# Account service changelog

## 11.8.1 — Streaming CSV validation

- Parse private CSV streams incrementally with UTF-8, byte/row bounds and checksum validation before SQL staging. Existing resumable generations and atomic activation remain unchanged.
- Return bounded logical row/column/table diagnostics for malformed CSV, conflicting identities and ambiguous relationships through HTTP/MCP. No cell contents in errors.
- Upload/materialization remains bounded to 8 MiB/10,000 source rows; this does not introduce an unbounded background import worker.

## 11.8.0 — Independent dataset copies

- Add permission-checked copy previews, relationship closure, quota checks and explicit Add to CRM operations.
- Commit CRM schemas, records, relationship counts, category grouping and the destination receipt atomically; reconcile lost acknowledgements without duplication.
- Preserve per-record import provenance and independent editing. Requires copies.sql; no automatic login import or synchronization.

## 11.7.0 — Dataset template contracts

- Add immutable versioned template declarations and validated field bindings; present generic slots without executable database content.
- Resolve shallow dataset-reference cards with independent target access checks. Existing Library configuration and URLs stay compatible.
- Requires templates.sql; template visual components and independent CRM copying are separate.

## 11.6.1 — Feedback fixes, 2 November 2026

- Preserve omitted execution approval through MCP parsing; shared task creation keeps owner approval and does not access private owner runners. Explicit bypass attempts return actionable errors.
- Accept registered agent attribution during collaboration SDK validation; return 400 for malformed feedback arguments instead of 500.
- Default omitted task deadlines to creation plus 24 hours, preserving explicit dates and historical imports.
- Allow bounded seven-write batches without increasing sustained quotas; sort numbered project names naturally.
- Add versioned client recovery help and authorised diagnostic-reporting guidance. Durable outbox delivery remains separate.
- Advertise current task title bounds while retaining historical task compatibility.
- Separate bounded UI read admission from management writes; return Retry-After timing.
- Explain browser symref references and route them to the existing authorised profile resolver instead of guessing CRM IDs.

## 11.6.0 — User datasets and moderated submissions

- Add normal-user dataset API/MCP tools, private ownership and membership, and separate pending proposals from published rows.
- Enforce role checks, revision/idempotency fences and bounded contribution quotas; preserve existing share gates and URL identities.
- Rollout requires contributions.sql and explicit feature activation. Templates and independent CRM copying remain separate work.

## 11.5.1 — Timeline contributor names

- Resolve actor display names only after activity visibility checks, including legacy agent events without source_agent_id. Direct outgoing grants are no longer needed to identify contributors. Missing/deleted names omit the label; no email fallback.

## 11.5.0 — Relational dataset storage foundation

- Add individual SQL records, schemas, foreign-key relationships and staged resumable imports.
- Serve existing dataset/Library reads from SQL after explicit verified cutover; preserve access gates and routes.
- Add migration parity checks and real PostgreSQL CI. Submission/user-management endpoints remain the next delivery phase.

## 11.4.0 — Dataset-owned Library configuration

- Doghouse `library_config` saves validated presentation, groups, banners and featured sections in the PostgreSQL dataset object.
- Generic Library reads support collection, group, record, app/platform, search and pagination views with fixed-preview access enforcement.
- Preserve UUIDs and dataset slug aliases; reserve group aliases and prevent record/group collisions.

## 11.3.0 — Dataset importer relationships

- Add explicitly configured distinct source-derived fields and revision-guarded Doghouse enrichment/rebuilds, preserving dataset UUIDs, slugs and record identities.
- Materialize incoming/outgoing relationship descriptors and complete-dataset counts; expose authenticated paginated related-record reads with current access checks.
- Keep private CDN artifacts and PostgreSQL metadata, bounded anonymous previews and all existing access modes. No ongoing sync, account import or Library route changes.

## 11.2.1 — Agent queue pagination

- Filter unfinished assignments before pagination in PostgreSQL and legacy stores, so unrelated account tasks cannot hide an agent's first page.
- Preserve agent-only automation selection in scoped continuation cursors through the existing queue tool. Direct queues still expose returned human-owner work without assigning it to an agent.
- Keep registration, scope and account boundaries; document cursor behavior and add MCP/SQL regressions. No tool-schema refresh or database migration required.


## 11.2.0 — Unified owned and shared Summary

- Add overview scope:all with current-authority shared assignments, exact totals, owner-qualified cursors and batched SQL context. Existing owned scope remains unchanged.

## 11.1.1 — Agent-specific onboarding and queue reconciliation

- OAuth automation reads require a registered source_agent_id; missing identity returns registration guidance without rules. Registered reads include bounded agent-specific work and continuation instructions through the existing response contract.

- Setup and schedule prompts require each agent to reuse its own identity, paginate its own queue, distinguish account housekeeping from assignments, and reconcile delivery evidence with formal completion without bypassing dependencies or acceptance gates. Existing saved rules and schedules remain user-owned.

## 11.1.0 — Shared project hand-back and agent discovery

- Current person assignees can return shared tasks to the project owner through `sym_projects_manage hand_back` or `sym_task_actions decide/reassign`. Other reassignment remains owner-only. Existing lifecycle, revision, membership, execution and form guards still apply.
- Hand-back provenance records the authenticated person, registered agent, time and optional note. Owner agents discover returned tasks without automatic assignment. Task reads include the assigned agent platform.
- `sym_projects project_agents` exposes relevant current members’ agents and bounded project-only task evidence. It never exposes private profiles or reconstructs old unscoped history.
- Apply Doghouse migration `0006_project_agent_context.sql` before rollout. It preserves immutable project and assignment context on new task events. Existing task UUIDs and assignment state are unchanged.

## 11.0.0 — Account agent identities and task assignment

- Account-level agent directory with registration, stable external-ID lookup, per-connection recovery, editable names, disabled profiles and capability-aware identity persistence guidance. Multiple profiles can share one platform or OAuth connection.
- Named agent task assignment and per-agent task queues. New production task creates require an explicit person or named agent. Human decision authority remains with the account owner for agent tasks; Summary finalization and explicit MCP confirmation share the same approval flow, without a required note.
- `source_agent_id` validates the registered account/connection and derives platform attribution. Task action and project execution claims fence agent profiles as well as OAuth principals. Runner configuration accepts an agent binding; mismatched runners cannot process agent-assigned work.
- Optional activation gate `SYM_AGENT_IDENTITY_REQUIRED=true` requires registration for agent mutations. Read/discovery and registration remain available for recovery. Existing human website flows remain usable.
- Deployment requires Doghouse activity migration `0005_agent_identity.sql` after `0004_ai_platform.sql`, coordinated Summary UI rollout, and an explicit revision-guarded unfinished-task backfill. No live data migration, runner schedule or provider permission is created by deploying this code alone.

## 10.7.0 — Session evidence and AI attribution

- Forms (including inline task forms) accept bounded canonical CRM patches before evidence validation in the same transaction. Record provenance identifies AI-session assertions; owner form reads expose review/undo receipts. Revision-guarded answer mappings write back only configured fields and preserve unrelated values. Existing consent and recipient-access rules remain unchanged.
- Owner-only `revert_record_patches` restores unanswered updates or archives new records and closes the form; concurrent edits block reversal. Replays do not duplicate patches or response writes.
- Optional MCP `source_ai_platform` accepts known AI platform names and normalizes unknown strings to `other`. Canonical CRM/workflow resources retain the latest explicitly attributed AI write; immutable activity events store per-event attribution, including grouping by platform. Omission preserves old clients. Attribution is caller-reported, never identity or authority.
- Doghouse `sym_app_candidates` lists existing task-derived app library candidates and icon cache status with owner-only, mode-bound cursor pagination; no automatic catalogue promotion or URL fetch.
- Deployment requires Doghouse SQL migration `0004_ai_platform.sql` before switching account-service code. Both account units must use the same release. The Doghouse app definition must be republished to expose its new read operation; no access grants are changed by this code.

