Change Log Hub

Summary

Public GitHub support links now live in a sidebar App Support section with icon-led pills instead of the shared footer.

Detailed changes

• Move GitHub, Open an issue, and Discussions links from the shared footer into a new App Support section at the bottom of the left sidebar.
• Show App Support below Log out for signed-in users and after the theme toggle for guests.
• Style each support link as a pill with a Lucide icon and a hover lift effect.
• Keep the Change Log Hub Feedback and source block unchanged.

Affected areas

• Shared layout sidebar
• Shared layout footer
• Public navigation chrome

Version decision

Patch release: relocates existing public GitHub links within the shared layout without changing URLs or access rules.

Summary

All 72 documented app versions now have matching GitHub Release tags (v{VERSION}), and release prepare requires a pull request reference so future versions stay aligned with GitHub.

Detailed changes

• Backfill GitHub Releases and tags for v0.1.0 through v0.31.6 mapped to their merge commits on main.
• Add scripts/local/map-release-commits.mjs and scripts/local/backfill-github-releases.mjs with dry-run, resume, and batch support.
• Require --pr on myapes:changelog-prepare so every new release cites its merging pull request.
• Show a GitHub Release link in the Change Log Hub Source section for staff and admin viewers.
• Document GitHub Release tag parity and the deploy SHA versus version introduction commit distinction in README and ship-gate guidance.

Affected areas

• GitHub Releases and tags
• Release metadata workflow
• Change Log Hub staff references
• Agent ship-gate documentation

Version decision

Patch release: aligns external GitHub versioning with in-app semver and tightens release metadata hygiene without changing production application behaviour.

Summary

Guests and signed-in users can open the MyAPES Core GitHub repository, start a new issue, or browse discussions from the shared footer and Change Log Hub.

Detailed changes

• Add GitHub, Open an issue, and Discussions links to the shared site footer on every layout screen.
• Add a public Feedback & source section on the Change Log Hub with the same GitHub links.
• Centralize repository, issue chooser, and discussions URLs in config/myapes.php for reuse and optional env overrides.

Affected areas

• Shared site footer
• Change Log Hub
• Public chrome configuration

Version decision

Patch release: backward-compatible public navigation to GitHub feedback channels; no API or auth behaviour change.

Summary

Cloudron deploy is operator-triggered only. Cursor agents follow a ship-gate: ask after CI, ask to deploy after merge, verify Change Log hubs, then ask whether to create a GitHub Release.

Detailed changes

• Stop auto-deploy on green main; Deploy MyAPES Core to Cloudron runs only on workflow_dispatch.
• Add ship-gate agent rule and skill with next-actions menus for merge, deploy, changelog hubs, and GitHub Release.
• Document that the app Change Log Hub updates from releases.json on the same Cloudron deploy, and that sibling website changelogs need an explicit operator ask.

Affected areas

• Cloudron deployment workflow
• Agent ship-gate documentation
• Public Change Log Hub (via deploy)

Version decision

Patch release: changes how operators and agents trigger deploy and release without changing application product features for end users.

Summary

Stale Super Admin addresses for Plugins and Groups now send people to the live Admin pages instead of a bare Laravel 404.

Detailed changes

• Redirect /superadmin/plugins and the older /superadmin/modules address to the live Plugins page at /admin/modules.
• Redirect /superadmin/groups to the live Groups address at /admin/groups, which continues into the Access Groups tab.
• Keep Super Admin navigation pointed at the live Access and Plugins pages so those chrome links do not use the stale addresses.

Affected areas

• Super Admin navigation
• Super Admin compatibility URLs

Version decision

Patch release: restores existing Super Admin Plugins and Groups destinations without adding a new workspace.

Summary

Guests and signed-in public accounts now see a public Change Log summary only. Internal-only records, rollback notes, and GitHub issue or pull-request links stay on staff and admin directory sessions.

Detailed changes

• Hide Internal-only release records from guests and signed-in public accounts on the Change Log Hub.
• Hide the Internal-only filter chip and GitHub issue or pull-request links for those public audiences.
• Keep the Internal-only chip, fuller notes, and GitHub links for Cloudron staff and admin directory sessions.

Affected areas

• Public Change Log Hub

Version decision

Patch release: withholds Internal-only changelog notes from guests and public accounts without changing how staff and admin directory sessions read the full history.

Summary

Signed-in public accounts can see their login email on Profile as read-only, next to the password block, so they know where notifications and password-reset mail go.

Detailed changes

• Show the signed-in account email on Profile as read-only, next to the password block.
• Explain that notifications and password-reset mail go to that address; do not offer an email-change form.
• Keep directory and Cloudron password management in Cloudron; staff continue to see directory email on the staff profile.

