CHANGELOG.md

Changelog

Unreleased

• Sign in with a passkey on Trade's own origin (WebAuthn Related Origin Requests). The signed-out account line offers
  "Use a passkey" only after PublicKeyCredential.getClientCapabilities() reports relatedOrigins; the browser
  ceremony is brokered by POST /auth/passkey/options and /verify (SDK 0.151.0) with Trade's OAuth client, and
  Network verifies the exact origin and RP ID. Browsers without support and people without a key keep the ordinary
  OpenVibe sign-in. server/app.js (relatedPasskeys), server/render/layout.js, public/js/passkey-signin.js.

• Worker-written AI briefs ask OpenVibe.AI for the batch latency class: the pending run id and the exact inputs live in trade_ai_brief_jobs (migration 0009), the worker collects the answer on a later tick, a run id is written once, and a refused or expired batch falls back to background once; a reader's ask stays synchronous. test/ai-briefs.test.js.
• The instrument page carries the market-research outcomes the data backs: every observation shows the source URL and the source's own reference (source_ref), when the value was true, when it was fetched, and a stale verdict with the value's max_age_sec and a plain reason; a "Free, always" line; one-tap watchlist (new POST /watchlists/watch) and new-filing alert actions, with the configured limits stated instead of a no-cap claim; price rows are labelled source-stated, not live, and no delay is invented. Observation rows are compact on phones, with the long provenance in a closed "Source details" fold; the source table uses the OpenVibe Kit and stacks on phones. test/market-outcomes.test.js.
• The front page is curated (server/render/home.js): a company search and the numbers beside the hero (companies, filings in 24 hours, filings recorded, companies with figures, AI briefs, currencies), then AI briefs as cards, euro reference rates as cards with the change from the same source, new 10-K/10-Q reports, the week's filings by form in plain words, the newest filings, companies with something new, what is here and six questions (FAQPage JSON-LD). The instruments list moved to /instruments (301 from /?page=N); /filings[?form=] is new; /sitemaps/pages.xml lists /, /instruments, /filings and /sources (the sitemap listed nothing before: instrument pages stay noindex until a person reviews their context). The navbar reads Companies, Filings, Sources, Watchlists.
• Account export and deletion (ADR-033) through server/domain/account-data.js over openvibe-sdk/account-data (SDK v0.37.0, was v0.35.0):
• Deleted: watchlists, alert rules (with their deliveries) and drafts.
• Authorless: contributed instruments, aliases, purges, context revisions and hand-recorded observations.
• Kept: reviews.
• Migrations: 0003_account_data.sql adds account_data_events. 0004_account_erasure.sql lets only the erasure transaction take a person's id out of the append-only revisions and observations.
• The two subscriptions are created at boot. test/account-data.test.js.
• openvibe-contracts moves to v0.97.0 (pin, lockfile and node_modules). All twelve trade.* ids are now defined by the release, so server/auth/capabilities.js drops its local fallback for proposed ids and sends every check through the library's grant rule; test/capabilities.test.js pins that every guarded id is defined and that exact, prefix, denied and unknown ids answer as capabilities.check() does. server/index.js moves its shutdown onto openvibe-sdk/service's gracefulStop (drain with Connection: close, then the worker, the outbox and the store; SIGTERM/SIGINT replace the hand-rolled handlers and timer), pinned by the spawn-SIGTERM check in test/service-kit.test.js. README and STATUS.json name v0.97.0 and the pinned v0.26.0 SDK.
• Every page is rendered through openvibe-publishing/layout (v1.2.0, on openvibe-shared/shell v2.6.0): the head, the Frame, the noscript navigation, the footer and its init come from the shared document; Trade keeps its site stylesheet, the disclaimers, the account bar and the "Recently shipped" line. Pins openvibe-shared v2.6.0 and openvibe-publishing v1.2.0.