## 10.6.2 — Large and RPC-style OpenAPI apps

- One app may hold up to 500 operations (was 250). The real bound is now explicit: the normalized definition must fit 900 kB so the version stays inside one Firestore document (was 512 kB). Grants and `operation_ids` accept up to 500 ids.
- POST operations that declare `x-sym-effect: read` may be published as read, so RPC-style APIs (one POST per tool) run without write confirmation. Undeclared POST/PUT/PATCH/DELETE still require write; any other `x-sym-effect` value is rejected with its location.
- Request schemas may use `uniqueItems`, fixed-length patterns such as `^[A-Z]{3}$`, and branch-local `required` (`anyOf: [{required: [a]}, {required: [b]}]`, `not: {required: [...]}`). Unknown keywords remain fatal.
- First user: the generated Cosmise API document (`https://cosmise.com/api/mcp/openapi.json`, 293 tools) imports as a single app.

## 10.6.1 — App icon pages

- Read only the first 512 KB of an app origin page when resolving its icon instead of failing on large pages; `fetchBytes` gains `truncate`. Found on the first live app source (linear.app, ~600 KB homepage, HTML served at `/apple-touch-icon.png`).

## 10.6.0 — App sources on tasks

- New tasks must name the app they happen in: a catalogue id in `apps[]`, or a `sources[]` entry with `type: "app"` carrying a catalogue `app` id or a product `url` plus `name` when the app is not in the library. Missing app context is reported through the existing `task_requirements_updated` response; existing tasks and updates are untouched. Watcher-routed tasks inherit the watcher provider as their app and are otherwise exempt.
- URL-backed app sources receive a server-owned `icon`: the origin page is read once through the Apps public-destination policy, the best declared icon is stored on the Sym CDN and cached per origin (daily retry on failure); client icon values are discarded. Each such origin is queued in `sym_app_candidates` as a library candidate for review.
- Agent guidance: pick from the catalogue; otherwise give the product URL and name; never invent an id.

## 10.5.2 — Apps on by default for MCP

- Published apps are available to existing MCP connections by default and stay available when a new version is published. Only an explicit Apps-page switch-off hides an app, and that switch-off survives republishing.

## 10.5.1 — MCP transport compatibility

- Serve MCP 2026-07-28 through the official v2 SDK alongside existing legacy clients, preserving OAuth grants, scopes, expiry and revocation.
- Isolate public metadata from token-operation rate limits with a separate bounded discovery budget.
- Record bounded protocol versions for request diagnostics.
- Add tested public OAuth discovery fallback and safe restart proxy guidance; never cache private responses or replay dispatched POSTs.

## 10.5.0 — Real-world OpenAPI imports for Apps

- Import vendor documents as published: JSON:API bracket parameter names (`fields[list]`, `page[cursor]`), comma-joined `explode:false` query arrays, `application/*+json` request and response media types, and header parameters whose schema `default` is sent automatically.
- Credentials: `apiKey` schemes may target `Authorization`; `http` basic is accepted (save `user:password`); a vendor prefix such as `Klaviyo-API-Key ` is declared once as `x-sym-credential-prefix` on the security scheme. The connection form is unchanged: one token.
- `sym_apps_manage import` accepts documents up to 4MB inline or from a public https `spec_url` (same destination policy as dispatch, no redirects), optionally limited to `operation_ids`; examples, vendor extensions and unreferenced components are dropped before validation and the operation ceiling is 250. Response schemas ignore unsupported keywords; request schemas stay strict.
- Rejections now carry `at` (JSON location) and `hint` (remedy) beside the error code.

## 10.4.0 — Sourced form suggestions

- Require per-input sourced prefill, contextual draft, or explicit new-input reason for new forms, including task forms.
- Verify CRM evidence and recipient access; render provenance beside editable suggestions without automatically submitting.
- Preserve legacy forms and submitted responses; allow revision-guarded refresh before first submission.

## 10.3.0 — Task follow-through

- Owner-scoped grouped follow-ups, runner observations and project housekeeping.
- Additive bounded migration preserves legacy tasks and notifications.
- Refresh-tools guidance for rejected schema arguments; grouped mail replacement remains opt-in until delivery is qualified.

## 10.2.0 — Designed search result metadata

- Add bounded, permission-scoped display facts for Home result cards. Reuse current authorised search payloads; aggregate native project progress and owner-only form submission counts for the bounded result page. No form answers or recipient capabilities.
- Keep indexed ranking, pagination and current access checks; enforce the32KiB output bound on shared global search too. No migration or additional input fields.

## 10.1.1 — Combine project and task archives

- Consecutive project changes group across project IDs; task archives group across projects. Counts remain permission-scoped and distinct, with complete-packet pagination and detail expansion.
- Fresh direct read grants short-circuit unrelated organisation lookups; revoked grants fall back to current organisation/project authority checks. No permission caching.

## 10.1.0 — Faster Home and consecutive activity packets

- Batch current access checks per result page, reuse project authority within a request, and cache only shared discovery candidates for 30 seconds. Revocation is rechecked on every request; new shares may take up to 30 seconds to enter discovery.
- Add optional grouped activity and encrypted group expansion tokens. Consecutive matching changes remain one packet across hours, count distinct records, and paginate after whole packets. A different visible activity breaks a packet.
- Home labels MCP changes as Sym and expands packets into paginated individual changes. Raw activity remains the default for compatibility.

## 10.0.0 — Home, Summary and assigned task actions

- Adds permission-aware automatic sym_activity, shared global search and owned form metadata search.
- Adds sym_task_actions for short editable forms, explicit assignee decisions, defer/reassign/manual completion, queued host execution claims and receipts. Assignment acceptance is separate.
- Summary has Needs you and Waiting on others; activity belongs on Home.
- Retires new standalone approval requests and caller-authored Activity writes at public boundaries. Preserves historical reads; pending legacy record requests migrate idempotently to assigned decision tasks without authorising external work.
- Documents host-tool limitations, exact accepted values, current-access rechecks and reconciliation of uncertain outcomes.

## Unreleased — Empty automation fallback

- Owner reads of an entirely empty sym_automations table return an unsaved default upkeep instruction and the current custom table list, with bounded continuation. No record writes, quota usage, schedule creation or migration.
- Existing rules, including paused and archived rules, suppress the fallback. Explicit starter setup reuses any existing rule. New saved starters rediscover current tables on each run.

## 8.0.0 — Indexed CRM keyword and phrase search

- `sym_search` with `q` now defaults to ranked, indexed global search of own records/projects/tasks. Explicit record/project/task queries search all matching rows, replacing page-local substring semantics. Without q, discovery remains unchanged. Major version marks the intentional query behavior change.
- Shared table/task scopes retain live ACL checks; global foreign-owner searches are denied.
- REST and authenticated Records UI use the same search service. Generated PostgreSQL vectors stay current on all writes; migration0007 backfills existing data and adds GIN indexes. No separate service.
- Ranked encrypted keyset cursors, excerpts, archived filter, bounded scalar projection, docs and50k SQL regression/performance checks.

## 7.2.0 — Paginated CRM discovery

- Add read-only sym_search and POST /v1/search: compact tables, groups, records, projects, tasks and explicit shared-resource discovery using existing permission checks and indexed owner pagination.
- Bind encrypted cursors to account, scopes and query; bound candidate work and output, with opt-in scalar projections and exact next-read calls. Literal text filtering is page-bounded; continue empty pages. No database migration or new grant scopes.
- Publish guidance through sym_docs, /docs/search.md and generated MCP/REST reference.