Affected areas

• Public profile

Version decision

Minor release: adds a read-only account email on Profile without introducing an email-change flow.

Summary

Signed-in local public accounts can change their password on Profile. Directory and Cloudron accounts continue to manage passwords in Cloudron.

Detailed changes

• Add current, new, and confirm password fields on Profile for local service-user accounts.
• Require the current password; keep the signed-in session after a successful change and invalidate other sessions.
• Hide the change-password form for Cloudron directory, pending first-login, hybrid, and staff-eligible accounts.
• Set current-password and new-password autocomplete hints on the Profile password fields.

Affected areas

• Public profile
• Public local password sign-in

Version decision

Minor release: adds a signed-in password-change path for local public accounts without changing Cloudron directory sign-in.

Summary

Local public accounts can request a password reset from Public Login. Directory and Cloudron accounts continue to use Staff Login and Cloudron.

Detailed changes

• Add guest forgot-password and reset-password pages for local service-user accounts, linked from Public Login.
• Send a reset email only for eligible local public accounts; directory, Cloudron, pending first-login, and staff-eligible accounts receive the same generic confirmation without a reset mail.
• Set username, current-password, and new-password autocomplete hints on public login, register, forgot-password, and reset fields.

Affected areas

• Public login
• Public registration
• Guest password reset

Version decision

Minor release: adds a guest password-recovery path for local public accounts without changing Cloudron directory sign-in.

Summary

Admins and Super Admins can issue a one-time temporary password for a local public account from Admin → Public users. Directory and Cloudron accounts cannot be reset this way.

Detailed changes

• Add a local-password reset action on the Admin public-users list and detail screens for local service-user accounts.
• Show the temporary password once after reset; it is not stored in audit history.
• Refuse directory, Cloudron, pending first-login, and staff-eligible accounts so those passwords stay on Cloudron.

Affected areas

• Admin public users
• Public local password sign-in

Version decision

Minor release: adds an Admin capability to recover local public passwords without changing protected roles or Cloudron directory sign-in.

Summary

Public password login is limited to local service-user accounts. Cloudron directory users must use Staff Login, and directory sync still never creates local public users.

Detailed changes

• Reject directory identities on the public login form and remember-me restoration so Staff Login remains the production Cloudron sign-in path.
• Hide and 404 the local staff password form outside local and testing environments.
• Keep public, volunteer, and student accounts off Admin and Super Admin routes, and document the public versus Cloudron account split.

Affected areas

• Public login
• Staff Login
• Directory user sync
• Admin and Super Admin navigation

Version decision

Patch release: tightens public versus Cloudron account separation without adding access tiers or changing canonical myapesaccount group names.

Summary

Super Admins now manage Cloudron group mappings, job-role capability packs, and the permission catalogue from a single Access workspace instead of three separate admin pages.

Detailed changes

• Replace Super Admin Groups, Roles, and Permissions with one /admin/access workspace (Groups, Job roles, Permission catalogue tabs).
• Add reviewed job-role capability packs with Advanced fine-grained permissions for custom and default job roles.
• Redirect legacy /admin/groups, /admin/roles, and /admin/permissions URLs into the matching Access tab while keeping immutable mappings and denial audits unchanged.

Affected areas

• Super Admin Access workspace
• Directory group mappings
• Job role management
• Permission catalogue

Version decision

Minor release: consolidates authorization admin UX into one workspace with capability packs without changing protected tiers, sync semantics, or mutation services.

Summary

Fresh installs now include four organisational job roles with reviewed default permission packs, and Super Admins can map those roles onto managed Cloudron groups without changing preset access-tier mappings.

Detailed changes

• Seed board-of-directors, management, client-services-advisor, and receptionist as custom job roles during authorization metadata sync.
• Keep Super Admin permission edits on later syncs, and exclude Super Admin-only permissions from the default packs.
• Allow mutable job-role mappings on managed myapesaccount.* groups while preset protected mappings stay immutable.

Affected areas

• Authorization metadata sync
• Admin Groups and Roles
• Directory group mappings

Version decision

Minor release: adds seeded organisational job roles and optional group-to-job-role mappings without changing protected access tiers.

Summary

Directory synchronization now suspends Cloudron staff accounts that disappear from required myapesaccount.* groups, blocks Staff Login while suspended, and can clear only directory-disabled suspensions when membership returns.

Detailed changes

• Suspend directory users missing from required Cloudron group membership with reason directory-disabled during manual and scheduled sync.
• Clear directory-disabled suspensions when membership returns through sync or a successful Staff Login directory proof.
• Keep public local accounts untouched by directory user sync and document the disable-mirroring behaviour.

Affected areas

• Directory user synchronization
• Staff Login and directory revalidation
• Authorization documentation

Version decision

Patch release: completes disable mirroring for already-shipped directory user sync without changing group naming or public account rules.

