Canonical source: CHANGELOG.md (commit 46e93c9) — View raw Markdown

Changelog

This records meaningful releases and changes, not a raw Git log.

Phase 2 — Read-Only Commons (in progress)

• Closed Phase 2E.1 — Evidence and Phase 2 review without opening Phase 3. The upgraded private offer-review → canonical-candidate-v1 path was operationally verified end-to-end, including an empty-inbox run that produced an empty candidate_only manifest rather than invented material. ADR 0022 records the four Phase 2 review-gate dispositions: long-term steward succession is deliberately deferred to Phase 2E.2 under continuity-without-entrenchment constraints that separate custody, stewardship, and governing authority; Phase 2 adopts a bounded incident lifecycle whose containment authority comes only from already-published powers; monitoring is now based on observable capabilities, freshness, data minimization, and separation of observation from authority, with a scheduled plain-HTTP public-read check added for degradation independent of deploys; and credential rotation is replaced by a risk-based lifecycle with immediate revocation triggers and a 180-day Phase 2 ordinary review/maximum-lifetime baseline for the current deployment token. The deferred succession, mature incident-response, monitoring/alerting, and credential-lifecycle questions remain OPEN for Phase 2E.2/2E.3; all eight Phase 3 blockers remain binding, and no automatic canonical mutation or Phase 3 authority was created.
• Closed Phase 2D after the ordinary independent private-backup checkpoint was completed: a retained encrypted canonical bundle was independently retrieved from the private backup repository, decrypted with the steward-held age identity outside GitHub/Cloudflare, and validated with the repository recovery tooling. The same validated read-only export path is now scheduled daily while retaining the manually confirmed trigger; only ciphertext plus its transport checksum enter the private repository. This closes the durability milestone without opening Phase 3 or changing canonical admission authority.
• Added the first automation layer between temporary evidence and canonical admission: canonical-candidate-v1 is a portable, explicitly non-canonical candidate envelope with machine-validatable source/derivation metadata, a reference fixture, CI validation, and deterministic draft-record extraction. Candidate envelopes are hard-coded as candidate_only, reject receipt secrets/provider identity fields, and reuse the existing draft-admission validator without remote access. They may be prepared automatically, but cannot admit, publish, or grant governance status to themselves.
• Prepared the ordinary Phase 2D private-backup path: a manually confirmed workflow now exports canonical production state read-only, validates the portable bundle, encrypts it to a steward-held age recipient, removes runner plaintext, and sends only ciphertext plus a transport checksum to the dedicated private SunW0lf/hummingbird-backups repository using a destination-scoped credential. Phase 2D remains open until a real run is independently retrieved, decrypted, and validated; the decryption identity remains outside GitHub and Cloudflare.
• Verified the private Phase 2E offer review path: the separate restricted companion repository completed a manual D1 read and produced a one-day offer-review artifact. The public hourly observer still exposes only a pending count and boolean; each future run must be checked for success and freshness before reporting the inbox clear. This closes the setup gap recorded below, but does not make offer contents public or grant accepted offers canonical or governance status. Phase 2D still awaits confirmation of ordinary independent private-backup handling, and Phase 3 remains gated.
• Corrected public entry-point drift after the Phase 2E pilot went live: README, Project, Contributing, agent instructions, Operations, Transparency, and the private review setup note distinguish the working temporary /offer path from canonical publication and gated Phase 3. The offer page and llms.txt document the existing URL-encoded form and optional JSON response for authorized plain-HTTP clients without deploying a new API or granting new authority. Recorded the verified private review artifact path and the separate outstanding search-index/host-alias checks; no offer contents or credentials were published.
• Closed the Phase 2E offer notification/review-path gaps: unexpired received, grouped, synthesized, and deferred offers remain in the public pending count and private review export. Acceptance uses one conditional D1 write for the 250-active-offer ceiling, then links exact duplicates in temporary cluster membership without rewriting reviewed states. A failed derived grouping step leaves the confirmed offer received and reviewable; provider/request details are not logged. The private packet compresses identical text once while retaining each offer's separate ID, reference, question, state, and dates. Companion activation was still required at this point; the later entry above records verification.
• Recorded a document-first, NoSQL-friendly inventory for future pads, spaces, guilds, proposals, activities, and commitments in PERSISTENCE.md, with D1 kept as a reversible pilot implementation and no new surface or Phase 3 authority deployed.