## 7.1.0 — CRM roster and activity

- Add owner-only Doghouse CRM roster, activity timeline/daily/summary, and revision-guarded internal/test classifications. Empty provisioned namespaces stay visible; shared CRM actors are separate from resource owners.
- Record metadata-only CRM interactions across MCP, authenticated UI and Doghouse. Committed SQL mutations are recorded atomically, including archives and deletes. Rollbacks leave no mutation event.
- Require Doghouse migration 0003 and restricted runtime grants before enabling SYM_CRM_ACTIVITY_ENABLED. Historical missing activity is explicitly unknown; no content or payloads are copied into analytics.

## 7.0.0

- Add atomic MCP task/form/assignee/deadline creation and a fixed deployment cutover. After activation, newly created tasks require these fields and a name of at most 35 characters; older creation calls receive actionable validation/reconnect guidance. Existing task edits and legacy form outcomes remain supported. No client version is required.
- Reuse form links for account acceptance, direct external responses, self-assignment, explicit decline and optional reasons. Optional structured answer mappings distinguish completed from closed; only completed satisfies dependencies.
- Queue one assignment email and deduplicated task outcome/decline notifications through the existing Sym sender. Add native receipt listing, delivery inspection and confirmed-failure recovery; unknown sends are never replayed.
- Support silent ordinary-answer browser drafts in the coordinated frontend. Deployment requires the compatible frontend first, then a fixed server cutover setting. No database backfill, reminder checker or expanded sharing-scope feature.

## 6.3.0 — Editable automation rules

- Add protected `sym_automations` default table and repeat-safe `sym_objects_manage.ensure_automations` starter setup. Existing list/get/update/archive operations manage user-owned rules. Setup preserves edits and paused/archived state.
- Document one onboarding prompt for persistent CRM instructions and a three-hour host schedule reading current rules. Sym stores instructions; scheduling and execution remain with the user’s AI platform.

## 6.2.1

- Verified invitation recipients can accept or decline by ID through MCP without retrieving the email token. Identity, scope, revision, expiry and current sharing authority checks remain enforced; public link flows still require tokens.
- Limit new project and form attachments to 3 MB (3145728 bytes). Oversize and unsupported-file errors explain the Google Drive/Dropbox HTTPS reference alternative. Preserve existing file reads and owner-only attachment writes.

## 6.2.0

- Add owner-only Doghouse MCP usage summary and leaderboard, daily per-user grouping, and surviving-record daily and leaderboard reports with canonical storage routing. Include identity enrichment, bounded pagination, Sydney dates and explicit telemetry coverage. No new detailed call logging.

## 6.1.1

- Expose typed Apps management fields in MCP discovery so clients can publish apps and create credential setup links with numeric versions and object policies. Preserve strict action-specific validation and defaults.
- Return safe field-specific Apps validation errors without reflecting supplied credentials or arbitrary record keys.

## 6.1.0

- Form submission notifications support up to 20 additional email recipients, including non-members, with isolated delivery receipts, deduplication and cancellation when the policy changes. Existing owner notification behavior remains; no answers or access grants are included in recipient mail.
- Owner CRM tables can supply live select/multiselect choices on recipient, task and table forms through the existing MCP forms tools. Explicitly published composite labels use up to five fields and selections save stable record IDs. Acceptance revalidates current records; prior responses retain their labels.
- Add configure_option_sources, capability discovery, bounded filtering and reference-field compatibility; no new MCP tool or data store.

## 6.0.0

Breaking authoring change: newly created forms and previews require guidance or valid explicit defaults for every input, including conditional and repeated fields. Missing guidance returns `form_field_guidance_required` with field-specific repairs. Legacy fields accept typed defaults and placeholders. Existing forms and unchanged creation replays remain compatible. Field guidance is retained in the renderer; templates and MCP documentation describe the new contract.

## 5.4.0

- Add the specific next onboarding step to nonblocking response reminders, including documentation results.
- Teach initial MCP instructions and onboarding docs to continue requested work without repeated disclaimers, forced reconnects or degradation claims. Production enforcement is disabled globally; onboarding progress validators remain intact.

## 5.3.0

- Keep accounts created before the 2026-10-27 04:07 UTC onboarding rollout non-blocking, even when enforcement is enabled for new accounts. Unavailable account-age metadata never locks out a user.
- Add an onboarding reminder to successful responses, including incomplete baseline setup. Preserve the response and provide get_setup as a fallback for clients with older tool definitions; no forced reconnect.

## 5.2.2

- Give connected Apps requests a bounded 20-second response window so authenticated Doghouse operations can return their committed outcome. Preserve authorization, response limits, concurrency leases, receipts and no-retry behavior.

## 5.2.1

- Batch fresh onboarding release authorization reads inside Firestore transactions and overlap independent draft, policy and receipt reads. Preserve all owner, revocation, revision and idempotency checks while reducing connected-app request latency.

## 5.2.0 — 2026-10-27

Owner-only Doghouse draft/preview/publish onboarding releases, immutable history, section edits and form-ready step upserts. Published guidance, phase order, setup definitions and form templates reach runtime without resetting answers. Existing policy edits retain release history. Publishing never enables enforcement.

## 5.1.3

- Batch fresh Doghouse credential and operator-policy reads using a previously authenticated UID hint; validate the hint against the current key and preserve all permission and revocation checks.

## 5.1.2

- Read each admin onboarding SQL snapshot in one bounded statement; preserve active-owner and route-epoch checks without provisioning or write locks.

## 5.1.1

- Reduce Doghouse onboarding read latency by overlapping independent authority/policy/identity reads and omitting unused profile reads. Preserve owner authorization and post-read revocation checks.

## 5.1.0

- Add owner-only Doghouse onboarding engine and individual-user read endpoints, backed by canonical PostgreSQL/Firestore routing without provisioning or changing progress.
- Expose phase guidance, setup/form definitions, current global requirements, saved answers and evidence; retain global policy preview/apply and keep enforcement separately disabled.

## 5.0.0 — Ordered, persistent onboarding and native QR delivery

- Breaking onboarding workflow contract: discover, one submitted prefilled review, verified CRM build, upkeep, finish. Existing completed baseline 1 remains honored; missing real work never requires invented contacts or tasks.
- Reuse existing owned CRM evidence without a form; validate actual submitted responses, contact provenance, task ownership and project relationships. Resume and revise without deleting CRM records.
- Owner-only Doghouse get/preview/apply publishes versioned required or optional requirements. Policy changes do not enable enforcement. Production enforcement and advisory metadata are separately opt-in, off by default.
- Platform instruction statuses distinguish user-reported installation, trusted verification, pending, declined, unavailable and explicit requests to falsely claim completion. All remain non-blocking.
- Setup guidance v6 covers contacts, email scope, personal connected-tool messages and actual recurring 3/5-hour schedule receipts. Adds the onboarding_guided recipe and precise tool sequence.
- QR tool replies include native MCP PNG content and an Open form link, avoiding reliance on an expiring remote image embed. Hosts should use a supported link button with Markdown fallback.

## 4.0.2 — Enforcement opt-in

- Required onboarding blocking is disabled unless explicitly enabled after qualification. Dependency lock metadata matches resolved versions.

## 4.0.0 — Required onboarding baseline

## 4.0.2 - 2026-10-27

- Disable onboarding enforcement by default. Require explicit SYM_ONBOARDING_ENFORCEMENT_ENABLED=true only after the complete recovery path is qualified. Preserve onboarding progress and all normal authorization.


