Changelog

force Accept-Language: en on recording/grounding contexts

allowlist auth-session broker route + guardrail for internal routes

portal-brokered login session — defeat cal.com datacenter-IP block

API-first auth prelude — NextAuth handshake before form-driving

testids page + actions re-materialize the clone on cold starts

'Test stored credentials' — server-side NextAuth handshake from the vault

completed steps are revisitable — remove forward-bounces

surface the page's visible error text on failed login

auth-prelude fill() fallback + fail-fast on configured-login failure

run-preflight allows partial approval; stepper layout collapse

entry-route matching understands dynamic routes

partial workflow approval unlocks launch

self-serve credential vault — customers enter test-account credentials in the portal

salvage off-shape agent replies + one corrective retry

monorepo target detection — cal.com Clone & scan unblock

audit response — kill cross-tenant + hot-path bugs (28 findings)

fresh-workspace onboarding on the shared deploy

per-workspace marketing entitlement + digest sweep

tenant-true changelog reads + workspace-stamped write paths

multitenancy sweep — session workspace replaces env binding

multitenancy identity — workspace on users, sessions, signup, invites

help-center card/list view toggle

changelog-aware digest kits on operator cadences

sidebar brand mark is the tilde — same mark as favicon + marketing site

Help Center sidebar shows its article count

help-center, blog queue, feedback read DB-backed content

repackage paywall — docs suite included, Marketing is the upgrade

bind update-changelog to the Production environment

DB-backed release notes — merges become rows, not PRs

self-healing bot — catch-up append on one reusable branch

moment-cited AI answers — help search cites seconds in recordings

mobile operator shell — off-canvas sidebar, phone stances

pin the execution receipt to a commit sha

mobile article reader — drawer catalog, in-player karaoke caption, step chips

changelog loader works on serverless — static JSON import with fs fallback

per-feature launch kits with an elite-strategy generator (X, LinkedIn, email)

system-ffmpeg override on CI + video-stream duration gate

tail article push reuses the orchestrator run id — stop shadowing artifact rows

narration-derived step headings — no selector syntax in customer-facing docs

narrate the workflow that ran — approval is the single artifact source

grounding manifest preserves workflow step indices — the desync root cause

scene-anchored timing base + CFR compose input, SSIM-verified

frame-accurate trim via output seeking; opt-in raw recording keep

end-anchor single-pass recording t0; stop karaoke page-yank

allow the public Vercel Blob host in CSP — article media was silently blocked

grounding goal gate — judge the final frame before approving

defer seed-provided text targets to post-seed grounding

reset_endpoint dispatch input — clean-seed the target before batches

empty-string QUILL_WORKSPACE_ID no longer dispatches workspace ""

four workflow fixes from the 2026-07-06 invoices_create run

/evidence hero v2 — conversion-first rewrite ahead of homepage promotion

fold the original homepage's keeper sections into /evidence

/evidence — draft homepage rebuilt around the real value prop

production wiring — Postgres dual-write, pipeline step, published-only public gate, request-body redaction

ship the category catalog to production — help-center sidebar groups again

multi-tenant hosted publishing — host-resolved tenants on the docs deploy

visual polish pass — live playback UI, timeline states, help-center card grid

karaoke spotlight drift — manifest aligned_segments as single source of truth

make completed stepper chips clickable

opt-in regex PII auto-mask layer + demo-workspace guidance

conversation-prefix cache breakpoints for multi-turn loops

restore live-demo CTAs env-gated; move ship-gate ops to deploy checklist

auth wizard field auto-detect + login dry-run

Settings → Deploy Tokens — encrypted portal-managed pipeline credentials

onboarding-state write guard + run-step config repair (target URL ask/probe, reset-endpoint contract) (#673)

authenticated + safe-click discovery crawl in the discover step

runner grounds the APPROVED workflow at preflight (fail fast + grounding_drift proposal)