Summary

Directory catalogue sync and Super Admin Groups now keep only managed myapesaccount.* Cloudron groups in the working catalogue view, while historical non-prefix rows remain stored for audits.

Detailed changes

• Filter catalogue persistence to managed myapesaccount.* groups, including legacy alias rewriting.
• Show managed myapesaccount.* groups in Super Admin Groups and hide historical non-prefix noise.
• Document the catalogue filter and audit retention behaviour in the README and Admin Groups page.

Affected areas

• Directory catalogue synchronization
• Super Admin Groups
• Authorization documentation

Version decision

Patch release: hardens existing myapesaccount.* catalogue behaviour and Admin listing without changing sign-in or role mappings.

Summary

Volunteers and students keep staff-class service access across enabled modules but no longer receive ticket or case delete abilities; local QA fixtures and documentation cover the Student and Volunteer switcher roles.

Detailed changes

• Grant module delete abilities only to staff, administrator, and super-admin protected roles.
• Seed local QA Student and Volunteer accounts and expose them in the QA role switcher.
• Document volunteer and student access tiers, including the no-delete rule, in the README auth architecture.

Affected areas

• First-party module permission defaults
• Local QA seeding and role switcher
• Authorization documentation

Version decision

Patch release: corrects delete grants for already-shipped volunteer and student protected roles without changing directory group naming.

Summary

Directory readiness now accepts misspelled Cloudron volunteer group names such as myapesaccount.vounteer and temporary myapesaccont.* prefix typos, mapping them to the canonical myapesaccount.* groups so deploy can succeed while operators finish renames.

Detailed changes

• Normalize myapesaccount.vounteer and related misspellings to myapesaccount.volunteer during LDAP enumeration and membership resolution.
• Accept temporary myapesaccont.* Cloudron group names as aliases of the canonical myapesaccount.* groups.
• Document the misspelling aliases and the remaining operator rename to correctly spelled Cloudron groups.

Affected areas

• Directory LDAP group normalization
• Authorization deploy preflight
• Cloudron operator documentation

Version decision

Patch release: backward-compatible deploy readiness fix that maps misspelled directory group names without changing canonical myapesaccount.* authorization semantics.

Summary

Splits CI from Cloudron deploy, adds pre-merge release gates, upgrade-preflight simulation, and clearer deploy failure summaries so merge and deploy fail less often and recover faster.

Detailed changes

• Split GitHub Actions into test-cloudron.yml and deploy-cloudron.yml so failed deploys can be retried without rerunning the full test matrix.
• Retry transient directory_readiness failures during activation preflight and write sanitized failure summaries to GitHub Actions.
• Add ProductionUpgradePreflightTest plus composer pre-merge for release and deploy contract checks before push.
• Auto-patch ReleaseHistoryCommandTest date indices during changelog prepare and cross-check version-pinned tests in changelog validate.

Affected areas

• GitHub Actions CI and deploy
• Cloudron deployment activation
• Release metadata validation
• Agent pre-merge workflow

Version decision

Patch release hardening merge and deploy reliability without changing end-user product behavior.

Summary

Cloudron deploy no longer fails when the LDAP group rename migration finds both legacy myapes.* and canonical myapesaccount.* directory groups already present.

Detailed changes

• Make the myapes-to-myapesaccount directory group rename migration merge duplicate rows instead of renaming into an existing unique name.
• Reassign directory mappings and role sources to the canonical group before deleting the legacy duplicate.

Affected areas

• Cloudron deployment activation
• Directory groups migration

Version decision

Patch release: backward-compatible deploy fix for a partial-upgrade database state without changing authorization semantics.

Summary

Deploy preflight now accepts legacy myapes.* Cloudron LDAP groups by normalizing them to the canonical myapesaccount.* names, so production can upgrade before operators rename directory groups.

Detailed changes

• Normalize legacy myapes.* LDAP group names to myapesaccount.* during directory enumeration and managed group filtering.
• Allow authorization preflight and super-admin eligibility checks to succeed when production still exposes the previous Cloudron group prefix.

Affected areas

• Cloudron deployment activation
• LDAP directory readiness
• Staff OIDC authorization preflight

Version decision

Patch release: backward-compatible deploy fix that maps legacy directory group names during readiness without changing canonical myapesaccount.* authorization semantics after Cloudron groups are renamed.

Summary

Cloudron deployments from v0.25.0 no longer fail authorization preflight when the database still has the previous authorization guard triggers until the upgrade migration runs.

Detailed changes

• Allow legacy Phase B authorization guard triggers during preflight while the guard upgrade migration is still pending.
• Force reinstall authorization compatibility triggers during the volunteer and student role migration.

