Skip to content
Get started

Hatamoto 1.x release notes

Every 1.x release, newest first.

GitHub releases

canary

v1.0.8

Features

  • tag-packs: code-free tracking tag packages wired into Tracking, CSP and consent (#138)
  • image-formats: WebP and AVIF copies with picture sources and a rebuild job (#137)
  • maintenance-mode: site access modes (coming soon, maintenance, password) (#136)
  • tag-manager: core Settings > Tracking with consent-gated vendor tags (#135)
  • plugin-sdk-gaps: Plugin SDK 0.18.0 with request headers, cookies, csp, translations and media alt (#131)
  • search-replace: search and replace across site content with preview and versions (#134)
28 more features
  • two-factor: two-step sign-in with authenticator app, recovery codes and passkeys (#132)
  • email-log: log every outgoing email with resend and retention (#133)
  • duplicate-entity: duplicate a page or post into a new draft (#129)
  • consent: cookie consent banner and Google Consent Mode v2 (#128)
  • app-compression: compress responses in the app, cache compressed pages, warn on uncompressed visitors (#127)
  • cc-standing-approvals: standing approvals with step-up, plain-words install prompt and a daily digest (#126)
  • proxy-compression: compress proxied responses with zstd and gzip (#125)
  • cc-ownership-ui: show who owns a plugin page and hand it over on a structural edit (#124)
  • cc-review-ui: review, publish, discard and undo plugin runs in the admin (#123)
  • locale-neutral-schemas: shared-across-languages entity type setting (#122)
  • cc-preview: isolated preview of a plugin changeset in a sealed frame (#121)
  • builder-match-chrome: top bar, stage bar, canvas overlays and Insert surfaces match the mockup (#119)
  • cc-runs: plugin runs, phase isolation and changeset host functions (#120)
  • builder-match-inspector: compact inspector matching the editor design (#117)
  • builder-match-layers: Layers panel and field selection in the builder (#116)
  • cc-engine: transactional changeset engine and content origins (#115)
  • org-catalogue-locale-currency: lock site currency on the Organization offer catalogue (#114)
  • plugin-changeset-adr: propose ADR 0004, transactional changesets and phase-isolated plugin runs (#113)
  • business-details-per-locale: move business details into Settings > Locales (#112)
  • admin-unslop2-plugins-theme: quieter plugin and theme screens, painted live theme preview, Colours notes under their swatches (#111)
  • admin-unslop2-settings: shared tab strip, sticky card saves and Theme colours link on Settings > General (#110)
  • admin-unslop2-quiet-rows: quiet row titles, published status dot, labelled drafts marker (#109)
  • admin-unslop2-list-toolbar: one 32px list toolbar row and the view toggle in the table header (#108)
  • admin-unslop2-shell-notices: shell notices as one hairline group (#107)
  • admin-docked-subnav: restore the docked subnav shell with one sidebar toggle (#106)
  • seo-mcp-api: read and change SEO settings through the API and MCP with read:seo / write:seo (#105)
  • ci-registry-full-tier: skip the registry build tests on PRs (#104)
  • seo-wp-import: import global SEO settings from WordPress (#102)

Fixes

  • isolate the integration-gate cleanup checks in test-hooks from a concurrent gate (#118)
Docs / Chores
  • v1.0.7 on canary now, edge +2d, stable +7d (#103)
edge

v1.0.7

Features

  • render-query-visible-locales: include shared content in template data funcs on multi-locale sites (#101)
  • ci-tiered: fast PR tier, full suite in ci-full (#100)
  • seo-bulk-edit: inline SEO view on content and term lists (#99)
  • menus-real-data: menus are always real, editable data; themes declare menu locations (#98)
  • business-profile-rest-graph: business details over the site settings API, and new graph fields (#97)
  • admin-unslop-shell-match: match the live admin shell to the approved preview (#95)
4 more features
  • seo-404-monitor: SEO 404 monitor settings and a people/bots filter on the 404 log (#96)
  • seo-breadcrumbs-indexnow: breadcrumb settings and opt-in IndexNow pings (#94)
  • seo-sitemap: SEO > Sitemap settings, per-type rows, exclusions and Hide from sitemap (#93)
  • seo-robots-verification: SEO robots, verification and per-type noindex everywhere (#92)
Docs / Chores
  • v1.0.6 on canary now, edge +2d, stable +7d (#91)
edge

v1.0.6

Features

  • wasmhost-closed-instance: never pool a closed plugin instance (#90)
  • business-profile-extended: identifiers, payments, services, expertise and amenities on the business profile (#89)
  • seo-schema: SEO schema settings, knowledge graph tab and per-entry JSON-LD (#88)
  • admin-unslop-4-settings: restyle the Settings screens (#87)
edge

