# Changelog

All notable changes to Veritas Kanban are documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [4.3.2] - 2026-05-16

### Added

- Added `pnpm validate:release` to verify workspace version alignment, required release files, the README version badge, changelog headings, built artifacts, optional GitHub tag/release state, and optional production Docker image builds.
- Added `.github/workflows/scheduled-qa.yml` so Playwright and k6 smoke/load checks can run on a scheduled cadence outside the fast pull request CI path.
- Added the full codebase audit report at `docs/CODEBASE-AUDIT-2026-05-16.md`, including completed remediation notes and linked follow-up issues for the remaining larger work.
- Added dedicated URL validation regression coverage for blocked localhost, private-network, and unsafe redirect webhook targets.

### Changed

- Bumped the release from `4.3.1` to `4.3.2` across the root, shared, server, web, CLI, and MCP package manifests.
- Updated the README version badge and MCP documentation footer for `4.3.2`.
- Expanded the root build script and CI artifact checks to include the CLI and MCP packages so release validation covers every published/runtime surface.
- Split heavy web panels, chat, board, command palette, and task-detail surfaces out of the initial Vite bundle, removing oversized chunk warnings from the production build.
- Centralized web view metadata and task-detail tab metadata to reduce navigation drift, feature-gate drift, and duplicated labels.
- Added a lint warning budget gate after reducing current warning debt from 728 to 714, making future lint debt increases visible in CI.
- Stabilized full-suite test execution by tightening async Codex provider assertions, isolating Docker path filesystem mocks, and giving slower jsdom/route-integration tests realistic timeouts.

### Fixed

- Hardened outbound webhook URL handling with shared validation, DNS/IP block checks, and redirect validation before webhook delivery.
- Fixed board drag reordering persistence, dependency-blocked task transitions, checkpoint clearing semantics, CLI/MCP version reporting, API envelope handling, and setup guidance found during the audit.
- Fixed Docker workspace dependency stages to include CLI and MCP package manifests before install/build steps.
- Fixed failure-alert, hook, policy, squad webhook, and transition hook services to use the hardened URL validation path consistently.

## [4.3.1] - 2026-05-11

### Security

- Restricted policy create, update, and delete routes to admin role only (#357).
- Restricted tool policy create, update, delete, and validation routes to admin role only (#355).
- Restricted agent permission level changes, permission field updates, and approval review to admin authority (#356).
- Restricted task-to-agent routing configuration updates to admin role only (#354).

### Changed

- Updated workspace package versions, README badge, and MCP README footer from `4.3.0` to `4.3.1`.

## [4.3.0] - 2026-05-09

### Added

- Veritas Cutover operating guide covering the authority model, HermesAgent roster, mandatory QA evidence gate, product/spec task template, research/revenue intake template, and Medik8 Cyprus-only task template.
- Agent Registry references for active and on-demand Veritas Cutover HermesAgent owners.
- Agent provider adapter contract for OpenClaw, Codex CLI, and Codex SDK start/stop/status/log/completion capabilities.
- Codex event mapping into activity, trace, token telemetry, and task deliverable surfaces.
- Mocked Codex JSONL fixture coverage for success, failure, malformed output, token usage, and file-change artifacts.

### Changed

- Updated workspace package versions and README badge from `4.2.5` to `4.3.0`.
- Updated Codex roadmap docs from v4.2 tracking language to v4.3 completion language.
- Bumped `zod` from v3 to v4.4.3 across the MCP, server, and web packages, including server schema compatibility updates.
- Bumped safe chore dependencies: `@typescript-eslint/*` to `8.59.2`, `express-rate-limit` to `8.5.0`, `hono` to `4.12.18`, `postcss` to `8.5.14`, and `shadcn` to `4.7.0`.
- Added dependency audit overrides for patched `fast-uri` and `ip-address` transitive versions.
- Created the `dependencies` and `github-actions` GitHub labels expected by Dependabot.

### Acknowledgements

- Thanks to @asperty567 for the Veritas Cutover issue set and operating direction.

## [4.2.5] - 2026-05-06

### Added

- Codex Settings health endpoint at `GET /api/settings/codex/health`.
- Server-side checks for Codex CLI installation, CLI version, `codex login status`, Codex SDK import availability, and Codex CLI/SDK/Cloud agent profile readiness.
- Settings Agents tab Codex Health panel with refresh, readiness badges, version/auth details, and actionable recommendations.
- Frontend API and hook support for Codex health checks.
- Route coverage for the Codex Settings health endpoint.

### Changed

- Updated workspace package versions and README badge from `4.2.4` to `4.2.5`.
- Documented richer Codex Settings health checks as implemented, completing the requested v4.2 patch train.

## [4.2.4] - 2026-05-06

### Added

- Codex review action for task branch diffs through `POST /api/diff/:taskId/codex-review`.
- Codex SDK review runner that executes in read-only sandbox mode, asks for structured JSON findings, and maps findings to Veritas review comments.
- Review summary/task comment persistence plus review decision metadata when review saving is enabled.
- Frontend API and React Query hook support for triggering Codex reviews.
- Route coverage for Codex review validation and service invocation.

### Changed

- Updated workspace package versions and README badge from `4.2.3` to `4.2.4`.
- Documented Codex review actions as implemented while richer Settings health checks remain next in the v4.2 patch train.

## [4.2.3] - 2026-05-06

### Added

- Workflow-engine Codex agent steps for workflow agents configured with Codex provider metadata or Codex agent naming.
- Codex SDK streaming execution inside workflow step runs, including worktree-aware execution, final response capture, and persisted step output files.
- Workflow session tracking for Codex thread IDs through `run.context._sessions`, enabling reuse-mode workflows to resume the same Codex thread.
- Unit coverage for Codex-backed workflow step execution.

### Changed

- Updated workspace package versions and README badge from `4.2.2` to `4.2.3`.
- Documented Workflow Codex steps as implemented while review actions and richer Settings checks remain next in the v4.2 patch train.

## [4.2.2] - 2026-05-06

### Added

- Codex Cloud delegation through GitHub issue, issue-comment, and PR-comment workflows.
- `POST /api/github/codex/delegate` for creating scoped `@codex` GitHub delegation prompts from Veritas tasks.
- Disabled-by-default `codex-cloud` agent profile and `codex-cloud` provider metadata support.
- Cloud delegation attempt metadata with `cloudUrl` and `cloudTarget` fields.
- Task comments that link successful Codex Cloud delegations back to the GitHub artifact.
- Frontend API hook for Codex Cloud delegation.

### Changed

- Updated workspace package versions and README badge from `4.2.1` to `4.2.2`.
- Documented Codex Cloud delegation as implemented while workflow steps, review actions, and richer Settings checks remain next in the v4.2 patch train.

## [4.2.1] - 2026-05-06

### Added

- Codex SDK session provider powered by `@openai/codex-sdk`, enabling durable local Codex threads for code-task attempts.
- Disabled-by-default `codex-sdk` agent profile for teams that want SDK-backed sessions alongside the existing `codex` CLI profile.
- Codex SDK attempt logging for streamed thread, turn, item, error, and usage events.
- Codex SDK token telemetry mapping and stop support through abortable SDK turns.
- `threadId` attempt metadata so SDK session IDs are preserved on active and completed attempts for follow-up workflows.

### Changed

- Updated workspace package versions and README badge from `4.2.0` to `4.2.1`.
- Documented Codex SDK sessions as implemented while keeping Cloud delegation, workflow steps, review actions, and richer Settings checks in the v4.2 patch train.

## [4.2.0] - 2026-05-06

### Added

- OpenAI Codex integration roadmap for v4.2, covering local Codex CLI execution, Codex SDK sessions, Codex Cloud delegation, MCP setup, workflow-engine execution, telemetry, review automation, and release QA (#310)
- Codex Integration SOP with operational guidance for CLI, SDK, Cloud, MCP, telemetry mapping, reviews, workflow steps, escalation, and release validation (#310)
- Codex workflow examples for local feature work, Codex review, SDK follow-up sessions, workflow pipelines, Cloud delegation, MCP-first board maintenance, and release QA (#310)
- Codex-specific AGENTS.md guidance and MCP setup instructions for Veritas-aware Codex work (#310)
- Codex feature reference in `docs/FEATURES.md`, updated to distinguish implemented CLI support from planned SDK, Cloud, review, and workflow modes (#310)
- Built-in `codex` agent profile backed by local `codex exec --sandbox workspace-write --json`
- Local Codex CLI execution path for code-task attempts, including process launch in the task worktree, attempt logs, final summary capture, completion handling, stop support, and run/token telemetry mapping
- Config migration that appends missing built-in agents, including Codex, to existing configs without overwriting customized agents

### Changed

- Updated workspace package versions and README badge from `4.1.0` to `4.2.0` (#311)

## [4.1.0] - 2026-05-04

### Added

- QMD-backed search foundation with keyword fallback across active tasks, archived tasks, and docs (#290)
- In-app search dialog with backend and collection controls, fallback status, and task-result navigation (#291)
- Duplicate detection hints in the create-task dialog using active and archived task retrieval (#292)
- VERITAS chat context injection with compact, cited `<veritas_context>` blocks and per-message opt-out (#293)
- QMD index maintenance commands and API refresh endpoint:
  - `pnpm qmd:setup`
  - `pnpm qmd:refresh`
  - `POST /api/search/index/refresh` (#294)

### Changed

- Documented the v4.1 QMD setup, search UI, duplicate detection, VERITAS context injection, and index maintenance workflows
- Updated package versions from `4.0.1` to `4.1.0`

