Skip to content

Repository navigation

CHANGELOG.md

Latest commit

 

History

History
796 lines (654 loc) · 55.9 KB

CHANGELOG.md

File metadata and controls

796 lines (654 loc) · 55.9 KB
Raw

Changelog

Notable changes to this repository are recorded here from 11/08/2026 onward. Earlier work is not summarized in this file; see Earlier history for where it is verifiable.

This repository is not versioned: it publishes the organization profile, the static organization site, the sponsor page, and shared community-health defaults. It does not publish packages or a numbered application artifact. Entries are grouped by date rather than semantic version.

The format follows Keep a Changelog as far as it applies to an unversioned repository. Dates are written DD/MM/AAAA in Brasília time (UTC−03:00), the presentation rule this organization applies to text meant for people (.github/WORK-TRACKING.md).

Unreleased

  • Bring AGENTS.md and CLAUDE.md to the operator's final master text (LCV-653): the rule against running code neither the operator nor the agent wrote becomes a top-level item, and the Entire diagnosis and stale-session steps say the agent's shell is non-interactive.

  • Bring the master text in AGENTS.md and CLAUDE.md to the operator's current version (LCV-653): only the operator edits it, GitHub Copilot CLI joins the supported agents, and the op run terminal and 1Password MCP rules are removed.

  • Publish Privacy Policy 1.17, effective 14/11/2026 (LCV-644): section 14.1 and the notice above the account-deletion form state that the Firebase App Check verification with reCAPTCHA Enterprise also runs when the confirmation link is requested, not only when it is confirmed, and the page's unavailable-confirmation message fits both phases. Retain version 1.16 at its permanent archive address. site/ stays byte-identical with .github-private.

  • Send the Firebase App Check token when the account-deletion page requests the sign-in link (code scanning github-operations #46, LCV-644): POST /sessions now carries X-Firebase-AppCheck like POST /sessions/confirm, and the page shows its existing confirmation error instead of calling the service when no token is obtained. site/ stays byte-identical with .github-private.

  • Refuse framing of the sponsor page by other sites (code scanning .github-private #27, CWE-1021, LCV-644): site/_headers sends X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none' for /sponsor/* on Cloudflare Pages; GitHub Pages ignores the file. site/ stays byte-identical with .github-private.

  • Fix the sponsor page interrupting an amount that is still being typed (LCV-644): a value ending in a separator ("10," or "10.") no longer shows the range error or reloads the card form while the donor types; leaving the field and paying still validate the amount strictly. site/ stays byte-identical with .github-private.

  • Fix two sponsor page defects reported by code scanning (sponsor-motor #75, .github-private #29, LCV-644): an amount typed as "10.50" is no longer charged as R$ 1.050,00 (only dot-decimal or pt-BR amounts are accepted), and the bank verification (3DS) page loads only from an https: address; when it cannot be opened, the donor is told the order was registered and not to submit it again. site/ stays byte-identical with .github-private.

  • Update the official anthropics/claude-code-action from v1.0.268 to v1.0.269 (commit 61a9c274fa7110a66dfafc1bbbced03833eb25fe) in workflow-templates/claude.yml, and exclude every dependency from the Dependabot cooldown: the cooldown stays configured, but with exclude: ["*"] inside each package-ecosystem block every update is proposed immediately (LCV-596).

  • Align the Scorecard starter workflow and the inventory license link with the official CodeQL SARIF upload Action v4.39.3 at its immutable release commit SHA, matching the versioned Scorecard workflow (LCV-574).

  • Unify the account-deletion form and email-invitation flows, preserving the original email request and protocol. Keep the confirmed email visible and read-only, require all four personal fields, and bind registration and lookup to the original tab's session context. Collect and send WhatsApp as an 11-digit Brazilian area code and mobile number without adding a country code. Renew email invitations through the original capability and operation, clear personal fields only after accepted renewal, and retain the protocol while requiring a new Google confirmation link. Asynchronous BigDataCorp checks do not prevent protocol registration. Before confirmation, offer a clean form in a new tab after a failed link while preserving the original page and directing Central invitations to a new invitation for the same request. Terminal invitation errors keep renewal disabled and direct the requester to Central. Synchronize the public site and manifest with the counterpart copy; preserve Privacy Policy 1.16 (LCV-563).

  • Confirm account-deletion email links automatically, including when opened in another browser, without asking for the email again. Keep the confirmed email visible and read-only while collecting the required personal details, and allow retrying a temporarily unavailable confirmation. If the session expires, offer a new confirmation link for the same email while preserving any issued protocol and lookup value. Clear the four personal fields only after a successful resend; keep them on failure. Explain that the new page requires the personal details or protocol again.

  • Publish Privacy Policy 1.16, effective 04/11/2026, explaining Firebase App Check and reCAPTCHA Enterprise during email-link confirmation, including technical signals, the necessary cookie and Google's privacy and data-processing references. Retain version 1.15 at its permanent archive address.

  • Require WhatsApp alongside full name, CPF and date of birth after account email confirmation in the account-deletion form. Always send the normalized WhatsApp in the existing request JSON, explain registration and display the protocol returned in the response. Keep neutral privacy-support messages for legacy registry errors without asking for civil-data corrections, email reconfirmation or waiting. Preserve session, callback and status lookup contracts; regenerate the shared site manifest.

  • Configure the public account-deletion form with the HTTPS API base https://privacy-api.lcv.dev (LCV-563).

  • Record LCV-Ideas-Software/.github-private as the checkpoint destination in versioned .entire/settings.json, making the existing private route available to Entire's server-side discovery. Checkpoint ingestion and Dispatch coverage require separate server-side verification after publication.

  • Upgrade the repository Node.js toolchain to official 26.13.0 LTS and read the same .node-version pin in the existing Pages and Site Parity workflows.

  • Add the approved public account-deletion form with email verification, required identity fields and lookup by the native Linear issue identifier; keep the email channel, remove tracking only from this form page and regenerate the identical site manifests. The HTTPS API base must be configured before enabling the form (ADMIAPP-59).

