6e082ce58f
- SEC-05: Fail fast if SECRET_KEY is default 'change-me-in-production' - SEC-06: CORS allow_credentials=False (Bearer tokens don't need it) - SEC-08: Input validation on auth schemas (min/max length, username pattern) - SEC-10: .dockerignore files (root, backend, mcp-connector) - SEC-11: Hardcode ALGORITHM='HS256' as constant, remove from settings - CQ-01: Gate crawl scheduler on CRAWL_ENABLED env var (default false) - OS-02: CONTRIBUTING.md - OS-03: CHANGELOG.md with v1.0.0 entry - setup.ps1: Add API_TOKEN generation (Windows parity with setup.sh)
27 lines
956 B
Markdown
27 lines
956 B
Markdown
# Changelog
|
|
|
|
All notable changes to Diligence are documented here.
|
|
|
|
## [1.0.0] — 2026-06-18
|
|
|
|
Initial open-source release.
|
|
|
|
### Features
|
|
- Points economy with daily gate, weekly targets, weekly reset
|
|
- Science-based onboarding (PAR-Q+, TTM, BREQ-2 motivation profiling)
|
|
- Activity logging (manual + Strava OAuth + Polar OAuth sync)
|
|
- Food logging with Open Food Facts barcode scanning + USDA FoodData Central
|
|
- 90-day structured program tracking
|
|
- Configurable reward shop
|
|
- In-app support chat with Telegram notifications
|
|
- 14-tool MCP connector for AI agent integration
|
|
- Meal plan system with compliance tracking
|
|
- Dynamic integration configuration (11 providers)
|
|
- B2A discovery layer (llms.txt, agent-card.json, SKILL.md)
|
|
|
|
### Security
|
|
- Fernet-encrypted credential storage (HKDF key derivation)
|
|
- Signed JWT OAuth state parameters
|
|
- MCP connector authentication via API_TOKEN
|
|
- First-user auto-admin grant
|
|
- Traceback suppression in error responses
|