{ "schemaVersion": "ivision-doc-releases.v1", "releases": [ { "id": "live-route-check-20261103", "version": "docs-0.6.1", "date": "2026-11-03", "prelaunch": true, "title": "Pages checked against live Vision", "summary": "Every published route was requested on live Vision without credentials and checked against the code live runs. This corrects what didn't match.", "changes": [ "CRM HTTP 9.12.1: client-directory deals and won deals need crm:opportunities:read; directory matches and their commands need crm:settings:manage and list their 400, 401, 403, and 503 answers.", "Environments: on live, CRM's API answers from the internet with a token required (401 without one); the other App APIs still answer 403.", "Getting started and Authentication: on live, the only App permission a key you make can hold is CRM's lead intake (crm:intake:create). The People & Companies contract is linked.", "API keys and Vision Core: Vision Core's /vision-core/v1 reads aren't open on live yet and answer 404." ] }, { "id": "contracts-live-20261102", "version": "docs-0.6.0", "date": "2026-11-03", "prelaunch": true, "title": "Contracts match what live Vision runs", "summary": "Publishes the contracts of the exact App versions live Vision runs after the 2026-11-02 release, and adds People & Companies. Publishing a contract is documentation only and does not make any API or MCP server available.", "changes": [ "Vision Core 1.0.0-preview.8: POST /oauth/token documents the optional workspace_id for an app_service client with a module audience. No route or scope changes.", "Accounting HTTP 0.32.0: 23 routes added, none removed: cash sales and repeat checks, command outcomes, receipt PDF and send receipt, undo payment, invoice remind, duplicate and connected history, paper invoice drafts, invoicing settings, record links, record-related contributions, and repeating invoices. No scope changes.", "Calendar HTTP 1.20.0: 5 routes added, none removed: People contract, people agenda, person sharing commands, and record-related and widgets contributions.", "CRM HTTP 9.12.0: 11 routes added, none removed: overview, open work, complete, agenda and others' agenda contributions, client directory, and directory matches.", "To Do HTTP 1.9.0: 3 routes added, none removed: others' agenda, record-related and widgets contributions.", "New: People & Companies API 1.5.0, restricted at runtime." ] }, { "id": "api-keys-confirm-wording", "version": "docs-0.5.1", "date": "2026-11-02", "prelaunch": true, "title": "API keys: confirming it's you", "summary": "The API keys page no longer gives a length for the fresh sign-in that creating, replacing, or revoking a key needs, matching Vision's own screens.", "changes": [ "/credentials: \"Confirm it's you\" now says to sign in again, or enter your current password where Vision holds one, without a time limit." ] }, { "id": "contracts-refresh", "version": "docs-0.5.0", "date": "2026-10-30", "prelaunch": true, "title": "API and MCP contracts refreshed to match the Apps", "summary": "Updates the published contracts for Vision Core, Accounting, Calendar, CRM, and Todo to what the code declares today. Publishing a contract is documentation only and does not make any API or MCP server available.", "changes": [ "Vision Core 1.0.0-preview.7: the host is now https://app.runonvision.com and paths are under /vision-core/v1 (the old /platform/v1 paths no longer exist), with the app tasks route, the OAuth server metadata route, and the notices key set added. Every protected operation declares its required scope.", "Accounting HTTP 0.16.0: paths now include the /apps/accounting/v1 prefix and the host https://accounting.runonvision.com. Adds payments, refunds, billing agreements, credit notes, invoice approval and issue, pay links, Stripe connect, and widgets. Adds seven scopes. Accounting is not publicly reachable.", "Accounting MCP 0.2.0: read-only capability inventory for Vision Core's preview endpoint on development and preview tiers only. Proposal and import capabilities move to planned and are not served.", "Calendar HTTP 1.17.0: adds availability, the agenda widget, and calendar sync (connections, ICS subscriptions, conferencing, Google and Microsoft webhooks). Adds two scopes. Calendar MCP 1.0.1: removes list_event_attendees and corrects the workspace identifier pattern to CWS-.", "CRM HTTP 9.6.0: adds intake submissions, timelines, Today triage, widgets, pipeline overview, access settings, and spreadsheet imports. Adds two scopes. Todo HTTP 1.5.0: adds agenda, daily list, and complete routes, list archive and restore commands, and optional all-day and move-on-delete fields." ] }, { "id": "api-keys-accuracy", "version": "docs-0.4.3", "date": "2026-10-30", "prelaunch": true, "title": "API keys and leads checked against the code", "summary": "Corrects what the API keys and Collect leads pages say about confirming it's you, two-step sign-in, phone numbers, and the honeypot, and replaces a link to a page that does not exist.", "changes": [ "API keys: the 10-minute window applies to a fresh sign-in; with a password, you enter it each time. Two-step sign-in is needed to create a key or replace a secret on live Vision, not to revoke one.", "Collect leads: the phone format is an optional leading + and then 7 to 32 characters; the honeypot field takes up to 200 characters and returns 204 only on an otherwise valid body; accepting a lead creates a company only if one was sent.", "API availability: the link to the missing /audit page now goes to Environments. Sidebar section links on Collect leads, SDKs, and Platform architecture now match their headings." ] }, { "id": "api-keys-page", "version": "docs-0.4.2", "date": "2026-10-30", "prelaunch": true, "title": "API keys from Settings → Developer", "summary": "Adds the API keys page and points every guide at the self-serve path in Settings → Developer instead of keys provisioned by the Vision team.", "changes": [ "New page /credentials: connect a website form in one step, create a custom key (name, where it runs, what it can do), what is shown once, using the key, telling Apps, replacing a secret and revoking a key.", "Collect leads from your website: one-time