v1.0.4

Features

  • seo-panel-p3-polish: close the builder and term SEO review follow-ups (#45)
  • menu-editor-v2-js: JS menu editor with drag, inspector, live preview and undo (#44)
  • button-hairline: hairline ring and bevel on every admin button (#43)
  • seo-settings-hardening: atomic SEO saves, all-or-nothing titles save, cache race test (#40)
  • seo-panel-builder-terms: SEO drawer in the Builder and SEO on term pages (#39)
  • per-locale-hreflang: per-locale public URLs, hreflang and sitemaps (phase 1) (#41)
12 more features
  • ship queues an auto-merge and deploys in the background (#38)
  • plugins-redesign: split the plugin admin into Installed, Browse and Package security (#31)
  • wait for green CI and take it as the full suite (#30)
  • seo-settings: Settings > SEO with title templates and a shared SEO panel (#26)
  • menu-editor-v2: no-link menu items, item settings and theme menu presets (#25)
  • replace the top-bar update chip with a colophon (#24)
  • first-party-mirror-docs: first-party plugins are not mirrored (#23)
  • make design-check, one package for every static design check (#22)
  • vps-installer-followups: publish-install and apply-caddy dry-run fixes, installer P2/P3 fixes (#21)
  • directory-polish-validator-mirror: registry builds mirror the manifest validators, icon-only permission warning (#20)
  • vps-installer: curl | sh and cloud-init VPS installer with setup-link prefill (#13)
  • plugin-pages: public detail pages for registry plugins and themes (#14)

Fixes

  • ship waits for the merge state to settle after green checks (#33)
  • staging check runs both boxes in parallel and stops when a box is stuck (#32)
Docs / Chores
  • roll back multi_locale with DownTo, not Down (#42)
  • hairline frame and 28px segmented toggles (#37)
  • subtle selected state for segmented toggles (#36)
  • make the fake updates Glance counter atomic (#34)
  • integration gate runs its packages in parallel, each on its own database copy (#35)
  • ignore an inherited GH_REPO in the publish-install test (#29)
  • parse the admin templates once per process (#28)
  • wait for the live builder canvas before AT-22's window and control (#27)
  • unhalt v0.27.1 on canary (#18)
  • halt v0.27.1 on canary (#17)
  • track the channel sources in this repository (#15)
stable

v1.0.2

Features

  • plugin-directory-anti-spam: enforce listing rules in the registry build, plain-English permissions on directory cards (#12)
  • repoint-first-party-links: point docs and homepage-shots at hatamoto-first-party (#11)
  • stats-quiet-fixes: quiet install stats failures, demo hiding, last success time, card fixes (#9)
  • optin-telemetry: opt-in anonymous install stats (#8)

Fixes

  • golang.org/x/net v0.62.0 (#6)
  • do not cache a missing release file for a year (#5)
Docs / Chores
  • bump sharp to 0.35.5 in scripts/homepage-shots (#10)
  • expect only the public core repository as origin (#7)
edge

v1.0.1

First Hatamoto 1.x release. Notes to be written.