Affected areas

• Cloudron deployment activation
• Authorization preflight
• Database guard migrations

Version decision

Patch release fixing a production deployment blocker introduced in v0.25.0 without changing the LDAP group migration behaviour.

Summary

Staff directory authorization now uses five preset Cloudron groups under the myapesaccount prefix, including new volunteer and student roles, with LDAP-driven user provisioning before first sign-in.

Detailed changes

• Replaced legacy myapes.* directory groups with five preset myapesaccount.* Cloudron groups mapped to staff, administrator, super-admin, volunteer, and student protected roles.
• Synchronize only myapesaccount-prefixed LDAP groups and pre-provision Cloudron OIDC users plus staff profiles during directory sync.
• Removed admin enable/disable and custom directory mapping controls; the groups catalogue is read-only apart from manual sync.
• Added a data migration to rename legacy directory group records and refresh authorization metadata for existing installs.

Affected areas

• Staff Cloudron OIDC sign-in
• LDAP directory synchronization
• Admin Groups and Users
• Authorization roles and permissions

Version decision

Minor release: adds volunteer and student protected roles and changes directory group naming and sync behaviour while keeping existing staff and administrator sign-in paths compatible after Cloudron group migration.

Summary

Directory authorization now accepts both the singular and plural Cloudron superadmin group names so either group can grant Super Admin and satisfy deploy readiness.

Detailed changes

• Mapped both myapes.superadmin and myapes.superadmins immutably to the super-admin role.
• Updated auth readiness so at least one of those groups must have members, while staff and admin groups remain required and membered.
• Aligned preflight eligibility, integrity checks, Local QA fixtures, and documentation with the dual group names.

Affected areas

• Directory role mapping and sync
• Authentication readiness and authorization preflight
• Staff login authorization
• Local QA fixtures and README

Version decision

Patch: backward-compatible fix that adds an alternate exact group name without changing role semantics or public account flows.

Summary

User-facing product language now presents MyAPES Core as the platform, Services as the APES CIC / Shelter / Pet Care hubs, and Plugins as Tickets, Cases, Pet Profiles, and Consultations. Runtime keys, routes, and permission names are unchanged.

Detailed changes

• Renamed signed-in chrome, Admin, changelog, and APP_NAME branding to MyAPES Core while keeping login and registration as MyAPES Account.
• Relabelled Super Admin Modules navigation and registry copy to Plugins, and sub-core wording to Services.
• Updated hub empty and summary headings, tips, permission titles, and flash messages to Plugins and Services language.
• Documented the Core → Services → Plugins vocabulary in README and PRODUCT.md.

Affected areas

• Application branding and layout
• Super Admin Plugins registry
• Service hub dashboards
• Permission catalogue titles
• README and PRODUCT docs

Version decision

Minor: backward-compatible product language and documentation capability with no API, permission-key, or data-model break.

Summary

Directory groups on staff profile and admin user pages now show as wrapping chips instead of a hard-to-scan comma-separated list.

Detailed changes

• Replaced the comma-separated monospace directory groups list with wrapping chips on the staff profile page.
• Applied the same chip layout to normalized directory groups on the admin user detail page.
• Added Local QA sample directory groups for staff, admin, and superadmin accounts so the layout is easy to check locally.

Affected areas

• Staff profile page
• Admin user detail page
• Local QA fixtures

Version decision

A backward-compatible patch that only changes how existing directory group values are displayed.

Summary

APES CIC support tickets and formal cases now use hierarchical categories, optional website selection, screenshot and screencast attachments, clearer ownership fields, and Super Admin editable module settings. The Super Admin modules page also shows modules in a three-column card grid.

Detailed changes

• Added hierarchical service areas and subcategories for APES CIC tickets, including CIC-oriented areas such as web development, IT, governance, finance, fundraising, and membership support.
• Added formal case categories for data access, privacy requests, complaints, membership casework, welfare concerns, and related escalations.
• Allowed website selection and screenshot or screencast attachments where a subcategory requires them.
• Surfaced ticket and case owner and assigned staff more clearly, including staff reassignment where permitted.
• Added database-backed module settings with Super Admin editing for APES CIC tickets and cases.
• Restyled the Super Admin modules page to show up to three module cards per row.

Affected areas

• APES CIC tickets and cases
• Super Admin modules registry and module settings
• Support attachment uploads

Version decision

A backward-compatible minor release that adds new optional fields, settings, and UI capabilities without removing existing ticket or case workflows for other services.

Summary

APES CIC, Shelter and Rescue, and Pet Care Clinic hub pages are now service dashboards with friendly public wording, open-item attention, numeric support-service totals, quick links, and recent updates.

