Reliquary Alpha
MenuClose

Alpha: things change and may break; data is backed up daily. See the roadmap.

Docs menu

Docs / Project

Changelog

What changed in each release of Reliquary, newest first.

A breaking change, a new feature and a change to how something works each get a heading and a short note; smaller changes and fixes are one line each.

Releases are made from the repository's CHANGELOG.md. The version running now is in every page's footer, linking here, and at /version as JSON. Upcoming work is on the roadmap.

0.28.0 (2026-10-23)

New

The operator can seal every plaintext vault body in place, and rotate the content key (#496)

The operator can now encrypt vault content written before writes were sealed, in place, a batch at a time, and rotate the content key the same way as the variables key. Until the backfill runs on the hosted service, older content stays as plain bytes in the database.

Changed

A person's agents share one rate limit across all their tokens (#497)

Over MCP, a person's tool calls and requests for work now count together across all their tokens and connections: 1,200 tool calls and 120 requests for work a minute per person, on top of each token's limits. You can still connect as many agents as you like; they share this allowance. Rate limit windows also no longer start on the clock minute: each counter's windows start at its own second past the minute, and Retry-After is always the end of your own window.

Every write seals its body under the content key (#484)

File text, proposals, review notes, thread messages and search vectors are now encrypted by Reliquary's servers before they reach the database, under the content key (CONTENT_KEYS) and bound to their vault; the database holds ciphertext and never the key. Content written before this release stays as it was until the backfill (#465) seals it. Storage usage counts the small envelope around each sealed body.

Fixes

  • Asking for work waits when the database is too busy to count it (#492)
  • The Netlify env file names the hand-set keys in a comment, never as a placeholder value (#480)

Performance

  • The flags hint reads what waits for the caller, not the whole log (#494)
  • A token over its rate limit is refused without reaching the database (#491)
  • Asking for work again before the gap no longer reads the plan (#493)

0.27.2 (2026-10-19)

Changed

The bytea migration sets no pgvector option, and the suites apply migrations as production's role (#476)

V0.27.1's deploy stopped at the same database migration, this time on a pgvector option the hosted database's role may not set at that point. The option is dropped from the intermediate definition it was in; the final search function never had it. Nothing people or agents see changes; this release's deploy runs v0.27.0's migrations. From now on the test suites apply migrations as a role shaped like the hosted database's, so a statement production would refuse fails before a release is cut.

0.27.1 (2026-10-19)

Changed

The body writers convert text themselves; no cast for hosted Supabase (#474)

V0.27.0's deploy stopped at a database migration that hosted Supabase refused (a cast it may not create), so production stayed on v0.26.0. The migration is rewritten without it and the functions that store file, proposal, note and message text convert it to bytes themselves. Nothing people or agents see changes; this release's deploy runs v0.27.0's migrations.

0.27.0 (2026-10-19)

This release gives the web app search by meaning, emails members about the threads that reach them, adds a Hackathon vault template, encrypts off-site database dumps, and lays groundwork for encrypting vault content: a content key set both servers need, content stored as bytes, references and search moved from the database into the servers. Hosted: set CONTENT_KEYS in both Netlify sites before deploying.

New

Off-site database dumps are encrypted with age before they touch disk (#455)

Off-site database dumps are now encrypted with age before they are written, so a laptop that holds them holds only ciphertext. The restore test decrypts them with an identity the operator keeps outside the repo. Self-hosters get the same recipe in the self-host guide.

A content key set, separate from the values key, held by both servers (#467)

A content key set (CONTENT_KEYS) is now required by both servers, separate from the values key, ahead of encrypting vault content. Self-hosters: deploy/setup.sh generates it; hosted: set it in both Netlify sites before deploying.

A Hackathon template under Start from on New vault (#454)

New vault has a Hackathon template under Start from, for a short team event such as a hackathon, a sprint or a launch week. It sets up the event's rules and roles as canon, a plan file with a work_plan block ready to register, a research folder whose start-here file keeps corrections at the top, and a scratch folder, with a README that tells people and agents to keep one fact in one file and to put keys on the Variables page, never in chat.

Email a member when a thread is for them or their whole vault (#458)

Reliquary emails you when a thread is opened for a whole vault you're in or addressed to you, and when such a thread gets new messages: one email per thread once it has been quiet for two minutes, with its title, who wrote and a link, never the messages themselves. Turn them off with Email me about threads on Account settings.

The web app's search finds files by meaning too (#456)

The web app's search finds files by meaning: ask "what are we charging" in the top bar or a vault's search page and it finds the pricing file even when they share no words, as your agent's search already did. If search by meaning is unavailable, the page says so above results that match words only.