download-aware grounding + label-aware autofill values

disk-store path re-resolution + shared EMPTY arrays; webhook rotation dual-sign overlap; wire article.published

contenteditable + iframe capture — frame-aware recording and replay end to end

hosted capture verification worker — GHA-dispatched replay over the Postgres/Blob store

select_option + set_checked actions — native form control capture & replay

hosted capture support — Postgres device tokens, Blob capture store, chunked uploads

goal post-condition gate — veto publishes that didn't demonstrate the feature

capture SPA navigations + screenshot-evidence races; richer role selectors

light up video/audio/annotations on production help center

trim-then-verify for agentic workflows + intent-vs-parameter granularity rule in discovery

record selectors that RESOLVE, not selectors that describe — run-6 jobs_create postmortem

run-5 postmortem — token-safe seed rebinding, entry navigation for agentic workflows

observe unlabeled combobox triggers by text; drop backdrop-covered elements

run-3 postmortem — Radix option-click commit, locator-less mark handling, batch-start reset, decider model override

search the full catalog for prerequisite create flows

prompt caching + spend telemetry + outcomes ledger with selective re-runs

WS-E form completion sees + drives Radix comboboxes

per-feature ground watchdog — one wedged feature can no longer stall the batch

logged-out auth-flow demo path (PR6) (#624)

wire seeder into CI + thread seeded-record identity (PR5)

winning pipeline config reachable from the portal trigger (PR4)

agentic fallback + seeding in single-pass, trim recordings to kept-step windows

Set-of-Marks discipline — capped in-viewport-first world, off-screen flags, coord guard

form perception + hands — options/disabled visibility, select primitive, verified typing

object-store media publish + multi-tenant host-resolution

hybrid click (precise selector when unambiguous) — stop closing modals

clear the field before coordinate-typing (unblocks the Create-Form family)

stop burning budget on a successful-but-non-advancing action

click the SPECIFIC marked element by coordinate (kills ambiguous-selector timeouts)

wait + press actions to crack "repeated action failures" + history diagnostics

raise step budget + follow new tabs (deep chains + cross-context)

give the agent scroll + hover — attack "repeated action failures"

a fumbled decision is a retry, not a feature-killer

self-seed missing data + fix the vision JSON-truncation regression

give the executor eyes — Set-of-Marks screenshot per step

goal-directed agentic executor — attack the execution ceiling

seed via the real planned create-feature workflows (not heuristic synthesis)

seed-as-setup — create prerequisites off-camera, demo references them

feed white-box data-model facts into the planner

white-box data-model comprehension (Prisma → entity DAG)

hover table rows to reveal row-gated actions (Edit/Delete)

form-completion recovery — enable disabled-submit create flows

floor substring match at 3 chars — kill the name="T" hijack

resolves() must assert ACTIONABILITY, not just visibility

single-pass capture + persistent locator cache (classes 3, stability)

reflection & bounded recovery search (classes 1 & 2)

vision Set-of-Marks grounding fallback (classes 1 & 4)

force-click fallback for resolved-but-unactionable controls

multi-strategy repair — narration intent + submit-button fallback

pass observe snapshot to page.evaluate as a STRING (was returning [])

skip optional ungroundable steps, settle after clicks, diagnostics

live verify-and-repair loop — author by doing (pillar 1)

capture form-field identity → real field selectors in the menu (source-v8)

selector-repair matcher (live verify-and-repair core)

verified locator synthesis + authoritative planner menu

regenerate + re-approve stale workflows with grounded planner

rebase auth loginUrl origin onto the supplied target URL

let onboarded operators reconnect a dead tunnel URL

ground click/type text selectors against live DOM (source-v6)

generate one launch-tier post per article, DB-backed like #526

articles open on the docs site + ground testids against the live DOM

stop docs-site 500s + ground planner with live-DOM crawl (PR-B)

docs site reads pipeline articles from Postgres, not just disk

ground source-mode selectors, reject invented testids

publish glob must use the workspace-namespaced articles path

wait for async SPA/NextAuth sign-in instead of reading url() once

type credentials character-by-character (React forms)