  • Remove the English translation and language link from the account-deletion page, retaining the Portuguese request channel and all legal and license texts; regenerate the shared site manifest in both governance repositories (operator decision of 03/11/2026).

  • Update the official CodeQL SARIF upload Action to v4.39.2 and Claude Code Action to v1.0.268 at their complete immutable release commit SHAs, preserving workflow inputs, permissions and separate CLI licensing terms. Refresh the inventory license links to the same commits (LCV-554).

  • Update the official Zizmor Action to v0.8.1 and its explicitly selected analyzer to 1.32.0 at their immutable release coordinates (LCV-542).

  • Correct steps 5 through 8 of the Entire and GitHub agent instructions in CLAUDE.md, AGENTS.md and docs/entire.md, matching the admin-app text. Step 5 no longer carries a rule the operator never gave: the hook writes the Entire-Checkpoint trailer at commit time, no checkpoint ID is invented, and a squash merge ends its message with the hook-written trailer lines, one per checkpoint proven in step 6 (operator decision of 02/11/2026). Step 6 runs entire checkpoint explain from a clone of another repository, because inside this repository's own clone it reads the local copy and answers even when Entire never received the checkpoint. The new step 7 defines the squash-merge requirement; the former steps 7 and 8 are now steps 8 and 9. Step 8 asks for <owner>/<repo> exactly as GitHub spells it and names both causes of "No checkpoints". docs/entire.md replaces the outdated Windows console limitation with the installed local CLI build 0.12.2-lcv.roadmap.1 (LCV-500), which does not resolve upstream entireio/cli#2980 (LCV-537).

  • Add site/account-deletion/ (https://www.lcv.dev/account-deletion/), the universal account and data deletion page for every LCV Ideas & Software app, current and future, on Android, iOS and the web (operator decision of 31/10/2026): requests go to [email protected] and start inside apps that have an account through a link to this page; it is checked by test/institutional-boundary.test.mjs.

  • Publish privacy policy 1.15 (site/privacy/, in force from 31/10/2026; version 1.14 archived at site/privacy/1.14/): section 11.1 describes Oráculo Celestial account and data deletion on request only, through [email protected], as decided by the operator on 22/10/2026; the app has no option that deletes the account directly (removed on 27/10/2026). Section 13 states how Oráculo Celestial meets the in-app and external deletion request paths. The other sections do not change. site/ is identical in .github-private and .github.

  • Publish privacy policy 1.14, Terms of Services 1.1 and Security 1.1 (site/privacy/, site/tos/, site/security/, in force from 30/10/2026; previous versions archived at site/privacy/1.13/, site/tos/1.0/ and site/security/1.0/): the texts describe the six-month account library of the paid Oráculo Celestial analysis, the profile content sent to the AI providers, Firebase Cloud Messaging, Firebase App Check with Play Integrity, Mercado Pago on the web edition, the automatic refund, the 18+ distribution and the current provider chain (Gemini via Vertex AI, Anthropic via its own API, OpenAI). The organization profile and site/index.html record the three Android apps in Google Play production (Calculadora 1.0.12, Maestro 1.0.11, Oráculo Celestial 1.0.0, 30/10/2026) (LCV-464).

  • Update the official Linear Release Action to v0.18.2 at its complete immutable release commit SHA, preserving the existing workflow inputs and official Linear CLI v0.18.0 (LCV-488).

  • Enable native Google Antigravity CLI (agy) hooks in .agents/hooks.json and document the Antigravity integration and MCP configuration in docs/entire.md (LCV-477).

  • Configure official Entire Brain/Graph guidance and the Codex MCP; document repository-specific merge gates, required branch freshness, removal of the retired Depot gate, and the remaining checkpoint/Trail evidence (LCV-477).

  • Publish privacy policy 1.13 (site/privacy/index.html, in force from 26/10/2026): the new section 15.1 "Transferências internacionais de dados" gathers, in its own subsection linked from section 15 and from the change note, the information that article 17 of the regulation approved by Resolução CD/ANPD nº 19/2024 asks the controller to publish: what leaves Brazil, for which purpose and for how long, the destination each provider states, how each transfer is made (the ANPD standard contractual clauses in the Google Cloud Data Processing Addendum, through Google Cloud Brasil, and in the Google Play controller terms; contract execution and the data subject's request under LGPD article 33, IX, for the other providers, as decided by the operator), the roles and security measures, onward transfers, links to the clauses, the 15-day request for their full text and the right to petition the ANPD. The section 15 paragraph on transfers moves to the end of the section, lists every kind of provider and points to 15.1. Sections 7.1 and 7.2 now describe the automatic sending of the Firebase reports instead of their "coleta"; the behaviour is unchanged. Retain version 1.12 at site/privacy/1.12/, add it to the boundary test and regenerate the site manifest, byte-identical between .github and .github-private (LCV-466).

  • Publish privacy policy 1.12 (site/privacy/index.html, in force from 25/10/2026): sections 11 and 15 state that the LCV processing service for the paid features of the Oráculo Celestial Android app runs on Google Cloud in the United States (region us-central1), where its Cloud Firestore order records are also kept, naming the United States as the destination of that international transfer; the other sections are unchanged. Retain version 1.11 at site/privacy/1.11/, add it to the boundary test and regenerate the site manifest. The homepage sentence saying the Android apps keep their data on the device now adds "salvo nos recursos descritos na Política de Privacidade", so it no longer contradicts the policy (LCV-461).

  • Move the Claude Code starter workflow (workflow-templates/claude.yml) to Anthropic workload identity federation: its body is again byte-identical to the organization's canonical claude.yml, which exchanges the job's GitHub OIDC token for a short-lived Claude API token under the organization's Anthropic federation rule (accepting only repositories owned by LCV-Ideas-Software) instead of reading the CLAUDE_CODE_OAUTH_TOKEN secret. The workflow holds only the rule, organization, service account and workspace identifiers, no credential; the header comment and workflow-templates/claude.properties.json now require the Claude GitHub App and that federation rule instead of the secret (LCV-455).

