Changelog
Every Hatamoto release, newest first.
v1.0.0 canary
Features
- builder-ux-canvas-inspector: canvas toolbar, + handles, zoom and device band; inspector Style tab, Show on, element restore (#320)
- fix-cookie-auth: API cookie sessions get their own kind, cookie and bound CSRF token (#308)
- fix-canvas-scripts: no page scripts in editor frames, private canvas port (#312)
- pw3-preflip: sandboxed pageview fetch, per-page sandbox marker, legacy cookie pre-check (#315)
- pw3-p08: admin address leftovers and community grant wording (#314)
- render-series-author: .Series and .PostsByAuthor layout helpers (#313)
- pw3-edit: signed-in /-/edit end-to-end tests (#311)
- pw3-leaks: keep the admin address out of logs and non-admin emails (#310)
- pw3-caddy: strip Via, /security redirect, cloudflare-only cutover check (#309)
- freeze-prep: point links at Zen-Labs-Corp, fill tokens, final cut-over rehearsal (#305)
- builder-ux-shell: UX-1 builder shell (Navigator|Add, Ctrl+K, device labels, start panel, phone dock, Site styles) (#304)
- admin-frames (A3): frame tickets for the builder canvas, blog preview and plugin pages (#298)
- admin-address-ui: owners choose, see and change the admin address (wizard, Security, upgrade banner, live swap) (#294)
- gate-followups: docs-only ships skip the full suite; review follow-ups (#295)
- gate-throughput: affected-only pre-push, full suite once at ship, farm limit (#291)
- worktree-workstreams: wsinit, wsmerge and wsclean in pipeline-worktree.sh (#283)
- overview-control-panel: calm Overview with top-bar update chip, Site health and Activity (#288)
- admin-storage (A4): editor and builder recovery copies move server-side (#287)
- opaque-origin-c4: Layer B opaque-origin sandbox + C4 fingerprint scrub (#289)
- faster-gates: parallel pre-push, gate cache, skip needless UI gate (#284)
- sealed-admin: seal the admin against same-origin page scripts (Layer A: A1, A2, A5) (#282)
- open-site shortcut beside the site name in the sidebar (#280)
- danger-confirm-sudo: typed danger confirm (ui.DangerConfirm) and 10-minute sudo mode (RequireSudo) (#278)
- admin-address-core: per-install admin address (adminpath, CLI, boot) + standard not-found responder (#272)
- builder-ux-audit (UX-0): builder UX audit, task timings, three directions, owner decision; M-A milestone summary (#276)
- admin-consistency: one look per control across the admin (#270)
- builder-e11-mcp-builder: MCP tools to build and edit pages by ops (version-checked), shared builder save core (#274)
- content-locale: every content entity carries a BCP 47 locale (G14) (#273)
- admin-path-c1: route every admin URL through one configurable prefix (C1) (#269)
- blobstore-restore: BlobStore interface (G13) and hatamoto backup restore (G10) (#268)
- builder-e6-element-settings: anchors, link target/rel, image caption/link/lightbox and size, container links, aria/tooltip (#271)
- go-public-tooling: cut-over tooling (runbook P1-P3, P5-P7) (#267)
- builder-e5-inline-rich-text: bold, italic, links and more inline on canvas headings and text (#266)
- settings-half-width: compact Performance/Updates/General/Email settings and provider-aware email fields (#263)
- admin-nav-groups: group the admin sidebar under Site and Customize (#265)
- builder-e4-direct-manipulation: move handle, copy/paste across pages, context menu, wrap/unwrap, + layout picker, rename, multi-select, history (#264)
- builder-e3-inspector-controls: colour picker, unit+slider, box model, set-here dots, source labels; lazy splits reclaim first-paint JS (#262)
- builder-e2-states: hover/focus/pressed/parent-hover states, transform, filters, transitions (#260)
- migrations: neutral index names in the baseline; drop the last check-neutral exception (#259)
- status-pills-sweep: one status pill look (tint + dot) across the admin (#255)
- builder-e1-style-depth: StyleSpec v2 (50 new style keys, show on narrower screens) (#257)