Changed

A proposal on an owned path waits on its named owners only (#457)

A proposal on a path with named owners is flagged to, and listed in the Inbox of, those owners only, whatever their role in the vault. The vault's other owners and editors, whose approval doesn't count on that path, are no longer told it waits on them.

References are found by the server that writes a file, not a trigger (#469)

The references between files ([[path]] and Markdown links to .md files) are found by the server that saves a file and recorded with the write, instead of by the database reading the text. What a file's page and related_files show is the same. This is a step of vault content encryption (#238).

Search runs in the server, over a vault's newest 2,000 files (#471)

Search runs in Reliquary's servers instead of the database, a step of vault content encryption (#238). Words are matched over each file's first 10,000 characters (a longer file is still found by its name and its opening), and a search reads a vault's newest 2,000 files, saying so when there are more. Stored search vectors are rebuilt by the next search of each vault, so a file may be found by its words only until then.

Vault content columns are bytea, their text kept as it is (#468)

Vault content is stored as bytes in the database (its text unchanged), the shape the coming encryption of vault content needs. Nothing people or agents see changes.

Fixes

  • The restore test handles pgvector and rows that point at auth.users (#460)
  • The changelog tiers survive an issue number in a pull request's title (#452)

0.26.0 (2026-10-19)

Links are easier to keep running: an owner can replace a link's credential or refresh its tools without losing its grants, send the credential in the header its service expects, and see every call agents made through it. Signing in to the hosted service now means agreeing to the terms. This release applies 4 database migrations.

New

A link's Calls page shows who used it, with which tool, and how it went (#448)

A link now has a Calls page that shows every call agents made through it: who made it and through which agent, the tool, how it went and how much came back. Arguments and answers are never stored or shown. The Links list shows each link's last call and how many calls it had in the last 7 days. Owners and editors see calls; viewers don't.

A link can now send its credential in the header its service expects. The Add and Edit forms on a vault's Links page have a Header field: leave it as Authorization to send Bearer <credential> as before, or type another name, like X-Api-Key, to send the credential as that header's whole value. Existing links keep Authorization.

An owner can replace a link's credential, or refresh its tools, from the link's menu on the Links page without deleting the link. The link keeps its name, URL and grants, and its call history stays under one link. Either action runs discovery again and says which tools were added and removed.

Changed

Signing in to the hosted service now asks you to tick one box, agreeing to the Terms and Privacy Policy and confirming you're not based in the EU, EEA, UK or Switzerland, where the alpha isn't offered yet. Reliquary keeps a record of which terms version you accepted and when. The terms also say how to report copyright infringement, when anyone at Red Mage looks at your content, and what happens to your data when authorities ask for it.

Smaller changes

  • A deploy checks that search by meaning works, and its setup can't break other secrets (#438)
  • Say how long the oldest proposal has waited in session brief (#408) (#413)

Fixes

  • The other release pull request stays in tiers when one is merged (#435)

0.25.0 (2026-10-18)

Search finds files by meaning, not only by shared words, and a file now shows what it refers to and what refers to it. There is a Reliquary plugin for Claude Code, Threads marks what you haven't read, and vault owners can see which searches found nothing. A work plan's for: line names a member by their short tag instead of their email. This release applies 7 database migrations. The command line's changes are in its own changelog, as CLI 0.5.0.

New

Find files by meaning, not only by shared words (#396)

Agents' search now finds files by meaning as well as by shared words: asking "what are you charging" finds a pricing note that talks about seats and plans. It runs on Supabase's built-in model, with no third-party AI provider and no key to set up. If it is unavailable, search answers by words and says so on its first line. Self-hosting: the database image is now pgvector/pgvector:0.8.2-pg17-trixie, and search by meaning is the optional embed compose profile.

A Claude Code plugin that connects to Reliquary and briefs you on what changed (#391)

There is a Reliquary plugin for Claude Code: claude plugin marketplace add andersthemagi/reliquary, then claude plugin install reliquary@reliquary. It connects Claude Code to Reliquary, teaches it how to work in a vault, briefs you on what changed when a session starts in a project linked to a vault, and reminds you to propose an update after git push.

See which files refer to each other (#394)

Reliquary now keeps track of which files refer to each other, through [[path]] references and Markdown links to .md files. A file's page lists its References and what it is Referenced by, and agents get the same with the new related_files tool.

Threads shows which threads have unread messages (#431)

The Threads page marks a thread Unread when someone else, or an agent (your own included), has posted since you last opened it. What you have read is yours alone: no other member and no agent can see it.

Vault owners see which searches found nothing (#429)

Vault owners can see what people and agents searched for and didn't find, under Settings, General, Searches that found nothing: a gap in the vault, or words it uses differently. It keeps the words, whether a person or an agent searched, and when, never who. Entries are kept 30 days unless an owner changes it (1 to 365), and only owners see or clear them.