  • Install the official Google Tag Manager snippets for the container GTM-5W9M8KRM on every page of the published site, archived privacy policies included (only the two snippet positions change; policy text is unchanged): the loader as high as possible in <head>, as its first script and ahead of the Google tag, with <meta charset="utf-8" /> moved to the top so the encoding declaration stays within the first 1024 bytes, and the <noscript> iframe immediately after the opening <body> tag, as Google's installation screen requires. Inventory both endpoints in THIRDPARTY.md, update its sponsor-page line reference, require both snippets and the early charset declaration in the boundary test, and regenerate the site manifest, byte-identical to the .github-private copy (LCV-452).

  • Configure the Google Analytics 4 measurement ID G-PK09C40XL5 on every page of the published site as a second config command of the existing Google tag, sharing its single gtag.js loader as Google documents for multiple tag IDs. Update the THIRDPARTY.md entry and its sponsor-page line reference, require the new config call in the Google tag test, and regenerate the site manifest, byte-identical to the .github-private copy (LCV-451).

  • Install the official Google tag (gtag.js) for the Google Ads account AW-18511303830 immediately after <head> on every page of the published site, archived privacy policies included (head only; their text is unchanged). Inventory the externally hosted script in THIRDPARTY.md, add a test that every published page loads it and that the inventory records it, correct the stale site/sponsor/index.html line reference for the device identifier precedence, and regenerate the site manifest, byte-identical to the .github-private copy (LCV-450).

  • Publish the Claude Code starter workflow (workflow-templates/claude.yml and workflow-templates/claude.properties.json): the organization's canonical workflow, unchanged below the standard organization-template header, with the official anthropics/claude-code-action pinned by its full commit SHA. It answers @claude in issues and pull requests, except pull requests opened by Dependabot, and requires the Claude GitHub App and the organization's Anthropic workload identity federation rule. This repository does not run it itself; THIRDPARTY.md lists the Action and records that Dependabot does not maintain its starter-only pin (#398, GITHORG-120, LCV-441).

  • Publish privacy policy 1.11: describe automatic Firebase Crashlytics diagnostics and Performance Monitoring metrics in the Android apps, technical and network data, installation/session identifiers, Google processing and the distinct retention periods; retain version 1.10 at site/privacy/1.10/ (#393).

  • Publish privacy policy 1.10 (site/privacy/index.html): Google, through Vertex AI, becomes the first provider of the analyses made through our service, and Anthropic is reached through Google Cloud, with the 30-day storage of inputs and outputs made available to Anthropic described in section 10, as the Oráculo Celestial 0.3.8 provider chain requires. Version 1.9 stays available unchanged at site/privacy/1.9/ (LCV-424).

  • Publish privacy policy 1.9 (site/privacy/index.html, in force from 19/10/2026): new subsection 11.1 (#google-user-data) describes the Google user data the Oráculo Celestial app receives through Sign in with Google — access, use, storage, transfer, protection, retention and deletion — and its adherence to the Google API Services User Data Policy, including the Limited Use requirements, as the OAuth brand verification requires. The homepage card names the app, its current internal-testing version and why it asks for a Google login. Every public product label (products intro, web card, terminal list and sponsor project list) now uses the commercial name Oráculo Celestial, and the organization profile lists Oráculo Celestial v0.3.7 in internal testing with the paid AI analysis flow instead of the superseded v0.2.0 state; repository names and URLs stay unchanged. Version 1.8 stays available unchanged at site/privacy/1.8/ (LCV-421).

  • Ignore the operator-mandated repository-local temp/ workspace so audit and test artifacts cannot be committed (LCV-414).

  • Retire o Project organizacional #17 depois de comprovar que todas as 5.522 Issues e pull requests já pertenciam aos 21 Projects individuais. O #17 foi excluído em 18/10/2026 e não será recriado; .github usa somente seu Project #24.

  • Update the official OpenSSF Scorecard Action to v2.5.0 at its complete release commit SHA, preserving workflow inputs and permissions (LCV-403).

  • Publish the approved Privacy 1.8, Terms of Services 1.0 and Security pages, dated 13 October 2026, at /privacy/, /tos/ and /security/. Preserve the privacy 1.7 archive, justified paragraphs with a 1.5em first-line indent, institutional links and exact cross-site path/byte parity including manifests (LCV-397).

  • Correct both institutional Android site inventories and publish privacy policy 1.7 for Astro 0.2.0 internal testing, including manual birth data, local history, deletion, backup exclusions and user-selected PDF destinations. Preserve policy 1.6 at its permanent archive URL and regenerate identical site manifests (LCV-358; PR #380 review).

  • Reconcile the current inventory to 1 public, 2 internal and 18 private repositories; identify private product repositories and preserve identical public site content in both governance repositories. Update current Android product and license descriptions to the verified 12 October 2026 releases, distinguishing production from internal testing and preserving third-party rights and prior grants. Identify the four private, empty iOS repositories as future work without claiming implemented applications or licenses (LCV-358).

  • Publish privacy policy 1.6 (site/privacy/index.html, in force from 11/10/2026): the Maestro is now published on Google Play, so its row in the section 2 table points to section 6 of the policy, like the Calculadora's, instead of saying it is under review there; and version 1.5 stays available unchanged at its permanent address, site/privacy/1.5/ (LCV-351).

  • Publish privacy policy 1.5 (site/privacy/index.html, in force from 08/10/2026): the Calculadora's Google Play target audience is now adults only (18 and over), with Google Play's minor access restriction, as the Maestro's already was; the Yahoo privacy policy link now opens the policy itself instead of Yahoo's general legal page; and version 1.4 stays available unchanged at its permanent address, site/privacy/1.4/ (LCV-340).

  • Publish privacy policy 1.4 (site/privacy/index.html, in force from 08/10/2026): the Data safety statements match the forms exported from the Play Console for both apps, which declare that they neither collect nor share user data; every statement that nothing reaches LCV Ideas & Software is limited to what the apps send, since a report the user chooses to email does reach us; section 4 states who is responsible for each part and the legal basis for the reports and rights requests sent to us; and the earlier versions 1.0 to 1.3 stay available unchanged at permanent addresses under site/privacy/<version>/ (LCV-334).