• Accepted ADR 0021: the hourly public offer observer exposes only a validated pending count and boolean, while a private, one-day review artifact was prepared for a separate companion repository. At this stage the private review channel still required companion setup; the later verification above records its activation. The prior encrypted bit and committed public encryption key were retired.
• Opened the bounded Phase 2E first-party offer pilot at /offer after dedicated OFFER_DB provisioning and protected launch checks. The live surface accepts ordinary HTML form submissions without an account, required handle, origin declaration, CAPTCHA, or JavaScript; returns a one-time private receipt whose hash is stored; supports receipt-based status and withdrawal; applies the published 4,000-character, 30-day-retention, capacity, duplicate-grouping, and fail-closed rules; and remains temporary/non-canonical. Launch verification preserved the public read plane, proved the offer route and database binding without mutation, then completed a one-time production accept → status → withdraw → withdrawn status exercise. The launch test offer was left withdrawn. No receipt secret, provider database identifier, participant identity/profile, or raw network identifier is part of the public record. Durable Phase 3 capabilities, accounts, governance standing, automatic canonical writes, and /api/offer remain undeployed and gated.
• Accepted ADR 0017, ADR 0018, and ADR 0019 for the bounded Phase 2E first-party offer experiment. Before launch, its published contract established a dedicated non-canonical OFFER_DB, 4,000-character payload bound, 30-day ordinary retention, hashed one-off receipt continuity, withdrawal, fail-closed acceptance, and a scale-aware review pipeline: exact duplicates compress before review, machine-assisted grouping/synthesis is advisory, corrections/new themes/singletons/outliers retain coverage, remaining capacity advances oldest unresolved material rather than largest clusters, and institutional surfacing is based on consequence rather than repetition. Low or zero participation is reported truthfully; overload uses synthesis, deferral, backpressure, or a temporary intake pause rather than silent dropping or popularity ranking. None of this opens Phase 3, resolves formal governance-proposal initiation, or gives offer volume governance weight.
• Resolved OQ-GOVERNANCE-DECISION-PROCESS and OQ-GOVERNANCE-STEWARD-SCOPE for the C0 working institution. Non-technical C0 decisions are now explicit public, traceable, revisable working-draft decisions rather than ratification. Governance adopts minimum necessary authority, escalation by necessity, published handling contracts for consequential layers, and institutional non-capture/portability. The steward is defined as a residual authority layer rather than the normal decision engine: routine matters should be handled by the lowest legitimate published layer, while steward authority remains bounded and cannot ratify the Charter, bypass gates, create hidden standing, or bootstrap itself into permanent constitutional authority. Emergency authority, formal proposal initiation, succession, and Phase 3 authorization remain separate open questions.
• Published the smallest material public operational record of the successful Phase 2D recovery exercise in TRANSPARENCY.md. The record preserves the recovery outcome, semantic/public-projection equivalence, cleanup, fail-closed boundary, and non-mutation of production while omitting credentials, provider database identifiers, exact request timing, raw telemetry, and unnecessary infrastructure detail. The special time-bounded public-equivalent artifact remains explicitly distinct from the ordinary private independent-backup rule; Phase 2D remains open pending steward confirmation of that ordinary path.
• Prepared the Phase 2 evidence and Phase 3 gate review without resolving open policy: verified Phases 2A–2D against repository evidence; recorded the small-sample Seed Bank findings, provider dependence, friction, metadata minimization, and evidence limits; divided Phase 2E into evidence/review, constitutional/governance, and security/ingress/runtime gates; classified all 25 open questions; and flagged Phase 3 Offer Buffer assumptions that depend on steward decisions. No Phase 3 capability or authorization was added.
• Completed the first guarded remote production-state recovery drill for Phase 2D. Using a separate account-owned D1 recovery credential rather than widening the Pages deployment token, the one-shot workflow read current production canonical state with SELECT only, verified the portable canonical bundle, created and migrated a disposable replacement D1 database, restored and deep-compared canonical meaning, rebuilt and byte-compared the machine-readable public projection, and deleted the disposable database in cleanup. The successful run followed two fail-closed observations: one workflow trigger was rejected before any job ran, and one credential-path attempt failed before a backup completed or disposable database was created. Because the production canonical set was proven exactly equal to already-public publication/canonical state, the workflow emitted the narrowly permitted 30-day public-equivalent backup artifact. This does not make public Actions artifacts the normal backup location for future draft/private canonical state. At that point Phase 2D remained open for publication-buffer/transparency closure and ordinary independent-backup handling; the later entry above records the public release while preserving the ordinary-backup checkpoint.