Search results show the lines that matched, not the start of the file (#400)

Search results in the web app now show up to three lines that contain your words, with the words highlighted, instead of the start of each file.

Changed

A plan names a member by tag, never by email (#432)

In a work plan, for: now names a member by their short tag, the 8 characters shown beside their name (for: 3fa85f64), instead of their email, so plan files no longer carry addresses to agents. Plans already registered keep working. Registering a file whose for: line still holds an email is refused until it uses the tag.

Smaller changes

  • New file warns when a path has no extension or has spaces (#417)
  • One-click install for VS Code on the Connect page (#421)
  • A how-to and agent guidance for keeping call and meeting notes in a vault (#411)
  • The Claude Code skill tells agents to search first and follow related files (#416)
  • The changelog gives new, changed and breaking work a heading and a note (#434)

Fixes

  • A held step is released, not deleted, when its holder leaves the vault (#428)
  • Landing page says what Reliquary is in one line (#423)
  • Screen readers name Members buttons, feedback hints and empty states (#402)
  • dev.sh lists every subcommand and prints usage before creating .env.dev (#414)

Performance

  • Search in a small vault no longer scans every vault's files (#419)

0.24.0 (2026-10-13)

Agents can now ask a vault for work and wait in line for it, first come, first served, and one call tells an agent where it stands in every line. A task can be held for a person's review, carry a due date, priority and notes, and show when a file it cites has changed. Each vault gets its own request budget, so one busy vault can't slow the others. You choose whether people see your email, and you can delete your account while you own vaults: members can then take an orphaned vault over. The web app has a new look, with a vault overview, a grouped sidebar and simpler Tasks, Variables and Settings pages. This release applies 19 database migrations.

Features

  • account: choose whether people see your email, and vaults can require it (#376) (fe902f1)
  • account: delete your account while you own vaults; members can take an orphaned one (#384) (c1b78d2)
  • export: a vault's export includes its threads (#328) (f99da04)
  • mcp: agents ask for work and wait in line over MCP (#354) (12a7654)
  • mcp: agents get the server's current time in UTC (#326) (5f9738a)
  • mcp: list Reliquary in the official MCP registry with a server.json entry (#322) (6df5e55)
  • mcp: one call tells an agent where it stands in every line (#355) (3f3fb29)
  • site: show the product on the landing page and in the README, a reel and real screens (#319) (45c7263)
  • tasks: a registered plan gains new tasks when its file changes (#329) (334efa5)
  • tasks: a review-gated task holds what waits on it until a person approves (#356) (aff4981)
  • tasks: a task can carry a due date, priority, notes and who it's for (#374) (06857b7)
  • tasks: a task shows "context moved" when a file it cites has a newer version (#324) (bc094d1)
  • tasks: agents wait in line for work, first come, first served (#349) (a57c398)
  • tasks: each vault gets its own request budget, so one busy vault can't slow the others (#358) (d5cf74d)
  • tasks: people who can approve a task are flagged when it awaits their review (#369) (798923d)
  • tasks: reopen a cancelled task from the Tasks page (#327) (9feea58)
  • tasks: the plan page shows who is waiting for work, in order (#350) (e7989bb)
  • web: a vault opens on an overview of what's waiting, in progress and new (#373) (2006e68)
  • web: a vault's sidebar and front page, grouped, labelled and full width (#340) (abcaaad)
  • web: a vault's Updates page puts what's new for you above the changes (#370) (cf876da)
  • web: an identity of its own: square corners, Atkinson Hyperlegible Next, mono metadata (#363) (bb30482)
  • web: Home shows your vaults and shared vaults as cards (#343) (4b9e7a0)
  • web: Links, Connect and Account settings show the list first (#368) (006500b)
  • web: proposals and threads share one row, and a proposal's decision sits beside its diff (#372) (a89a777)
  • web: Settings gets a grouped sub-nav, and Members splits people, invites and agents (#345) (ba08584)
  • web: Tasks reads as a simple list, with who is on each task (#344) (c34a7cd)
  • web: Variables shows one row per variable, with environments as views (#342) (cdbb9a1)

Bug fixes

  • account: a vault no longer decides whether members' emails show (#382) (0116ae5)
  • tasks: deleting a vault no longer deadlocks with claiming or finishing a task (#325) (02d0c6c)
  • tasks: rule presets set how long agents wait in line and how often they check (#351) (6ac488f)
  • tasks: two work plan messages say what actually happens (#365) (fcdaf9e)
  • web: show less on a vault's pages, and one section menu on phones (#375) (0b35bb0)

0.23.0 (2026-10-13)

The legal pages now name who runs Reliquary, Memento Vivre Fine Arts LLC (doing business as Red Mage), a Colorado company, under Colorado law. The privacy policy adds US state privacy rights, and gathers what will apply in the EU, EEA, UK and Switzerland, where the alpha isn't offered yet, in one marked section. The pages stay marked draft until their legal review. No database changes.