  • Clarify official Gemini eligibility for developers building for professional or business purposes, excluding consumer use, and abuse retention terms; distinguish page URLs, DNS names and connection IPs, and clarify Google DNS uses and Crossref log retention in the shared privacy policy (LCV-334).

  • Update the official actions/upload-artifact to v7.0.2 at complete commit SHAs (LCV-334).

Changed

  • Fix the Entire dispatch step: list and title each dispatch setup in the jurisdiction that generated the dispatch, since each jurisdiction lists only its own setups, and rewrite the step for clarity (LCV-477).

  • Set Entire commit_linking to always and document the enterprise rule for running Entire and GitHub together: agent commits link to their captured session without a prompt, each push is followed by proof that its checkpoint reached GitHub, and one remote dispatch is generated per pull request (LCV-477).

  • Atualizado o telefone fixo institucional para +55 (11) 5229-0077 e seu link do WhatsApp. O site compartilhado exibe os dois telefones no cartão da organização e em cards individuais do WhatsApp, preservando a paridade entre os dois repositórios.

  • Privacy policy 1.2 (site/privacy/index.html): the Maestro section lists every Android permission the app uses. Version 1.1 named only internet access, notifications and biometrics; the 1.0.0 APK also uses the foreground service of the data-sync type, and WorkManager, the official Android library that schedules the session, adds three permissions Android grants at install time (keeping the processor awake while the session runs, reading the connection state, and rescheduling pending work after a reboot). The identity check also accepts the device screen lock. Counted with aapt2 dump permissions on 06/10/2026 (#368; twin LCV-Ideas-Software/.github-private#143).

  • Privacy policy 1.1 (site/privacy/index.html): the Maestro app gets its own section (6) before its first publication on Google Play: what the app sends and to whom (the AI providers the user enables, with the user's own keys, each provider's API data terms and retention, the Gemini unpaid tier and DeepSeek's downstream duties; the sites cited in the text and Google Public DNS; Crossref and OpenAlex, with their request logs), what stays on the device, and the Data safety declaration in the form's vocabulary (collection required and optional, purposes, the sharing exception for the user's own action, approximate location inferred from the IP). The general promises of sections 1 to 4 carry the Maestro exception, and section 4 gains the rights flow for what the user sends to those providers. Astrologo moves to section 7 and the amendments clause to section 8; section 5.1 says that the AwesomeAPI publishes no privacy policy the developer could find, instead of presenting its documentation as one; the site manifest is regenerated and the copy is byte-identical in both site repositories (maestro-android#100).

  • Update the official Linear Release Action to v0.18.1 at its full commit SHA, select the official CLI v0.18.0 explicitly and retain upstream checksum verification (LCV-316).

  • Atualizados o README, o perfil e o site compartilhado para os repositórios admin-app, sponsor-motor e mtasts-motor com código-fonte privado: o inventário passa a 11 públicos, 2 internos e 4 privados, e as superfícies públicas deixam de oferecer links de código sem acesso. Os termos de licença existentes e a paridade por bytes entre os dois sites são preservados (LCV-316).

  • Alinhado o pin oficial do upload de SARIF no starter workflow do Scorecard com o CodeQL Action v4.38.2 já usado pelo workflow deste repositório.

  • O portfólio Android deixou de ser descrito como estágio de baseline. A Calculadora Android publicou a v1.0.0 na Google Play em 20/09/2026 — port nativo em Kotlin com Jetpack Compose e Material 3, motor de cálculo em Kotlin puro, cache em Room, injeção com Hilt, sem IA, sem rastreamento, sem anúncio e sem conta, sob AGPL-3.0. As edições Android do Astrólogo e do Maestro constam como iniciadas: projeto Gradle aberto e nenhuma linha de Kotlin escrita. O perfil da organização afirmava, em quatro pontos, que os três repositórios carregavam apenas governança "ahead of their application code", o que deixou de ser verdade (LCV-203).

  • A vitrine de tecnologias do perfil ganhou a linha Mobile (Android) com Kotlin, Android e Jetpack Compose, e a página passou a declarar a camada móvel na Plataforma Compartilhada e a trazer o cartão do aplicativo publicado — até aqui o site não mencionava Android em lugar nenhum (LCV-203).

  • A publicação do www.lcv.dev na Cloudflare Pages saiu deste repositório. O operador renomeou o projeto de org-site para enterprise-site e determinou que a origem passasse a ser o .github-private, que serve o mesmo site/ também ao enterprise.lcv.dev no GitHub Pages. Aqui, o GitHub Pages segue publicando site/ — agora em org.lcv.dev. Com o deploy, saíram o cloudflare/wrangler-action, a dependência wrangler e a resolução escopada de Sharp sob Miniflare, que existia por causa dela: inventário que descreve o que não está mais aqui deixa de ser inventário (LCV-204).

Added

  • As duas cópias de site/ precisam permanecer idênticas, e nada compara dois repositórios sozinho. Cada um passa a registrar um manifesto SHA-256 do próprio site/ em site/site-manifest.json, e o workflow Site Parity compara diariamente com o manifesto que o outro publica, reprovando com o nome do arquivo divergente. Em pull request roda só a metade offline, para que a revisão não dependa de o outro site estar no ar (LCV-204).

  • Publicada a página pública de Política de Privacidade dos aplicativos Android em site/privacy/index.html, servida em https://www.lcv.dev/privacy/ pelo mesmo projeto org-site do Cloudflare Pages que publica o site (GITHORG-111 / mainsite-app#575). A página segue a folha de estilo, o cabeçalho e o rodapé do site; o texto, em português do Brasil, tem parágrafos justificados com recuo de primeira linha e títulos maiores em negrito, e cobre o que a política de Dados do Usuário do Google Play exige: responsável e contato, aplicativos cobertos, dados tratados, compartilhamento, retenção e exclusão, direitos da LGPD e a declaração coerente com o formulário de segurança dos dados. A home ganha o link "Privacidade" no rodapé e o teste de fronteira pública passa a exigir a página.

