What changed, in plain language, newest first. Production runs application 49ada1e on schema 38. Entries marked In source describe work that was implemented before the 12 October release; the newest entry says which parts are now deployed.
Eight entries from the project record, newest first.
Live
New site, GitHub-style Projects and project-scoped device sessions go live
The hosted pilot moved to application 49ada1e on schema 38 after a verified backup and a rehearsal on a copy of production. The history digests before and after are identical.
Projects, profiles and the admin console have a repository-style layout with a command palette, activity feed, contribution graph and a read-only Branches tab.
A device holding an enrolled signing key can request a one-hour token for one project and renew it by signing again. Tokens are separated from account tokens and re-checked on every request.
The schema and API for shared project history, signing keys, storage budgets and private transfers are deployed. Shared writers stay off and no receipt-signing key is installed, so publishing to shared branches is still refused.
Add-in manifests are renamed for a future store listing. No listing exists yet.
Application 49ada1e · schema 38 · engine e5b9d94
In source
Dependencies refreshed, and a streaming audit check
Nine of the ten open dependency updates to the standalone engine were reviewed and merged. The tenth stays open because it fails to build and needs code changes.
The event log can now verify forward from a trusted position without loading everything. Review caught two bugs in the first version, a skipped negative sequence and an overflow at the maximum sequence, and both are fixed with tests.
Verifying from the start still checks every stored row. Starting later needs an independently trusted anchor.
No schema or hash format changed. All 360 tests pass in CI.
Application 15f42c6 · engine 422e011
In source
Selected-history sync from the command line
A client can plan, push, fetch and fast-forward project history against the new shared-history API, sending only what you selected.
A plan lists every commit and dependency that would become shared, including private ancestry. Push cannot add anything the plan did not show.
Fetch checks signatures, objects and receipts. Pull only fast-forwards a branch you chose and never writes to an open document.
Retries reuse what was already accepted. Stale references and corrupted objects stop with an error.
Application 47cb87f · engine 4ca7f16
In source
Shared project history, protected main and signed receipts
Schema 36 lets a project publish history explicitly, protect main with review rules and sign each branch update.
Contributors publish candidates and advance feature branches. Main applies the current project and file rules and independent approvals.
Each branch update, its signed receipt and its audit entry are written together or not at all.
Erasing a document removes the affected published history. Affected heads become unavailable and never fall back to older content.
Application 23ed7bf · engine 5f86db2
In source
Private transfers, storage budgets and device keys
Three pieces that make remote history safe to build on: who may upload, how much, and which device signed.
Signing keys are bound to an account through a short-lived challenge. Revoking one is permanent, and earlier signatures stay verifiable.
Shared storage has durable budgets (by default 1 GiB per document and 4 GiB per creator), and capacity errors say so plainly.
Private object and commit staging means a guessed hash cannot expose someone else’s draft. Quotas and erasure are enforced.
Application be538a6 · schemas 33 to 35
In source
Project revert and cherry-pick, receipts and shared snapshots
The local project repository can undo or replay a change anywhere in its history, and a client can detect a rolled-back branch.
Revert and cherry-pick apply a change, or its inverse, to the current commit and record where it came from in a signed commit. Tested fifty commits back with later work preserved.
Signed receipts and a separate client journal detect rollback, forks and missing updates. Authority keys rotate only with both keys’ signatures.
Named, deployed and public snapshots can share objects with drafts, behind an opt-in setting.
Application 7d889ac, 3218315, f8f0adb
Live
Security and runtime safeguards go live
The hosted pilot moved to application 858801c on schema 29 after a verified backup and an upgrade and rollback rehearsal.
Sessions are revocable and sign-out is enforced on the server. Saved snapshots are checked against event replay before reads, public copies and restores use them.
The API runs with restricted database credentials, and migrations are a separate operator step.
Project rules are a floor for file rules, metadata changes are audited, and browser policy and workload limits are scoped to the app.
Application 858801c · schema 29
Live
Projects becomes the front page
After sign-in you land on Projects: files, drafts, review and history in one place, with the web editors one tab away.
Member-only profiles, multiple files per project, a main version and private drafts per file, pull requests and history.
A separate Web editor tab opens the basic editor and returns to the repository.
During testing, original uploads are capped at 3 MB.
Application ecbc643 · schema 26
Live
Range recovery and six editor test builds
History can be recovered by range, and every editor connector can sign in through the browser.
Revert or cherry-pick a revision range into a private draft with explicit choices on overlap, then review it like any change.
Download historical DOCX, XLSX and PPTX files through the supported exporters.
Word, Excel, PowerPoint, Google Docs, Sheets and Slides connectors are downloadable as test packages. This is test distribution, not store publication.
Application 536a448 · schema 25
[ WHAT NEXT ]
The next entries are on the roadmap.
Rollout of schema 36 and project-scoped sign-in are the next steps that would change what runs in the hosted pilot.