Features

  • web: the legal pages name the Colorado LLC and add US state privacy rights (#316) (34f254f)

0.22.0 (2026-10-12)

Reliquary's alpha is closed, and the site now says so. The landing page's button is Request access: a short form (email, country, a note on your team and AI tools) that goes to the operator, who replies with an invite. Sign in stays for people who already have an account or an invite. No database changes.

Features

  • web: request access through a form instead of open sign-up (#313) (700b247)

0.21.0 (2026-10-12)

The landing page links the code on GitHub, with its star count, in the top bar, the hero, Source available, the closing and the footer; the server reads the count from GitHub and leaves it off when GitHub does not answer. The link preview image shows the current tagline. No database changes.

Features

  • web: the landing page links the code on GitHub with its star count (#294) (60092be), closes #293

Bug fixes

  • web: the link preview image shows the current tagline (#291) (18e57ef)

0.20.0 (2026-10-12)

The operator is emailed once when someone new joins: their address, when they confirmed it, and where they stand (let in, their place in line, or held by invite-only), with the command to let them in now. Accounts that already existed are not emailed. One database migration, applied by the deploy.

Features

  • web: email the operator when someone joins (#289) (be3b2e3)

0.19.1 (2026-10-12)

On a phone, the landing's hero and closing buttons now stack full width and the section spacing tightens, as 0.19.0 intended. No database changes.

Bug fixes

  • web: the phone layout's rules apply to the landing's hero and closing (#286) (136c2a2)

0.19.0 (2026-10-12)

The landing page works properly on a phone: the site's links and Sign in fold into a menu, buttons stack full width, and the spacing fits the screen. It also gains a Why Reliquary section, an Alpha badge that matches its band, and examples that use roles instead of names. No database changes.

Features

  • web: the landing says why Reliquary, with a menu drawer and a badge that fits the band (#284) (a79a89f)

0.18.0 (2026-10-12)

Reliquary is now in alpha, and says so everywhere: the badge, the docs, the terms and a new Status section on the security page that always names the running release. The landing page is redesigned: it shows how agents, a vault and people fit together, lists what an agent can never do, and lets you try approving a proposal with no script. The real logo replaces the placeholder in the top bar, the favicon and link previews. No database changes.

Features

  • web: landing opens with the agent ceiling and an H1 that states the mechanism (#276) (7c299cc)
  • web: show the Reliquary logo in the top bar, favicon and link preview (#274) (e88fe40), closes #273
  • web: the landing page becomes a poster (#280) (8a4bd3e)
  • web: the landing's proposal card can be approved, with no script (#278) (4837047)
  • web: the security page says the current stage and release (#281) (c16fd8a)

0.17.1 (2026-10-11)

Security

  • ratelimit: on Netlify only Netlify's client-address header counts, and a self-hosted proxy ignores it (#257) (6ad4599)

0.17.0 (2026-10-11)

Features

  • anyone can sign up to the pre-alpha, and new accounts are let in steadily from a line (#231) (be12fd0)
  • hosting: move the web app and the MCP endpoint from Vercel to Netlify (#249) (3f92a7b)
  • web: the roadmap is the GitHub project board, and /roadmap goes there (#213) (799a9b8)

0.16.2 (2026-10-09)

Phone layouts stop hiding tabs off-screen and use fingertip-sized controls, and agents get more from the MCP server: every tool says whether it reads, adds or destroys, every argument is described, bad arguments and cut-off lists say what to do, and names people choose are fenced as data. The three cli: entries are the CLI's own changes, to be released separately as 0.4.2, and are listed here because they touched shared files; one adds a database function, so a push refused at 20 waiting says to apply or reject some, not to wait.

Bug fixes

  • cli: a push refused because 20 are already waiting says to apply or reject some, not to wait (#184) (ef4e7ac)
  • cli: a slow token refresh keeps its lock, and a lock is only removed by the process that owns it (#178) (ddacbea)
  • cli: Ctrl-C reaches the command once, and file and git problems are explained instead of reported as bugs in the CLI (#175) (6f819ba)
  • mcp: bad arguments get a reference, names people chose are fenced as data, and cut-off lists say how to go on (#180) (0ef8fb6)
  • mcp: every tool says whether it reads, adds or destroys, and every argument says what it is (#173) (b5087a2)
  • mcp: list_claims names each holder in its people line, so an agent can tell which claim is its person's (#182) (33e3a2c)
  • web: on phones, tabs wrap instead of scrolling out of sight, the Pre-alpha badge has room, and controls are 44px (#179) (72e7d53)

0.16.1 (2026-10-09)

Adds a Connect an agent button beside New file on every vault's front page, so you can connect an agent from any vault at any time; before, the way in was the first-run step of a vault's first 14 days, or the inside of an empty vault. No database changes.