wait for hydration before submitting login form

orphaned auth fix + incremental upload + parallelism + 180m

fail loudly when 0 articles publish (don't lie success)

wire orchestrator to prod ledger + docs-URL fallback

consolidate /v1/workspaces dynamic slug — [ws] → [id]

fetch approved feature catalog from portal before run

PAT-fallback clone path when no GitHub App is installed

pre-fill connect form from OnboardingState

point pnpm/action-setup at quill/package.json

make Clone & scan idempotent on same GitHub URL

probe the pipeline dispatch token against GitHub

mirror "Approve all N workflows" CTA at the top

persist generated workflows to Postgres

whimsical quill-nib loader for LLM-paced steps

ensureRepoOnDisk before workflow generation

inline schema.sql for Vercel function bundle

bootstrap approvals schema lazily on first DB use

persist approved feature catalog in OnboardingState

raise default max_tokens 4096→16384, surface truncation

re-extract GitHub repo when Vercel /tmp is cold

extract tarball with `tar` npm package, not system binary

break the GitHub-private-repo catch-22

drop jargon from tunnel instruction copy

client pre-flight folder uploads at 4 MB (Vercel ceiling)

tighten Connect step copy + fix overflowing tunnel code block

emit og:image meta tag + allow OG/apple-icon through auth gate

brand favicon (~ tilde squiggle) + OG image for social previews

native OS folder upload — picker now reads YOUR machine, not Vercel's

inline folder picker for the Local-path tab

portal toggle, narration/docs-gen skipped awareness, persistent tunnel runbook, URL preflight

remove dead localhost CTAs from landing page

tunnel-localhost UX + safe-mode for no-staging operators

source-level PII mask via data-quill-mask init script

Layer 3c — onboarding integration for live discovery crawl

Layer 3b — logged-in browser crawler for live discovery

Layer 3a — agent accepts a LiveInventory input

Layer 2 — selective depth=2 walks + modal-host detection

surface interactive_text in the agent prompt (Layer 1c)

walker shallow-import-follow + interactive_text (Layer 1b)

wire backend routes into agent + SaaS-category prompt checklist + cap 40 → 60 (Layer 1 of feature-discovery-blind-spots)

wire run.completed / run.failed / drift.detected emit triggers

handle `press` action + add exhaustiveness check to approved-prefix executor

four UX bugs caught during Tier 5 activation

skip auth middleware on api.quilldocs.ai host

Tier 5 Group B (M4–M6) — public REST API webhooks + outbound delivery

M4 — webhooks core package (events, signing, retry, SSRF)

M3 — write endpoints, runs resource w/ run-id correlation, OpenAPI

M2 — /v1 read endpoints, token auth, rate limiting, Settings→API

M1 — framework/infra-agnostic primitives for the public API

silver-tier capture-grounded fallback article on verification failure

add `press` keyboard action to the WorkflowAction contract

surface scheduled replay + GitHub push-drift states

correct post-Tier-4 roadmap & CLI truth

unify pipeline orchestrator under the quill binary

record a correction — approve-over-existing via supersede proposal

scheduled verification replay as a drift probe + verifying-state crash recovery

production probe transport via GHA + HMAC-signed result channel

GitHub push webhook — push-driven clone refresh + citation drift probe

store-ready package + gated install CTAs (Tier-3 PR 5)

selector-citation grep + automatic drift proposals (Tier-3 PR 4)

private repos through CI + connection-aware preflight (Tier-3 PR 3)

repo picker, Settings → GitHub, workspace-token clones (Tier-3 PR 2)

encrypted token store + GitHub App OAuth flow (Tier-3 PR 1)

forward API key to source planner; plan for clean-state targets

schedule the dispatcher cron + last-sweep liveness

launch preflight, stage narration, article-reveal finale

role/name baseline on state-2 first approvals

auto-approve worker — probe/decider split + shadow mode (Approval Layer 6b/N)

operator approvals queue + first-approval route (Approval Layer 6a/N)

quill CLI for operator approvals (Approval Layer 5/N)

ledger preflight wires the gate shut (Approval Layer 4/4)

file backend + explicit-backend factory API + rejection memory (Approval Layer 3/4)