## [4.0.1] - 2026-05-04

### Fixed

- Restored task detail side-popout spacing after the shadcn/ui v4 sheet padding change
- Prevented task detail tabs from being squeezed in code-task popouts by allowing horizontal tab overflow
- Mass archive failure caused by missing `/api/tasks/bulk-archive-by-ids` endpoint
- MIME validation test fixtures now use valid PNG IHDR chunks (#266)
- Status history tests isolated from real state
- Build order: shared package built before server and web (#244)

### Changed

- Batch file reads use bounded concurrency for improved task loading performance (#255)
- Shared package exports governance, policy, and workflow types (#256)
- Bumped pnpm/action-setup from v4 to v5 (#260)

### Security

- Required `N8N_WEBHOOK_SECRET` for unauthenticated n8n webhook requests
- Hardened n8n webhook secret comparison, attachment type checks, filename sanitization, and path containment
- Patched high and moderate dependency advisories for `@xmldom/xmldom`, `hono`, `postcss`, and `sanitize-html`
- Hardened localhost bypass and broadcast frontmatter parsing (#242)
- Startup init failures now fatal with shutdown timeouts (#241)
- Config cache stampede prevention and corrupted activity file logging (#240)
- WebSocket event listener leak fix and message rate limiting (#239)
- Promise handling fixes preventing crashes and data loss (#238)
- Enforced HS256 algorithm in JWT verification (#237)

### Docs

- v4.0 governance security audit (#265)
- Comprehensive unit tests for v4.0 governance services (#263)
- Feedback, chat, and system-health route tests (#257)

## [4.0.0] - 2026-03-21

### ✨ Highlights

**Veritas Kanban 4.0 is the agent governance release.** This release adds a complete Agent Governance Layer — configurable policies, behavioral drift detection, decision audit trails, output evaluation, and user feedback analytics — alongside a fully customizable dashboard widget grid, a Prompt Template Registry with version control, and a real-time Global System Health Status Bar.

All shadcn/ui components have been upgraded to v4 with Tailwind v4 integration. This release also adds MCP comment CRUD tools and project management tools, wires lifecycle hooks to the notification service, and ships seven new SOP guides plus updated API documentation.

### Added

- **Agent Policy & Guard Engine (#178)** — Configurable tool/action policies with guard rules
  - Define policies with `allow`/`deny`/`require-approval` guard rules per tool and action
  - Policy evaluation engine with configurable precedence (deny-first or allow-first)
  - REST API: `GET/POST /api/policies`, `GET/PUT/DELETE /api/policies/:id`, `POST /api/policies/:id/evaluate`
  - Per-agent and per-project policy scoping
  - Built-in audit log for every policy decision

- **Decision Audit Trail with Assumption Tracking (#179)** — Log agent decisions with assumptions and outcomes
  - Structured decision records: decision text, confidence score, supporting evidence, assumptions
  - Outcome tracking: record what happened after a decision and whether assumptions held
  - Full-text search and filtering by agent, task, confidence range
  - REST API: `GET/POST /api/decisions`, `GET/PUT/DELETE /api/decisions/:id`, `POST /api/decisions/:id/outcome`

- **Agent Output Evaluation & Scoring Framework (#180)** — Quality scoring for agent outputs
  - Scoring profiles with weighted criteria: `RegexMatch`, `KeywordContains`, `NumericRange`, `CustomExpression`
  - Composite scoring methods: `weightedAvg`, `minimum`, `geometricMean`
  - Evaluation history with per-scorer breakdown and per-dimension explanations
  - REST API: `GET/POST /api/scoring/profiles`, `GET/PUT/DELETE /api/scoring/profiles/:id`, `POST /api/scoring/evaluate`, `GET /api/scoring/history`

- **Behavioral Drift Detection & Alerting (#181)** — Detect and alert on agent behavior changes
  - Metric tracking with configurable baselines and alert thresholds
  - Drift status lifecycle: `ok` → `warning` → `alert` → `resolved`
  - Automatic timestamp of detection and resolution events
  - REST API: `GET/POST /api/drift`, `GET/PUT/DELETE /api/drift/:id`, `POST /api/drift/:id/resolve`

- **User Feedback Loop with Sentiment Analytics (#182)** — Collect and analyze user feedback on agent outputs
  - Feedback collection with sentiment (`positive`/`neutral`/`negative`) and category tagging
  - Aggregate analytics: sentiment breakdowns, trends over time, category distributions
  - REST API: `GET/POST /api/feedback`, `GET/DELETE /api/feedback/:id`, `GET /api/feedback/analytics`

- **Draggable & Resizable Dashboard Widget Grid (#183)** — Customizable dashboard layouts
  - Drag-and-drop widget repositioning with smooth animations
  - Resizable widgets with snap-to-grid behavior
  - Layout persistence via `settings.json`
  - Add/remove widgets from the widget library

- **Prompt Template Registry with Version Control (#184)** — Manage and version prompt templates
  - Template CRUD with variable extraction (e.g., `{{agent_name}}`, `{{task_context}}`)
  - Full version history with changelog entries; rollback to any version
  - Usage tracking: model, tokens, rendered output (optional)
  - Preview rendering with sample variable injection
  - REST API: `GET/POST /api/prompt-registry/templates`, `GET/PUT/DELETE /api/prompt-registry/templates/:id`, `GET /api/prompt-registry/templates/:id/versions`, `POST /api/prompt-registry/templates/:id/versions`, `GET /api/prompt-registry/templates/:id/versions/:versionId`, `POST /api/prompt-registry/templates/:id/preview`, `GET /api/prompt-registry/templates/:id/stats`, `POST /api/prompt-registry/templates/:id/usage`

- **Global System Health Status Bar (#185)** — Real-time system health monitoring
  - Five health levels: `stable` → `reviewing` → `drifting` → `elevated` → `alert`
  - Three signal categories: `system` (storage/disk/memory), `agents` (online/offline counts), `operations` (success rate, recent runs)
  - Persistent header bar with expand/collapse for detail panel
  - REST API: `GET /api/v1/system/health`

- **MCP comment CRUD tools (PR #206)** — Full comment lifecycle from MCP
  - New MCP tools: `add_comment`, `list_comments`, `get_comment`, `update_comment`, `delete_comment`
  - Works with both task-level and sprint-level comments

- **MCP project management tools (PR #227)** — Full project lifecycle from MCP
  - New MCP tools: `list_projects`, `get_project`, `create_project`, `update_project`, `delete_project`, `get_project_stats`, `reorder_projects`

- **Lifecycle hooks wired to notification service (PR #201)** — Hook outcomes now trigger real-time notifications
  - Hooks with `notify: true` push events through the notification service
  - Integrates with @mention notification system for addressable hook alerts

- Comprehensive MCP server documentation at `docs/mcp/README.md` — architecture, quickstart, full tool catalog with examples, security model, troubleshooting playbook, and FAQ
- Condensed root README MCP section with link to dedicated docs

### Changed

- **Upgraded shadcn/ui components to v4 (#186, PR #219)** — All UI components updated for shadcn/ui v4 compatibility with Tailwind v4 integration; breaking prop changes resolved across the component tree

### Fixed

- **Squad chat panel scroll (PR #225, #224)** — Panel now properly scrolls to latest message; overflow clipping bug in nested flex containers resolved
- **False cycle detection in dependency API (PR #208, #188)** — DFS algorithm no longer flags valid multi-path dependencies as cycles when two nodes share a common ancestor
- **TypeScript build errors (PR #207, #177)** — Resolved type mismatches introduced by shadcn/ui v4 and Zod 4 type inference changes
- **SystemHealthBar successRate percentage display (PR #212, #211)** — `successRate` is now correctly formatted as a percentage (0–100) instead of a decimal (0–1)

## [3.3.3] - 2026-03-01

### ✨ Highlights

**Veritas Kanban 3.3.3 is a patch correction release** delivering stability, security, and performance fixes on top of 3.3.2, plus full Zod 4 API migration completing the TypeScript compilation fix.

### Fixed

- **#162 — Complete Zod 4 API migration** — Resolved 50+ TypeScript compilation errors blocking CI/CD
  - `ZodError.errors` → `ZodError.issues` across all route files and middleware
  - `z.record(valueSchema)` → `z.record(z.string(), valueSchema)` for explicit key types
  - Schema defaults corrected from string to proper numeric/boolean types (`PORT`, `VERITAS_AUTH_ENABLED`, `RATE_LIMIT_MAX`)
  - `required_error` → `message` in number schemas (`agents.ts`, `agent-schemas.ts`)
  - Affected: `validate.ts`, `agent-registry.ts`, `workflows.ts`, `lifecycle-hooks.ts`, `tasks.ts`, `reports.ts`, `env.ts`

- **#165 — SSRF protection for webhook URLs** — Added server-side request forgery safeguards for all outbound webhook destinations (replaces #163)

### Added

- **Orchestrator Delegation Enforcement** — Full enforcement gate for orchestrator delegation
  - Orchestrator agent selector in Settings → Enforcement (dropdown of enabled agents)
  - Active/Inactive status badge showing enforcement state
  - Warning banner when delegation enabled but no agent selected
  - Section auto-disables when delegation toggle is off
  - Zod-validated `orchestratorAgent` field (string, max 50 chars)
  - `POST /api/agent/delegation-violation` endpoint for violation reporting
  - Auto-posts violations to squad chat when squad chat enforcement is enabled

- **Enforcement Gate Toast Notifications** — Enhanced error feedback for all enforcement gates
  - Gate-specific titles and actionable guidance for REVIEW_GATE, CLOSING_COMMENTS_REQUIRED, DELIVERABLE_REQUIRED, ORCHESTRATOR_DELEGATION
  - 10-second toast duration for enforcement messages (up from 5s)
  - BulkActionsBar surfaces gate details on bulk move failures

- **Dashboard Enforcement Indicator** — At-a-glance enforcement status
  - Shows active/total gate count with color-coded shield icon (green/amber/gray)
  - Individual gate dots (green = active, gray = off)
  - Renders in dashboard status bar alongside refresh timestamp

### Performance

- **#167 — WebSocket broadcast batching** — Batch broadcasts to prevent event loop blocking under high-frequency update load (replaces #164/#166)

---

## [3.3.2] - 2026-03-01

### ✨ Highlights

**Veritas Kanban 3.3.2 delivers sprint management for CLI + MCP surfaces** alongside task↔agent state synchronization, security hardening of the sync auth boundary, and a circuit breaker test suite.

