2025-06-28 - 2026-06-28
Overview
149 Pull requests merged by 2 users
Merged
#157 fix(web): soften two unbacked claims for closed-beta honesty
Merged
#155 Deploy #154 to stage — analytics CSP fix
Merged
#154 Allow Google Analytics and Ads domains in CSP
Merged
#153 Deploy #152 to stage — SyntaxError fix + CSP expansion
Merged
#152 Fix SyntaxError in account-dashboard and expand CSP
Merged
#151 Stage deploy: device count cleanup
Merged
#150 Clear hardcoded device count — JS owns it
Merged
#149 Stage deploy: device count fix
Merged
#148 Fix device count: 1 for free, 2 for professional/founding
Merged
#147 Stage deploy: fix account el_meta SIGSEGV
Merged
#146 Fix account SIGSEGV: el_meta 1-arg → 2-arg
Merged
#145 Stage deploy: fix account SIGSEGV
Merged
#144 Fix account page SIGSEGV: el_img extern arity mismatch
Merged
#143 Stage deploy: fix free plan payment init
Merged
#142 Fix free plan checkout: SetupIntent instead of $0 PaymentIntent
Merged
#141 Stage deploy: fix about page El tokenizer rendering
Merged
#140 Fix about page: restore raw string syntax to fix El tokenizer rendering
Merged
#139 Deploy dev to stage — magic link sign-in fix
Merged
#138 Fix magic-link sign-in: implicit flow + redirect to /account
Merged
#137 Deploy dev to stage — Stripe dedup + attestation bypass fix
Merged
#136 Fix duplicate Stripe customers and attestation plan bypass
Merged
#135 Deploy dev to stage — webhook user_metadata fix, textarea, initStripe
Merged
#134 Fix initStripe load order, subscription webhook email, chat textarea
Merged
#133 dev → stage
Merged
#132 Fix intro greeting and load history on return visits
Merged
#131 dev → stage
Merged
#130 Fix question counter, rate-limit timer, admin reset API, pricing clarity
Merged
#129 dev → stage: binary assets, payment fix, checkout layout
Merged
#128 fix: binary asset serving + checkout centering
Merged
#127 fix: remove setup_future_usage from $0 PaymentIntent
Merged
#126 dev → stage: free plan $0 PaymentIntent
Merged
#125 fix: free plan $0 PaymentIntent for age verification
Merged
#124 dev → stage: free checkout Stripe fix + copy updates
Merged
#123 fix: free checkout Stripe SetupIntent + remove no-card-required copy
Merged
#122 dev → stage: force full build after registry cleanup
Merged
#121 fix: force full build when no diff or stage-latest missing
Merged
#120 dev → stage: trigger rebuild
Merged
#119 ci: touch dist to trigger stage rebuild
Merged
#118 ci: trigger workflow via dist/ change
Merged
#117 ci: re-trigger #3
Merged
#116 ci: re-trigger build after runner restart
Merged
#115 ci: rebuild after registry cleanup
Merged
#114 dev → stage: fix HTML escaping in headings and button
Merged
#113 fix: heading and button elements pass children unescaped
Merged
#112 Deploy: clean prod build — strip CGI content
Merged
#111 Force full El rebuild — strip CGI content
Merged
#110 Force full El rebuild — strip CGI content from base image
Merged
#109 Deploy: CI fixes (migrations, source guard, asset-only detection)
Merged
#108 Also skip El rebuild for workflow-only changes
Merged
#107 Also skip El rebuild for workflow-only changes
Merged
#106 Skip El rebuild for migration/script/test-only changes
Merged
#105 Skip El rebuild for migration/script/test-only changes
Merged
#5 promote: stage → main
Merged
#104 Update CORS test: no-Origin requests are allowed
Merged
#103 Update CORS test: no-Origin requests are allowed
Merged
#102 Fix stage source guard: fetch origin/dev before ancestry check
Merged
#101 Fix stage source guard: fetch origin/dev before ancestry check
Merged
#100 Fix: idempotent migration policy creation
Merged
#99 Fix: idempotent migration policy creation
Merged
#98 dev → stage: fix CI migration heredoc YAML parse error
Merged
#97 Fix CI migration step: script file instead of heredoc
Merged
#96 dev → stage: fix supabase-config null-origin CORS bug
Merged
#95 Fix supabase-config CORS: treat absent Origin as allowed
Merged
#94 dev → stage: wire Supabase migrations into CI/CD
Merged
#93 Wire Supabase migrations into CI/CD
Merged
#92 dev → stage: pricing buttons, API keys, enterprise contacts
Merged
#91 Stage: pricing buttons, API keys, reasoning note, enterprise contacts
Merged
#90 Stage: CI fixes, pricing buttons, API key provisioning
Merged
#89 dev → stage: CSP unsafe-eval fix
Merged
#88 add unsafe-eval to CSP (El native_js compatibility)
Merged
#87 dev → stage: remove --obfuscate (CSP/eval fix)
Merged
#86 remove --obfuscate from elc JS compile step
Merged
#85 Stage: fix Stripe CDN mock + free-plan waitForLoadState sync
Merged
#84 Fix Stripe CDN mock override and free-plan sync guards in E2E tests
Merged