  • Acrescentado o Número D‑U‑N‑S® 583149431 à linha de identificação da empresa no rodapé, ao lado do CNPJ e da Inscrição Municipal, nas quatro superfícies publicadas deste repositório: perfil da organização, README da raiz, site e página de apoio.

  • Publicado o badge oficial "Disponível no Google Play" logo abaixo dessa linha nas mesmas quatro superfícies, apontando para a página do desenvolvedor da organização. O artefato oficial do Google é versionado em profile/assets/ e site/assets/, e sua procedência, base de uso e conformidade regra a regra estão registradas em THIRDPARTY.md, incluindo a única regra publicada que ainda não é satisfeita.

Fixed

  • Atualizadas a Action oficial Linear Release e a CLI para v0.18.0 no workflow local e nos dois starter workflows, com pin por SHA completo e versão da CLI explícita. A atualização incorpora a correção upstream na execução dos comandos Git e mantém o comportamento padrão de identificação das issues.

  • Corrigida a dependência transitiva Sharp afetada por GHSA-rgj7-g3m4-5g8c com a configuração oficial overrides do npm, limitada ao Miniflare. O lockfile foi regenerado pelo npm, preservando os gates de segurança existentes.

Changed

  • Atualizados os pins oficiais do upload de SARIF do CodeQL para v4.38.1 e do zizmor-action para v0.6.4, nos workflows locais e nos starter workflows, com os SHAs completos das respectivas releases.

  • profile/README.md alinhado ao estado medido do GitHub e da Cloudflare, após auditoria adversarial do texto do perfil Enterprise. Corrigidos: a separação das bases D1 — mtasts-motor, sponsor-motor e tlsrpt-motor compartilham bigdata_db, e a base dedicada pertence a um sistema operacional interno —, a origem da exigência de pin por SHA, que é a política de Actions da Enterprise e da organização e não uma allowlist por repositório, o alcance da ausência de bypass, válido para os rulesets de branch e tag, a verificação de assinatura de pacotes nos deploys Cloudflare, restrita ao deploy do site institucional, e os marcadores de release aferidos pelo CI do cross-review, que não lê README.md. Os itens de governança de PR e de code scanning passaram a nomear as regras que o ruleset Enterprise de fato impõe, e Code Quality entrou na lista de ferramentas de qualidade.

  • Removida da célula do calculadora-app a frase final que atribuía a modelagem do produto a uma metodologia publicada por terceiro, sem lastro em qualquer artefato daquele repositório.

05/09/2026 — Aviso de licença dos ícones publicados

Fixed

  • Publicado o texto MIT integral e inalterado do Octicons junto ao site, com link no rodapé. O aviso já existia no inventário da raiz, mas não acompanhava as duas marcas GitHub no artefato de Pages, que contém somente site/.

02/09/2026 — Governança nativa do repositório (#323, GITHORG-101)

Removed

  • O lockfile .github/workflows/actions.lock, os cabeçalhos "managed by gh actions-lock" e os gatilhos merge_group: a organização deixou de usar lockfile de Actions e merge queue.
  • O workflow codeql.yml, substituído pelo default setup do code scanning do GitHub, e o starter workflow correspondente em workflow-templates/.
  • Os workflows dependabot-automerge.yml e dependabot-automerge-signal.yml, que dependiam de uma GitHub App própria, e o teste test/dependabot-automerge-eligibility.test.mjs.

Added

  • .github/workflows/dependabot-auto-merge.yml, o padrão oficial do GitHub para auto-merge de PRs do Dependabot: sem Action, sem checkout, armando gh pr merge --auto --squash com um token pessoal guardado como segredo do Dependabot (DEPENDABOT_AUTOMERGE_TOKEN).
  • SUPPORT.md, arquivo-padrão de saúde comunitária que faltava, e o starter workflow dependabot-auto-merge para os demais repositórios.
  • O starter workflow linear-release-after-deploy, variante completa do Linear Release para os repositórios que publicam com um workflow chamado Deploy: a release só é registrada após um deploy bem-sucedido da branch padrão. Substitui a receita em comentários que o starter linear-release carregava.

Changed

  • dependabot.yml semanal (segunda-feira, 06:00 em Brasília), com um grupo de minor e patch por ecossistema, majors separados e rebase automático.
  • zizmor.yml alinhado ao exemplo oficial (zizmor-action v0.6.3, agenda semanal); scorecard.yml agendado semanalmente; pages.yml com deploy-pages v5.0.1; linear-release.yml com linear-release-action v0.17.2; dependency-review.yml só em pull_request.
  • cloudflare-pages.yml com guarda de branch main no job de deploy: um disparo manual a partir de outra ref nunca publica em produção, o que torna verdadeira a frase do site sobre pull requests.
  • test/institutional-boundary.test.mjs restrito à superfície pública (paths, marca, licença). Os validadores de forma de workflow saíram: um teste que fixa o SHA de uma action dentro de um check obrigatório impediria o Dependabot de mergear o bump seguinte, e a governança é imposta pelo GitHub (rulesets, code scanning, CODEOWNERS), não por teste do repositório.
  • THIRDPARTY.md lista dependências por nome, licença e fonte; versões e SHAs vivem só no manifesto, no lockfile e nos workflows, e o grafo de dependências do GitHub é o inventário versionado, sem deriva a cada bump.
  • Starter workflows reescritos sem instruções de lockfile e README.md, profile/README.md, SECURITY.md, CONTRIBUTING.md e THIRDPARTY.md sem referências ao trust root actions-lock-policy, à merge queue, ao controlador de automerge e ao CodeQL Advanced Setup.

31/08/2026 — Proveniência e cor da marca GitHub (#314, GITHORG-97)

Fixed

  • As duas marcas GitHub embutidas no site passam a usar o caminho oficial exato do Octicons v19.33.0 e branco puro, removendo a geometria antiga e a cor ciano fora das diretrizes atuais.
  • O inventário registra origem imutável, licença do Octicons, termos de marca e a finalidade referencial de cada uso.