### Added

- **#161 — Sprint Management (CLI + MCP)** — Full sprint CRUD and task integration from the command line and MCP
  - `vk sprint list` — list sprints with `--hidden` / `--json` flags
  - `vk sprint create` — create sprints with optional description
  - `vk sprint update` — update label, description, visibility
  - `vk sprint delete` — delete sprints (with `--force` for non-empty)
  - `vk sprint close` — archive completed tasks in a sprint
  - `vk sprint suggestions` — show sprints ready to archive
  - `vk list -S <sprint>` / `vk create -S <sprint>` / `vk update -S <sprint>` — task sprint integration
  - MCP tools: `list_sprints`, `create_sprint`, `update_sprint`, `delete_sprint`, `close_sprint`, `sprint_suggestions`
  - Sprint field surfaced on `list_tasks`, `create_task`, `update_task` MCP tools

- **#155 — Task↔Agent State Sync + Reconciliation** — Bi-directional sync engine keeping task state consistent with agent execution state; reconciliation pass resolves diverged records

- **#156 — Circuit Breaker Test Suite** — 18 new unit tests covering circuit breaker open/half-open/closed transitions, timeout behaviour, and error thresholds

### Fixed

- **#159 — Harden task-agent sync auth boundary** — Tightened authentication checks on sync routes to prevent unauthorized state manipulation (#157 #158)

---

## [3.3.1] - 2026-02-28

### Fixed

- **#153 — Express 5 wildcard route compatibility** — Updated route patterns for Express 5.x compatibility
- **Security: upgrade hono to >=4.12.2** — Addressed GHSA-xh87-mx6m-69f3 vulnerability

### Changed

- **#148 — Bump vite from 6.4.1 to 7.3.1** — Major version upgrade with performance improvements
- **#149 — Bump tailwindcss from 3.4.19 to 4.2.1** — Major version upgrade with new features
- **#154 — Bump production dependencies (8 updates)** — Routine dependency maintenance

---

## [3.3.0] - 2026-02-15

### ✨ Highlights

**Veritas Kanban 3.3 delivers production-grade task intelligence** — four features that significantly improve task management capabilities, reliability, and accessibility. This release represents the culmination of rigorous cross-model development: all features authored by Sonnet, reviewed by Codex, and scored 10/10 across security, reliability, performance, and accessibility through our 4x10 review gate.

**Key improvements:**

- **Dependency graph** prevents circular dependencies through DFS cycle detection that traverses bidirectional relationships
- **Crash-recovery checkpointing** protects credentials with auto-sanitization of 20+ secret patterns plus regex value detection
- **Observational memory** preserves critical context across agent sessions with full-text search and importance scoring
- **Agent filtering** enables precise task queries by agent name with proper input sanitization

### Added

- **#122 — Task Dependencies Graph**
  - Bidirectional dependency model (depends_on / blocks) with cycle detection
  - DFS algorithm traverses both directions to prevent dependency loops
  - Dependency graph API with recursive tree traversal (`GET /api/tasks/:id/dependencies`)
  - UI: DependenciesSection component with add/remove for both directions
  - TaskCard badges showing dependency count
  - Zod validation on dependency routes
  - Batch-loaded graph traversal (eliminated N+1 queries)
  - Full keyboard + ARIA accessibility

- **#123 — Crash-Recovery Checkpointing**
  - Save/resume/clear API (`POST/GET/DELETE /api/tasks/:id/checkpoint`)
  - Auto-sanitization of secrets (20+ key patterns + regex value detection)
  - 1MB size limit on checkpoint state with 24h expiry and automatic cleanup
  - Resume counter tracks restart attempts
  - Sub-agent checkpoint context injection into prompts
  - Array sanitization (nested objects + primitive strings)
  - NaN timestamp handling
  - ARIA-accessible checkpoint UI in TaskCard + TaskDetailPanel

- **#124 — Observational Memory**
  - Add/view/delete observations per task (decision, blocker, insight, context types)
  - Importance scoring (1-10) with visual badges
  - Full-text search across all task observations (`GET /api/observations/search`)
  - Paginated search results (limit/offset, max 200)
  - Timeline view with type-colored badges
  - Activity logging for audit trail
  - XSS prevention via sanitizeCommentText()
  - ARIA-accessible range slider + decorative icon handling

- **#125 — Agent Filter**
  - `GET /api/tasks?agent=name` query parameter
  - Input sanitized (trim + 100 char cap)
  - Works with existing pagination and filters
  - JSDoc/OpenAPI documented

### Technical Notes

All features passed comprehensive security review:

- Input sanitization on all user-facing fields
- XSS prevention in observational memory comments
- Secret detection and auto-sanitization in checkpoints
- Cycle detection prevents infinite loops in dependency traversal

## [3.2.1] - 2026-02-12

### Fixed

- **reviewGate enforcement** — Now only applies to code task types (code, bug, feature, automation, system) — research, content, and custom types no longer blocked
- **Defensive settings access** — Prevents crash on missing config sections across all 8 settings tabs (General, Enforcement, Time Tracking, Agents, Projects, Sprints, Templates, Types)
- **Settings toggle persistence** — Fixed deepMergeDefaults overwriting user changes; now uses proper patch merging to preserve toggle states
- **SharedResources toggle persistence** — SharedResources and DocFreshness enabled/disabled states now correctly saved to `settings.json`
- **Squad chat visibility** — System messages now render as gray message bubbles (previously invisible dividers)
- **Time tracking telemetry** — Fixed corrupt 17K-hour entry, added 7-day (604,800,000 ms) cap on `durationMs` validation
- **Archived task reappearance** — Tasks no longer reappear on board after archival (orphaned files from title changes now cleaned up via `findTaskFile`)
- **EnforcementTab formatting** — reviewGate warning text properly formatted, "Quality Gates" duplicate header removed

### Added

- **PRD-Driven Autonomous Development guide** — Complete 961-line guide at `docs/features/prd-driven-development.md` covering setup, agent execution workflow, OAuth2 example, configuration tips, and troubleshooting
- **Time tracking bugfix post-mortem** — Documented 17K-hour telemetry bug in `docs/bugfix-time-tracking-17k-hours.md`

### Changed

- **Consistent gray styling** — Squad chat system messages now use muted theme tokens for subtle gray appearance
- **Theme token usage** — Settings UI updated to use Shadcn theme tokens instead of hardcoded Tailwind colors

## [3.2.0] - 2026-02-11

### Added

- **Markdown Editor** — Rich markdown editing for task descriptions and comments with formatting toolbar, live preview, keyboard shortcuts (Ctrl+B/I/K), syntax highlighting, and dark mode support. Configurable via Settings → Tasks.
- **Shared Resources Registry** — Define reusable resources (prompts, guidelines, skills, configs, templates) and mount them across projects. Full CRUD API with mount/unmount endpoints. Configurable via Settings → Shared Resources.
- **Documentation Freshness Tracking** — Track document staleness with freshness scores, alerts, and optional auto-review task creation. API at `/api/doc-freshness`. Configurable via Settings → Doc Freshness.

### Fixed

- Persist runtime auth/config state to the Docker volume by routing `.veritas-kanban` paths through `getRuntimeDir()` and migrating legacy files on startup (`security.json`, agent registry, lifecycle hooks, error analyses, agent permissions).
- Added Docker migration guidance for recovering auth state after rebuilding containers.
- Dark mode Lessons Learned display bug fixed (text was unreadable in dark mode)
- Plain text card previews for task descriptions (markdown rendering disabled on board cards for performance)
- JWT rotation test flakiness fixed (timing issue resolved)

## [3.1.0] - 2026-02-10

### Added

- **6 structural enforcement gates** (all disabled by default):
  - `squadChat`, `reviewGate`, `closingComments`, `autoTelemetry`, `autoTimeTracking`, `orchestratorDelegation`
- **Comprehensive enforcement documentation** with a dedicated "For AI Agents" section
- **Agent SOP enforcement awareness** updates

### Fixed

- Enforcement gate logic (correct `=== true` checks)
- TelemetryService supports backdated timestamps
- TelemetryService respects `DATA_DIR` in Docker environments
- Zod schema allows optional timestamp on telemetry events
- Template YAML serialization (recursive `cleanForYaml`)
- Case-insensitive agent color lookup in squad chat

**Issue:** #115

---

## [3.0.0] - 2026-02-09

### ✨ Highlights

**Veritas Kanban 3.0 ships the workflow engine** — a deterministic multi-step agent orchestration system that transforms VK from an ad-hoc task board into a repeatable, observable, and reliable agent execution platform. Think GitHub Actions for AI agents.