## 4.0.1 - 2026-10-27

- Enforce minimal form presentation across current and historical definitions: short titles, field labels, answers and buttons. Remove progress chrome, boilerplate, descriptions, helper copy and duplicate review titles. Clean discoverable templates and MCP authoring guidance; preserve answer validation, actions and response history.


- Normal MCP/REST work returns onboarding_required until baseline setup is begun, completed or explicitly declined. One owner-scoped revision ledger and a bounded 30-second cache; later optional wizard changes do not revoke completion. Existing read-only grants and authorised internal watchers remain usable.
- Wizard v5: context-first prefilled review with link and QR, bounded response polling, contacts and useful documents, owned tasks, suggested 3/5-hour upkeep, and verified platform instruction installation. Adds sym_use_cases and three fictional validated onboarding recipes.
- New tasks default to the account owner. Completion verifies actual owned CRM evidence.
- Breaking: Sym-service outreach dispatch and enabling Sym notification transport are disabled. Templates, drafts and export remain for connected communication tools. System authentication mail is unchanged.

## 3.4.0 — Structured form authoring

CRM setup recipes use folder trees, nested task rows, searchable assignees and explicit decision choices. Contact channels and next steps use radio controls. Authoring guidance prioritises discovered context and concise previews; existing issued forms and answers remain unchanged.

## 3.3.0 - 2026-10-26

- Return the authenticated Sym account identity through `sym_account` and `/v1/account`. Existing plan fields remain unchanged; verified email follows existing explicit OAuth email consent and live Firebase verification. No account lookup parameter, new access grant or connected-mailbox inference.

## 3.2.0 - 2026-10-26

- Add private Doghouse owner-only CRM limit get/preview/apply operations. Revision-guarded, audited per-user capacity and request-rate multipliers take effect on subsequent normal MCP and CRM requests without restart. Deployment defaults remain for unchanged users; schema, payload, graph, execution and authorization bounds do not change. No data migration or automatic allowance changes.

## 3.1.0 - 2026-10-26

- Add bounded owner-scoped `plan_context` to overview tasks: named stage, display position, completion dots and parallel-plan flag. One projected SQL batch covers all displayed projects; incomplete, cyclic or oversized plans return null. No schema migration, writes, new access or per-row plan fetches.

## 3.0.0 — Concise dynamic-form authoring
- New form titles are limited to60 characters and descriptions to144; nested questions,
  options, headings, help, actions and confirmation copy have explicit discoverable limits.
- This intentionally tightens accepted authoring inputs. Existing stored forms and answer
  payloads remain usable without truncation; legacy fields receive the same copy policy.
- MCP guidance requires consumer-facing wording and a recipient QR image with every form link.
- Onboarding now offers optional collaborator-response triggers with fictional Workspace/POST examples; removes stale pending-release wording.


## 2.42.0 - 2026-10-26

- MCP-only form dispatch supports Workspace conversations and connected-app POST operations. Configure, preview typed answer mappings and inspect receipts through existing form tools. Reuse saved app credentials and persistent OAuth authority; retain Workspace aliases and existing triggers. Completion snapshots, duplicate protection, explicit catch-up and receipt-only crash reconciliation preserve uncertain writes without replay. HTTP acceptance is distinct from downstream completion.

## 2.41.0

- Add explicit restart_setup with revision-guarded review cycles; retain answers and CRM while invalidating old review/outcome claims for a fresh review.
- Add contact review and targeted information-request templates, low-typing examples, current conversation discovery and a concrete approved-resource monitoring loop.
- Preserve saved/custom setup presentation and upgrade unchanged v4 guidance; no automatic sends, scheduler creation or new trigger activation.

## 2.40.0
- Add private administration with canonical-owner routing, isolated audit receipts and observed usage instrumentation. Preserve concurrent overview and workspace form dispatch releases.

## 2.39.0 - 2026-10-26

- Add owner-scoped `sym_projects overview`: full-set canonical task classification into Needs you, Waiting on others and reported Sym outcomes, exact per-section totals, bounded pages and project labels. Dependencies are checked across the project before pagination. Shared project discovery remains `my_work`/`my_projects`; approval inbox and legacy record tasks remain separate.
- Add optional task `follow_up_owner` and `follow_up_policy` (`required` or `none`). Unknown responsibility stays unknown; only an explicitly assigned, due follow-up is promoted to Needs you. These fields never send notifications or grant access.
- PostgreSQL project queries read current lightweight projections without cold-cache writes. Cross-owner assignment discovery uses one keyset query and checks each project's permission once per transaction; grants are rechecked on the next request.
- Verify all 13 active CRM owners read-only, including independent full-set totals and continuation checks. No schema migration or Firestore writes required.

## 2.38.0 - 2026-10-26

- MCP-only task-bound form completion can queue one authorized message to a selected Workspace profile/chat using configure_workspace_dispatch and workspace_dispatch. Durable owner-scoped SQL storage, exact response-version snapshots, duplicate protection, pause/resume, explicit catch-up and honest accepted/blocked/unknown receipts. No UI or automatic task-completion claim.

## 2.37.0

- Context-first setup v4 preserves original topics/answers with additive review and outcome evidence; old completions no longer skip revalidation.
- Native and embedded fallbacks prefill saved answers; action selections no longer imply execution.
- Added tailored CRM onboarding recipe, dependency notifications and current host-launch scope.

## 2.36.0 - 2026-10-26

- Return canonical server-resolved recipient form URLs at `/f/<access-id>/<title-slug>` for new and existing forms, owner reads, answered history and QR codes. Existing fragment links remain valid.
- Include a bounded title/introduction preview projection with recipient form reads for server-rendered HTML and images. Respect custom/off preview settings and preserve separate public-preview locator privacy.
- Keep recipient verification, expiry, cancellation, uploads and idempotency unchanged. No emails or answers are sent by link creation or readback.

## 2.35.1 — Discovery-led setup v3

- Start with available host apps and agreed source scope; guide prefilled dynamic reviews, contact/channel discovery, evidence-backed CRM population, personal-mail follow-ups, optional monitoring and concise host instructions.
- Upgrade unchanged default setup guidance for existing users on read, preserving answers, skips, custom options and intentional custom/dismissed flows; add five new optional steps.
- Publish `/docs/onboarding.md` with revision-guarded form-response reconciliation and no implicit execution.

## 2.35.0 — 2026-10-26

- Add explicit generic/custom/off public link previews to form/share creation and invitations, with owner-only revision-guarded set_link_preview and canonical share/image metadata outputs.
- Serve read-only crawler metadata through separate opaque locators; never expose source details or capability tokens by inference. Expired, cancelled, revoked or unavailable previews fail to generic branding.
- Preserve owner-routed Postgres data and canonical organisation identity storage, including preview pointer backup/migration inventory. Document agents' copy limits and independent messaging-client caches.

## 2.34.0 — 2026-10-26 (prepared, not deployed)

- Add `sym_objects related_query` for hydrated, permission-filtered direct relations, grouped by collection with full-result search, schema-validated filters/sorting, authorised counts and encrypted per-group pagination. Indexed relation discovery uses the existing routed Postgres/Firestore store; queries fail explicitly above 5,000 candidates. Permission checks run before counts and values, and changed result sets invalidate cursors.
- Include supported collection icons in record context; owners can inspect empty declared fields while record-scoped shared metadata remains limited to populated fields.


## 2.33.1
- Add opt-in Postgres-default CRM routing and guarded, verified first-use owner enrolment. Existing inactive gates and unmigrated owner data are never silently activated; identity and Apps stay in Firestore.
- Remove retired Firestore workflow/task scans in Postgres-only mode and batch owner-gate and sidebar metadata queries. MCP contracts are unchanged.
- Migration 0005 and explicit runtime function grant must accompany activation after all existing CRM owners are reconciled. Shared workflow transactions still lock active owner gates; this is not unlimited-throughput qualification.