30/08/2026 — Separação entre o perfil da organização e o perfil Enterprise

Changed

  • O cabeçalho do perfil público passa a nomear a própria superfície: LCV Ideas &amp; Software — Organization overview. Antes trazia apenas o nome do estúdio, o que deixava o perfil da organização indistinguível do overview Enterprise mantido em .github-private.

Removed

  • Removida a seção "Archived / discontinued" e a frase de licenciamento que registrava os termos de apphub, adminapps, cross-review-v1, grok-cli e deepseek-cli. A API não encontra nenhum dos cinco e a organização não reporta repositório arquivado, de modo que a seção afirmava um estado presente que deixou de ser verdadeiro. Os pacotes npm depreciados seguem publicados e não foram afetados.

29/08/2026 — Fronteira confiável do automerge Dependabot (#213)

Security

  • Separou a admissão automática em dois workflows locais: um sinal pull_request sem permissões, segredo, Action ou conteúdo controlado pelo PR e um mutador workflow_run carregado de main. A chave da GitHub App passa a ser lida somente depois da validação do workflow por ID/path, do run exato, dos atores, do PR e do head assinado.
  • Tratou o comportamento live em que GitHub omite workflow_run.pull_requests: o mutador resolve o PR pelo endpoint oficial de associação ao commit, exige exatamente um candidato aberto e cruza a identidade quando a lista do evento está preenchida. Nenhuma lista vazia é aceita como evidência de identidade.
  • Passou a rejeitar automaticamente qualquer adição, alteração, renomeação ou remoção sob .github/workflows/**, a paginar o inventário completo e a reler PR e arquivos antes de gh pr merge --auto --squash --match-head-commit. O fluxo continua local a este repositório e não introduz controlador central, checkout, cache, artefato, reparo de branch ou lockfile.
  • Isolou a concorrência automática por run e tentativa de origem, impedindo que um rerun rejeitado cancele o mutador legítimo da primeira tentativa no mesmo head. O Required Workflow Enterprise sem bypass permanece como autorização obrigatória de cada novo head, inclusive quando um pedido de auto-merge anterior continua armado; o workflow-fonte passa a proteger também o novo sinal.

28/08/2026 — Remoção do trigger privilegiado do automerge Dependabot

Security

  • Removeu pull_request_target, identificado pelo Zizmor em code scanning #97, e preservou o caminho automático oficialmente documentado para eventos opened e synchronize emitidos pelo Dependabot: pull_request, secret dedicado, token efêmero do GitHub App, validação da origem e da assinatura do head exato e gh pr merge --auto --match-head-commit.
  • Substituiu as exceções ready_for_review e reopened por um workflow_dispatch explícito, carregado de main, limitado ao operador por ID imutável e login, à primeira tentativa e ao environment dependabot-automation. Antes de qualquer escrita, o fallback relê o pull request e exige estado aberto, base main, branch dependabot/**, origem no mesmo repositório, autor Dependabot e assinatura GitHub válida no SHA exato.
  • Sincronizou o inventário jurídico com os manifestos e workflows vigentes: wrangler 4.125.0, github/codeql-action v4.37.9 e a Action oficial actions/create-github-app-token v3.2.0, nos SHAs efetivamente executados.

28/08/2026 — Automerge nativo e independente do Dependabot (#299, #302)

Added

  • Adicionou um workflow local que habilita o auto-merge nativo do GitHub somente para pull requests criados pelo dependabot[bot], identificado pelo autor imutável do pull request. A admissão usa um token efêmero limitado a pull requests e merge queue no repositório, preserva o SHA exato do head e deixa checks, aprovações e merge queue decidirem o merge.
  • Registrou a única Action oficial usada pelo fluxo no actions.lock. A atualização automática do lockfile pelo Dependabot hospedado continua dependente do experimento nativo do GitHub; nenhum reparador de lockfile próprio foi introduzido.

Fixed

  • Incluiu no token efêmero a permissão contents: write exigida oficialmente pela API nativa de merge. O token continua restrito ao repositório e exposto somente ao passo gh pr merge, sem checkout nem execução de código do pull request.
  • Separou os contextos oficiais de evento: ações emitidas pelo Dependabot usam pull_request, exclusivamente para opened e synchronize; ready_for_review e reopened usam exclusivamente pull_request_target, carregam o workflow do branch base confiável e exigem o operador lcv-leo por ID imutável e login do ator. Permanecem obrigatórios autor Dependabot, origem no próprio repositório, pull request não draft e correspondência do SHA exato. A concorrência compartilhada por PR serializa qualquer evento residual sem permitir cancelamento cruzado entre contextos.
  • Registrou a chave do App, sob o mesmo nome, nos stores de secrets de Actions e Dependabot. Cada evento recebe a cópia cifrada correspondente ao seu ator, sem expor a chave em código ou logs. A cópia de Actions ficou no environment dependabot-automation, restrito ao branch base main; a cópia de Dependabot permanece no store próprio, que não oferece escopo por environment.
  • Passou a validar o head exato pela API oficial de commits antes da admissão, exigindo associação ao Dependabot, committer web-flow e assinatura GitHub válida. Esse gate é defesa em profundidade; os controles autoritativos são os senders permitidos por ação, a ruleset Enterprise ativa que restringe atualizações em dependabot/** aos Apps aprovados e --match-head-commit.

26/08/2026 — Correções da review tardia do perfil (#291)

Fixed

  • Restaurou [email protected] como caixa de contato geral do perfil. A reforma havia revertido o endereço para o anterior, desfazendo a sincronização feita em 04e198f (#279), e passou a divergir de site/index.html, que já anunciava o endereço canônico.

  • Restaurou a convenção de contribuição: toda mudança no branch padrão chega por pull request e passa nos checks do repositório; push direto em main não é permitido. A reforma havia trocado esse texto pelo do panorama da Enterprise, que dizia o contrário, e a correção da rodada anterior alcançou só o item equivalente em práticas de engenharia — o de convenções ficou contradizendo CONTRIBUTING.md, SECURITY.md e o próprio documento.

