AkurAI-Build / CHANGELOG.md

Latest change cd8019fddc46769e797dc54194decfd9d4a98f2d - OLI-270: branch protection — rules per branch, pre-receive check, merge gate by Óli

# Changelog

## Unreleased

- Branch protection (OLI-270): per-branch rules (`GET/PUT /api/repos/{repository}/protection`, `DELETE …/protection/{branch}`), a `pre-receive` hook installed in every hosted repository that asks `POST …/protection/check` per ref update (fails closed), the default rule (no force-push, no delete) seeded for every default branch, and the pull-request merge refusing when the base branch requires a green run or an approved review; migration 007
- Access-control groundwork (OLI-271): `access.rs` and migration 006 (collaborators, deploy keys, scoped tokens), not yet wired to routes or git auth

- Commit history, commit diff, compare and blame: `GET /api/repos/{repository}/commits[/{sha}]`, `/compare/{base}...{head}`, `/blame?ref=&path=`, plus server-rendered pages at `/repos|/app/repositories/{repository}/commits/{ref}`, `/commit/{sha}`, `/compare/{a}...{b}`, `/blame/{ref}/{path}` (OLI-268)
- Delete repositories over HTTP: `DELETE /api/repos/{repository}?confirm={repository}` removes the rows (one transaction), hosted bare repository, browse mirror, and run artifact/workspace directories, and is refused while a run is queued or running; `akurai_repo_remove` shares the same path
- Fix `GET /api/state` without `?repo=` failing with "too many repository filters" once more than 32 repositories are registered: visibility is now a `public_only` run-query predicate instead of an enumerated name list

## 1.4.9 - 2026-07-19
Install the shared non-secret health manifest through the protected Build service deployment while keeping the worker credential mount read-only.
## 1.4.8 - 2026-07-19
Keep worker-image changes on MCP-controlled pipeline surfaces, remove the unnecessary EC2 source mount, and register PassVault in the shared production health sweep.
## 1.4.7 - 2026-07-19
- Mount the maintained AkurAI-EC2 CLI source into the worker so approval-gated application deploy jobs can resolve the host-installed CLI symlink
## 1.4.6 - 2026-07-19

- Complete branded not-found negotiation for authenticated code browsing and align responsive code-browser path and layout behavior
- Reconcile the worker table to the configured worker count on executor startup, pruning stale rows left by an earlier multi-worker configuration

## 1.4.5 - 2026-07-18

- Repair the live Build worker's `bunx` alias during protected service deployment while the next worker image preserves it permanently

## 1.4.4 - 2026-07-18

- Install self-deployed MCP and CI helpers into the worker's host bind instead of its isolated job home

## 1.4.3 - 2026-07-18

- Return exact branch-head SHAs and add bounded repository blob reads to the MCP control plane
- Install the packaged stdio MCP binary and Bun-compatible `bunx` helper through the protected self-pipeline

## 1.4.2 - 2026-07-17

- Add branded content-negotiated not-found pages, shared responsive public navigation and wordmark, compact code browsing, and meaningful directory sizes

## 1.4.1 - 2026-07-17

- maintenance release
## 1.4.0 - 2026-07-17

- Keep controller, worker, changelog, and host MCP release identities synchronized to one version and commit
- Add the `akurai_release` MCP tool: the single maintained release path for every product — bump the version (VERSION, Cargo.toml, package.json, manifest `stamp` files), cut the changelog's Unreleased section into a dated entry, commit + tag only the release bookkeeping in the trusted checkout, sync the hosted mirror, and queue the pipeline run for the release commit
- Complete the Build UI audit wave with canonical clone URLs, public/private code browsing, paginated run history, accessible details, responsive data views, CSP-clean rendering, and one repository registration surface
- Add approval-gated self-host service deployment that consumes the packaged binary, sends a bounded Docker context, atomically swaps only the HTTP service container, and rolls back on failed health

## 1.3.5 - 2026-07-16

- Redirect sign-in requests straight to AkurAI Auth, then return authenticated users to their workspace
- Make hosted Git synchronization and MCP-controlled CI/CD the canonical agent deployment workflow

## 1.3.4 - 2026-07-16

- Add a public AkurAI Build documentation route with Framework-style navigation and responsive layouts
- Replace the inherited Bunfork overview with the actual repository, pipeline, artifact, MCP, release, and security contracts

## 1.3.3 - 2026-07-16

- Redesign the public homepage around a GitHub-inspired product and community hierarchy
- Rank public repositories by real build activity and group their public source owners
- Accept process-server readiness logs from either output stream in HTTP integration checks

## 1.3.2 - 2026-07-15

- deploy.sh publish: sync the self-hosted mirror through the akurai_repo_sync MCP tool

## 1.3.1 - 2026-07-15

- Replace the JSON CLI with a full read/write MCP tool set

## 1.2.1 - 2026-07-14

- Host authenticated Git repositories over Smart HTTP with repo host/sync CLI

## 1.1.9 - 2026-07-12

- Enable verified ARM64 builds and reusable binary caches

## 1.1.8 - 2026-07-12

- Preserve non-root cache mount ownership

## 1.1.7 - 2026-07-12

- Pin actual Rust 1.97 build toolchain

## 1.1.6 - 2026-07-12

- Simplify self-hosted Rust container validation

## 1.1.5 - 2026-07-12

- Isolate build caches and bootstrap pinned CI tools

## 1.1.4 - 2026-07-12

- Run controller with Docker group and pin CI toolchain

## 1.1.3 - 2026-07-12

- Add bounded agent wait and readiness recovery

## 1.1.2 - 2026-07-12

- Harden deployment and edge diagnostics

## 1.1.1 - 2026-07-11

- Establish AkurAI Build from the Bunfork foundation with Git CI/CD, Docker matrices, encrypted state, artifacts, protected deployments, MiniJinja UI, agent skill, and managed Titan/EC2 deployment.