**14,079 lines of code shipped across 6 major phases:**

- Phase 1: Core workflow engine (~7,091 lines)
- Phase 2: Run state management (~1,409 lines)
- Phase 3: Frontend + real-time updates (~3,069 lines)
- Phase 4: Advanced orchestration (~2,255 lines)
- Dashboard: Monitoring & health metrics (~2,050 lines)
- Policies & Sessions: Tool policies + session isolation (~1,200 lines)

### Added

#### Core Workflow Engine (Phase 1 — #107)

- **YAML workflow definitions** — Define multi-step agent pipelines as version-controlled YAML files
- **Workflow CRUD API** — 9 REST endpoints for workflow management:
  - `GET /api/workflows` — List all workflows
  - `GET /api/workflows/:id` — Get workflow definition
  - `POST /api/workflows` — Create workflow
  - `PUT /api/workflows/:id` — Update workflow (auto-increment version)
  - `DELETE /api/workflows/:id` — Delete workflow
  - `POST /api/workflows/:id/runs` — Start a run
  - `GET /api/workflow-runs` — List runs (filterable by workflow, task, status)
  - `GET /api/workflow-runs/:id` — Get run details
  - `POST /api/workflow-runs/:id/resume` — Resume blocked run
- **Sequential step execution** — Execute workflow steps in order with retry routing
- **Step types: agent** — Agent steps spawn OpenClaw sessions with prompts (Phase 1 placeholder)
- **Template rendering** — Basic `{{variable}}` and `{{nested.path}}` substitution in step inputs
- **Acceptance criteria validation** — Simple substring matching for step completion checks
- **Retry routing** — Three strategies: retry same step, retry different step (`retry_step`), escalate to human
- **Workflow snapshot** — YAML saved in run directory for version immutability
- **RBAC** — Role-based access control with ACL files (`.acl.json`)
- **Audit logging** — All workflow changes logged to `.audit.jsonl`
- **Zod validation** — Schema validation for workflow definitions
- **Storage structure** — File-based persistence in `.veritas-kanban/workflows/` and `.veritas-kanban/workflow-runs/`

#### Run State Management (Phase 2 — #113, #110, #111, #108)

- **Persistent run state** — Run state survives server restarts via checkpoint timestamps
- **Progress file tracking** (#108) — Shared `progress.md` per run for context passing between steps
- **Step output resolution** — Template variables like `{{steps.plan.output}}` resolve from previous step outputs
- **Retry delays** — Configurable `retry_delay_ms` to prevent rapid retry loops
- **Tool policies** (#110) — Role-based tool restrictions:
  - 5 default roles: `planner`, `developer`, `reviewer`, `tester`, `deployer`
  - Each role has allowed/denied tool lists
  - Custom role CRUD via `/api/tool-policies` endpoints
  - Tool filter passed to OpenClaw sessions (ready for Phase 3 integration)
- **Fresh session per step** (#111) — Each workflow step can spawn a fresh OpenClaw session:
  - Session modes: `fresh` (new session) or `reuse` (continue existing)
  - Context injection: `minimal`, `full`, or `custom` (specify which steps to include)
  - Cleanup modes: `delete` (terminate after step) or `keep` (leave running for debugging)
  - Configurable timeout per step
- **Session tracking** — Session keys stored in `run.context._sessions` per agent
- **Backward compatible** — Legacy `fresh_session: false` maps to `session: reuse`

#### Frontend + Real-Time Updates (Phase 3 — #107 frontend)

- **WorkflowsPage** — Browse and start workflow runs:
  - Grid view of all workflows with metadata (name, version, agents, steps)
  - "Start Run" button → calls `POST /api/workflows/:id/run`
  - Active run count badges per workflow
  - Search filter
  - Lazy-loaded in App.tsx
- **WorkflowRunView** — Live step-by-step workflow run visualization:
  - Real-time step progress display
  - Each step shows status, agent, duration, retry count, output preview, errors
  - Color-coded step status (green=completed, blue=running, red=failed, yellow=skipped, gray=pending)
  - "Resume" button for blocked runs
  - Overall progress bar (step X of Y)
  - Auto-updates via WebSocket `workflow:status` events
- **WorkflowRunList** — Filter and browse runs:
  - Filter by status (all, running, completed, failed, blocked, pending)
  - Click to open WorkflowRunView
  - Progress bars, duration tracking
- **WorkflowSection** — Run workflows from TaskDetailPanel:
  - Shows available workflows
  - Displays active runs for current task
  - "Start" button with task context
  - Dialog modal
- **Navigation tab** — "Workflows" tab added to header with icon
- **WebSocket integration** — Real-time updates via `workflow:status` events
- **Polling fallback** — Aggressive polling (10-30s) when WebSocket disconnected, safety-net polling (120s) when connected
- **~75% reduction in API calls** when WebSocket connected

#### Advanced Orchestration (Phase 4 — #112, #113)

- **Loop steps** (#112) — Iterate over collections with progress tracking:
  - Configuration: `over`, `item_var`, `index_var`, `completion` policy, `fresh_session_per_iteration`
  - Completion policies: `all_done`, `any_done`, `first_success`
  - Loop state tracking: `totalIterations`, `currentIteration`, `completedIterations`, `failedIterations`
  - Output per iteration saved to `step-outputs/<step-id>-<iteration>.md`
  - Loop variables accessible in templates: `{{loop.index}}`, `{{loop.total}}`, `{{loop.completed}}`
  - Max 1000 iterations safety limit
  - `continue_on_error` flag to skip failed iterations
  - `verify_each` and `verify_step` for post-iteration validation (wired in types, executor pending)
- **Gate steps** — Conditional blocking with approval workflow:
  - Boolean expressions: `{{test.status == "passed" and verify.decision == "approved"}}`
  - Supports `==`, `and`, `or` operators with variable access
  - Blocking behavior: run status changes to `blocked` if condition fails
  - Approval API: `POST /api/workflow-runs/:runId/steps/:stepId/approve` and `/reject`
  - Escalation policies: `escalate_to: human` blocks, timeout support
- **Parallel steps** — Fan-out/fan-in execution:
  - Execute multiple sub-steps concurrently via `Promise.allSettled()`
  - Completion criteria: `all` (all must succeed), `any` (at least one), `N` (at least N sub-steps)
  - `fail_fast` flag aborts remaining sub-steps on first failure
  - Aggregated JSON output with per-sub-step status, outputs, errors
  - Max 50 concurrent sub-steps (soft limit)
- **Enhanced acceptance criteria** — Regex patterns and JSON path equality:
  - Regex: `/^STATUS:\s*done$/i`
  - JSON path: `output.decision == "approved"`
  - Backward compatible substring matching
- **Expression evaluator** — Safe variable access and boolean logic (no arbitrary code execution)

#### Workflow Dashboard (#114)

- **Summary cards** (6 metrics):
  - Total workflows defined
  - Active runs (currently executing)
  - Completed runs (period-filtered: 24h/7d/30d)
  - Failed runs (period-filtered)
  - Average run duration
  - Success rate (%)
- **Active runs table** — Live-updating list of currently executing runs:
  - Workflow ID, status badge, started time, duration, current step, progress (step X/Y)
  - Click to open WorkflowRunView
  - Real-time updates via WebSocket
  - Visual progress bars
- **Recent runs history** — Last 50 workflow runs:
  - Sortable by status (all/completed/failed/blocked/pending)
  - Run ID, status badge, start time, duration, steps completed
  - Click to open WorkflowRunView
- **Workflow health metrics** — Per-workflow stats:
  - Success rate
  - Average duration
  - Run counts (total, completed, failed)
  - Visual health indicators (green/yellow/red based on success rate)
- **Real-time updates** — WebSocket-driven with polling fallback (30s when disconnected, 120s when connected)
- **Backend endpoints**:
  - `GET /api/workflow-runs/active` — Currently running workflows
  - `GET /api/workflow-runs/stats?period=7d` — Aggregated statistics (total workflows, active, completed, failed, avg duration, success rate, per-workflow breakdown)
- **Navigation** — "Dashboard" button in WorkflowsPage header

### Changed

#### WebSocket Refactor (Phase 3)

- **All hooks now WebSocket-primary** — Polling is safety net only
- **Connected behavior** — 120s polling intervals (safety net)
- **Disconnected behavior** — Aggressive polling resumes (10-30s intervals)
- **Events** — `task:changed`, `agent:status`, `telemetry:event`, `workflow:status`
- **Broadcast service** — Centralized `broadcastWorkflowStatus()` function sends full run state (no extra HTTP fetches needed)
- **13 hooks/components refactored** — All polling intervals updated

### Security

- **ReDoS protection** — Regex patterns validated with size/complexity limits
- **Expression injection prevention** — Template evaluator only supports safe variable access and boolean operators
- **Parallel DoS limits** — Max 50 concurrent sub-steps in parallel execution
- **Gate approval validation** — Authentication and permission checks on approval endpoints
- **Path traversal protection** — `sanitizeFilename` on all file writes

### Performance

- **~75% reduction in API calls** — When WebSocket connected, polling drops to 120s safety-net intervals
- **Progress file size cap** — 10MB limit prevents unbounded growth
- **Lazy-loaded frontend** — WorkflowsPage, WorkflowDashboard only render when navigated to
- **Memoized filters** — `useMemo` for filtered workflows/runs
- **Skeleton loading states** — Shimmer placeholders during data fetch

---

## [2.1.4] - 2026-02-09

### Fixed

- **Status Counter Accuracy** (#104) — Sidebar task counts now use a dedicated `GET /api/tasks/counts` endpoint that returns total counts by status, independent of time-range filters applied to the board view
  - **New:** `server/src/routes/tasks.ts` — `/api/tasks/counts` endpoint returns `{ todo, in_progress, review, done, blocked, cancelled }`
  - **New:** `web/src/hooks/useTaskCounts.ts` — dedicated React hook for sidebar counts
  - **Updated:** `BoardSidebar.tsx` — uses `useTaskCounts()` instead of deriving from filtered task list
  - Cache invalidation wired to task mutations so counts stay in sync