Bug fixes

  • web: every vault's front page has a Connect an agent button beside New file, so connecting an agent no longer depends on the first-run step (#169) (79dbd6d)

0.16.0 (2026-10-09)

Adds a guided path from a new vault to its first connected agent, claim rules for a whole vault, and setting a variable in several environments at once; the rest hardens what exists: link credentials follow key rotation and a link's URL can no longer carry a key, approvals apply only the revision the reviewer read, a stale save can't bring back a deleted file, a cancelled export or dropped database connection no longer stops the server, and token and consent screens no longer preselect all vaults for someone in several vaults. Five database migrations apply before the new code goes live.

Features

  • web: guide a new vault to its first connected agent (#157) (caf4408)
  • web: set a claim rule for the whole vault, on a claim rules page that explains itself (#140) (e07cae9)
  • web: set a variable in several environments at once (#132) (2126370)

Bug fixes

  • cli: say a failed command's exit code is the command's, not Reliquary's (#131) (cdbd800)
  • db: a save made after someone deleted the file no longer brings it back (#167) (c6b9846)
  • mcp: a failed link call tells the agent where it broke, with a reference, and never what the upstream said (#166) (cbea61e)
  • mcp: annotate advance_flags as non-destructive and idempotent (#134) (9bf2e0a)
  • mcp: tell agents an approved proposal can't be revised (#133) (47e32c1)
  • mcp: two vaults' same-named link tools no longer hang every request, and upstream tool text is quoted (#165) (11e12cc)
  • review: an approval applies only the revision its reviewer read, and two at once can't both apply or deadlock (#160) (ed30a58)
  • variables: key rotation re-encrypts link credentials too (d695a27)
  • web,mcp: a cancelled export download or a dropped database connection no longer stops the server (19fa99a)
  • web,mcp: an oversize request body is answered with its limit, and invite links opened together no longer stall (c57dae1)
  • web: a refused save keeps you in the form you were in, on Links, Environments, Watching, tokens, vaults and account (#146) (7ed8f40)
  • web: an applied proposal shows what it changed; warn before approving one whose file moved (#148) (aa665ab)
  • web: don't preselect all vaults when connecting an AI (#138) (5e589ea)
  • web: invite sign-in recognises an accented address however it is typed and says so when it can't look an invite up (#164) (f7908ff)
  • web: menus on Rules, Links and Inbox rows open in full instead of a clipped sliver (#139) (45a05e6)
  • web: no links to pages that 404, thread flags that say what they are, a rule that can never be approved says so (#150) (47190ad)
  • web: phone table rows, a wrapping Links URL, no buttons that only scroll, a locked Change path (#145) (c5e4fc9)
  • web: refused file and proposal forms keep what you typed; Create file never overwrites (#147) (74f7174)
  • web: renewing a session no longer signs people out when Supabase Auth is busy, and is limited per IP (714c194)
  • web: template READMEs call variables examples and say what to do without npx (#135) (f05c39a)
  • web: the page that answers a refused save keeps the top bar's vault switcher and inbox (#143) (ace181f)
  • web: variables keep multi-line values intact, ask before replacing one, and every refusal carries a reference (#149) (39d451e)
  • web: vault page copy says what is true: links are callable, no Rotate, no quorum, Erase file (#144) (f937baf)

Security

  • links: a link's url refuses a user name, password, query string or fragment (#161) (5518ce4)
  • web: a refused client-metadata or link-discovery answer no longer holds its connection open (06d56a3)
  • web: the Feedback popover no longer sends an invite link's token (#141) (9f89ed2)

0.15.0 (2026-10-03)

Vaults get threads, conversations between members and their agents, with a Threads page and four MCP tools, and work plans get a Tasks page and MCP tools to register a plan and work its steps. Changes replaces Activity in a vault's navigation as a plain-language feed, flags and claims move under Diagnostics, a file's page shows who is working on it, and agents are told when flags are waiting.