  • Removeu a alegação de que o job do CodeQL reprova por achados SARIF. .github/workflows/codeql.yml executa apenas checkout, init e analyze: não há passo de contagem de alertas nem de falha. O texto agora afirma o que é verificável — CodeQL é check exigido em pull request e merge_group, e os resultados vão para o code scanning, onde os alertas são triados. A alegação era anterior à reforma e foi propagada por ela.

  • Inverteu o guard de titularidade de contenção para verificação estrutural de bloco. Cada documento protegido declara ONDE fica o seu parágrafo de titularidade — por cabeçalho ou por uma âncora top-level exata — e o parágrafo top-level seguinte precisa ser semanticamente igual ao texto aprovado. Nada pode ser acrescentado, citado em volta dentro do bloco, ou removido. Reflow por soft break continua livre.

    A inversão encerra cinco rodadas que caíram todas pelo mesmo motivo: perguntar "este texto aparece em algum lugar do arquivo?" é falha-aberto — não diz nada sobre o que cerca o achado. As tentativas anteriores fecharam um invólucro de cada vez (quebra de linha, quebra de parágrafo, ponto de abreviação) e sempre deixaram o próximo disponível, até o caso terminal: o par aprovado citado literalmente dentro de um preâmbulo negador. Contenção não restringe contexto; igualdade de bloco restringe.

    As rodadas seguintes mostraram que reimplementar apenas partes do CommonMark continuava falha-aberto: code blocks indentados, cabeçalhos dentro de fence, comentário ou HTML cru, closing hashes, tabulação em fence, autolinks confundidos com HTML e cabeçalhos aninhados em listas produziam novas rotas de bypass. O scanner artesanal foi removido por inteiro. O teste agora usa a implementação de referência commonmark 0.31.2, percorre somente os nós top-level e compara AST canônica, preservando links, ênfase, code spans, HTML e hard breaks como estrutura significativa. Âncoras ausentes ou duplicadas reprovam de forma fechada. Todos os bypasses históricos e atuais ficaram pinados como regressões.

    Fronteira declarada, porque é real: texto num bloco diferente não é alcançável por teste dessa natureza, e quem tem acesso de escrita pode editar o próprio teste. O que a verificação garante é que o parágrafo governante não deriva, não é preenchido e não é reemoldurado no lugar sem reprovar.

    Efeito colateral deliberado: reescrever o parágrafo reprova o teste. É texto jurídico — alterá-lo deve exigir mexer no guard e passar por revisão.

  • Atualizou a referência então vigente ao Project #17 em .github/WORK-TRACKING.md. Registro histórico: esse Project foi excluído em 18/10/2026 e não será recriado.

26/08/2026 — Perfil da Organization reformado e titularidade escrita por extenso (#288)

Fixed (rodada 1 do Codex)

  • Restaurou cinco afirmações que a reforma havia substituído por texto do panorama da Enterprise, mais antigo que este documento. A raiz era única: o perfil público foi redigido a partir daquele texto, e os dois documentos divergem de propósito. Voltaram a valer as redações verificadas — governança por pull request obrigatório com fila de merge nativa e squash, CodeQL como check exigido em pull request e merge_group, e Wrangler em versão exata vinda de manifesto e lockfile, com a janela de estabilização de sete dias.
  • Removeu do perfil público o identificador github-slack-alerts-db, que a reforma havia introduzido. WORK-TRACKING.md proíbe publicar identificador de sistema operacional privado, e o relay foi migrado para github-operations; a redação genérica de bancos dedicados foi restaurada.
  • Restaurou a formulação fiel do gatilho de rede da AGPL-3.0: ele alcança qualquer versão modificada com a qual usuários interajam remotamente por rede — não apenas serviço público — e obriga a oferecer o Corresponding Source a esses usuários, não apenas a publicar modificações.
  • Endureceu o guard de titularidade em test/institutional-boundary.test.mjs. A tolerância a reflow havia sido implementada com um curinga de 60 caracteres que aceitava a proposição inversa: original content is not owned by LCV Ideas & Software satisfazia a asserção. A cláusula agora é afirmativa e sem curinga, e uma asserção nova prova que a forma negada é rejeitada.

Changed

  • Reformulou profile/README.md com a linguagem visual aprovada pelo operador — cabeçalho com logotipo e animação de digitação, faixas de badges, bloco de identidade em YAML, tabelas de ícones da stack e separadores de seção — preservando integralmente o corpo institucional: catálogo de repositórios, plataforma compartilhada, práticas de engenharia, licenciamento, convenções e contato.
  • Substituiu o termo definido de titularidade pela forma por extenso "owned by LCV Ideas & Software" em LICENSE, NOTICE, README.md, THIRDPARTY.md, INBOUND.md e profile/README.md, atendendo à diretriz de que o nome da Enterprise e da Organization nunca é abreviado em prosa. O invariante permanece: a reivindicação de propriedade continua limitada ao material próprio e não alcança material de terceiros ou de contribuidores.
  • Tornou as asserções de titularidade de test/institutional-boundary.test.mjs tolerantes a reflow, para que o guard passe a verificar o invariante e não a quebra de linha do parágrafo.
  • Trocou os links relativos do perfil (./assets/, ../SECURITY.md, ../LICENSE) por URLs absolutas, já que a página renderizada da organização não resolve caminhos relativos de forma confiável.

Fixed

  • Corrigiu o inventário do perfil, que declarava 11 repositórios públicos quando o real são 15. Entraram no catálogo maestro-android, calculadora-android, astrologo-android e actions-lock-policy, este último com a explicação de por que sua visibilidade pública é exigência arquitetural do Required Workflow.
  • Corrigiu a tabela de licenciamento, conferida arquivo a arquivo: AGPL-3.0 nos onze repositórios de produto, Apache-2.0 em ultrabrain-mcp e cross-review, e proprietário em .github e actions-lock-policy. As entradas arquivadas passam a ser apresentadas como registro histórico.
  • Corrigiu o nome do produto do astrologo-app para Oráculo Celestial, conforme a página publicada em mapa-astral.lcv.app.br.

Added

  • profile/assets/section-divider.svg, separador de seção próprio, para não depender de imagens hospedadas por terceiros em uma superfície institucional.