- **Bulk Operation Timeouts** (#105) — Bulk archive, status update, and backlog demote operations now use single API calls instead of N individual requests
  - **New:** `POST /api/tasks/bulk-update` — update status for multiple tasks in one call
  - **New:** `POST /api/tasks/bulk-archive-by-ids` — archive multiple tasks by ID array
  - **New:** `POST /api/backlog/bulk-demote` — demote multiple tasks to backlog in one call
  - All bulk endpoints validate array size (max 100) to prevent abuse
  - Operations run in parallel via `Promise.allSettled()` (~26× faster for large batches)
  - **Updated:** `BulkActionsBar.tsx` — rewired to use bulk endpoints instead of sequential loops
  - **Updated:** `useTasks.ts`, `useBacklog.ts` — new mutation hooks for bulk operations

### Changed

- **Squad Chat Documentation** (#106) — Updated `SQUAD_CHAT_IMPLEMENTATION.md` to clarify that the `model` field is a structural JSON field in the API, not a text instruction

## [2.1.3] - 2026-02-07

### Fixed

- **Docker Path Standardization** (#102) — Comprehensive refactor: created shared `paths.ts` utility and migrated all 7 services to use it
  - **New:** `server/src/utils/paths.ts` — single source of truth for all path resolution
  - **Refactored:** task-service, activity-service, chat-service, audit-service, metrics/helpers, backlog-repository (7 files total)
  - **Resolution priority:** `DATA_DIR` / `VERITAS_DATA_DIR` env var → project root auto-discovery → fallback
  - **Safety:** Filesystem root guard prevents silent `/` resolution (the original EACCES bug)
  - **Backwards compatible:** Existing `DATA_DIR` configurations continue to work unchanged
  - **Cross-model reviewed:** 10/10/10/10 (GPT-5.1 authored, Claude Sonnet 4.5 reviewed)

## [2.1.2] - 2026-02-07

### Fixed

- **Docker Path Resolution** (#102) — Fixed WORKDIR resolution so services correctly find `.veritas-kanban` in containerized deployments
  - **Root cause:** Services use `process.cwd()/..` to locate project root; with `WORKDIR /app` this resolved to `/` (filesystem root), causing `EACCES: permission denied` on container startup
  - **Fix:** Changed production WORKDIR to `/app/server`, ensured `/app/tasks` and `/app/server` are writable
  - **Impact:** Resolves permission denied errors when starting VK in Docker containers
  - Related: Issue #102 (Docker: Standardize .veritas-kanban path resolution across services)

## [2.1.1] - 2026-02-07

### Fixed

- **Reverse Proxy Support** (#100) — Added `TRUST_PROXY` environment variable for deployments behind nginx, Caddy, Traefik, Synology DSM, and other reverse proxies. Fixes `express-rate-limit` ValidationError and WebSocket authentication loops caused by untrusted `X-Forwarded-For` headers.
  - Supports hop counts (`TRUST_PROXY=1`), named values (`loopback`, `linklocal`), and subnet strings
  - `TRUST_PROXY=true` is blocked by default (security hardening — logs warning, falls back to no trust)
  - Disabled by default — no behavior change for existing deployments
  - Documentation added for nginx, Caddy, and Docker Compose configurations

### Security

- Blocked `TRUST_PROXY=true` to prevent accidental trust-all-proxies misconfiguration on public-facing deployments

## [2.0.0] - 2026-02-06

### ✨ Highlights

**Veritas Kanban 2.0 is the multi-agent release.** 18 features shipped across agent orchestration, dashboard analytics, lifecycle automation, and developer experience. This release transforms VK from a single-agent task board into a full multi-agent orchestration platform.

### Added

#### Multi-Agent System (#28, #29, #30, #31)

- **Agent Registry** (#52) — Service discovery with heartbeat tracking, capabilities, live status, REST API for register/deregister/heartbeat/stats
- **Multi-Agent Dashboard Sidebar** (#28) — Real-time agent status cards in board sidebar, expandable details, color-coded status indicators (green=working, purple=sub-agent, gray=idle, red=error)
- **Multi-Agent Task Assignment** (#29) — Assign multiple agents to a single task, color-coded agent chips in task detail and board cards, shared helper utilities
- **@Mention Notifications** (#30) — @agent-name parsing in comments, thread subscriptions, delivery tracking, notification bell
- **Agent Permission Levels** (#31) — Intern / Specialist / Lead tiers with configurable approval workflows and autonomy boundaries

#### Dashboard Analytics (#57, #58, #59, #60, #61)

- **Where Time Went** (#57) — Time breakdown by project via telemetry data with color-coded project bars
- **Activity Clock** (#58) — 24-hour donut chart showing agent work distribution, sourced from status-history transitions
- **Hourly Activity Chart** (#59) — Bar chart with per-hour event counts, sourced from status-history
- **Wall Time Toggle** (#60) — Total Agent Time + Avg Run Duration with explanatory tooltips
- **Session Metrics** (#61) — Session count, success rate, completed/failed/abandoned tracking

#### Lifecycle & Automation

- **Task Lifecycle Hooks** (#72) — 7 built-in hooks (subtask-gate, assignee-required, blocked-reason, done-checklist, auto-archive, time-tracking, notification), 8 lifecycle events, custom hooks API
- **Documentation Freshness** (#74) — Steward workflow with freshness headers (`fresh-days`, `owner`, `last-verified`), 3-phase automation plan
- **Error Learning Workflow** (#91) — Structured failure analysis, similarity search for recurring issues, stats API. Inspired by @nateherk's Klouse dashboard concept.

#### Developer Experience

- **Markdown Rendering** (#63) — MarkdownText component for rich text in task descriptions and comments
- **Cost Prediction** (#54) — Multi-factor cost estimation model (tokens, compute, overhead) for task budgeting
- **CLI Usage Reporting** (#50) — `vk usage` command for token and cost reporting from the terminal
- **Dashboard Widget Toggles** (#92) — Show/hide individual dashboard widgets with settings gear and localStorage persistence
- **Production Binding** (#55) — `VK_HOST` and `VK_PORT` environment variables for flexible deployment
- **Custom favicon** — Purple scales-of-justice SVG icon replacing the default Vite favicon

### Changed

- **Timezone-aware metrics** — Server reports its timezone dynamically in all API response `meta`; clients can request metrics in their local timezone via `?tz=<offset>` query parameter
- **Activity data source** — Activity Clock and Hourly Activity Chart now pull from `status-history` (reliable state transitions) instead of `activity.json`
- **Cost-per-task clickability** — Enhanced hover states, border effects, and arrow indicator
- **Archive optimistic updates** — Archive mutations now remove tasks from cache immediately via `onMutate`, with rollback on error
- **Agent naming convention** — Agent names use ALL CAPS for acronyms (VERITAS, TARS, CASE, K-2SO, R2-D2, MAX)

### Fixed

- **Daily Activity 100% bug** — Utilization was calculated using UTC dates but displayed in local timezone, causing incorrect percentages
- **Feb 3 telemetry outlier** — 66-minute run normalized to 19min (p95 level)
- **Feb 2 telemetry outliers** — 3 runs (15-19min range) normalized to 10min
- **Registry stats interface mismatch** — Frontend expected `totalAgents`/`onlineAgents` but server sent `total`/`online`; interface updated to match server

### Security

- **MCP SDK vulnerability patched** — Updated `@modelcontextprotocol/sdk` from 1.25.3 to ^1.26.0 (GHSA-345p-7cg4-v4c7, cross-client data leak)
- **Rate limiting documented** — README now warns that VK does not include built-in rate limiting; reverse proxy recommended for public deployments

### Maintenance

- **21 stale feature branches cleaned** — Down to `main` only
- **README roadmap updated** — Reflects v2.0 shipped features, v1.6.0 and earlier history preserved
- **Version bumped** across all packages (root, server, web, shared, mcp)

### Credits

- [@nateherk](https://github.com/nateherk) — Error learning workflow inspired by Klouse dashboard concept
- [@mvoutov](https://github.com/mvoutov) — Documentation freshness inspired by BoardKit Orchestrator

---

## [1.6.0] - 2026-02-05

### ✨ Highlights

- **Activity Page Redesign** — Streamlined to focus on status history with full-width layout, clickable task navigation, and color-coded status badges
- **Task Templates UI (#39)** — Full management interface for creating, editing, and instantiating task templates with blueprints
- **Analytics API (#43)** — New endpoints for timeline visualization and aggregate metrics (parallelism, throughput, lead time)
- **Status Transition Hooks** — Quality gates and automated actions for task status changes
- **7 GitHub Issues Closed** — #47, #48, #49, #51, #53, #56, #82 verified complete and documented

### Added

#### Activity Page Improvements

**Full-Width Status History:**

- Removed activity feed column — status history now spans full width
- Removed redundant "Status History" header label
- Daily summary panel retained above status history
- Cleaner, more focused interface for monitoring agent activity

**Clickable Task Navigation:**

- Status history entries now clickable to open task detail panel
- Keyboard accessible (Enter/Space to activate)
- Hover state indicates interactivity

**Color-Coded Status Badges:**

- Agent status colors:
  - `working` / `thinking` — Green
  - `sub-agent` — Purple
  - `idle` — Gray
  - `error` — Red
- Task status colors (Kanban columns):
  - `todo` — Slate
  - `in-progress` — Amber
  - `blocked` — Red
  - `done` — Blue
- Task titles colored to match their new status
- Uniform badge width for visual consistency