Features

  • claims: checkin_step for work plan steps (CL-3.2 gap, #70) (#115) (5568e5a)
  • claims: the work plan block's grammar and parser (CL-3.1) (#108) (faa09cb)
  • claims: work plan tables and functions (CL-3.2) (#109) (c2b07b5)
  • db: threads and messages inside a vault (#126) (2750846)
  • flags: flag a vault's thread messages to the members they reach (#127) (c5fbdcd)
  • mcp: open, read and post to threads over MCP (#129) (c1afd23)
  • mcp: register work plans and work their steps over MCP (#124) (0992cc1)
  • mcp: tell an agent when flags are waiting (#130) (7e88b0a)
  • path-ownership: a named owner gets edit-and-approve, comments and the web app's controls (#105) (cddaedb)
  • web: a plain-language Changes feed for each vault (#123) (2ad8a34)
  • web: a Tasks page to see and steer a vault's work plans (#122) (c93c436)
  • web: a Threads page where people and their agents talk about the work (#128) (0e308de)
  • web: filter Changes to what you made or watch (#125) (e48a2d8)
  • web: move flags and claims under a Diagnostics area (#121) (e406bc5)
  • web: show who is working on a file, and let an owner or editor break the claim there (#120) (d393fe3)

Bug fixes

  • db: asPerson treats a failed rollback as a broken client (#107) (6d4b2f1)
  • web,mcp: map work plan step SQLSTATEs to a status and a name (#114) (c0636de)

0.14.0 (2026-10-01)

Features

  • claims: claim rules -- setter, presets and the web control (CL-2.7) (#100) (d14db01), closes #69
  • claims: lock order against delete_vault and erase_file (CL-2.2) (#96) (f6e225c), closes #65
  • claims: path claims table and functions (CL-2.1) (#95) (07f8bb1), closes #63
  • db: write_file and delete_file accept an expected version (#85) (bc0223a), closes #57
  • mcp: claim tools over MCP, and read_file shows an active claim (CL-2.4) (#98) (9a4d7ec), closes #67
  • mcp: read_file returns the file's current version id (#84) (a9520d5), closes #56
  • mcp: write_file and delete_file take expected_version (#87) (6f4fec0), closes #59
  • web: a vault's Claims page, and the Break action (CL-2.5) (#99) (a3f8991), closes #68
  • web: reframe the landing page from reader-check findings (#51) (6089bb2)
  • web: the editor carries the file's version and shows a conflict (#88) (1d83642), closes #60

Bug fixes

  • signin: double-tapped invite sign-up no longer shows 'Sign-in is unavailable' (#102) (1ef93d2)
  • signin: double-tapped invite sign-up no longer shows "Sign-in is unavailable" (1ef93d2)

0.13.0 (2026-09-29)

An owner can now make an invite link for anyone to use, up to a set number of joins, instead of one for a single known address. A gap in feedback's NUL-byte check is closed too.

Features

  • web: open invite links, good for anyone up to a use count (95afd75)

Bug fixes

  • mcp: refuse a NUL byte in feedback's context field too (#46) (5be8c10)

0.12.0 (2026-09-29)

The public-facing repo and site get a refresh: a new hero headline ("The canon for humans and agents."), real CI status badges and GitHub's standard community-health files (security policy, code of conduct, contributing guide) on the README, and CodeQL scoped past its test-file false positives.

Features

  • web: note why the hero headline changed (#41) (1c70741)

Security

  • ci: scope CodeQL past test-file false positives (26bdf77)

0.11.1 (2026-09-29)

Security work ahead of making this repository public: automated scans for leaked secrets, vulnerable dependencies and risky code on every push, and business-strategy or legal-draft content moved out to a private repo. Also two CLI reliability fixes: npm publishing now uses trusted OIDC publishing instead of a stored token, and a CI ownership bug that could break the release build is fixed.

Bug fixes

  • cli: publish to npm by trusted publishing, not a stored token (9110119)
  • cli: reclaim root-owned files before the runner's own npm ci (945e782)

Security

  • ci: add CodeQL static analysis (ed56b9c)
  • ci: flag a live secret or a high/critical dependency vulnerability before it hits main (3f8363e)
  • ci: stop trufflehog failing on unverified findings (a8b540c)
  • docs: move business strategy and draft licensing out; scrub a real vault name from a test fixture (57e9fc5)
  • docs: the citation fixes and fixture rename from the last commit (255e63c)
  • publish-cli: gate npm publish on a clean audit (e406fc0)

0.11.0 (2026-09-29)

A Flags tab in every vault, so you can see what's changed without asking your agent, plus two layout bugs fixed: nav links that could hide behind the search box, and file or proposal text that could get cut off instead of wrapping.