canary

v1.0.0

Features

  • builder-ux-canvas-inspector: canvas toolbar, + handles, zoom and device band; inspector Style tab, Show on, element restore (#320)
  • fix-cookie-auth: API cookie sessions get their own kind, cookie and bound CSRF token (#308)
  • fix-canvas-scripts: no page scripts in editor frames, private canvas port (#312)
  • pw3-preflip: sandboxed pageview fetch, per-page sandbox marker, legacy cookie pre-check (#315)
  • pw3-p08: admin address leftovers and community grant wording (#314)
  • render-series-author: .Series and .PostsByAuthor layout helpers (#313)
39 more features
  • pw3-edit: signed-in /-/edit end-to-end tests (#311)
  • pw3-leaks: keep the admin address out of logs and non-admin emails (#310)
  • pw3-caddy: strip Via, /security redirect, cloudflare-only cutover check (#309)
  • freeze-prep: point links at Zen-Labs-Corp, fill tokens, final cut-over rehearsal (#305)
  • builder-ux-shell: UX-1 builder shell (Navigator|Add, Ctrl+K, device labels, start panel, phone dock, Site styles) (#304)
  • admin-frames (A3): frame tickets for the builder canvas, blog preview and plugin pages (#298)
  • admin-address-ui: owners choose, see and change the admin address (wizard, Security, upgrade banner, live swap) (#294)
  • gate-followups: docs-only ships skip the full suite; review follow-ups (#295)
  • gate-throughput: affected-only pre-push, full suite once at ship, farm limit (#291)
  • worktree-workstreams: wsinit, wsmerge and wsclean in pipeline-worktree.sh (#283)
  • overview-control-panel: calm Overview with top-bar update chip, Site health and Activity (#288)
  • admin-storage (A4): editor and builder recovery copies move server-side (#287)
  • opaque-origin-c4: Layer B opaque-origin sandbox + C4 fingerprint scrub (#289)
  • faster-gates: parallel pre-push, gate cache, skip needless UI gate (#284)
  • sealed-admin: seal the admin against same-origin page scripts (Layer A: A1, A2, A5) (#282)
  • open-site shortcut beside the site name in the sidebar (#280)
  • danger-confirm-sudo: typed danger confirm (ui.DangerConfirm) and 10-minute sudo mode (RequireSudo) (#278)
  • admin-address-core: per-install admin address (adminpath, CLI, boot) + standard not-found responder (#272)
  • builder-ux-audit (UX-0): builder UX audit, task timings, three directions, owner decision; M-A milestone summary (#276)
  • admin-consistency: one look per control across the admin (#270)
  • builder-e11-mcp-builder: MCP tools to build and edit pages by ops (version-checked), shared builder save core (#274)
  • content-locale: every content entity carries a BCP 47 locale (G14) (#273)
  • admin-path-c1: route every admin URL through one configurable prefix (C1) (#269)
  • blobstore-restore: BlobStore interface (G13) and hatamoto backup restore (G10) (#268)
  • builder-e6-element-settings: anchors, link target/rel, image caption/link/lightbox and size, container links, aria/tooltip (#271)
  • go-public-tooling: cut-over tooling (runbook P1-P3, P5-P7) (#267)
  • builder-e5-inline-rich-text: bold, italic, links and more inline on canvas headings and text (#266)
  • settings-half-width: compact Performance/Updates/General/Email settings and provider-aware email fields (#263)
  • admin-nav-groups: group the admin sidebar under Site and Customize (#265)
  • builder-e4-direct-manipulation: move handle, copy/paste across pages, context menu, wrap/unwrap, + layout picker, rename, multi-select, history (#264)
  • builder-e3-inspector-controls: colour picker, unit+slider, box model, set-here dots, source labels; lazy splits reclaim first-paint JS (#262)
  • builder-e2-states: hover/focus/pressed/parent-hover states, transform, filters, transitions (#260)
  • migrations: neutral index names in the baseline; drop the last check-neutral exception (#259)
  • status-pills-sweep: one status pill look (tint + dot) across the admin (#255)
  • builder-e1-style-depth: StyleSpec v2 (50 new style keys, show on narrower screens) (#257)
  • builder-e0-budget-split: first-paint vs lazy builder JS, new budget metrics (#256)
  • ai-analytics-redesign: AI analytics rebuilt as the approved prototype in the sub-sidebar (#253)
  • fix-prepush-gates: make the local pre-push gates pass on main (#251)
  • release: [email protected] tag key; tags always tagged as Zen Labs (#248)

Fixes

  • test-hooks ignores an inherited HATAMOTO_PREPUSH_FULL (#302)
  • retry throwaway Postgres on another port when the port is taken (#297)
Docs / Chores
  • close post-wave-3 (#316)
  • close fix-canvas-scripts (#318)
  • close freeze-prep (#306)
  • record the Wave 3 owner decisions (#303)
  • track the go-public program folder; close opaque-origin-c4 (#300)
  • close admin-address-ui (#296)
  • close admin-storage (#290)
  • close admin-frames (#299)
  • close gate-throughput (#293)
  • close overview-control-panel (#292)
  • close danger-confirm-sudo (#279)
  • close admin-address-core (#277)
  • close Wave 1-2 plans; trufflehog exclude list (#286)
  • close admin-consistency (#275)
  • close status-pills-sweep (#258)
  • close ai-analytics-redesign (#254)
  • public repos go to the Zen-Labs-Corp org; zenlabscorp stays personal (#252)
  • owner decisions 2026-10-23 (software tag key, Workspace mail DNS checks) (#250)
  • close the admin design roadmap (#244)
  • close homepage-layout (#245)
  • pipeline-gate full self-test clears the env knobs it sets per call (#317)
  • integration tests load frames with a ticket (#307)
  • run the UI gate alongside the full suite, and its sessions concurrently (#301)
  • drop ignore rules for an untracked local tool directory (#285)
  • HATAMOTO_PERF_STRICT=0 selects the shared-runner bounds (#281)
  • run 851 of 925 internal/admin tests in parallel (#261)