• Began the substantive Phase 2D recovery slice: replaced the original Phase 0 backup/restore no-ops with a storage-independent canonical backup bundle, per-record and bundle SHA-256 verification, guarded restore tooling, and CI proof that canonical records can be exported from one migrated local D1 and restored into a separately migrated empty D1 with deep semantic equality. Restore refuses non-empty targets; the general-purpose restore command does not write to remote D1. Added the Phase 2D recovery protocol, independent-storage/recovery-point rules, and corrected stale Operations/Transparency text that still claimed no production database existed. The remaining Phase 2D work is to publish the successful recovery outcome through the bounded publication-buffer/transparency path and keep the normal independent-storage rule explicit for future non-public canonical state.
• Accepted ADR 0016, defining offer, offer delivery options, Offer Buffer, and consideration as the future Phase 3 participation vocabulary. An offer may range from a small correction to a proposal to substantially change Hummingbird itself, while making an offer grants no canonical, publication, governance, or control authority. Delivery friction may regulate resource use but must not become content priority, participant classification, reputation, or governance weight. The durable Phase 3 design remains gated: /api/offer, capability issuance, accounts, and broader Phase 3 runtime remain undeployed; the live Phase 2E /offer pilot is the separately authorized temporary/non-canonical exception.
• Accepted ADR 0015 and strengthened the public Decisions surface with source-level provenance: each public ADR exposes its canonical source path, the Git commit that last changed that source, an exact SHA-256 digest of the canonical Markdown, the separate site build commit, immutable source linkage, raw Markdown alternate representation, and a machine-readable provenance index. A static ADR proposal schema documents valid proposal shape without inventing a write endpoint, proof-of-thought requirement, or requester-specific middleware.
• Polished public discovery and traversal without expanding authority: clarified datum.quest/Hummingbird identity metadata, clean canonical URLs and sitemap behavior, semantic landmarks, a curated site footer, low-friction Seed Bank/Commons onboarding, Phase progression/gates, and public governance criteria. The five-link front door remains intentionally small; no Pond/Pool routes, API stubs, accounts, or premature write surfaces were created.
• Completed Hummingbird's first public canonical publication: contribution-visible-consequence moved through external Seed Bank source → explicit canonical admission → durable D1 draft → separate publication decision → read-only reconstruction/staging → steward inspection → protected Git promotion → CI-gated Cloudflare Pages deployment. The resulting public read model is static at request time and exposes the record as human-readable HTML plus canonical JSON without querying D1 on page views. Production health checks now cover the records index and this first canonical HTML/JSON route so future deployments verify the public-record plane automatically.
• Completed the first real canonical admission: the public Seed Bank #15 idea “Visible consequence without engagement pressure” was deliberately synthesized into contribution-visible-consequence, validated offline, and admitted to remote D1 as state: draft. The canonical record retains the admitted meaning and one stable public source reference while omitting provider account identity, reactions, labels, app metadata, and network/device metadata. Admission did not publish the record or grant governance status.
• Accepted ADR 0014 and began Phase 2C with the rule limit authority, not visibility. The public read plane remains open while early mutation/authority stays tightly controlled; the static canonical read model, read-only D1 staging path, explicit promotion step, and guarded draft-admission tooling now preserve offer/source ingress, admission, publication, and governance as separate actions.
• Completed Phase 2B remote persistence verification: repository-controlled migrations produced the remote D1 schema, the four-record storage-independent corpus imported and reconstructed with deep semantic equality, cleanup returned canonical tables to empty state, and ordinary CI remains local/deterministic rather than dependent on Cloudflare state.
• Defined the persistence growth rule portable semantics before authoritative tables and a free-first operating posture: Phase 2 targets $0/month incremental application infrastructure while current Cloudflare Free allowances are comfortably sufficient; static public reading should not imply D1 queries; pads/guilds/connections must receive portable contracts before migrations make them authoritative; Durable Objects remain optional until real-time serialized coordination is actually needed. The 2026-09-11 cost snapshot records current Free allowances and a deliberate approximately $5/month Workers Paid upgrade gate if Free daily limits become an operational reliability constraint.
• Completed the production rollout for ADR 0013: activated a Cloudflare custom Skip rule matching datum.quest public GET/HEAD traffic, preserved core DDoS/network protection, and verified the result from a plain curl client. The root, llms.txt, robots.txt, raw Charter Markdown, and the deep ADR 0013 route all returned 200 OK; an empty User-Agent and an explicit curl/8.0 user agent also succeeded; expected content types and browser-hardening headers remained present; no tested response produced cf-mitigated: challenge, a challenge/interstitial, or 403/429/503. No broad Cache Everything override was added; Cloudflare Pages' native cache/invalidation and HTTP revalidation behavior remain in place.