Detailed changes

• Replaced member-visible sub-core and module jargon on service hub pages with support service and support tool wording.
• Redesigned each service hub as a spaced dashboard showing what needs attention, available support services with totals, permission-aware quick links, and recent updates.
• Scoped hub attention and summary data to the active service while reusing the existing dashboard providers and privacy model.

Affected areas

• APES CIC, Shelter and Rescue, and Pet Care Clinic hub pages
• Service hub layout and styles
• Spike mascot tips on service hub routes

Version decision

A backward-compatible minor release adding richer service hub dashboards and clearer public-facing language without changing routes, permissions, or record data.

Summary

Admin and Super Admin overview pages now show compact reporting-range radio options and an Update range button instead of oversized form controls.

Detailed changes

• Scoped analytics-range styles so radio inputs no longer inherit full-width form sizing.
• Aligned reporting-range labels and the Update range button on a single compact toolbar row on Admin and Super Admin overview pages.

Affected areas

• Admin overview
• Super Admin overview
• Reporting range controls

Version decision

A backward-compatible patch release fixing oversized reporting-range controls on admin overview pages.

Summary

Spike tip dock dismiss control is a clear top-right close control, the dock avatar uses the pointing Spike artwork, and previous page dismissals are reset so the redesigned tip can appear again.

Detailed changes

• Replaced the Hide tip text control with a high-contrast top-right × close button on the tip bubble.
• Swapped the dock avatar to full-body pointing Spike artwork oriented toward the tip bubble.
• Rotated the local dismiss storage key so earlier page hide choices do not conceal the redesigned tip dock.

Affected areas

• Spike tip dock helper
• Page tip dismiss persistence

Version decision

A backward-compatible patch polishing tip-dock presentation and dismiss behaviour without changing tip copy, routes, or permissions.

Summary

Dashboard service totals now appear as separate accented panels for each sub-core, so Tickets and other shared modules are clearly tied to APES CIC, Shelter and Rescue, or Pet Care Clinic.

Detailed changes

• Grouped dashboard service totals into per-sub-core panels with accent rails, short module labels, and Open service links to each hub.
• Dropped redundant service prefixes from Cases and Pet profiles labels when modules sit under their sub-core heading.

Affected areas

• Account dashboard service totals
• Dashboard presentation styles

Version decision

A backward-compatible patch improving dashboard service-total clarity without changing module data, permissions, or routes.

Summary

The Admin Modules page now groups capabilities by sub-core with compact shipped-module rows and short incompatible chips, making installation state easier to scan without changing lifecycle controls.

Detailed changes

• Replaced the dense Admin Modules compatibility matrix with sub-core sections, compact shipped-module rows, and chip-style incompatible summaries.
• Kept guarded enable, disable, and install confirmations available under a Manage disclosure for authorized super-admins.

Affected areas

• Admin Modules registry page
• Admin Modules presentation styles

Version decision

A backward-compatible patch improving Admin Modules readability without changing module catalogue data, permissions, or lifecycle transition contracts.

Summary

Adds myapes:changelog-prepare so agents scaffold and sync VERSION, releases.json, module-runtime-contract.json, and version-pinned tests in the same PR before merge and Cloudron deploy.

Detailed changes

• Added myapes:changelog-prepare with stub-then-fill release scaffolding, dry-run support, and guards against incomplete or repeated bumps.
• Extended release validation to require module-runtime-contract.json application_version sync and reject scaffold TODO: placeholders.
• Documented mandatory end-of-work release steps in AGENTS.md, a Cursor rule, and a release-metadata skill.

Affected areas

• Release history validation
• Agent instructions and Cursor skills
• Cloudron deploy pre-merge contract

Version decision

A backward-compatible minor release adding agent-facing release preparation tooling without changing runtime application behavior.

Summary

Restores full-width Recent activity rows on APES CIC, Shelter and Rescue, and Pet Care Clinic hub pages by aligning hub markup with the dashboard attention-item grid.

Detailed changes

• Added a shared attention-item link component with icon, body, meta, and chevron columns used by the dashboard and sub-core hubs.
• Mapped hub recent-activity module types to the correct icon and style modifiers, including pet-profile rows.

Affected areas

• Sub-core hub Recent activity
• Dashboard attention feed
• Shared attention-item presentation

Version decision

A backward-compatible patch release fixing a pre-existing layout regression where hub recent activity content was squashed into the icon column.

Summary

Public service-user accounts keep the existing contact profile, while staff accounts now have a workplace profile. Public and staff identities stay on separate accounts, and administrators can manage both profile types.

Detailed changes

• Added a staff profile for job title, team, work phone, and photo, with Cloudron directory name, email, and groups remaining read-only.
• Stopped creating hybrid public-and-staff accounts and converted existing hybrid users to staff-only Cloudron identities.
• Gave administrators Public users and Staff lists with editors for each profile type.

