# Changelog

All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).

## Unreleased

### Added

- SAML and OpenID Connect SSO with domain policy controls, Google, GitHub, and Microsoft
  social login, authenticator two-factor with backup codes and trusted devices, workspace
  security settings, member bans, session revocation, and atomic ownership transfer.
- Better Auth password and magic-link authentication, configurable sign-up policies,
  invitations, member roles, transactional email transports, and workspace audit history.
  The session-table migration causes a one-time sign-out for every user on upgrade.
  Workspaces that hold several legacy owners keep the earliest as owner; the others become
  admins, because the workspace now has exactly one owner.
- Environment-driven workspace plans and states, managed model keys, write-path entitlements,
  Computer session metering, control-plane usage export, and an owner Usage settings page.
- Freestyle VM and Vercel Sandbox Computer providers with persistent lifecycle, snapshots,
  scrubbed execution, jailed file APIs, credential validation, and gated contract coverage.
- Expressive bot characters, persona creation and editing, idle personality actions, and a
  minimal rear-view line-desk workstation with working, waiting, and reduced-motion states.
- Durable filesystem and S3-compatible workspace storage with write-through materialization,
  reconciliation, health/status UI, MinIO coverage, and an owner-triggered sync action.
- E2B native workspace volumes with persisted attachment metadata, recreation notices, and a
  sync-only fallback for accounts without volume access.
- S3 database backup/restore, Litestream replication, and Archil/host-path Compose recipes.
- Managed-host deployment: `OPENSTAFF_TARGET` and `OPENSTAFF_USER` build arguments, a Caddy
  gateway image, an all-in-one image with Litestream, a Render blueprint, a Cloudflare
  Containers Worker, README deploy buttons, and `docs/DEPLOY.md` with the Railway recipe.
- `docs/ONBOARDING.md` so agents and contributors start from the same reading list,
  environment checks, and brief.

## 0.1.0

### Added

- Phase 6 Computer provider registry, encrypted vendor credentials, production Compose,
  backups, health checks, release automation, and OSS operating documents.