-861 as the canonical source

FixedCopy Anchor Link

• Resolved "No state specified for compliance job" errors for single-state utilities
• Fixed race conditions in realtime subscriptions where early events were missed

---

v0.19.0 — December 2025Copy Anchor Link

AddedCopy Anchor Link

• Remediation agent — Interactive deficiency remediation with amendment suggestions, form auto-fill, and real-time chat guidance
• Deficiency location agent — Vision-powered PDF analysis with bounding box detection for precise deficiency positioning
• Report generation agent — Automated compliance scorecards and annotated PDFs using Python and PyMuPDF
• Console workspace — Professional "Command Center" interface with tab-based navigation, URL state management, and cross-device preference sync
• E2E testing infrastructure — Playwright-based testing for console workflows, PDF upload, and realtime subscriptions
• User approval system — Email-based access control for the initial rollout with admin approval dashboard
• GridBoost branding — Updated all auth pages and reports with GridBoost identity