Affected areas

• Account profiles, staff and public authentication, admin user management, and local QA fixtures

Version decision

A backward-compatible minor release splitting public and staff profile data without changing service modules or directory group mappings.

Summary

Refreshed MyAPES Account with a warmer desert visual system and introduced Spike, a cartoon bearded dragon who offers short operational tips on key pages.

Detailed changes

• Updated light and dark colour tokens, sidebar, canvas texture, and browser theme colour to a sun-baked sand, sage, and clay palette while keeping teal as the accessible oasis accent.
• Replaced the photorealistic bearded dragon portrait with cartoon Spike artwork on landing, staff sign-in, and the dashboard identity card.
• Added reusable Spike tip callouts, a dismissible page-keyed helper dock, and operational copy for first-run, dashboard, and service list pages.

Affected areas

• Shared visual theme, mascot artwork, dashboard, landing and authentication pages, and in-page help copy

Version decision

A backward-compatible minor release adding the cartoon mascot helper and desert visual system without changing workflows, data, or authorization.

Summary

Completed APES Pet Care Clinic Pet Profiles, Tickets, and Consultations as three working, instance-scoped modules, adding Pet Care Clinic Tickets as the eighth shipped installation while preserving existing Pet Care records, routes, media, schedules, assignments, notifications, and audit identities.

Detailed changes

• Completed APES Pet Care Clinic Pet Profiles, Tickets, and Consultations with stable /petcare routes, registry-generated navigation, instance-scoped lifecycle checks, dashboard summaries, bounded recent activity, analytics, and attention behavior.
• Enforced the exact pet-care-clinic.pet-profiles view-own, create, update-own, view-all, and update-all abilities; the exact pet-care-clinic.tickets view-own, create, comment-own, view-all, update-all, assign, close, and delete abilities; and the exact pet-care-clinic.consultations view-own, create, update-own, view-all, update-all, assign, and close abilities. Owners require the matching exact owner ability, while staff-wide access, assignee choices, and staff recipients require protected staff eligibility plus the exact module-namespace permission; update, assignment, and terminal-transition abilities remain independent.
• Preserved public and internal Ticket messages with internal bodies hidden from owners and excluded from notification and audit metadata, kept Consultation notes out of notification and audit metadata, and retained authenticated authorization-checked Pet Profile photo delivery. The code-owned Pet Care Clinic Ticket delete permission has no Pet Care Clinic DELETE route or user control.
• Reused the existing pet_profiles, pet_care_consultations, support_tickets, and support_ticket_messages tables with no database migration, record copy, or identifier rewrite, preserving owners, pet links, assignments, schedules, statuses, closure timestamps, audit and notification identities, media paths, and physical media.
• Synchronized eight shipped installations, 59 first-party module permissions, and 72 total application permissions, and added three deterministic Pet Care Clinic Ticket fixtures with open, in-progress, and closed states, unassigned, staff-assigned, and administrator-assigned examples, and public and internal messages.

Affected areas

• APES Pet Care Clinic Pet Profiles, Tickets, Consultations, shared module providers, authorization, notifications, protected media, local QA data, and rollback compatibility

Version decision

A backward-compatible minor release completing the APES Pet Care Clinic module set and its exact permission, privacy, provider, QA, runtime, and rollback contracts.

Summary

Shipped APES Shelter and Rescue Pet Profiles, Tickets, and Cases as three working, instance-scoped modules, adding Shelter Tickets as the seventh shipped installation while preserving existing Shelter records and routes.

Detailed changes

• Shipped APES Shelter and Rescue Pet Profiles, Tickets, and Cases with fail-closed owner, domain, sub-core, lifecycle, dashboard, recent-activity, analytics, and attention behavior.
• Enforced the exact shelter-rescue.pet-profiles view-own, create, update-own, view-all, and update-all abilities; the exact shelter-rescue.tickets view-own, create, comment-own, view-all, update-all, assign, close, and delete abilities; and the exact shelter-rescue.cases view-own, create, update-own, comment-own, view-all, update-all, assign, close, and delete abilities. Owners require exact view-own, while staff-wide access, assignees, and recipients require protected staff eligibility plus the exact namespace view-all permission; assign, close, and update abilities remain independent, and the code-owned Shelter delete permissions have no Shelter route or control.
• Preserved public and internal Ticket messages and Case updates with internal content hidden from owners and excluded from notification and audit metadata.
• Delivered Pet Profile photos only through authenticated, authorization-checked Shelter and Pet Care routes while preserving stored media paths; direct pet-profile storage access is denied and avatars are the only public-storage runtime link.
• Synchronized seven shipped installations, 51 first-party module permissions, and 64 total application permissions, and expanded deterministic local QA fixtures with three Shelter Ticket states plus public and internal Ticket and Case activity.