## 2.33.0 — 2026-10-26

- Add the versioned sym.page/1 dynamic form library: all 23 Claude renderer families, structured schemas, layouts, rules, step/review configuration, action receipts and common/recipient suggestions.
- Add capabilities, list_templates, get_template, validate and preview; six reusable recipes and an interactive preview URL with no submission side effects.
- Validate rich answers, hidden/disabled controls, read-only values, typed repeated rows and real recipient-bound files server-side. Preserve legacy fields[], authenticated edits, idempotency and task boundaries.
- Publish the complete agent authoring guide and contract parity tests. This entry records implementation; deployment and device acceptance are separate milestones.

- Add optional, validated recipient-specific prefilled form suggestions, kept separate from submitted answers and completion effects.
- Add owner-scoped `sym_forms qr` returning the canonical recipient link and a 15-minute encrypted-capability PNG URL, with source cancellation/expiry checks and in-service rendering.
- Document MCP creation, QR display and saved-response retrieval; qualify real OAuth/HTTP, PNG decode, recipient isolation and existing storage routing.

## 2.32.0

- Add authenticated single-use API connection setup links with expiry, revision binding, cancellation, atomic credential completion and durable MCP status. Secret entry remains dashboard-only; no automatic provider call or assistant wake-up.

## 2.31.1 — 2026-10-26

- Keep shared CRM and task discovery paginated correctly after populated owners migrate to Postgres. Scan retired Firestore copies in bounded batches independent of the requested result-page size, with a 10,000-row reconciliation ceiling.
- Preserve resource-owner routing, current identity authorization and deletion tombstones. Apps remains Firestore.

## 2.31.0 — 2026-10-26

- Apps added through the authenticated Apps page are available to existing MCP connections without OAuth reconnection. Publishing or saving a credential records private, per-user, version-bound MCP access; the page can remove or restore that access.
- Existing connections discover `sym_apps` and `sym_app_call`; execution checks the saved app approval, current ownership/sharing, operation policy and private credential. No OAuth token or connection scopes are rewritten. Explicitly restricted Apps scopes remain restricted, and `sym_apps_manage` still requires its scope.
- Keep draft/unpublished operations out of this discovery path; recheck app consent at dispatch and require review after version changes. Preserve write confirmation, revocation, idempotency and account isolation.
- App import UI preselects operations for review rather than leaving every operation off. Document client tool-cache refresh separately from OAuth login.

## 2.30.0 — 2026-10-25

- Add `sym_attachments` / `sym_attachments_manage` and REST/CRM gateway parity: bounded canonical upload/form-file/provider-reference resources, explicit project/task links, current shared-reader checks, verified64KiB content, revisions, quotas and safe deletion.
- Reuse canonical attachment bytes in existing frozen email packages. Detach/source revocation prevents subsequent exports and sends; provider references never become fetched MIME content.
- Add derived attachment link counts to three-hour project snapshots; invalidate on link changes without changing task plans.
- Expose recipient form open/submission/chunk uploads through MCP with existing allocated-email edit rules and idempotent receipts. Preserve resource-owner routing across recipient accounts.
- Document the MCP workflow coverage and limits; no automatic calendar events, arbitrary URL downloads or silent transport fallback.

## 2.29.0 — Private API apps and saved credentials (prepared, not deployed)

- Add routed Apps UI support for owner-only re-enablement and private paginated call metadata; qualify separate encrypted database/key recovery and exclude preview secrets from release bundles.
- Add private OpenAPI API-app discovery, reviewed publication and invocation through sym_apps, sym_apps_manage and sym_app_call.
- Store definitions, versions, per-user permissions and durable invocation receipts transactionally in shared storage; deduplicate uncertain/concurrent writes across service instances.
- Add write-only credential intake with explicit VPS AES-256-GCM or KMS encryption, private per-user connections, expiry, replacement and revocation. Tokens are absent from MCP inputs/results and cannot be retrieved by the UI.
- Publish generic API-app documentation, REST schemas and explicit apps OAuth scopes; preserve human workflows/messages/consent features from2.27.1. Feature remains opt-in; existing grants do not widen.

## 2.28.0 — 2026-10-25

- Add explicit verified form-document selection for designed email, frozen owner-routed chunks, bounded export and source revalidation before delivery. Preserve exact manifests and duplicate-safe sender receipts.
- Add seven Claude file/deadline layouts and version-aware catalogue schemas; deadline copy omits redundant calendar-file rows/tutorials. Existing ICS generation stays unchanged.

## 2.27.3 — 2026-10-25

- Export calendar attachments as named binary files so Gmail displays the downloadable .ics file instead of suppressing a text/calendar MIME part. Calendar bytes, dates and hashes remain unchanged.

## 2.27.2 — 2026-10-25

- Generate bounded, importable ICS attachments during designed-email preparation; preserve date-only deadlines and explicit timezone offsets without creating calendar events.
- Freeze attachment bytes and hashes in MCP export/claims, retain them through delivery, and document Gmail/Outlook MIME handling and duplicate-safe receipts.

## 2.27.1 — 2026-10-25

- Serialize email template data at the Firestore boundary so card/table row arrays persist and decode without altering frozen email content.

- Allow the advertised version 3 task-completion email through MCP get/render/prepare validation; test every designed template across the public contract and frozen export boundary.

## 2.27.0 — 2026-10-25

- Add guest assignment choices with idempotent receipts, followed by verified intended-email completion; an anonymous choice does not grant project access.
- Add explicitly scoped, paginated shared-project tasks, records and submitted-form files with expiry, revocation and current-access checks.
- Add versioned rich email templates and bounded MCP discovery, rendering, preparation and frozen export. Legacy drafts remain unchanged; template availability does not imply an automatic trigger or permission to send.
- Prepare task-completion notifications using the new template version. Next-task notifications use rich templates, current assignment responses and validated consent links for outstanding assignments; missing consent offers block preparation rather than inventing an acceptance link.

## 2.26.0 — 2026-10-25

- Atomically record configured task-completion notifications and automatically prepare stakeholder updates and grouped next-assignee emails using Claude export7 templates.
- Add MCP notification policy/events, guarded external-send claims and connector-reported receipts, known-failure retry, cancellation and stale-access/readiness checks. No silent transport fallback or retry of unknown sends.
- Personal mailbox delivery remains through the authorised external connector; Sym dispatch remains explicit. Worker prepares emails, never independently assumes sending consent.

## 2.25.0 — 2026-10-25

- Task-bound forms apply complete/review/evidence policies after validated submissions without a follow-up AI completion call; enforce quorum, dependencies, revisions, claims and owner review.
- MCP bind/unbind/retry and bounded task-to-form discovery; preserve answers on failures, create idempotent evidence/events, prevent edits from repeating completion.
- Document configurable share windows (60 minutes when omitted). Automatic email orchestration remains scoped, not dispatched.

## 2.24.0 — 2026-10-25

- Anonymous form recipients may submit once. Editing saved answers or uploading replacements requires the allocated verified email; original-submit retries remain idempotent.
- Public form responses report edit access and sender display context for the revised form UI.

## 2.23.0 — Reusable designed email exports

- Add versioned Claude-designed email catalogue, per-template schemas, safe HTML/plain-text rendering and exact frozen draft export through Messages MCP/REST.
- Sym dispatch and external exports share rendered bytes and content hashes; export is not proof of sending. No automatic workflow notification execution.

