Changelog
Every change that shipped to Claim Your Gold, newest first — derived from commit history, not hand-written. The hash beside each commit is that entry’s leaf on the estate transparency log, and the last few entries may not be folded yet — the explorer says so.
Also available as a machine-readable devlog/1 fragment and as DEVLOG.md on GitHub.
Merge pull request #135 from FlashyLabs/claude/friendly-faraday-he0xvh
Cut the merge→production path, fix the favicon, and gate the workflow error I shipped (#133)
One defect shape, found five ways: documents and wiring that quietly disagree (#132)
Merge pull request #131 from FlashyLabs/claude/friendly-faraday-he0xvh
Merge pull request #130 from FlashyLabs/claude/friendly-faraday-he0xvh
Merge pull request #129 from FlashyLabs/claude/friendly-faraday-he0xvh
WGI-3b: LIFE non-custodial wallet behind the custody adapter (agent half) (#124)
Merge pull request #128 from FlashyLabs/claude/friendly-faraday-he0xvh
Merge pull request #127: Harden the competitive layer (settlement idempotency + isRealTelegramId sweep)
Vendor: re-vendor drifted emitter copies from current flashyos canon (#111)
Merge pull request #126: Matrix launch roadmap (email fallback, channel-guard sweep, machine-readable surfaces)
Merge pull request #125: Matrix launch roadmap (welcome bonus, identity badges, story cards, channel guards)
First-session UX, Matrix front door, and the component-reachability orphan queue (#123)
Merge pull request #121 from FlashyLabs/claude/dreamy-bell-2e5nq3
WGI-4b: ledger↔chain reconciliation (nightly) (#120)
Tests: track the 800,000+ Season 1 floor the source already shipped (#122)
Claimyour.gold: surface the machine surfaces in the footer
Add the provenance bar (estate chrome) to claimyour.gold
Season 1: 800,000+ eligible to claim Flashy Gold (audit 1.2)
WGI-4a: rail receipts as offline-verifiable claims (#117)
WGI-3a: custody abstraction (custodial + non-custodial) (#115)
WGI-1c: signed service auth, flag-gated beside the static key (#118)
WGI-1b: internal wallet routes + contract tests (#114)
Bump @flashyos/agent 0.16 → 0.21 (#116)
Wallet: full transaction list with Flashy Network explorer links (#113)
WGI-2c: round-trip integration test (#112)
Drop "real Flashy Gold" from copy; extend the brand lint (audit 1.5)
WGI-2b: receipts persisted and double-entered (#110)
WGI-4b: nightly ledger↔rail reconciliation (#109)
The dashboard wallet is the Flashy Financial wallet (#108)
Rail debits through the consent gate, migrated reads from the rail, a bounded rail client (#107)
WDK gold rail (WGI-2a): governed, flag-gated, testnet-only (#104)
Add Vercel Web Analytics (<Analytics/> component) (#105)
Delivery: the emitter's push does not run the laptop hook
Delivery: install before the Test step
Link Developers and the estate's open-source door from the footer
WDK–Gold integration: machine-readable roadmap + wallet.v1 contract (#103)
Branch mesh sync: check out the module the re-vendored script requires
Badge: verified on the FlashyOS network
Merge pull request #100 from FlashyLabs/claude/jolly-noether-oh1ev6
Merge pull request #99 from FlashyLabs/dependabot/github_actions/actions-add0da0037
Merge pull request #95 from FlashyLabs/claude/laughing-pasteur-lvg40h
Merge pull request #98 from FlashyLabs/claude/inspiring-mendel-34uy2u
Merge pull request #97 from FlashyLabs/claude/code-estate-audit-wfm6ha
Concierge: modal redesign re-vendor (#92)
Make flashy-app depend on the GatewayZ secret grant (#94)
Route the live /ops inference through GatewayZ (flashy-app) (#93)
Merge pull request #90 from FlashyLabs/claude/code-estate-audit-wfm6ha
Merge pull request #89 from FlashyLabs/claude/leaderboard-alltime-fix
Merge pull request #54 from FlashyLabs/claude/canonical-host-env
Merge pull request #55 from FlashyLabs/claude/fix-broken-cross-links
Outbox worker (increment 2) — settle earns, park debits (#88)
Merge pull request #87 from FlashyLabs/claude/trust-routing-network-77xwmg
Merge pull request #86 from FlashyLabs/claude/source-code-audit-b97g8c
Merge pull request #73 from FlashyLabs/claude/gord-directory-spec-3jx7zk
Reconcile the civilization roadmap against the canonical group roadmap
Quest rotation actually rotates — 83 -> 81
Close the crew war prize pool path; stop taking bets that cannot settle
WS-1 job registry and heartbeat; wire the staked-duel settlement path
Week 1: job wiring gate, cohort viral coefficient, war escrow audit
War systems audit and the growth-surfaces design brief
Technical recommendation: job registry, wiring gate, real k, share loop
Boardroom brief: distribution over surface area (2026-08-20)
SHIP-0: sync TECHNICAL_ROADMAP.md to canonical v1.1 (#59)
Regenerate lockfile for @flashylabs/ledger
Merge pull request #58 from FlashyLabs/claude/node-22
Merge pull request #57 from FlashyLabs/claude/seam-4-service-identity
Merge pull request #56 from FlashyLabs/claude/seam-3-integer-money
Merge pull request #46 from FlashyLabs/fix/smoke-test-cold-start-retry
Phase 9 + 10a — campaign management UI, daily streaks, configurable rewards
Changed chest image
Update lowercase ui component modules
Stabilize UI branch after main merge and auth-safe cleanup
Remove duplicate uppercase UI component files
Merge main into UI, keep main runtime functionality
Merge origin/main into UI using main conflict resolutions
Fix UI component filenames to match import casing (badge.tsx, button.tsx, card.tsx)
Add UI components index file for proper imports
Fix all TypeScript compilation errors and missing production infrastructure
Change database environment variable from DATABASE_URL to MONGODB_URI
Clean up project structure for Vercel deployment
Add comprehensive Vercel deployment guide and setup scripts
Fix leaderboard page and prepare for production deployment
Update Next.js config to use stable typedRoutes
Fix production UI component imports and change port
Fix port configuration and rate limiting for development
Add dev login button and fix auth endpoint for development
Integrate production-ready portal views and infrastructure
Push dev flag
Remove redundant ui/ folder after integration
Replace UI with new 'Claim Your Gold' landing page
Feat/CSV-Upload (#1)
Telegram HMAC passthrough for extra fields + points pre-check in claim (#2)
Correctly type rejected session in authOptions callback
Drop unused HMAC_CALLBACK_SECRET env var
Scope wallet/balance to the calling client's customers
HTML-escape user input in transactional email templates
Neutralise CSV formula injection in transaction exports
Require step-up auth before regenerating API secret key
Revoke client JWTs on password reset and tighten password policy
Add HTTP security headers and remove wildcard CORS
Bump next to 16.2.4 for DoS CVE GHSA-q4gf-8mx6-v5v3
Use timingSafeEqual for Telegram auth hash check
Validate outbound URLs to block SSRF on webhooks
Replace x-customer-id trust with HttpOnly portal session cookie
Initial Commit