Postgres ledger + concurrency-safe writes (Approval Layer 2/4)

v1 integer-domain guard + live-a11y rule on auto-approve

canonical workflow hashing — single source of truth for ledger + runner (Approval Layer 1/4)

port portal's outputFileTracingExcludes (the real fix)

unbloat docs serverless functions by trimming transpilePackages

Browserbase runtime integration behind QUILL_USE_BROWSERBASE flag (Track A 5/N)

workflow content hash + approval verification (Track A 3/N)

Playwright trace.zip post-processing redactor (Track A 4/N)

action budget + URL path denylist (Track A 2/N)

Browserbase-backed session with route-layer egress allowlist

capture target URL per-workspace, not as deploy env

article ingestion — workflow → portal → /articles page

scope quill-pipeline run to Production environment

end-to-end production pipeline — URL connect, dispatch, artifacts

Round 3 — team invites + mailer queue → Neon

Round 2 — branding + auth-config → Neon

Round 1 — workspace meta, onboarding state, active pointer → Neon

swap users.json for Neon Postgres when DATABASE_URL is set

invite flow + mailer rebuild + entitlement gate (DR-PR15/16)

linear 6-step wizard — make every gate explicit

customer-auth flow — form-login config + runner handoff

re-run discovery without cache from the discover step

pipeline progress context — step N of M, elapsed time, feature 1 of 2

targetRepoRoot honors active-workspace pointer in dev

workspace-root .env.local loader for portal + docs site

GitHub direct-connect — clone via gh CLI from the wizard

target dev-server lifecycle for customer runs

testid codemod preview + apply in the wizard

pipeline UI shows live step progress + failure detail

Phase 2 source-based planner — generate workflows from route source code

per-workspace article isolation — genRoot scopes to <id> in dev, portal pins active workspace

honor operator-state — overlay DEMODEMON_TARGET_* env on config, filter by approved features

unstack overlapping Cinema mode + Expand all buttons

collapse .app-shell grid when sidebar is hidden (onboarding)

hide chrome (sidebar+header) during /onboarding + DEFERRED: GitHub direct-connect

user roles foundation — admin/user/read_only (DR-PR14)

onboarding step 0 (welcome + company name) + post-auth routing (DR-PR13)

per-user onboarded_at flag (DR-PR12 dogfood fix)

suppress hydration warning on <html> for theme-init (caught during DR-PR12 dogfood)

onboarding wizard step 3 — pipeline trigger + log streaming (DR-PR11)

onboarding wizard step 2 — discovery + review (DR-PR10)

onboarding wizard step 1 — connect repo (DR-PR9)

provision-workspace onboarding script (DR-PR8)

article catalog derived-index (DR-PR5)

email piping — composer, queue, inbound webhook (PR E)

AI answers with plan streaming

Help-center search now generates inline AI answers when you ask a question. Streams a 'Searching → Reading → Answering' plan before the tokens (the wait-tolerance trick from Perplexity), with inline citation chips that link to the source articles. Article result rows also gain a 96×54 video walkthrough thumbnail — the bespoke move competitors without recordings can't match.

• Inline AI answer above results when the query parses as a question
• Plan stream + token stream via Claude Haiku + Server-Sent Events
• Numbered [n] citation chips matched to a top source strip
• Video walkthrough thumbnails on every help-center result row

New: hero search on the help center

Big centered search bar at the top of /help-center with a Raycast-style live two-pane preview — results on the left, focused-result preview on the right, keyboard-driven scrub. Results are cross-surface: help center + dev docs + changelog + blog in one query so you get the complete picture in one shot.

