This release improves workspace organization with a new capability system, adds workspace balance visibility in billing, fixes candidate filtering and display issues, and includes security hardening across the platform.
Security hardening improvements across the platform
pin the timer dock to the visible sidebar, and make the hero its state
make the recruiter workspace a working product
compliance-documents is NOT shut — it returns real rows
one workspace balance + plan-included reveals
capability registry + make the Team page tell the truth
looping speaker rail + partner logo strip on pizza night
distributed IP limit on expert nomination
deep-linkable detail panel + list-view redesign
module contract + docs-drift gate, closes webapp#type-check
active-filter chips, a funnel that agrees with the board
stop the card overflowing, and make the numbers true
allow Brandfetch asset hosts in img-src
allow Brandfetch asset hosts in img-src
let the capability test name the roles it asserts on
drop another session's staged work from this branch
pin the timer dock to the visible sidebar, and make the hero its state
make the recruiter workspace a working product
compliance-documents is NOT shut — it returns real rows
one workspace balance + plan-included reveals
capability registry + make the Team page tell the truth
denial surface across the whole Domains page + the shared admin guard
migrate the 5 remaining non-colliding gates
notifications + migrate 11 more surfaces onto the registry
request access — the in-product way out of a tier denial
complete the workspace being onboarded, and fail open
complete the workspace being onboarded, and fail open
integrate capability tiers with work that landed on staging
move onboarding state onto the workspace it describes
move onboarding state onto the workspace it describes
3 security hardening fixes
looping speaker rail + partner logo strip on pizza night
distributed IP limit on expert nomination
distributed Upstash rate limiter with per-recipient keying
gate hiring-quote on BotID (shadow) + per-recipient distributed limit
throw-safe isBotRequest + shadow-mode bot-enforce flag
correct BotID path syntax JSDoc to reference actual entries
don't empty the local part when an email begins with +
eliminate IP-range collision in the quote-abuse improvement test + assert shadow-mode log
hash IP identifiers, log distributed-limit denials, fix nomination i18n key
normalize plus-addressed emails before hashing, raise quoteEmail budget to 6
register hiring-quote + expert-nominate with BotID via one route registry
replace pnpm-add lockfile with plain-install resolution
widen expert-nomination distributed-limit mock's return type