Affected areas

• APES Shelter and Rescue Pet Profiles, Tickets, Cases, shared module providers, authorization, notifications, protected media, local QA data, and rollback compatibility

Version decision

A backward-compatible minor release shipping the complete APES Shelter and Rescue module set and its privacy, media, QA, and runtime contracts.

Summary

Added the complete owner- and permission-scoped APES CIC Cases workflow while strengthening Tickets with instance isolation, explicit reply visibility, reusable activity, and analytics contracts.

Detailed changes

• Added APES CIC Cases with categories, priorities, assignment, terminal transitions, public updates, internal staff notes, private notifications, and bounded audit metadata.
• Added explicit sub-core storage and instance-scoped authorization, lifecycle detectors, dashboard summaries, recent hub activity, and typed analytics providers for APES CIC Tickets and Cases.
• Expanded the compatible Shelter case store additively, preserved existing record and audit identities, and installed APES CIC Cases as the sixth shipped module instance.

Affected areas

• APES CIC Tickets and Cases, shared case storage, module registry, dashboard, sub-core hub, authorization, notifications, analytics, and rollback compatibility

Version decision

A backward-compatible minor application release adding the planned APES CIC Cases capability and reusable module-provider contracts.

Summary

Added a password-confirmed, expiring, single-use flow for linking a verified public account to an eligible Cloudron staff identity without email-only auto-linking.

Detailed changes

• Separated staff-login and account-link OIDC state while retaining the established staff callback compatibility keys.
• Required the current password, matching verified email, unclaimed OIDC subject, current exact LDAP eligibility, and an unconsumed link intent.
• Preserved public capabilities on hybrid accounts while requiring a current OIDC session for directory-derived staff permissions.

Affected areas

• Public accounts, Cloudron authentication, protected staff authorization

Version decision

A backward-compatible minor release completing the explicit hybrid identity capability planned in issue #19.

Summary

Introduced normalized usernames, verified-email registration, required UK onboarding, auditable optional contact choices, and per-user MyAPES service selections.

Detailed changes

• Added username-or-email login, signed expiring verification links, required onboarding, and canonical UK telephone storage.
• Added explicit all-false contact confirmation with policy-versioned grant and withdrawal events.
• Aligned navigation, public permissions, and direct service routes with selections while preserving OIDC staff access and all existing service records.

Affected areas

• Registration, login, profiles, navigation, service access, and contact preferences

Version decision

A backward-compatible minor release adding the user-facing public account lifecycle planned in issue #19.

Summary

Introduced a first-party registry for MyAPES sub-cores and modules, with guarded installation state, generated navigation, and super-admin lifecycle controls.

Detailed changes

• Registered the permanent APES CIC, Shelter and Rescue, and Pet Care Clinic sub-cores with four reusable module types and five enabled shipped instances.
• Added an accessible Admin module matrix, dependency and active-record safeguards, consistent disabled-route handling, generated sub-core navigation, and registry-backed dashboard summaries.
• Added deployment preflight, lifecycle-serialized dependency-aware synchronization, integrity, durable full-operation locking, and forward-only rollback compatibility checks for module state.
• Applied each ticket comment, update, close, and assignment permission independently while preserving owner comment-only behavior and existing ticket state.
• Hardened stale-transition protection, exact code-owned permission teardown, post-commit projection publication, database-scoped lifecycle locks, fail-closed activation classification, and authenticated post-switch rollback while preserving non-disclosing module availability responses.
• Updated the Markdown rendering dependency to its patched release after the locked dependency audit.

Affected areas

• Sub-core navigation, dashboard summaries, module administration, authorization, and guarded deployment rollback

Version decision

A backward-compatible minor release adding the first-party module registry and lifecycle foundation while preserving existing feature URLs and authorization behavior.

Summary

Introduced protected role-based authorization, context-aware sessions, exact directory synchronization, suspension controls, and complete Admin authorization management.

Detailed changes

• Introduced four protected roles and thirteen code-owned permissions enforced through application-owned Gate and policy decisions, with provenance-guarded direct user permissions available only to central authorization services.
• Added source-provenanced role assignments with mandatory persisted actors for local grants and actor-free non-local sources, authorization epochs, context-aware password, Cloudron OIDC, and local quality-assurance sessions, plus suspension and forced reauthentication controls.
• Added exact normalized directory-group mappings, catalogue synchronization, eligibility revocation, and lifecycle commands for guarded activation and verification.
• Added accessible Admin Users, Groups, Roles, and Permissions sections with transactional assignment, mapping, suspension, custom-role, and final-super-admin safeguards.
• Aligned Admin user permission inventories with the runtime Gate by combining role and provenanced direct grants without exposing an arbitrary direct-assignment interface.
• Restricted assignment and operational notifications to unsuspended staff whose protected baseline and qualifying provenance agree, with uniform authorization-first denial handling.
• Bound and coalesced directory synchronization work, made final and repeated queue-failure callbacks durably invalidate prior directory sessions while clearing only their matching lease, and pinned the production application environment.
• Serialized privileged mutations behind authorization-state locks with session, epoch, generation, exact-role provenance, and present-group revalidation, including one final-super-admin predicate shared by runtime and lifecycle checks.
• Derived deployment-control trust directly from the exact Git revision before third-party actions or dependencies and published root-owned, application-non-writable activation and rollback controls.