• Big hero search input + popular-query chips
• Two-pane overlay: results left, live preview right
• Keyboard-driven (arrow keys, Enter, Esc)
• Cross-surface mosaic — one query spans all four content surfaces

Dark mode polish

Four readability sharpenings: success green reads as green instead of olive, cards visibly lift off the canvas, the top-light hint on cards is now visible, and the sidebar boundary is crisp without being aggressive.

Coffee-shop warm dark mode

Dark mode redesigned end-to-end with a warm, atmospheric palette that mirrors the cream light mode instead of fighting it. Surface ladder compressed to a 14-unit lightness band (lamplight on paper, not cave). Sidebar now LIGHTER than canvas — content recedes, chrome floats — per Notion/Things/Bear.

• Warm canvas `#1a1614`, Gruvbox cream text `#ebdbb2`
• Sidebar lifts above canvas (Notion/Things/Bear inversion)
• Status pills harmonize with warm bg (Gruvbox-bright family)
• Visible warm-brown borders so cards actually lift

Settings → Branding

New Settings page lets the operator pick a logo (PNG/JPEG/SVG), a color scheme (6 curated presets + custom hex), and a typography stack (4 curated stacks). Live preview pane on the right updates in real time. Changes cascade to the customer's docs site (apps/web) on next request.

• Logo upload to apps/web/public/branding
• Color presets: Quill Orange / Indigo / Forest / Cobalt / Crimson / Slate + Custom
• Typography: Modern Sans / Editorial Serif / Geometric / Humanist
• Live preview pane on the right

Premium polish: tighter radii + overshoot easing on lifts

Radius scale tightened to a Linear-adjacent ladder (6px workhorse). Article-card hover and changelog entry reveal use a new motion-expressive overshoot easing so the lift reads as 'yeah, here it is' instead of a mechanical slide.

Changelog: status pills now match the theme

ChangelogClient and the article-card video backgrounds use design tokens instead of hardcoded hex values, so the changelog status pills harmonize with the new light/dark themes automatically.

Theme toggle in the portal header

Three-icon toggle (Light · System · Dark) next to the search input. Default = system; explicit Light/Dark wins regardless of OS. Persists in localStorage; an inline FOUC guard sets the theme before React hydrates so the page never paints in the wrong mode.

Portal redesign: warm cream canvas, restrained status

Light-mode token redesign per the design-research synthesis. Warm cream canvas (`#faf8f4`, Notion-adjacent), white panels floating on it (Stripe pattern), warm near-black text with brown cast, status pairs in restrained Stripe-style colors.

• Cream canvas `#faf8f4` — not pure white
• Status pairs: success `#0f8b4e/#e6f5ec`, warning, error, info
• Tighter display tracking
• Whisper-soft Stripe-style shadows

Articles: grid + list view toggle

Two-button toggle on the Articles page lets the operator switch between the existing card grid and a new list/table view. Choice persists in localStorage. Every row is clickable; whole row navigates to the article.

Portal aesthetic now matches the marketing site

Portal color tokens swap from amber to brand orange. Active sidebar links gain a 2px orange left-stripe + soft orange-tinted background. Eyebrows adopt monospace + accent treatment. Same `#ff8c5e` everywhere from landing → auth → portal.

Customer-facing changelog

A first-class product surface: every merge to main becomes a beautiful changelog entry visible on the public docs site. Premium timeline rail that fills with scroll, velocity sparkline, expandable 'files changed' on each entry (the bespoke move), inline citation pills, and a 'Powered by Quill' footer.

• Public changelog at /changelog with timeline rail + velocity sparkline
• Operator manages entries in the portal under Authoring → Changelog
• Cross-surface marketing positioning: landing spotlight + stats section + pricing bullets

SSO buttons on the login page

GitHub / Google / Apple SSO buttons appear under a 'or continue with' divider on /login and /signup. Visual placeholders — the OAuth wiring follows in a later PR.