- builder-e0-budget-split: first-paint vs lazy builder JS, new budget metrics (#256)
- ai-analytics-redesign: AI analytics rebuilt as the approved prototype in the sub-sidebar (#253)
- fix-prepush-gates: make the local pre-push gates pass on main (#251)
- release: [email protected] tag key; tags always tagged as Zen Labs (#248)
Fixes
- test-hooks ignores an inherited HATAMOTO_PREPUSH_FULL (#302)
- retry throwaway Postgres on another port when the port is taken (#297)
Docs / Chores
- close post-wave-3 (#316)
- close fix-canvas-scripts (#318)
- close freeze-prep (#306)
- record the Wave 3 owner decisions (#303)
- track the go-public program folder; close opaque-origin-c4 (#300)
- close admin-address-ui (#296)
- close admin-storage (#290)
- close admin-frames (#299)
- close gate-throughput (#293)
- close overview-control-panel (#292)
- close danger-confirm-sudo (#279)
- close admin-address-core (#277)
- close Wave 1-2 plans; trufflehog exclude list (#286)
- close admin-consistency (#275)
- close status-pills-sweep (#258)
- close ai-analytics-redesign (#254)
- public repos go to the Zen-Labs-Corp org; zenlabscorp stays personal (#252)
- owner decisions 2026-10-23 (software tag key, Workspace mail DNS checks) (#250)
- close the admin design roadmap (#244)
- close homepage-layout (#245)
- pipeline-gate full self-test clears the env knobs it sets per call (#317)
- integration tests load frames with a ticket (#307)
- run the UI gate alongside the full suite, and its sessions concurrently (#301)
- drop ignore rules for an untracked local tool directory (#285)
- HATAMOTO_PERF_STRICT=0 selects the shared-runner bounds (#281)
- run 851 of 925 internal/admin tests in parallel (#261)
v0.32.0 edge
Features
- homepage-layout: hero strip, split panel match height, cards container fix, one-per-line strip items (#242)
- admin-dashboard: /admin overview from shipped components and existing data (#243)
- admin-shell-auth: shell notices, auth pages, setup wizard, users/people/profile, shared partial follow-ups (#241)
- admin-settings: settings layout, confirm card, performance/updates KPIs, design tokens grid, plugins, API keys (#237)
- security: plugin markup without site.scripts: actions only in text or quoted values, via the HTML tokenizer (#238)
- homepage-shots: reproducible, framed homepage screenshots from a seeded demo (#233)
- nav-cache-purge: refresh cached pages after content writes from other processes (#234)
Fixes
- neutral default paths (check-neutral is red on main) (#240)
Docs / Chores
- close nav-cache-purge and homepage-shots (#239)
v0.31.0 edge
Features
- release-rehearsal: local rehearsal on the public snapshot; fix 3 things it found (Stream R) (#236)
- admin-editors: one save model, phone editor chrome, entities list, versions (#235)
- sdk-0-12-stability: pin SDK 0.12.0, one refusal message, root STABILITY.md (#232)
- lint-cleanup: staticcheck 0 and blocking, write-path errcheck, neutral bans, fuzz targets (Stream C1) (#231)
- release-supply-chain: NOTICE, bundles, SBOM+attestations, signed tags, gated signed ghcr image, channels private (Stream D2) (#221)
- theme-directory: community theme submissions, signed builds and a /themes directory section (#228)
- public-demo: HATAMOTO_DEMO mode, seed, hourly reset on its own capped PG cluster, Caddy block (Stream H) (#225)
- docs-accuracy: outbound connections table, Docker and downloads, public ROADMAP, release notes, accessibility (Stream F1) (#224)
- admin-media-forms: dropzone, media bulk actions, form builder rows, menus, taxonomies, submissions (#226)
- sdk-modules: SDK 0.12.0, Go 1.26, external build, STABILITY.md, plugin template, public-identity publish (Stream E) (#220)
- site-infra: security.txt, one copy of each security header, DNS/mail/monitor/CDN runbook (Stream G, prepare-only) (#218)
- governance-docs: SECURITY_MODEL, governance, support, contributing, trademarks, issue forms, keys page (Stream F2) (#217)