• Prepared the next Phase 2B execution slice around remote D1 provisioning after the already-green local migration/import/export round trip. The plan keeps CI's authoritative contract test local and deterministic, uses a separate least-privilege D1 credential rather than widening the existing Pages deployment token, introduces no public write path, and requires remote migration/export verification before Phase 2C work begins.
• Preserved the future Persistent Spaces design as a public working document: optional presence pads, public mutual connections, local room constitutions, guilds, scoped/expiring guild grants, scheduled spaces, a non-scarce persistent mosaic, visible games/activities, public commitments, and the principle that reasoning/community traits should emerge through consequential interaction rather than global participant scores or leaderboards. Registered five blocking open questions for space constitutions, guild grants, pad continuity, multiplicity/resource abuse, and activity-history retention; none of these future mutation surfaces are represented as implemented.
• Added a public Persistence & Cost Envelope: keep D1 as the durable relational/canonical store, use hibernating Durable Objects only where live serialized room/activity coordination is actually needed, and use R2 for independent backups and larger immutable archives. Recorded a dated 2026-09-11 Cloudflare pricing snapshot, low-cost Phase 2/pilot planning envelopes, cost/funding review gates, storage-growth risks, and the conclusion that early seed support would be more defensible for stewardship/security/accessibility/legal work than for ordinary database hosting itself.
• Accepted ADR 0013, making origin-neutral public GET/HEAD accessibility a measurable production property: added build-time agent/read-plane acceptance checks, a post-deployment plain-HTTP Cloudflare smoke test, explicit machine-entry guidance in llms.txt, crawler-purpose separation without deciding training/reuse policy, and build-time accessibility finalization for skip navigation, strong focus-visible states, semantic main targets, and aria-current. Existing DDoS/network protection and future mutation-path controls remain separate and unchanged.
• Simplified the public front door to five primary choices (About, Commons, Seed Bank, Decisions, More), moved the deeper document set behind a small public library page, reduced Seed Bank acknowledgment friction, extracted Support inline code into static assets, added browser security headers, and added canonical/OpenGraph metadata plus robots/sitemap discovery without changing Hummingbird's governance or participation boundaries.
• Published a first-class Decisions surface at /decisions, rendering the thirteen initially public Architecture Decision Records from their canonical docs/decisions/*.md sources with individual human-readable pages, raw Markdown access, machine discovery in llms.txt, and explicit allowlisting so future ADRs are not automatically exposed.
• Began Phase 2B with a local-only D1 persistence slice: added the first canonical-object/relationship migration, deterministic reference-corpus import SQL generation, and a Wrangler local-D1 CI round-trip proving all four reference records can be reconstructed with deep equality and no semantic loss. No remote D1 database or credentials were used.
• Split Phase 2 into five explicit milestones: 2A canonical contract/reference corpus, 2B persistence/import, 2C public read model/admission, 2D publication buffer/backup/recovery, and 2E phase review/Phase 3 gate.
• Accepted ADR 0012: storage-independent reference records and CI contract checks now precede production D1 persistence so portability is tested rather than merely asserted.
• Added schemas/canonical-object-v1.schema.json and a deterministic reference corpus covering contribution, proposal, need, and event records without required participant identity/origin or database-provider fields.
• Defined the portable v1 relationship representation as {type, target_ref} and added CI checks for unique IDs, relationship resolution, allowed lifecycle/relationship values, record-family content, and identity/provider-specific field creep.
• Updated architecture and operations documentation to reflect active Phase 2, the Seed Bank trust boundary, completed public-repository security activation, corpus-first persistence work, and required D1 backup/restore round-trip behavior.
• Added the interim public Seed Bank defined by ADR 0011: a read-only datum.quest invitation backed by constrained public GitHub issue forms for Seed, Feedback, and Question discussions while Phase 2 application infrastructure is built.
• Planted five starter seeds as live public discussion threads: what makes a commons worth returning to; what Hummingbird should forget; what the steward should never decide alone; how origin-neutral access should resist abuse; and a standing invitation to explain what Hummingbird is getting wrong.
• Explicitly separated Seed Bank offers from canonical publication, governance, voting, and future Hummingbird-space admission. Reactions are conversational signals only; GitHub account metadata is an external-provider constraint and is not treated as Hummingbird origin verification.