24/08/2026 — Regime proprietário e titularidade delimitada (#280)

Changed

  • Replaced AGPL-3.0-or-later for repository revisions carrying this change with an explicit proprietary LICENSE: the original content owned by LCV Ideas & Software is now All rights reserved, while third-party and contributor-owned material retains its own terms and rights already granted for earlier revisions are not revoked.
  • Added INBOUND.md, a repository-local document that GitHub does not distribute as a community-health default: external copyrightable material cannot be merged into .github unless a separate written inbound license or copyright assignment has been executed and verified before merge. No proprietary inbound rule was added to the shared CONTRIBUTING.md or pull request template.
  • Documented the limited viewing and forking rights inherent to this public special .github repository under the GitHub Terms of Service, without granting an additional public software or content license.
  • Updated the rendered organization profile so its license badge, repository matrix, conventions, and footer no longer identify the proprietary institutional and operational repositories as AGPL.
  • Declared the private npm package UNLICENSED, expanded the third-party inventory to the directly used Actions, assigned every repository path to @lcv-leo, and aligned both applicable funding files to the lcv-ideas-software GitHub Sponsors account.
  • Preserved the institutional-boundary test that prevents organization-wide controllers and operational systems from returning to this public special repository.

22/08/2026 — Linear Release oficial

Added

  • Added a repository-local Linear Release workflow for pushes to main, using Linear's official linear/linear-release-action v0.16.0 pinned to immutable commit 0a25abab892a91062ebf42260dbb2ce6277aa205.
  • Preserved the continuous .github-org pipeline, complete Git history, dedicated linear-release environment, least-privilege contents: read grant, non-canceling concurrency, and best-effort behavior. The workflow records only this repository's commits and is not an organization-wide operational system.
  • Refined the institutional-boundary gate so it continues to reject migrated controllers and integrations while explicitly requiring the repository-local writer's trigger, permissions, environment, full history, immutable Action pin, and absence of shell downloaders.
  • Documented the accepted upstream supply-chain gap: the Action pin protects the Action source, but its installer still downloads the selected CLI without authenticating its bytes. The issue remains tracked in linear/linear-release-action#59 / LIN-82854.

21/08/2026 — Dependabot Custom Auto-merge

Removed

  • Removed the short-lived reusable Dependabot action and its tests from this special .github repository. The complete controller, scheduler, canaries, credentials, and operational ownership now live exclusively in github-operations (controller #101, ruleset validation #102, cleanup #271).
  • Removed the exception that allowed operational system code in .github; this repository retains only its institutional public surfaces and the workflows that secure or publish those surfaces.

Changed

  • Distinguished human-authored pull requests, which retain human queue admission, from Dependabot updates, whose admission is intentionally automated by Dependabot Custom Auto-merge from github-operations. Both paths remain squash-only, have no bypass actor, and must pass the same required checks again on the synthetic merge_group SHA.

20/08/2026 — Separação da operação interna

Removed

  • Removed the GitHub-to-Slack, Cloudflare Worker/D1, and GitHub–Linear operational implementations, their workflows, tests, runbooks, and dedicated dependencies from the public institutional branch after their migration to github-operations was validated (github-operations#8, tracker #3).
  • Removed all seven disabled operational workflow files still present on main. The two other disabled catalog entries, native-pr-feedback-signal.yml and add-to-project.yml, were already absent from the branch and therefore required no versioned deletion.

Changed

  • Reduced the root npm dependency graph and Dependabot configuration to the tooling still used by the two public-site deployments.
  • Kept the organization profile, public and sponsor sites, community-health defaults, and active public security/governance workflows in this repository.
  • Preserved all Git history, tags, releases, and immutable component references. Existing consumers pinned to the historical public codeql-sarif-gate commit remain unaffected by this branch-only cleanup.

15/08/2026 — Official security automation

Changed

  • Incorporated the CodeQL 4.37.7 update from Dependabot PR #197 and replaced repository-owned workflow wrappers with direct, SHA-pinned official Actions.
  • Kept CodeQL, Dependency Review, Zizmor, and OpenSSF Scorecard active with least-privilege job permissions and native Code Scanning uploads.
  • Moved the organization site's Cloudflare Pages deployment to the official Wrangler Action.
  • Recorded the accepted upstream limitation that the official Zizmor Action does not yet expose --strict-collection, without recreating a local wrapper or parallel gate.

14/08/2026 — Zizmor baseline do astrologo-app

Fixed

  • Pre-authorized the exact reviewed base and least-privilege rollout blobs for the astrologo-app deploy workflow, trusted Dependency Review workflow, and Zizmor configuration. Evidence: #189 and astrologo-app#294.

13/08/2026 — Zizmor consumer policy recovery

Fixed

  • Restored each consumer's reviewed Zizmor policy after zizmor/v2.2.0 replaced it with a central configuration and disabled all ignores. The reviewed contract was released as zizmor/v2.3.0; existing component tags remain immutable. Evidence: #189.

11/08/2026 — GitHub Actions governance sanitation

Removed

  • Retired the repository-owned auto-merge and governance controllers in favor of GitHub's native merge queue and effective Enterprise, organization, and repository rulesets (#151).
  • Consolidated the public-site format check into the Pages artifact build and removed the duplicate workflow and check context (#151).

Changed

  • Applied least privilege across workflows and retained immutable SHA pins for external Actions (#149, #151).
  • Aligned Dependabot so GitHub Actions updates can be evaluated immediately while ordinary updates in other ecosystems keep a seven-day cooldown; security updates remain exempt (#164).
  • Kept the Enterprise hardened OIDC issuer for Scorecard while preserving the official scanner and native SARIF upload (#165).

Added

Fixed

  • Aligned documentation and public surfaces with repository policy, current organization facts, and the visible site (#167, #168).
  • Replaced the public site's broken invisible contact anchor with its documented email link (#174, #168).

Earlier history

Before this changelog, the repository evolved through its commit history, covering the organization profile, the static site at https://www.lcv.dev, the GitHub Pages mirror, the sponsor page, and successive security and community-health baselines. That history is left where it is verifiable: in the signed commits and pull requests that carried it.