**Task Status Changes:**

- Now shows both agent status changes AND task status changes
- Task status changes display with kanban column colors
- Unified timeline view of all activity

**Files:**

- `web/src/components/activity/ActivityFeed.tsx` — Redesigned component
- `web/src/hooks/useStatusHistory.ts` — Updated color functions

#### Task Templates UI (#39)

Full management interface for task templates:

**Templates Page (`/templates`):**

- Grid view of all templates with category grouping
- Search and filter by category
- Quick actions: Edit, Preview, Delete, Create Task
- Empty state with helpful onboarding

**Template Editor Dialog:**

- Create and edit templates
- Configure task defaults (type, priority, project, agent)
- Add subtask templates with ordering
- Blueprint support for multi-task workflows
- Validation and error handling

**Template Preview Panel:**

- Read-only preview of template configuration
- Shows all defaults and subtasks
- One-click task creation from template

**Files:**

- `web/src/components/templates/TemplatesPage.tsx`
- `web/src/components/templates/TemplateEditorDialog.tsx`
- `web/src/components/templates/TemplatePreviewPanel.tsx`
- `server/src/routes/templates.ts`
- `server/src/services/template-service.ts`

#### Analytics API (#43)

New endpoints for advanced metrics and visualization:

**Timeline Endpoint:**
`GET /api/analytics/timeline`

- Returns task execution timeline data
- Includes start/end times from time tracking
- Task assignments and status history
- Parallelism snapshots (concurrent tasks over time)
- Query params: `from`, `to`, `agent`, `project`, `sprint`

**Metrics Endpoint:**
`GET /api/analytics/metrics`

- Aggregate metrics for a time period:
  - Parallelism factor (average concurrent tasks)
  - Throughput (tasks completed per period)
  - Lead time (creation to completion)
  - Agent utilization (working time per agent)
  - Efficiency metrics (tracked vs total time)
- Query params: `sprint`, `from`, `to`, `project`

**Files:**

- `server/src/routes/analytics.ts`
- `server/src/services/analytics-service.ts`
- `server/src/schemas/analytics-schemas.ts`
- `docs/API-analytics.md` — Swagger-style documentation

#### Status Transition Hooks

Quality gates and automated actions for task status changes:

**Pre-Transition Gates:**

- Must pass before status change is allowed
- Examples: require description, require time logged, require code review

**Post-Transition Actions:**

- Fire after status change succeeds
- Examples: notify channel, update external system, trigger automation

**Configuration:**

- Stored in `.veritas-kanban/transition-hooks.json`
- Configurable per-transition (e.g., `in-progress` → `done`)
- Enable/disable globally or per-rule

**Files:**

- `server/src/services/transition-hooks-service.ts`
- `server/src/routes/transition-hooks.ts`
- `shared/src/types/transition-hooks.ts`

#### CLI Setup Wizard

Interactive onboarding for new users:

```bash
vk setup
```

- Guided configuration of API URL and auth
- Creates `.veritas-kanban/config.json`
- Tests connection and validates setup
- Shows next steps and helpful commands

**Files:**

- `cli/src/commands/setup.ts`

#### Prompt Registry

10 copy/paste prompt templates in `docs/prompt-registry/`:

1. **task-breakdown.md** — Epic → subtasks decomposition
2. **code-review.md** — Cross-model review prompt
3. **bug-fix.md** — Structured debugging approach
4. **documentation.md** — Doc writing guidelines
5. **security-audit.md** — Security review checklist
6. **research.md** — Research task structure
7. **content-creation.md** — Content production workflow
8. **sprint-planning.md** — Sprint setup prompt
9. **standup-report.md** — Daily standup generation
10. **lessons-learned.md** — Post-task reflection

### Fixed

#### Security

**SEC-001: Path Traversal Vulnerability**

- Added validation to trace and template services
- Prevents `../` path injection in file operations
- All file paths now resolved and validated against allowed directories

#### Performance

**Telemetry Streaming:**

- Large telemetry reads now streamed instead of loaded into memory
- Pagination pushed to service layer
- Optimized lookups for common queries

#### Quality

**React Strict Mode Compliance:**

- Replaced `Math.random()` with `crypto.randomUUID()` for keys
- Fixed type alignment issues
- Resolved React warning about duplicate keys

### Changed

#### Dashboard

- Sidebar task counts now show current state, not time-filtered counts
- Archive/delete/restore operations now correctly find files on disk
- Metrics cache invalidation on status changes

### Closed Issues

| Issue | Title                                         | Implementation                 |
| ----- | --------------------------------------------- | ------------------------------ |
| #82   | Dev reliability (health, dev:clean, watchdog) | Health endpoints + dev scripts |
| #56   | Dashboard filter bar with presets             | DashboardFilterBar component   |
| #53   | Per-model cost tables & calculation           | Cost tracking in telemetry     |
| #51   | Standup summary with model usage              | /api/summary/standup           |
| #49   | Dashboard Model Usage & Cost panel            | Tokens Card + Cost per Task    |
| #48   | Global usage aggregation service & API        | /api/metrics/\* endpoints      |
| #47   | Model Usage schema, types & API               | Full telemetry system          |

---

## [1.5.0] - 2026-02-04

### ✨ Highlights

- **Comprehensive SOP Documentation Suite** — 8 new guides covering agent workflows, sprint planning, multi-agent orchestration, code review, best practices, examples, and power user tips
- **Cross-Model Code Review Enforcement** — Claude ↔ GPT review gate now fully documented with RF-002 91% accuracy validation
- **Bulk Archive Error Handling** — Fixed silent failures in Done column archival with per-task error tracking and user feedback toasts
- **Sidebar Metrics Sync** — Fixed stale task counts in board sidebar by invalidating metrics cache on status changes

### Added

#### Documentation (#US-1600)

Complete SOP Sprint with 8 new markdown files in `docs/`:

- **GETTING-STARTED.md** — 5-minute quickstart from zero → agent-ready, includes:
  - Prerequisites, manual setup wizard, UI/CLI task creation
  - Agent pickup checklist with agent-requests folder flow
  - Sanity checks section (API health, UI health, agent pickup verification)
  - Prompt registry guidance (shared resources pattern from BoardKit)
  - Documentation freshness SOP (AGENTS.md, CLAUDE.md, BEST-PRACTICES.md)
  - Multi-repo/multi-agent notes with consistent naming conventions
  - OpenClaw Browser Relay integration notes for auth-required workflows
  - Credited Neal (@nealmummau) for asking the triggering question

- **SOP-agent-task-workflow.md** — Complete lifecycle (claim → work → complete):
  - Roles table (PM, Worker, Human Lead)
  - Lifecycle overview with 6 stages
  - API/CLI examples for each step (start timer, status change, completion)
  - Prompt template for consistent agent instructions
  - Lessons Learned expectations + notification patterns
  - Escalation paths for blocked tasks, tooling failures, reviewer disputes

- **SOP-sprint-planning.md** — Epic → Sprint → Task → Subtask hierarchy:
  - Hierarchy table with real examples (MessageMeld, US-1600)
  - Sprint planner agent prompt template
  - Bulk API payload for creating entire sprints at once
  - Estimation pattern (subtasks × 0.5d = effort)
  - Assignment workflow (leave unassigned for agent pickup)
  - Example sprint (US-1600 docs sprint + RF-002 bug fix sprint)
  - After-planning checklist (recap docs, GitHub milestones, standup scheduling)

- **SOP-multi-agent-orchestration.md** — PM + Worker roles:
  - PM checklist (plan, assign, track, review, report)
  - Worker handoff template with clear acceptance criteria
  - Status reporting cadence (daily updates, standup summaries)
  - Error escalation paths
  - Opus-as-PM / Codex-as-worker walkthrough example

- **SOP-cross-model-code-review.md** — Non-negotiable opposite-model gate:
  - Enforcement rule: If Claude wrote it, GPT reviews; if GPT wrote it, Claude reviews
  - When to trigger reviews (application code required, docs optional, research optional)
  - Review workflow (create task, opposite model audits, findings as subtasks, fixes tracked)
  - Reviewer checklist (Security, Reliability, Performance, Accessibility, Docs)
  - Prompt template for consistent audits
  - Escalation paths for disagreements
  - RF-002 reference (91% accuracy validates the approach)

- **BEST-PRACTICES.md** — Patterns that work + anti-patterns to avoid:
  - 10 "Do This" rules (time tracking, subtasks, acceptance criteria, atomic scope, SOP updates, etc.)
  - 10 "Don't Do This" anti-patterns (no acceptance, skipping timers, grab-bag tasks, etc.)
  - Based on real-world usage with agents

- **EXAMPLES-agent-workflows.md** — 6 copy/pasteable recipes:
  - Feature development (BrainMeld Lessons Learned)
  - Bug fix (GH-86 bulk archive)
  - Documentation update (sanity checks in Getting Started)
  - Security audit (RF-002 style)
  - Content production (podcast clip → LinkedIn post)
  - Research & report (Champions dossiers)
  - Each includes goal, task creation, prompt, workflow steps, and deliverables

- **TIPS-AND-TRICKS.md** — Power user features:
  - CLI shortcuts (vk begin/done/block/unblock/time/summary)
  - Keyboard shortcuts (Cmd+K palette, arrow nav, Esc)
  - Command palette power moves
  - WebSocket awareness and polling fallback
  - MCP server setup for Claude Desktop
  - Git worktree integration patterns
  - Obsidian/Brain mirroring with brain-write.sh
  - Dev helpers (dev:clean, dev:watchdog)

- **README.md** — Added "Documentation Map" section listing all new guides with descriptions

#### Fixes

##### GH-86: Bulk Archive Silent Failure (#86)

**Root Cause:** `BulkActionsBar.handleArchiveSelected()` used `Promise.all()` with no error handling. When any single archive failed, the entire batch would silently reject with zero user feedback.