## 2.22.0 — Human forms, sharing and prepared messages

- Add persistent recipient-scoped form requests with editable revisioned responses, idempotent submission receipts, paginated sent/answered views, validated nested/conditional fields, canonical app choices and private bounded file uploads.
- Add field-scoped snapshot/live shares:60-minute anonymous window by default, followed by verified allowlisted-email access; revocation and allowlist updates apply immediately. Opaque nonsecret references preserve login return without bearer tokens in URLs.
- Add frozen message preparation and explicit dispatch with genuine provider receipts. Dedicated messages:send OAuth consent is required; old Objects grants never acquire email-send authority. No automatic replay after unknown delivery.
- Add opt-in narrow signed-out invitation previews and revision-guarded recipient task binding on acceptance; assignment never executes or completes tasks.
- Reuse existing identity, sender, storage and scopes for read/write operations; publish six new MCP tools, REST/gateway routes and bounded documentation. No billing or provider provisioning.

## 2.21.2 — Paginated app discovery

- Add sym_previews list_apps with 100-entry pages and continuation cursors.
- Replace embedded app catalogues in general docs and get_schema with compact discovery instructions.

## 2.21.1 — Agent app maintenance guidance

- Document canonical app discovery, evidence-backed task updates, revision-safe list merging and targeted snapshot refresh.
- Clarify stale client-schema recovery and preserve runtime registry validation.

## 2.21.0 — Cached project summaries and platform registry

- Expand the canonical app registry to 1,484 IDs while preserving existing IDs and compact tool schemas.
- Add bounded bulk project snapshots with a three-hour cache and explicit single-project refresh.
- Include task app counts, source counts and reference provenance counts; preserve project edit revisions and enforce current sharing access.
- Cap scans at 1,000 tasks per project and mark partial results explicitly.

## 2.20.1 — Account allowances with CRM navigation

- Preserve the account-specific usage policy alongside the newly merged canonical links and project query contracts.

## 2.20.0 — CRM links, filters and shared navigation

- Added permission-checked resource links and reproducible project view URLs.
- Added full-result project relationship queries, bounded connected matching, grouping and revision-safe projection caches.
- Added outgoing sharing discovery over existing direct grants and organisation policies; preserved 2.19 collaboration and related-data contracts.
- No new OAuth scopes, automatic invitations or execution authority.

## 2.19.2 — Account-specific usage allowances

- Deployment-owned `SYM_ACCOUNT_LIMITS_JSON` enables a bounded 1–10x Objects/Projects capacity and request-rate multiplier for exact account UIDs. Unconfigured users retain their existing limits.
- Immutable per-owner service routing prevents cross-account quota leakage; actor request budgets remain independent of resource-owner capacities.
- Existing authority, suspension, schema, pagination, payload, graph, claim and approval safeguards remain unchanged. No new self-service quota-management tool.

## 2.19.1 — CRM collaboration management

- Allow explicitly confirmed publication and legacy indexing, plus responsibility reports, through the authenticated CRM gateway; execution and approval bypass remain blocked.
- Sharing previews preserve the current audience and do not preselect stale publication after unlink/relink.

## 2.19.0 — Project collaboration and related context

- Indexed cross-owner my_projects/my_work, bounded legacy task reindex, assignee responsibility reports.
- Explicit revision-guarded supporting-record publication, read-only and nonrecursive; independent grants remain additive.
- Permission-filtered related records and project attachments, encrypted context-bound cursors, record-scoped collection metadata.
- MCP schemas/descriptions, sym_docs, API reference and served Objects/Projects/Collaboration/CRM guides teach verified linking and authorised enrichment of existing poorly linked data.
- Requires tasks collection-group composite index and legacy owner task reindex before complete work discovery. No automatic customer-data backfill or sharing.

## 2.18.2
- Publish action-specific Organisation/Access requirements while preserving legacy organisation ID aliases and canonical retry parsing.
- Give all six collaboration tools family/action-aware, bounded validation with exact action errors, allowed values and numeric/length bounds. Reject untrusted lookalike no-dispatch diagnostics.
- Add SDK/HTTP required-field matrices, organisation invitation acceptance/quota tests, delivery uncertainty cases and an explicit fail-closed coverage gate.

## 2.18.1
- Fix invitation discovery to publish required fields for each action and kind. Direct collection sharing uses resource permissions, not organisation membership.
- Return precise, value-free field diagnostics before dispatch, including through MCP SDK validation; document safe recovery and delivery states.
- Preserve existing invitation fingerprint/default ordering, idempotency, ownership, verified-recipient checks and revocation. No new OAuth scopes.

## 2.18.0
- Add bounded canonical app usage and HTTPS source metadata to task input/output schemas and agent discovery. No existing task ownership or execution semantics change.
- Upgrade protected Activity/Approvals to additive schema v2 with explicit outcome links, evidence provenance and app context; preserve old records and counts. Reject malformed metadata and caller-forged decision actors.
- Publish the shared app registry and factual planned-versus-performed guidance.

## 2.17.1
- Reject already-in-flight competing refresh rotations without revoking the winning credential. Later refresh-token replay, explicit revocation, expiry and legacy restrictions remain enforced; no token reuse/grace response is introduced.
- Regression-test that MCP session 404s and tool errors leave OAuth access and refresh credentials usable.

## 2.17.0
- Add sym_workspace and sym_workspace_manage over the existing 74-operation Workspace API catalogue, plus equivalent authenticated REST routes and operation documentation.
- Add one Workspace API consent detail block. Expanded scope requires approval; retain read-only intent, client ceilings, existing grants, Browser Pass separation and native business permissions.
- Route through current membership using short-lived method/path/query/body-bound internal delegation. Do not forward user OAuth tokens or mint permanent keys.
- Add bounded resumable event batches and private binary downloads as authenticated MCP resources, with fresh authority and content-integrity checks.

## 2.16.2
- Preserve successful refresh credentials when a competing request was already in flight. Later replay and explicit revocation remain enforced.
- Verify MCP session404/tool errors do not revoke OAuth credentials.

## 2.16.1

- Restore owner-scoped legacy tasks without assignee metadata to CRM completion, including blocked tasks whose dependencies are complete.
- Preserve explicit-assignee authorization, active-execution locks, revision checks, and unverified owner-report semantics.

## 2.16.0

- Add optional task assignee, approval link and due/follow-up metadata for the CRM overview. No existing tasks are reassigned.
- Add verified-session owner completion reports with CAS, assignment, project and dependency gates. Reports are explicitly owner_reported, never execution or independent verification.
- Persist each account’s Ask Sym app preference behind the authenticated internal gateway.
- Preserve existing setup MCP App, record icon catalogue and branding schema compatibility.

## 2.15.1
- Preserve in-progress and submitted form state when hosts repeat unchanged tool output during context/theme updates. Explicit Refresh still reloads authoritative state. Version the widget URI to avoid stale host HTML caches.

## 2.15.0
- Add dedicated read-only sym_setup MCP Apps form, dual standard/ChatGPT host bridge and explicit preview, save, cancel, refresh and next-question controls.
- Add validated owner-only submit_setup_item with original item/setup revisions; preserve host consent, current scope checks and no external execution. No-write previews never create records.
- Preserve API2.14.1's portable branding array schema and regression tests, native form elicitation, stateless clients, record icons and existing APIs.

## 2.14.1

- Fix ChatGPT MCP import compatibility: branding radius uses homogeneous numeric items with exactly three values, preserving bounds and permissions. Add installed-SDK discovery regression coverage.