Features

  • web: every vault has a Flags tab: a proposal waiting on your review, your own proposals, and paths you watch, the same things your agents have been able to see over MCP since 0.9.0 (d0e0668)

Bug fixes

  • web: the top navigation could overlap the search box and hide the Docs and Connect links on many window sizes; it now always gets its own row (0a14728)
  • web: long, unbroken text (a URL, say) and wide tables in a rendered file or proposal could get cut off instead of wrapping on a narrow screen; both now wrap (0a14728)
  • db: two database indexes the performance advisor flagged (account plans, vault storage tiers) are now in place; nothing user-visible, just cheaper lookups (f4a6c1b)

0.10.0 (2026-09-28)

Features

  • mcp: call a link's granted tools as <link>.<tool> (8f59e88)
  • web: a vault's Links page, to add, edit and delete a link (0df6b2d)
  • web: discover a link's tools when it's added (bdffac5)
  • web: grant a link's tools per role from a Grants page (95f0923)
  • web: name and remove a path's owners from Rules (e52d3c7)
  • web: watch and unwatch folders and files (c59ffca)

Bug fixes

  • db: cascade path_owners rows off vault membership (a84c202)
  • db: renumber F417 to F426 after merging origin/main (293e6a9)
  • web: close three unclosed @media blocks in style.css (9051d10)

Security

  • db: a named path owner's write access now respects their connection's scope (ef59088)
  • db: the MCP proxy's credential-egress chokepoint for links (b7b13ad)
  • export: refuse Windows-unsafe file paths and rename them in exports (54fa289)

0.9.0 (2026-09-28)

Features

  • mcp: list_links, list_flags, advance_flags, list_subscriptions (af6ca6f)

0.8.0 (2026-09-28)

Features

  • db: flags and watched paths, schema and SQL functions only (f8f087e)
  • db: links to upstream MCP servers, schema and owner-only management (b100dd1)
  • db: path ownership, alongside links (2b621ce)

0.7.0 (2026-09-26)

Features

  • web: a welcome tour for new accounts, and from the account menu (f99ab5d)

Bug fixes

  • deploy: the self-hosting check expects the welcome tour on a new owner's first sign-in (fe2fb55)

0.6.0 (2026-09-26)

Features

  • db: a staff plan and per-vault storage grants (5036b91)

0.5.0 (2026-09-26)

Features

  • cli: the CLI speaks of its connection, and points to the Connections page (1bfc8de)
  • deploy: run Reliquary on your own server with Docker Compose (109a991)
  • feedback: deleting an account deletes its feedback (9bc56af)
  • feedback: send feedback and bug reports from the web app and through your agent (d5f1937)
  • site: name Resend as the email sub-processor (767fdcd)
  • the server is source-available under the Functional Source License (FSL-1.1-ALv2) (f1d068d)
  • web: a top bar with a vault switcher, search, an inbox and account settings (b8907c5)
  • web: Activity puts filters behind a Filters button with removable chips, says who a member change was about, and reads as a list on phones (258899a)
  • web: change your email address from Account settings (9e8f420)
  • web: Connections moves to /connections, with one vocabulary for connections (287202c)
  • web: Connections page lists what can act as you first, with New token on its own page and a confirm step to revoke; Connect shows one client per tab (64fab52)
  • web: delete your account from Account settings (372f85b)
  • web: email vault invites through Resend (25398ab)
  • web: file pages put Delete and Erase behind a More menu and confirm pages, and vaults show their sections as tabs on phones (87db1f7)
  • web: Home lists your vaults as a table with your plan's count, and New vault shows template cards and stops at your plan's limit instead of offering a form it would refuse (0f670fd)
  • web: join or decline an invite from your Inbox, no link needed (6a20571)
  • web: messages after a form show as success, warning or error under the page title (2221964)
  • web: new sign-in, confirmation and account email templates (1580a19)
  • web: proposal discussions show times as "6 min ago" with the exact time on hover (8eb8839)
  • web: proposal pages keep a refused decision's note, show how a proposal ended, and count proposals by state (bdeb1ec)
  • web: rules page lists rules first, asks before removing one, and refuses approvals outside 1 to 20 in the form (6f810ca)
  • web: sign out everywhere from Account settings (72df7ab)
  • web: sign-in explains invite-only access, and sign-in and invite failures carry a reference (e4552d7)
  • web: variables page shows one menu per value, with Values, Environments, Access log and Imports tabs (a068142)
  • web: vault settings as tabs, invites on their own page, and limits shown before a refusal (9a33903)

Bug fixes

  • db: changing a plan or a tier waits for writes and acceptances in flight (80257fc)
  • db: invite links work however the address's accents are encoded (af2ce75)
  • db: rules refuse paths outside the vault (c2a0b5b)
  • db: writing, erasing, inviting and deleting a vault at once no longer deadlock (3211fe9)
  • deploy: a self-hosted instance's first account can create vaults (e5a5f9b)
  • web: Activity names every event in plain words (4d4d8cb)
  • web: editing lines of a proposal no longer flags it as removing them (e17185b)
  • web: keep the confirm page's notice import after merging sign-in changes (79ed3db)
  • web: the Variables page links to the CLI tab on Connect (ae3fddf)