**Fix:**

- Import `useToast` hook
- Replace `Promise.all()` with per-task error tracking loop
- Show success toast (e.g., "Archived 5 tasks")
- Show error toast on partial/full failure with counts
- Log individual failures to console for debugging
- Clear selection regardless of outcome
- **File:** `web/src/components/board/BulkActionsBar.tsx` (+38 lines)

##### GH-87: Sidebar Task Counts Out of Sync (#87)

**Root Cause:** The sidebar uses `useMetrics('24h')` which polls every 30 seconds with 10-second staleTime. Meanwhile, `useUpdateTask` mutations did NOT invalidate the metrics cache, causing up to 30 seconds of stale data after status changes.

**Fix:**

- Add metrics query invalidation to `useUpdateTask.onSuccess()`
- Only invalidate when task status changes (prevents over-invalidation)
- Preserves timer state handling (no aggressive blanket invalidation)
- **File:** `web/src/hooks/useTasks.ts` (+9 lines)

### Scripts

- **scripts/dev-clean.sh** — Added explicit `pnpm` path resolution for launchd sessions (fixes "command not found" in automated restarts)
- **scripts/dev-watchdog.sh** — Improved restart storm prevention with lock file + PID checking; fixed pnpm path resolution

### CLI

- **`vk setup`** — New guided onboarding wizard that validates environment and helps new users get started:
  - Checks Node version (requires ≥18)
  - Verifies server is running and reachable
  - Tests API authentication
  - Optionally creates a welcome task with next steps
  - Supports `--json` output for automation and `--skip-task` to skip sample task
  - Credit: BoardKit Orchestrator (Monika Voutov) for the wizard pattern inspiration

### Fixed

- **Archive/Delete/Restore** — Fixed "Archive failed" errors caused by filename mismatch when task titles changed after creation. Now uses `findTaskFile()` to locate actual file on disk by task ID prefix instead of computing filename from current title
- **Sidebar Task Counts** — Fixed metrics showing time-filtered counts (e.g., 33 todo) instead of current board state (e.g., 124 todo). `/api/metrics/all` now returns current task status counts regardless of period filter; period only applies to telemetry metrics (runs, tokens, duration)
- **Backlog Count API** — Fixed double-wrapped response (`{data: {success, data: {count}}}`) by letting `responseEnvelopeMiddleware` handle wrapping

### Security

- **SEC-001 Extended** — Added path traversal validation to `trace-service.ts` (attemptId, taskId, traceId) and `template-service.ts` (templateId) using `validatePathSegment()` + `ensureWithinBase()`

### Changed

- Version bumped from 1.4.1 → 1.5.0

---

## [1.4.1] - 2026-02-02

### Security

- **SEC-001 Path Traversal Prevention** — added strict path segment validation + base directory enforcement in server utilities; applied to file-based services that join paths from user-controlled ids
- **SEC-007 Admin Authorization** — enforced admin (or admin+agent where appropriate) on mutating settings/config/activity/status-history/notifications endpoints

### Fixed

- **Agent Status Panel** now uses real-time WebSocket updates (`useRealtimeAgentStatus`) and correctly handles `activeAgents` payloads
- Improved proxy/IP trust behavior for rate limiting (`X-Forwarded-For` only trusted when `trust proxy` is configured)

## [1.4.0] - 2026-02-01

### ✨ Highlights

- **CLI Workflow Commands** — Two-command task lifecycle (`vk begin` / `vk done`) plus time tracking, comments, agent status, and project management from the terminal
- Inspired by Boris Cherny's (Claude Code creator) "automate everything you do twice" philosophy

### Added

#### CLI Workflow Commands (#44)

- **Composite workflows** — Complete task lifecycle in single commands:
  - `vk begin <id>` — Sets in-progress + starts timer + updates agent status to working
  - `vk done <id> "summary"` — Stops timer + sets done + adds comment + sets agent idle
  - `vk block <id> "reason"` — Sets blocked + adds comment with reason
  - `vk unblock <id>` — Sets in-progress + restarts timer
- **Time tracking CLI** — Full time management from terminal:
  - `vk time start <id>` — Start time tracker
  - `vk time stop <id>` — Stop time tracker
  - `vk time entry <id> <seconds> "description"` — Add manual time entry
  - `vk time show <id>` — Display time tracking summary (total, running status, entries)
- **Comments CLI** — `vk comment <id> "text"` with optional `--author` flag
- **Agent status CLI** — Manage agent presence:
  - `vk agent status` — Show current agent status
  - `vk agent working <id>` — Set to working (auto-fetches task title)
  - `vk agent idle` — Set to idle
  - `vk agent sub-agent <count>` — Set sub-agent mode with count
- **Project management CLI** — `vk project list` and `vk project create "name"` with `--color` and `--description` flags
- All commands support `--json` for scripting and automation
- 5 new command modules, 18 subcommands, 651 lines added

---

---

## [1.3.0] - 2026-02-01

### ✨ Highlights

- **GitHub Issues Bidirectional Sync** — Import issues with the `kanban` label and push status changes back to GitHub
- **Activity Feed** — Full-page chronological activity feed with filtering, real-time updates, and compact/detailed toggle
- **Daily Standup Summary** — Generate standup reports via API or CLI with completed, in-progress, blocked, and upcoming sections

### Added

#### GitHub Issues Sync (#21)

- `GitHubSyncService` (464 lines) with polling, label-based field mapping, and circuit breaker
- Inbound: import issues with `kanban` label as tasks
- Outbound: push status changes (done → close issue, reopen on todo/in-progress/blocked) and comments
- Label mapping: `priority:high` → priority field, `type:story` → type field
- Config: `.veritas-kanban/integrations.json`, state: `.veritas-kanban/github-sync.json`
- `TaskGitHub` interface in shared types: `{issueNumber, repo, syncedAt?}`
- New API endpoints:
  - `POST /api/github/sync` — trigger manual sync
  - `GET /api/github/sync/status` — last sync info
  - `GET /api/github/sync/config` — get config
  - `PUT /api/github/sync/config` — update config
  - `GET /api/github/sync/mappings` — list issue↔task mappings
- New CLI commands: `vk github sync`, `vk github status`, `vk github config`, `vk github mappings`

#### Activity Feed (#33)

- Full-page chronological activity feed accessible from header nav (ListOrdered icon)
- `agent` field added to Activity interface
- `ActivityFilters` for combinable filtering (agent, type, taskId, since, until)
- `GET /api/activity` enhanced with query params: `?agent=X&type=Y&taskId=Z&since=ISO&until=ISO`
- `GET /api/activity/filters` — distinct agents and types for filter dropdowns
- `ActivityFeed.tsx` component with day grouping, 15 activity type icons, filter bar, compact/detailed toggle
- Infinite scroll via IntersectionObserver
- Real-time WebSocket updates
- `ViewContext` for board ↔ activity navigation

#### Daily Standup Summary (#34)

- `GET /api/summary/standup?date=YYYY-MM-DD&format=json|markdown|text`
- Sections: completed, in-progress, blocked, upcoming, stats
- `generateStandupMarkdown()` and `generateStandupText()` in SummaryService
- CLI: `vk summary standup` with `--yesterday`, `--date YYYY-MM-DD`, `--json`, `--text` flags
- 12 new tests

### Changed

- MAX_ACTIVITIES increased from 1,000 to 5,000

---

## [1.2.0] - 2026-02-01

### ✨ Highlights

- **Standardized API Response Envelope** — All endpoints return a consistent `{success, data, meta}` format with typed error classes
- **Abstract File Storage** — Repository pattern decouples services from the filesystem
- **Blocked Task Status** — Full support for blocked tasks across MCP, CLI, and board

### Added

#### Standardize API Response Envelope (#2)

- 4 new error classes: `UnauthorizedError`, `ForbiddenError`, `BadRequestError`, `InternalError` (in `middleware/error-handler.ts`)
- `sendPaginated(res, items, {page, limit, total})` helper for pagination metadata in envelope
- Response envelope format:
  - Success: `{success: true, data, meta: {timestamp, requestId}}`
  - Error: `{success: false, error: {code, message, details?}, meta}`
  - Pagination: `meta` includes `{page, limit, total, totalPages}` on paginated endpoints

#### Abstract File Storage (#6)

- 5 new repository interfaces: `ActivityRepository`, `TemplateRepository`, `StatusHistoryRepository`, `ManagedListRepository`, `TelemetryRepository`
- `StorageProvider` extended with new repositories
- `fs-helpers.ts` — centralized filesystem access (only file that imports `fs`)

#### Blocked Task Status (#32)

- MCP tools Zod/JSON schema definitions updated for blocked status
- MCP active tasks filter updated to include blocked
- CLI help text updated
- CLI status color: blocked = red

### Changed

- All 11 route files standardized — zero ad-hoc `{error: "..."}` patterns
- Auth middleware errors standardized to use typed error classes
- All 10 services migrated off direct `fs` imports to use `fs-helpers.ts`

---

## [1.1.0] - 2026-01-31

### ✨ Highlights

- **Built-in Chat Interface** — Talk to AI agents directly from the board or any task, with streaming responses and markdown rendering
- **Agent Routing Engine** — Tasks auto-route to the best available agent based on type, project, and capabilities
- **Agent Selection on Task Creation** — Choose which agent handles a task when you create it
- **Hardened Infrastructure** — Rate limiting, circuit breakers, file locking, request timeouts, data integrity checks, and more