## 2.14.0
- Native Setup Wizard form elicitation through elicit_setup_item: negotiated single-choice, multiple checkbox, text and date-range input. Explicit preview/save, validated answers, cancellation without writes, fresh authority and revision-guarded saves; conversational fallback for clients without form capability. No automatic imports or external actions.
- Authenticated, bounded, grant/resource/scope-bound SSE sessions only for clients negotiating forms (including legacy form capability). Existing non-form clients retain stateless JSON. Restart/expiry requires reinitialization; never replay an uncertain answer save.
- Hardcoded record icon catalogue through list_available_icon_ids, optional icon_id on record/type creation and record updates, plus owner-only revision-guarded set_type_icon for custom types. Null clears an override; existing records remain compatible. UI uses record/type icons with the existing fallback; no uploaded SVG or external URLs.
- Updated initialization guidance, client-visible schemas, public reference and CRM docs. Client implementation/plan determines rendering; Grok and other untested clients are not claimed verified.

## 2.13.0
- Server-backed get_setup on sym_objects returns versioned default questions with per-item AI guidance, selection formats, conditional relevance, saved progress and next pending item. Read-only: no automatic user-data seeding.
- update_setup_item and configure_setup on sym_objects_manage support revision-guarded answers/progress and personal definitions, intentional empty/dismissed modes, stable-ID default evolution and legacy saved records. Owner-only, existing Objects scopes, bounded reads and quota-accounted writes.
- Agent initialization, tool descriptions and served guides now require reading/resuming setup, contextual recommendations, explicit source/import selection and honest completion. Existing org branding operations reused; no new UI or automatic external actions.

## 2.12.0
- Per-organisation validated branding JSON, owner/admin revision-guarded updates, and explicit personal organisation-brand selection with current membership checks and safe revoked-member fallback. Appearance never changes data ownership or grants.
- Served AI instructions now require meaningful, truthful, deduplicated Activity outcomes and business-first Setup Wizard defaults. Eight stable starting questions cover tailored Objects/Projects/Tasks and optional browser onboarding: download, sign in, profile extension, scoped Passes, and connection availability.
- Existing OAuth grants and scope families retained; refresh imported tool schemas to see new organisation actions. No customer records, passwords, or answers are seeded automatically.

## 2.11.1

- Add invitation display labels from matching frozen invitation snapshots after recipient/sender authorization. No tokens, mail payloads or live private record contents are exposed.
- Add canonical current-user organisation roles for truthful UI controls; preserve ACLs, membership limits, refresh lifetime and all prior releases.

## 2.11.0

- Add canonical organisation membership, explicit resource sharing, verified-email invitations and permission requests through six new scoped MCP tools and the shared CRM gateway.
- Extend existing Objects/Projects for owner-targeted collaborative data access; preserve protected schemas, private linked records, independent execution gates and live revocation.
- Add one-level collection groups, batched assignment metadata and configurable membership limits that preserve existing memberships.
- Integrate eight approved sharing emails through the existing Sym sender, durable idempotent outbox and accurate delivery outcomes.
- Offer collaboration permissions explicitly to reconnecting legacy resource clients; preserve registered-client ceilings, read-only requests and existing tokens.
- Fix newly issued MCP refresh credentials expiring with the consent browser's one-day session. Grant expiry, explicit revocation, legacy session binding and account-disablement checks remain enforced. Real OAuth restart/reconnect regressions cover registered-client and token continuity.
- Preserve logging-only request attribution from PR270.

## 2.10.0

- Simplified account consent pairs the supplied Sym design with one Connect account decision, eligible browser defaults and signed-in profile imagery.
- CRM-only OAuth consent now offers Watchers alongside account tools, respecting client ceilings and explicit read-only scopes. Only displayed, approved scopes are granted; existing tokens are unchanged.
- Watchers confirmation is carried by the single account approval, not a separate UI checkbox. No observer starts on connection. Browser/Computer authorization, native consent and zero-Pass CRM remain intact.


## 2.9.1

- MCP OAuth consent now accepts zero selected Browser/Computer Passes, including mixed CRM and browser scopes. Selected Passes still require existing entitlement, ownership and scope checks. Browser operations still require explicit delegation.

## 2.9.0

- Integrate all 57 supplied application preview layouts as validated data-bound templates, retaining the six legacy v1 layouts and adding app-selectable v2 generic templates.
- Expose example_data and the real application registry through preview discovery; preserve immutable version reads and admin overrides.
- Paginate the expanded registry with one bounded stored-page query, not one read per builtin.
- Preserve private owner records and decision-only approval semantics; no external actions or cache-policy changes.

## 2.8.0

- Add bounded Objects get_many (1..20 IDs, deduplicated) with ordered records and fixed resource_not_found item failures; identical private-owner/archive semantics to get. One admission and bounded adapter read, with every document/miss counted.
- Allow authenticated CRM Objects read burst 20 with the same shared sustained read budget (30/min default). MCP/REST retain burst 5, writes burst 3/20 per minute, other resources unchanged. Trust is server-owned, never an input flag.
- Verify existing internal-account HTTP429 retry_after_ms and Retry-After propagation with the actual limiter; no automatic mutation retries, new indexes or auth changes.

## 2.7.0

- Add protected private `sym_activity` default (Activity): required summary/occurred_at, optional kind and bounded related_records linking custom or default records. Existing owner Objects CRUD/scopes; no automatic logs, execution, sends or consent changes. Custom Activities remain distinct.
- Activity-specific listing uses indexed created_at descending, ID ascending cursor pagination. Requires the composite index documented in CRM.md before release; no scan fallback. Other listings remain ID ascending.
- List all three defaults independently of custom pagination; default lookahead scales with the canonical definitions. Extend memory/Firestore regressions for CRUD, protection, isolation, references and ordering.

## 2.6.0

- Add private CRM owner gateway with Objects, bounded Projects planning and published previews. No OAuth principal minting, execution, claims or Project approval bypass.
- Add virtual Sym-managed Setup Wizard and Approval definitions, writable private records, bounded JSON fields and indexed one-hop object connections. Existing users need no schema backfill.
- Add immutable versioned preview registry, six data-bound engine-derived templates, explicit platform-admin publication/CAS, and Objects-scope MCP/REST reads. Decisions and notes remain data, never execution triggers.

## 2.5.0

- Add explicitly authorised unattended `run_skill` watcher routes and revision-checked `set_route` for existing watchers.
- Durable event delivery queue, exact skill version and destination URL guard, current OAuth/catalogue/Pass checks, bounded pre-dispatch retries, and inspectable execution state. Unknown or interrupted dispatch is never replayed automatically.
- Keep browser runtime and existing Project routing unchanged. No extension update required for routing. Existing events are not backfilled.

# Sym API and MCP changelog

## 2.4.0

- Add general-purpose declarative DOM Watchers on selected HTTP(S) pages: exact URL, bounded selectors, stable identity, change fingerprints and optional account/tenant guard. Gmail remains an optional compatibility adapter, not a restriction.
- Require installed extension 0.1.32+ before generic native installation or producer rotation. Preserve independent consent, exact Pass/profile authority, short leases, durable deduplication and acknowledgement.
- Document the open-tab requirement, silent reload baselines, coverage gaps and truthful installed-runtime boundary.

## 2.3.5

- Offer independent Watchers consent to older browser clients when Watchers is enabled. Existing grants, read-only choices and registered scope restrictions remain unchanged.
- Keep authorization redirects on the OAuth issuer so connecting through the public MCP hostname preserves the login flow.

## 2.3.4

- Fix Watchers profile operations incorrectly using the bookmarks handler. Use the existing scoped single-step transport without extension or desktop updates.
- Keep exact profile isolation, operation validation, fresh dispatch checks and native failures. No eligible existing tab fails closed without opening one.
- Existing grants are unchanged; Watchers still requires independent consent.

## 2.3.3
- Preserve unchanged browser uploads and other core operations with the released pre-Watchers connector. Exact schema compatibility, live extension capabilities and Pass scope remain required; unknown revisions and unsupported Watcher operations remain blocked. No installed application update required.