- admin-charts: Tremor-style charts, sparks, legends and chart states (#223)
- admin-linking-redirects: linking, redirects and import on the shared viz partials (#222)
- plugin-updates-ui: versions, one-click update and Update all in Admin > Plugins (#219)
Docs / Chores
- close theme-directory (#229)
- fix the screenshots Caddy test that made main red (#228 follow-up) (#230)
- pin the outbound-connections promise the README now makes (main is red) (#227)
v0.30.0 edge
Features
- admin: plugin issues as a Needs attention pill, details on the plugin page (#214)
- local-gates: git hooks enforce the CI gates locally (GitHub checks off) (#210)
- plugin-js-permission: site.scripts gates plugin JS, sections and partials (Stream A, P1 blocker) (#206)
- plugin_directory: spacing and shared-cache cap on builder pages (#213)
- plugins-page-in-theme: Plugin directory section so /plugins uses the site theme (#211)
- admin-component-contracts: component contract enforcer, token sweep, one date format, copy guide (#212)
- plugins-out-of-core: gtm and searchconsole leave core, public SDK export, first-party tier (#207)
- ci-green-2: importer ignores people when judging an empty site; TestBuilderDataConcurrent tests correctness not speed (#204)
- security-hardening: loopback proxies, media allowlist and os.Root, bounded argon2, setup code, CSRF never in URLs, agent-ranges switch (Stream B) (#202)
- ci-guards: CI hygiene, secret scan, CodeQL/Scorecard, nightly fuzz/vuln, Dependabot, digest pins (Stream D1) (#201)
- admin: hide empty entity types from the subnav; Children column links to a parent's entities (#203)
- canary-bleeding-edge-label: Settings > Updates names canary as bleeding edge, may break (#198)
- plugin-source-archive: build community plugins from our source copy, keep every signed build (#195)
- admin-design-pass: Tremor-aligned foundation, shared components, styled Select and QA rules (PR-A) (#197)
- ci-green: admin-ui, supervisor and page-cache test fixes (stacked on #199) (#200)
Docs / Chores
- close admin-design-pass (shipped #197) (#209)
- close plugin-source-archive, ci-green, plugins-out-of-core (#208)
- close hatamoto-dev-docs (shipped #170) (#178)
- close docs-layout-v2 (shipped #190) (#193)
- don't run the unit suite twice when DATABASE_URL is set (#186)
v0.29.1 edge
Features
- docs-layout-v2: edge-to-edge docs, Guides/Reference, cards, docs search, rewritten content (#190)
Docs / Chores
- prepare the tree for the public release (#189)
v0.29.0 edge
Features
- admin-smtp-settings: configure SMTP from the admin (Settings > Email + setup step) (#191)
- B10 cleanup: one page model (page_sections frozen, classic editor removed) (#192)
- close-release-changelog: badges from the live manifests (canary, ramps, halts), ops/* filter, plan closed (#187)
- B9 hardening: budgets in make check, per-node version diff, strict-script CSP opt-in (#183)
Fixes
- API keys page uses default width so the key table doesn't scroll (#188)
- Backups and Performance no longer share the database icon (#184)
Docs / Chores
- close backups (#182)
v0.28.0 edge
Features
- backups: Settings > Backups, CLI, and a pre-update backup that covers plugins and blocks on failure (#181)
- fix-settings-goldens: settings-spam golden after #171 and #174 merged side by side (#179)
- B8 extension API: widget packs and plugin data sources (#177)
- hatamoto-dev-docs: in-depth docs site at /docs (layout, publish tool, 81 pages) (#170)
- form-spam-protection: enforced captcha (Turnstile/reCAPTCHA v3/hCaptcha) + invisible spam rules for public forms (#171)
- Tremor tabs, select/multiselect, combo chart, delta badges (#174)
- core-webhooks: outgoing webhooks are built into core, the webhooks plugin is gone (#172)
Fixes
- spam Test connection tests the typed keys, no save needed (#180)
Docs / Chores
- close form-spam-protection (#176)
v0.27.1 stable
Features
- B7 dynamic data: prop bindings and query loop (#173)