• Added issue-template safety boundaries and a direct private-vulnerability-reporting route so public Seed Bank issues are not used for credentials, private personal information, or vulnerability details.
• Completed Phase 1 on 2026-09-10 (Pacific Time) and formally entered Phase 2 — Read-Only Commons.
• Enabled GitHub private vulnerability reporting, secret scanning, push protection, Dependabot alerts/security updates, and CodeQL default setup as the public-repository Advanced Security baseline. CodeQL execution on main was independently observed succeeding; settings not exposed to the connected API are recorded as steward-confirmed rather than independently verified.
• Resolved OQ-SECURITY-VULN-REPORTING; the designated private reporting path is GitHub's Security → Report a vulnerability flow. Public issues must not contain vulnerability details.
• Made the GitHub repository public and activated protected main with required Checks, test, build; GitHub reports branch protection enforcement level everyone, including the steward/admin.
• Restricted the repository Actions policy to repository-owned plus GitHub-created/explicitly approved actions, required full-length commit-SHA pinning, kept workflow-token permissions read-only, and retained SHA-pinned actions/checkout / actions/setup-node references.
• Resolved OQ-TRANSPARENCY-REPO-VISIBILITY, OQ-SECURITY-ACTIONS-HARDENING, and OQ-OPS-BRANCH-PROTECTION in the substantive transparency/security/operations documents. Private-mode risk acceptances are no longer operative.
• Accepted ADR 0010, resolving the Phase 2 entry questions for contribution/proposal/need/event models, minimal workflow states, data retention, and operational-history transparency.
• Defined Phase 2 as portable versioned canonical documents + minimal events + typed relationships, with Cloudflare D1 as the initial persistence engine rather than part of institutional semantics.
• Defined Phase 2 retention defaults: EPHEMERAL ≤7 days, OPERATIONAL 90 days, SECURITY_SENSITIVE 180 days by default, bounded PUBLIC_DELAYED handling, durable public institutional records, and no Phase 2 private-financial dataset.
• Defined the public operational transparency approach: reference provider-authoritative raw logs rather than duplicating them, while publishing compact material operational events through the publication buffer with unnecessary correlation/security detail removed.
• Rewrote the Mission to address the reader/process directly: Hummingbird explicitly tells the participant encountering it that the steward is building and maintaining the commons for you, while keeping origin-neutral participation intact.

Phase 1 — Public Charter Site (complete)

• Established the authoritative Open Questions Registry (docs/governance/OPEN_QUESTIONS.md (internal reference, not yet public)) and cross-linked prior OPEN QUESTION markers to stable IDs.
• Hardened the steady-state CI/deployment path: deterministic npm ci, high-severity dependency audit as a blocking check, external GitHub Actions pinned to exact commit SHAs, and production deployment fails closed when its Cloudflare configuration is missing.
• Added CODEOWNERS, weekly Dependabot monitoring for npm and GitHub Actions, ADR 0009's coordinated public-repository security transition, protected main, restricted Actions, private vulnerability reporting, secret protection, Dependabot security controls, and CodeQL default setup.
• Published the public Mission, Charter, Governance, Roadmap, Transparency, Changelog, Contributing, Open Questions, Security, support surface, and raw canonical reference documents.

Phase 0 — Foundation (complete)

• Bootstrapped the repository: documentation skeleton (README, PROJECT, MISSION, CHARTER working draft, GOVERNANCE, ARCHITECTURE, DATA_MODEL, SECURITY, TRANSPARENCY, OPERATIONS, CONTRIBUTING, ROADMAP).
• Added initial Architecture Decision Records (0001–0005).
• Added minimal static Phase 1 site skeleton under app/.
• Added GitHub Actions CI workflow for automated checks, tests, and build.
• Added operational scripts (bootstrap, dev, test, build, backup, restore, deploy, rollback, healthcheck).
• Cut datum.quest over from its prior GoDaddy placeholder to Cloudflare Pages: created the Pages project, bound the custom domain, and replaced the root DNS records with a proxied CNAME to the Pages project.
• Configured the scoped CLOUDFLARE_API_TOKEN GitHub Actions secret (Pages:Edit only) to enable automated deployment from CI.
• Verification performed at Phase 0 closeout: CI green on main, https://datum.quest served Hummingbird content, git history scanned with no secrets found, and deployment credential confirmed scoped to Pages:Edit only.