#83 Fix Stripe CDN mock override and free-plan sync guards in E2E tests
Merged
#82 Stage: fix CI JS corruption from obfuscator stdout + flaky test guards
Merged
#81 Fix CI JS corruption from obfuscator stdout; clean up flaky test guards
Merged
#80 Stage: free plan age verification + soul demo personalization
Merged
#79 Free plan Stripe age verification + soul demo personalization
Merged
#78 dev → stage: CI paths + comprehensive checkout tests
Merged
#77 Add tests/** to stage CI paths filter
Merged
#76 dev → stage: comprehensive checkout + Stripe tests
Merged
#75 Comprehensive checkout + Stripe payment flow tests
Merged
#74 test: full Playwright + API test suite for stage
Merged
#73 test: full Playwright + API test suite for stage
Merged
#70 security: pentest fixes — deploy to stage
Merged
#69 security: pentest fixes — webhook sig, CORS, soul-health gate, asset headers
Merged
#68 feat: auth-gate demo chat + budget circuit breaker
Merged
#67 feat: auth-gate demo chat + budget circuit breaker
Merged
#66 feat: scale fixes — max-instances, asset caching, shared rate limits, global cap
Merged
#65 feat: scale fixes — max-instances, asset caching, shared rate limits, global cap
Merged
#64 feat: extract soul-demo into standalone Cloud Run service
Merged
#63 feat: extract soul-demo into standalone Cloud Run service
Merged
#62 deploy: fix HAVE_CURL verification
Merged
#61 fix: HAVE_CURL verification — use strings not nm
Merged
#60 deploy: fix HAVE_CURL — enable chat proxy to soul-demo
Merged
#59 fix: relink neuron-web with HAVE_CURL (chat proxy)
Merged
#58 Deploy: replace k3s with direct soul-demo watchdog
Merged
#57 Replace k3s with direct soul-demo watchdog
Merged
#56 Deploy: fix envelope truncation
Merged
#55 Fix envelope truncation in http_response when called after fs_read
Merged
#54 Deploy: fix JS served as JSON envelope
Merged
#53 Fix JS files served as JSON envelope (checkout/Stripe/auth all broken)
Merged
#52 Fix checkout auth (dev → stage)
Merged
#51 Fix checkout auth: free-success panel + Stripe auto-init for paid plans
Merged
#50 Fix http handler registration (dev → stage)
Merged
#49 Fix http handler not found: pre-register via constructor
Merged
#48 Fix GLIBC_2.38 mismatch: switch base image to ubuntu:24.04
Merged
#47 Fix GLIBC_2.38 mismatch: switch base image to ubuntu:24.04
Merged
#46 Non-blocking entrypoint + k3s --flannel-iface fix
Merged
#45 Non-blocking entrypoint: start neuron-web before k3s is ready
Merged
#44 Single-stage Dockerfile.stage: pre-download k3s on host runner
Merged
#43 Single-stage Dockerfile.stage: pre-download k3s on host runner
Merged
#42 promote: dev → stage
Merged
#41 Fix soul-demo Docker build: --no-cache to avoid corrupted overlay2 layers
Merged
#40 promote: dev → stage
Merged
#39 Selective Docker prune (preserve build cache) + k3s retry
Merged
#38 Make docker prune non-fatal (concurrent prune race)
Merged
#37 Fix CI disk exhaustion: docker system prune at job start
Merged
#36 Move soul-demo build after JS compile in stage pipeline
Merged
#35 promote: dev → stage
Merged
#34 Add diagnostics to stage JS compile step
Merged
#33 promote: dev → stage
Merged
#32 Fix soul-demo compile: add -I runtime/ include path
Merged
#31 promote: dev → stage (soul-demo image tar fix)
Merged
#30 Build soul-demo image tar before Docker build in stage
Merged
#29 promote: dev → stage
Merged
#28 Use ci-base:dev for stage SDK extraction
Merged
#27 promote: dev → stage
Merged
#26 Fix stage SDK extraction: use ci-base:latest and repo runtime
Merged
#25 promote: dev → stage
Merged
#24 Fix stage source check: run after checkout
Merged
#23 promote: dev → stage
Merged
#22 Use repo runtime dir for EL_RUNTIME in push builds
Merged
#21 Add forward declarations for web stub functions to el_runtime.h
Merged
#20 Fix implicit declaration of page_close on Linux
Merged
#19 Fix stage source check to use git parents
Merged
#18 promote: dev → stage
Merged
#17 Fix broken payment/checkout page
Merged
#16 promote: dev → stage
Merged
#13 feat: embed k3s to run soul-demo as self-healing k8s pods
Merged
#2 promote: dev → stage
Merged
#15 feat(native-el-ui): full el-html vessel rewrite — no raw HTML strings
Merged
#12 Enforce dev-only source on stage
Merged
#11 Sync stage fixes into dev
Merged
#10 Fix free tier checkout and Stripe duplicate customers
Merged
#8 fix: -DHAVE_CURL for el_runtime OTLP — resolves emit_metric linker error
Merged
#7 fix: soul-demo emit_metric linker error — rebuild from source, compile with el_runtime.c
Merged
#6 fix: security hardening from pentest findings
1 Issue created by 1 user
Opened
#156 [P0] Terms §5 overclaims: "cannot read network traffic" is false for first-party inference