### Added

#### Chat Interface (#18)

- Full chat panel accessible from any task or the board header
- Streaming AI responses with real-time WebSocket delivery
- Floating chat bubble with pulse indicator for new messages
- Chat sessions stored as markdown files with YAML frontmatter
- Gateway integration for AI responses via Clawdbot
- Chat export as markdown (download icon in header)
- Clear chat history with confirmation dialog
- Mode toggle: Ask (read-only queries) vs Build (changes, files, commands)
- Keyboard shortcut support
- Auto-focus input after sending messages
- Tool call display with expandable input/output sections

#### Agent Routing Engine (#16)

- Task-aware routing that matches tasks to agents by type, project, and capabilities
- Routing rules configurable per agent in Settings → Agents
- API endpoints for routing queries and rule management
- Full test coverage (17 tests)

#### Agent Selection on Task Creation (#17)

- Agent dropdown in the Create Task dialog
- Auto-routes to best agent based on task type, or allows manual override
- Agent field displayed in task metadata section

#### Agent CRUD Management

- Full Add/Edit/Remove for agents in Settings → Agents
- Add Agent form with name, type slug (auto-generated), command, and args
- Edit/Remove via inline icons (default agent protected from deletion)
- `AgentType` loosened from fixed enum to any string slug — fully custom agents

#### Board Filter: Agent

- Filter board by assigned agent in the FilterBar
- Agent indicator dots on task cards match filter state

#### Infrastructure & Security

- **Rate Limiting** — Per-route tiered thresholds (auth, API reads, writes, uploads)
- **Circuit Breaker** — Automatic failure detection for external service calls with configurable thresholds
- **File Locking** — FIFO queue prevents race conditions on concurrent file writes
- **Request Timeouts** — Middleware kills hung connections before they pile up
- **Data Integrity** — Hash-chain verification + automatic backup on startup with rotation
- **Audit Log** — Immutable hash-chain audit trail for sensitive operations
- **Health Endpoint** — Liveness, readiness, and deep checks (storage, disk, task file)
- **API Envelope** — Standardized `{ success, data, meta }` response format across all endpoints
- **Schema Validation** — Zod schemas on all mutating API routes
- **Metrics** — Prometheus-compatible `/metrics` endpoint for monitoring
- **WebSocket Heartbeat** — Connection keep-alive with automatic reconnection and connection limits
- **Error Boundaries** — React error boundaries with graceful fallback UI
- **Dependency Audit** — Automated vulnerability scanning in CI

#### Storage & Architecture

- Abstract file storage behind repository interface (prep for future database backends)
- Structured logging with pino (replaced all `console.*` calls)

#### First-Run Experience

- Example tasks auto-populate the board on first run (4 sample tasks)
- Manual seed script: `pnpm seed`
- Task data `.gitignore`d — your data stays private

#### Dark/Light Mode

- Settings → General → Appearance toggle (moon/sun icon)
- Persists to localStorage; default is dark mode
- Inline script prevents flash of wrong theme on load

#### UI Theme

- Primary color: purple (`270° 50% 40%`) with white text
- Focus rings, switches, and accents updated to match

#### Documentation

- TROUBLESHOOTING.md with common issues and solutions
- Comprehensive FEATURES.md reference
- Agentic AI Safety best practices guide
- Roadmap section linking to v1.1 milestone
- Competitive comparison table
- OpenClaw (formerly Moltbot/Clawdbot) attribution updated

#### Per-Status Selection (#24)

- Select All checkbox per column header
- Toolbar buttons for bulk operations scoped to selected status
- Column checkboxes for quick multi-select

### Fixed

- **Chat delete not clearing UI** — React Query kept stale cached data after session file was deleted; now uses `removeQueries` to nuke cache
- **Chat send broken after delete** — Server now recreates task-scoped sessions instead of throwing 404
- **Cross-column drag-and-drop** — Tasks reliably move between columns with local state management during drag
- **Dashboard agent comparison** — Fixed broken data fetch (raw `fetch` → `apiFetch` for envelope unwrapping)
- **Dashboard drill-down** — Removed duplicate X button, fixed focus ring clipping, wired up `open-task` event
- **Localhost auth rate limit** (#25) — Exempted localhost from rate limiting
- **Numeric inputs** — Clean inputs without browser spinners (#19)
- **Timer start/stop** — Optimistic UI toggle + cache patch for instant feedback
- **Task cache fragmentation** — All routes now use TaskService singleton
- **Sprint/Agent label alignment** — Fixed form layout in task detail panel
- **Sticky header** — Fixed positioning + matched indicator dot sizes
- **Keyboard test infinite loop** — Resolved render loop in `useKeyboard` + memoized context
- **Agent idle timeout** — Increased from 5 to 15 minutes to reduce false resets
- **File lock ordering** — Added in-process FIFO queue for deterministic write ordering
- **Search filters** — Added task ID to board and archive search

### Changed

- Agent status popover: moved idle description to bottom, added activity history link
- WebSocket indicator: click popover with connection status explanation
- Dashboard layout: Daily Activity (75%) + Recent Status Changes (25%) side-by-side
- Rolling average line: cyan-teal to contrast purple theme
- Bar chart hover: subtle muted fill instead of white flash
- All repo links updated to BradGroux (primary repo)
- All contact emails standardized to contact@digitalmeld.io
- Test suite: 72 files, **1,270 tests** (up from 61 files / 1,143 tests)

---

## [1.0.0] - 2026-01-29

### 🎉 Initial Public Release

Veritas Kanban is an AI-native project management board built for developers and autonomous coding agents.

### Features

#### Core Board

- Kanban board with drag-and-drop between columns (Backlog, To Do, In Progress, Review, Done)
- Task detail panel with full editing (title, description, priority, status, type, project, sprint)
- Subtasks with progress tracking on cards
- Task type system with icons and color-coded borders
- Sprint management with auto-archive
- Bulk operations and keyboard shortcuts

#### Code Workflow

- Git worktree integration for code tasks
- Diff viewer for code review
- Line-level review comments
- Approval workflow with review decisions
- Merge and close integration

#### AI Agent Integration

- Agent orchestration system for autonomous task execution
- Agent status tracking (idle, working, sub-agent mode)
- Time tracking per task with automatic and manual entries
- REST API designed for AI agent consumption
- MCP (Model Context Protocol) server for LLM tool integration
- CLI for headless task management

#### Dashboard & Analytics

- Sprint velocity tracking
- Cost budget tracking with daily digest
- Task-level metrics and telemetry
- Status history timeline

#### Security

- JWT authentication with secret rotation
- Admin key + API key authentication
- CSP headers with Helmet
- Rate limiting with express-rate-limit
- CORS origin validation
- WebSocket origin validation
- Server-side MIME type validation for uploads
- Markdown sanitization (XSS prevention)
- Timing-safe credential comparison
- Credential redaction from task data

#### Performance

- In-memory task caching with file watchers
- Config caching with write invalidation
- Gzip response compression
- Lazy-loaded dashboard with vendor chunk splitting (69% bundle reduction)
- Pagination and summary mode for large datasets
- Reduced polling when WebSocket connected
- Telemetry retention and automatic cleanup

#### Infrastructure

- Production Dockerfile with multi-stage build (runs as non-root)
- GitHub Actions CI pipeline
- Pre-commit hooks with husky + lint-staged
- Structured logging with pino
- Request ID middleware for tracing
- Graceful shutdown with service disposal
- Unhandled rejection and exception handlers

#### Documentation

- OpenAPI/Swagger API documentation
- Deployment guide (Docker, bare metal, nginx, Caddy, systemd)
- Security audit reports
- Contributing guide with conventional commits
- Code of Conduct (Contributor Covenant v2.1)

#### Testing

- 61 test files, 1,143 unit tests (server + frontend) with Vitest
- End-to-end tests with Playwright (19/19 passing)
- Gitleaks pre-commit hook for secret scanning

### Technical Details

- **Frontend:** React 19, Vite 6, TypeScript 5.7, Tailwind CSS 3.4, Shadcn UI
- **Backend:** Express 4.21, TypeScript, file-based storage
- **Testing:** Playwright 1.58, Vitest 4
- **Runtime:** Node.js 22+, pnpm 9+

---

_Built by [Digital Meld](https://digitalmeld.io) — AI-driven enterprise automation._

[unreleased]: https://github.com/BradGroux/veritas-kanban/compare/v4.1.0...HEAD
[4.1.0]: https://github.com/BradGroux/veritas-kanban/compare/v4.0.1...v4.1.0
[4.0.1]: https://github.com/BradGroux/veritas-kanban/compare/v4.0.0...v4.0.1
[4.0.0]: https://github.com/BradGroux/veritas-kanban/compare/v3.3.3...v4.0.0
[3.3.3]: https://github.com/BradGroux/veritas-kanban/compare/v3.3.2...v3.3.3
[1.4.1]: https://github.com/BradGroux/veritas-kanban/compare/v1.4.0...v1.4.1
[1.4.0]: https://github.com/BradGroux/veritas-kanban/compare/v1.3.0...v1.4.0
[1.3.0]: https://github.com/BradGroux/veritas-kanban/compare/v1.2.0...v1.3.0
[1.2.0]: https://github.com/BradGroux/veritas-kanban/compare/v1.1.0...v1.2.0
[1.1.0]: https://github.com/BradGroux/veritas-kanban/compare/v1.0.0...v1.1.0
[1.0.0]: https://github.com/BradGroux/veritas-kanban/releases/tag/v1.0.0