Affected areas

• Authentication sessions, authorization, policies, and account suspension
• Directory group catalogue, mappings, synchronization, and revocation
• Admin Users, Groups, Roles, and Permissions
• Authorization migration, activation, verification, and rollback compatibility

Version decision

A backward-compatible minor release completing the protected authorization and administration capability planned in issue #10.

Summary

Corrected protected-route handling so signed-out visitors reach Public Login instead of a server error.

Detailed changes

• Directed browser guests from protected pages to the existing Public Login route while preserving their intended destination.
• Restored unauthorized JSON responses for clients that explicitly request JSON.

Affected areas

• Guest authentication redirects and protected-route error handling

Version decision

A backward-compatible patch correcting guest access to the existing authentication entry point.

Summary

Introduced a public, searchable MyAPES release history and a source-controlled semantic version contract for future releases.

Detailed changes

• Added the public Change Log Hub with search, release filters, expandable records, current-release navigation, and accessible result feedback.
• Added a shared footer version link so guests, public users, and staff can reach the current release record from every application screen.
• Added append-only release validation for pull requests and main-branch updates without creating a database-backed editor.
• Separated the semantic application version from the immutable deployment commit identity in health and release verification.

Affected areas

• Public Change Log Hub and shared application footer
• Release metadata validation and continuous integration
• Health reporting and immutable release packaging

Version decision

A backward-compatible minor release establishing a new public capability and the release-management contract for later roadmap work.

Summary

Replaced the shared horizontal navigation with a responsive sidebar and mobile drawer while refreshing the application brand assets.

Detailed changes

• Introduced one responsive navigation shell for authenticated and guest pages while preserving role-aware routes and theme behavior.
• Regenerated browser, progressive-web-app, login, email, and social assets from the approved APES artwork.
• Added deterministic brand-asset generation and design quality-assurance evidence.

Affected areas

• Shared navigation, mobile drawer, footer, and themes
• Browser, progressive-web-app, login, email, and social brand assets
• Design quality-assurance tooling and documentation

Version decision

A backward-compatible minor release with a substantial user-visible navigation and branding improvement.

Summary

Introduced the Naturalist Notebook interface, deterministic local quality assurance, and protected staff sign-in backed by Cloudron identity and directory eligibility.

Detailed changes

• Added the approved light and dark application interface with role-scoped dashboard attention and local quality-assurance identities.
• Added standards-based staff sign-in with protected authorization state and exact directory-group eligibility.
• Added periodic directory revalidation, secure local logout behavior, readiness checks, and immutable release activation with rollback.
• Added sanitized health and staff-login verification around the release workflow.

Affected areas

• Authentication, directory authorization, sessions, and staff logout
• Shared application interface and role-scoped dashboard
• Release activation, rollback, health, and post-release verification

Version decision

A backward-compatible minor release introducing major application, identity, and deployment capabilities.

Summary

Refreshed the shared application interface with a warmer mascot-led visual system and documented product design principles.

Detailed changes

• Integrated approved brand, browser, progressive-web-app, and social assets.
• Added reusable mascot artwork to key entry and dashboard surfaces.
• Unified shared styling for navigation, panels, forms, tables, alerts, and the footer.
• Added product direction covering users, purpose, personality, anti-references, and accessibility.

Affected areas

• Authentication, dashboard, administration, and service screens
• Shared layout, branding, and product documentation

Version decision

A backward-compatible minor release delivering a substantial visual and product-design capability.

Summary

Introduced the full Laravel application structure, initial service areas, and the approved MyAPES branding pack.

Detailed changes

• Added controllers, models, routes, views, configuration, migrations, tests, and local development scripts.
• Added role-aware APES CIC, Shelter, and Pet Care areas with the initial account and administration surfaces.
• Integrated the approved header, browser, progressive-web-app, and social artwork.
• Aligned local setup and Cloudron deployment automation with the expanded application.

Affected areas

• Whole MyAPES Laravel application baseline
• APES CIC, Shelter, Pet Care, accounts, and administration
• Application branding and local/deployment tooling

Version decision

A backward-compatible minor release introducing the main application baseline and service capabilities.