- plugin-directory: community plugin submissions, signed builds and a public /plugins page (#168)
- release-changelog: /changelog page in the footer, auto-drafted per release, editable in the CMS (#167)
- Theme primary nav (blocks and parts out of Entities) (#166)
- nightly-channel: canary as a third update channel (canary -> edge +2d -> stable +7d) (#164)
- calendar date range picker (SimpleOnboarding/Tremor style) (#165)
- Tremor components (BarList, Tracker, CategoryBar, Spark, Progress, Callout, Donut) wired into AI analytics (#163)
Docs / Chores
- close plugin-directory (#169)
- close v1-23a-admin-ia-design-and-feel (#112)
v0.27.0 edge
Features
- light by default, header toggle for dark mode (#160)
- B6 reuse: templates, synced blocks, theme parts (#161)
- daterange-picker-polish: presets apply at once, tidier picker (#158)
Docs / Chores
- close settings-ia-split (#130)
- vanity module paths hatamoto.dev/core + hatamoto.dev/sdk (#141)
- Apache-2.0 licence and trademark policy (#140)
v0.26.99 edge
Features
- crawler-range-pills: drop the 7/30/90 day pills beside the analytics date picker (#156)
- schema-post-editor: settings.editor=post opts any type into the post editor (#155)
- resizable and collapsible builder sidebars (#153)
- person-profiles: one person record per human, owned by the user, replacing authors (#146)
v0.26.0 stable
Features
- entities-subnav: Entities secondary sidebar (All + one entry per type) (#144)
- B5 design system (#152)
- B4 widgets and responsive (#151)
Docs / Chores
- close v1-25f (v0.25.0 release + halt drill evidence) (#150)
v0.25.0 edge
The first Hatamoto 1.x release: the whole CMS rebuilt as one Go binary. Next.js is gone, the admin is server-rendered Go, plugins run as sandboxed WebAssembly, and installs keep themselves up to date from signed releases.
Features
- One Go binary serves the site, admin and API (serve, migrate, user, routes, version); Next.js removed (#80, #101)
- Go admin: entities, schemas, taxonomies, media, menus, forms, redirects, dashboards, users and settings (#89, #92, #93)
- Page editor with a live canvas, and a blog editor with slash menu, autosave and an SEO/AEO panel (#95, #98, #120, #123)
- Builder foundations: page_doc v2 model, canvas protocol v2 and the editor shell (#131, #132, #139)
- Themes: template hierarchy, archives, taxonomy, author and search pages, the default blog theme, theme data functions and section anchors (#81, #106, #107)
- WebAssembly plugins on Extism (wazero) with capabilities, a per-plugin database, routes and cron; signed packages and a registry that installs plugins and themes without a restart (#82, #84, #96, #108)
- First-party plugins: Search Console, webhooks and Google Tag Manager (#99, #121)
- Self-updating installs: signed release records and channel manifests, a pull-based updater with ramps, halt and yank, hatamoto supervise with health-gated switch and rollback, and Settings > Updates (#125, #133, #137, #143, #145)
- Safe upgrades: migration linter, n-1 check and rollback-safe schema rules (#129)
- MCP server, CLI, and full-site export and import (#87)
- WordPress import: REST and WXR importer with a URL audit, and an import wizard in the admin (#88, #91, #94)
- Page cache with configurable lifetimes, preload and complete invalidation (#111, #126, #135)
- A calmer admin: new information architecture, analytics dashboards and one consistent set of controls (#110, #115, #116, #117, #119, #122, #134, #136)
Fixes
- The sitemap lists the page the homepage serves and drops redirected paths (#138)
- Degraded plugin renders are never page-cached; separate deadlines and a per-function breaker (#109)
- Builder convert keeps the modified date (#142)
- Deploy rollback re-runs from the deployed commit and restores the database correctly (#78)
Docs / Chores
- Go 1.27, a final dependency audit and a stdlib router in place of chi (#76, #79, #105)
- One site, one language: locales removed (#86)
- Removed everything 1.0 does not need (#77)