Security

  • db: accounts need an invite or the operator's admission to create vaults (7e406e1)

0.4.0 (2026-09-25)

Features

  • db: plans and limits: vaults per account, people and storage per vault (63170a1)
  • mcp: plan limits reach agents as clear errors, and list_vaults notes a vault near a limit (83e8d3b)
  • web: plan and usage on Home, Account and vault Settings, and limit errors where they happen (1973901)
  • web: pricing shows the plans and their limits (ae86bf9)

Bug fixes

  • cli: print the server's reason and reference, and why a request got no answer (1b62920)
  • mcp: tool errors say what failed, where and why, with a reference (59ac4db)
  • web: error pages say what failed, where and why, with a reference (98b810b)

0.3.0 (2026-09-25)

Features

  • cli: keep sign-ins in the OS keychain (macOS Keychain, Secret Service, Windows DPAPI) (dc9c1d4)
  • mcp: rate limit tool calls per token and unauthenticated requests per IP (f0b0bfb)
  • web: rate limits on sign-in, OAuth, invites, the env API and forms (b5f1dbe)
  • web: start a new vault from a template (7e59595)

Bug fixes

  • cli: publish under the MIT licence (236c7db)
  • cli: run npm, npx and pnpm on Windows, and merge variables without case duplicates (972a7d8)
  • cli: say when to retry after the env API's rate limit (78e1174)
  • variables: refuse Windows start-up, trust-store and npm config names (f05b7d2)

0.2.0 (2026-09-25)

⚠ BREAKING CHANGES

  • cli: a .reliquary.json or RELIQUARY_URL naming https://reliquary.redmage.cc must change to https://app.reliquary.redmage.cc, then run reliquary login again.

Features

  • cli: the default server is https://app.reliquary.redmage.cc (2e0916b)
  • web: serve the public site and the app on separate hosts (2c0eeef)

0.1.0 (2026-09-25)

The first versioned release: everything live on 2026-09-25.

Vaults, files and review

  • Vaults with owners, editors and viewers; open files anyone who can write edits directly, and canon files (by folder or file, with a quorum) that change only through approved proposals.
  • Proposals with approve, request changes, reject, and edit & approve; revisions void earlier approvals; nothing becomes canon without a person.
  • Proposal threads (people and, over MCP, their agents) and private snooze in the Review inbox.
  • Unified, split and rendered diffs with word highlights; Activity per account and per vault, filterable and paged; a file's History.
  • An append-only log of every change; erasing a file blanks its text and keeps the record.

Agents over MCP

  • A remote MCP endpoint: read, search, write open files, propose, revise, comment, follow changes (changes_since), create vaults and delete open files, with entry text always returned as quoted data.
  • Agents act as their person, minus a ceiling enforced in the database: no approving, no revealing variable values, no managing members, no deleting or exporting a vault.
  • Parity between the web UI and MCP for everything an agent may do.

Sign-in and connectors

  • Sign-in with Supabase Auth.
  • MCP OAuth 2.1 with the web app as the authorization server, so Claude Code, Claude.ai and ChatGPT connect by signing in, with client ID metadata documents.
  • Scoped, expiring agent tokens (chosen vaults or all, read-only or read-write, 1 to 366 days) with last use and client name on the Tokens page.

Environment variables and the CLI

  • Environments and variables per vault, encrypted in the web app; people set, rotate, delete and reveal them; agents only ever see names; every read and reveal is in an append-only access log.
  • The reliquary CLI (login, logout, vaults, run, env pull, env push), signing in over OAuth.
  • Imports: paste a .env on the Variables page or push one from the CLI; a person previews it (names only) and applies it.
  • Custom environments, limits, and key rotation without downtime.

Members and vault administration

  • Members and invites: single-use invite links for one address, role changes, removal (a vault always keeps an owner), leaving, and cutting off a member's agent connections.
  • Vault settings for owners in person: rename, default policy, export as one .tar.gz snapshot (never variable values), and deletion with a notice to the other members.

Hardening and performance

  • Every permission is a row-level security policy or trigger, with hostile tests on every push.
  • Size ceilings and rate limits (invites, exports), pinned search paths, and one pooled connection and transaction per request; fewer round trips on every page and tool call.

Operations

  • Hosted on Vercel (web and MCP, Frankfurt) and Supabase (Frankfurt, Pro).
  • A deploy pipeline (migrations, then both apps, then smoke checks), hourly uptime checks with an outage issue, and off-site backups with a restore test.
  • A public site with landing, legal and trust pages.
  • Versioned releases: a release pull request collects this changelog, and only a published release deploys; GET /version on both apps and the version in the web footer show what is live.

For agents: this page as Markdown, and every page at /llms.txt.