## 2.3.2
- Reuse verified account and session snapshots across refresh and MCP admission without extending five/thirty-second freshness deadlines.
- Consume refresh tokens using request-scoped Firestore version preconditions where supported; retain atomic fallback and replay/revocation protection.
- Avoid unused OAuth index placeholder reads; parallelize independent cold checks and expose credential-free refresh stage timings.

## 2.3.1
- New signed OAuth access tokens last one hour to avoid early-refresh client churn; permission/account freshness stays thirty/five seconds. Existing opaque token issuance retains ten minutes.
- Correct OAuth timing classification behind Express mount prefixes.

## 2.3.0
- Signed OAuth access tokens use local signature verification and shared bounded connection/session authority caches; existing opaque credentials remain accepted.
- Preserve authenticated client-bound grant-wide token revocation, audience/scope checks, 30-second permission freshness and five-second account-status freshness.
- Token issuance no longer flushes unrelated permission entries; transaction notifications include writes only.
- Add OAuth endpoint timing alongside MCP processing; Watchers remains held.


## 2.2.2

- Offer Objects, Projects and bug-report permissions explicitly when reconnecting legacy Browser/Computer clients. Client scope ceilings, explicit resource read-only choices and independent Pass permissions remain enforced.
- Require the existing visible data and Projects consent acknowledgements before issuing new scopes. Existing grants and tokens are not upgraded; Watchers remains held.

## 2.2.1

- Hold Watchers discovery, new consent, documentation and endpoints until the compatible Chrome extension is published. Existing stored data and grant records are preserved.
- Objects, Projects, browser execution, skills, recordings and bug reporting remain available under their existing permissions.

## 2.2.0

- Add private Watchers and retained event queries through shared MCP/REST services, with independent explicit OAuth consent. Existing grants are not expanded.
- Add exact Pass/profile/account-bound producer credentials, short observation leases, atomic bounded ingestion and durable deduplication. Producer credentials cannot invoke MCP.
- Add companion extension installation and status capabilities, silent Gmail baselines, old-thread change detection, durable outbox acknowledgements, sender/document validation, bounded inactive-source checks and revocation stops. A compatible extension is required; Gmail rendered-inbox observation remains a preview, not a complete mailbox feed.
- Add explicit atomic Project routing through existing task rules. Created tasks always require owner approval; routing does not run models or browser actions.
- Document capacity limits, coverage gaps and inspection of uncertain installation outcomes. Outlook and automatic retention deletion are not included. Real mailbox and Store-release qualification remain separate from local fixture evidence.

## 2.1.0

- Add private Projects, ordered optional pipelines/steps, tasks, Object references and bounded queries through shared MCP/REST services.
- Add transactional dependency/capacity checks, revision-safe edits and grant-bound fenced claims. Display moves preserve plans; completed plans and retained execution history are not silently rewritten or deleted.
- Add exact owner-session approvals, canonical published-skill execution, durable receipt/evidence linkage, unknown-outcome inspection without replay, and distinct agent-reported versus owner-confirmed completion. No new model worker or browser runner.
- Require separately disclosed Projects OAuth scopes and acknowledgement. Existing credentials gain no access automatically. Browser, catalogue and Object authority remain separate.
- Add configurable count limits, bounded private telemetry, documentation and emulator/protocol/producer-consumer regression coverage. Visual Projects/approval UI and Watchers are not included.

## 2.0.0

- Bug attachment reads now return public cdn.cosmise.com URLs and metadata, not inline base64 image blocks. This intentional attachment-response change follows the approved public-CDN storage correction; other tools and auth scopes are unchanged.
- Binary files upload through the existing signed CDN PUT method. Firestore holds metadata only; ownership and completed-upload validation remain enforced.

## 1.2.0

- Add private bug reports: sym_bugs / sym_bugs_manage and POST /v1/bugs/read /v1/bugs/manage. Read own reports/screenshots, create reports and publish saved replies. Only verified Sym support may use the inbox or change open/investigating/closed status.
- New explicitly consented bugs:read / bugs:write scopes; existing grants are not expanded. Writes require confirm:true and stable client_request_id; updates require revision. Report content is untrusted input and never grants browser/workspace access.
- Durable owner notifications use the Sym sender with leased retries and provider idempotency. No autonomous-fix promise.

## 1.1.1

- Fix Objects output schemas for MCP clients that validate structured error results even when `isError` is true. Existing success and error wire bodies are unchanged.
- Retain typed closed success results and actionable errors; reject empty or mixed envelopes. Add real SDK regression coverage for not-found, validation, conflict and rate-limit responses.

This changelog tracks the public account API/MCP contract, not the MCP wire protocol, Chrome extension or individual published skills. Version authority: `services/account-mcp/package.json`.

## 1.1.0

- Add private per-user Sym Objects: typed immutable definitions, records, references, revision-safe updates, archive/restore and reference-safe deletion.
- Add sym_objects / sym_objects_manage and their REST equivalents, with explicit objects:read / objects:write consent. Existing grants are unchanged.
- Store only under sym_mcp_data/{mode}/users/{uid}, with snake_case fields/collections. No tenant system or organisation sharing.
- Enforce item quotas atomically, bounded pages/payloads and process-local per-user request limits. Ordinary reads/updates do not read quota counters.
- Add privacy-preserving aggregated usage diagnostics; no Firestore write on reads. Operator-configured user suspension supported.
- Projects, Watchers and extension runtime are separate upcoming releases, not implied by this Objects release.

## 1.0.0

First explicitly versioned baseline of the existing production API, plus additive reference and response metadata. Earlier deployments used an unversioned evolving contract with service label 0.1.0; their individual rollout dates are not reconstructed here.

### Added
- Shared source registry for all possible MCP tools, titles, descriptions, input/output schemas and unchanged scope-dependent visibility.
- Generated `/docs/reference`, `/docs/reference.md` and OpenAPI 3.1 `/openapi.json` for public execution REST resources.
- Standard additive MCP `_meta["so.sym/response"]`: contract, API version, tool, returned/error status and request ID when supplied. Original structuredContent and REST success bodies are preserved.
- Output schemas for service-owned envelopes, with explicit open/dynamic boundaries for native payloads and action-dependent objects.
- Public `/version` and `/docs/changelog.md`; API version in MCP initialization, public docs, health and response headers.
- Coverage tests tying public references to actual registration, scope filters, transport serialization, routes and source operation sets.

### Existing capabilities included in this baseline
- Browser and Computer Pass discovery, typed observation/action tools and legacy mixed-operation compatibility tools.
- Published skill catalogue access, sharing, immutable publication and exact-version execution.
- Private screenshots/assets and authorized recordings.
- Reserved work sessions, window coordination, request deduplication and explicit recovery safeguards.
- Eval/skill error feedback, bounded permission/admission caching and version-fenced concurrency bookkeeping.
- Full wrapped-eval budget validation before window acquisition.

### Compatibility and limits
- No new OAuth scopes, automatic grant upgrades, native execution framework or changes to stored skill bytes.
- Native payloads are not claimed to have exhaustive closed per-operation output schemas. Selected-Pass discovery remains authoritative for device support and input schemas.
- OpenAPI covers public account/execution REST resources, not OAuth-provider internals, operator administration or playground endpoints. MCP tool discovery remains its own protocol.
- Schema/documentation tests are not proof of every operation on every installed device or successful mailbox extraction.

## Future releases

Every public contract change must update this file and the package/lockfile versions in the same change. Patch = compatible fixes/clarifications; minor = compatible additions; major = incompatible fields, removals or semantics. Preserve old result fields during compatible changes, document deprecations and keep scope/unknown-outcome regressions passing.