Crisper dark pages across the marketing site

Fixed a subtle cream tint that bled around the edges of dark pages in light-mode browsers. The portal's atmospheric styling now stays scoped to logged-in routes; marketing and auth pages are uniformly black to the edge.

New: How It Works page

A dedicated explainer that walks the full pipeline — from connecting your repo to drift detection on every push. Five steps, each with a visual mockup showing what Quill does at that stage.

• Point Quill at your repo with one command
• Watch the discovery engine map your features
• See three docs land from one source
• Review every change before it ships
• Drift detection catches stale docs automatically

Documentation menu in the nav

The marketing nav now has a hover-opened Documentation menu — Getting Started, Quill CLI, API Reference, Webhooks, and Changelog all reachable in one move. Reusable component so future menus drop in cleanly.

Premium Resources megamenu

Hover the Resources nav item and a two-column panel slides open — Explore (Startups, Enterprise, Migrate, OSS Program) and Use Cases (Help Center, Dev Docs, Blog, Knowledge Base). Glass-morphism panel, icon chips that glow on hover, animated arrows.

Pricing page

Three-tier pricing — Starter ($99/mo), Pro ($199/mo, most popular), and Enterprise (contact). Refactored the marketing chrome into a shared MarketingShell so future pages drop in without copying nav and footer.

Sign-out returns you home

Clicking Log out now lands you back on the marketing landing instead of the login form — the natural destination. Also restored the small 'made by a small team' tagline in the footer.

Bottom footer redesign

Mintlify-style 5-column footer — Explore, Resources, Documentation, Company, Legal — with social icons and a system-status pill. Cleanly responsive at 920px.

Center nav + Contact sales CTA

Top nav gained a center strip (Resources, Documentation, Customers, Pricing) and the right-side action pair became Log in + Contact sales — the standard B2B shape.

Portal sidebar reframe

The operator portal nav now groups by Surfaces (Help Center, Dev Docs, Blog), Authoring (Articles, Categories), Features, Backstage (Activity, Feedback), and Account (Settings, Log out). Mental-model match: what customers see vs what you ship vs the system under it.

Visible Sign Out button

Previously a tiny unlabeled square; now a prominent labeled button in the header so operators don't have to hunt for it.

Renamed: Quill

All marketing-facing surfaces now read 'Quill' instead of the codename. Repo internals keep the old name to avoid a churn-storm; only customer-facing strings flipped.

Authentication, rate limiting, remember-me

Iron-session cookies, bcrypt password hashing, and a 5-attempts-per-15-minutes rate limit on the login form. Remember-me extends sessions to 90 days when checked.

• Per-operator session cookies (iron-session, sealed)
• Bcrypt at 12 rounds for stored passwords
• Rate limit: 5 failed login attempts per 15 minutes per email
• Remember-me: 90-day session vs 24-hour default

Marketing landing page

The pitch in one page: hero with the loop (commit → detect → draft → review → ship), terminal demo, four pillars, proof card, FAQ, and a final connect-a-repo CTA. Built for the vibe-coder ICP.

Sign-up, login, password recovery

Full auth scaffold — accounts stored at ~/.config/quill/users.json (dev), bcrypt hashing, native HTML form submission with progressive enhancement. Works without JS.

Articles: insert manual steps

When the AI-generated walkthrough misses a step (or includes one that shouldn't be there), the operator can now insert their own steps inline between the auto-discovered ones. Manual steps survive re-runs.

Listen to articles

Every article now has a Listen button that opens a persistent audio bar — narration plays as you scroll. The bar stays sticky across nav, keeps playing when you switch articles within the same session.

Cinema mode for articles

Full-bleed scrollytelling layout — screenshots become hero panels, narration glides alongside, captions sync with the audio. Toggle on any article via the player chrome.

Citation hovers: see the moment

Hover any quoted text in an article and a small player pops up with the exact video clip it came from. The proof is one move away.