setup is now Settings → Developer → Connect a website form; the manual binding step is gone because Vision tells CRM about the key.", "Authentication: Get credentials describes Settings → Developer and links to API keys.", "The sitemap lists /credentials and /leads." ] }, { "id": "collect-leads-guide", "version": "docs-0.4.1", "date": "2026-10-28", "prelaunch": true, "title": "Collect leads from your website", "summary": "Adds a guide for sending website form submissions into Vision CRM from a server with Vision API client credentials.", "changes": [ "New guide: a website server exchanges its API client at https://app.runonvision.com/oauth/token (resource vision-crm-live, scope crm:intake:create) and submits vision-crm-lead-form.v1 to https://crm.runonvision.com/api/crm/v1/intake-submissions, with labelled answers, consent, idempotency, test submissions and per-form pipelines.", "The CRM catalog entry for the operation appears once CRM OpenAPI 9.4.0 is approved through the registry; this release does not approve it." ] }, { "id": "developer-docs-accuracy-2026-10", "version": "docs-0.4.0", "date": "2026-10-28", "prelaunch": true, "title": "Accurate hosts, per-App getting started, and MCP connection guide", "summary": "Replaces retired hostnames and paths with the running ones, documents each App's real conventions, corrects webhook signature verification, and adds an MCP connection guide with a token-refreshing bridge.", "changes": [ "Production Vision Core is https://app.runonvision.com; retired vision.ivisionstudios.com and /platform/v1 references now point to /vision-core/v1.", "Adds Environments and Getting started by App pages with origins, base paths, workspace formats, page sizes, idempotency and correlation headers per App.", "Quickstart and Authentication show cURL, TypeScript and Python, real token endpoint errors, the resource parameter, identity classes and how to get credentials.", "Corrects webhook verification: v1= HMAC-SHA256 over timestamp.deliveryId.body with vision-webhook-id, vision-webhook-timestamp and vision-webhook-signature headers.", "Errors, idempotency, pagination and rate-limit pages now carry per-App matrices and current numeric token limits.", "Adds the MCP server page and the Vision MCP bridge for Claude Code, Claude Desktop and other stdio clients.", "Rewrites the version policy with compatible and breaking change rules, deprecation headers and changelog generation." ] }, { "id": "developer-producer-factory-foundation", "version": "docs-0.3.1", "date": "2026-09-15", "prelaunch": true, "title": "Immutable producer contract factory foundation", "summary": "Adds generic compound-command references and immutable producer artifact validation without activating API, MCP, event, or production runtime surfaces.", "changes": [ "Documents every semantically identified compound command variant with its own schema fields and cURL, JavaScript, and Python examples.", "Adds the versioned producer-bundle declaration and fail-closed validation for explicitly declared APIs, commands, MCP tools, events, examples, changelog, provenance, and runtime evidence.", "Adds deterministic content-addressed ingestion, artifact and aggregate SHA-256 receipts, baseline compatibility checks, path and symlink defenses, and atomic candidate writes.", "Preserves bundle-less Apps and does not infer MCP tools, events, callable runtime availability, registry approval, deployment, or production release." ] }, { "id": "todo-publication-foundation", "version": "docs-0.3.0", "date": "2026-09-13", "prelaunch": true, "title": "To Do contracts and complete producer discovery", "summary": "Adds the missing To Do contract and makes missing producers visible without activating external API or MCP services.", "changes": [ "Published generated To Do schemas for the implemented tasks, lists, board, task-detail, presentation and command operations; command access remains human-only.", "Added source-discovery checks that report absent producer manifests and aggregate all contract drift instead of stopping at the first invalid module.", "Updated supported framework and image dependencies; dependency audit reports no known vulnerabilities at release verification.", "Automatic cross-repository publication, developer onboarding, external API activation and executable public MCP remain unverified and are not announced by this documentation release." ] }, { "id": "branded-developer-domain", "version": "docs-0.2.1", "date": "2026-09-12", "prelaunch": true, "title": "Canonical branded developer domain", "summary": "Moves active developer documentation and discovery metadata to the approved developers.runonvision.com origin without changing API or MCP availability.", "changes": [ "Updated canonical metadata, generated Markdown discovery links, sitemap, robots declaration, Atom feed, deployment configuration, and promotion receipts to developers.runonvision.com.", "Retained the site-wide noindex policy and truthful no-public-MCP status.", "Preserved approved checksum-pinned API contract issuer and audience literals pending a separately governed consumer migration." ] }, { "id": "developer-docs-foundation", "version": "docs-0.2.0", "date": "2026-09-08", "prelaunch": true, "title": "Developer documentation and AI discovery foundation", "summary": "Adds generated Markdown, AI discovery, release feeds, non-indexing controls, and freshness gates without changing API runtime availability.", "changes": [ "Improved light-theme contrast for documentation links, HTTP method badges, scope labels, and search keyboard hints after browser accessibility testing.", "Added generated Markdown guides for humans and AI systems.", "Added llms.txt, sitemap.xml, robots.txt, JSON changelog, Atom feed, and publication evidence generated from reviewed sources.", "Added a visible development banner and site-wide noindex policy.", "Documented MCP connection status without inventing a public endpoint or registry listing.", "Added CI gates that reject stale generated documentation or documentation changes without a release note." ] }, { "id": "retrospective-2026-08-21", "version": null, "date": "2026-08-21", "prelaunch": true, "title": "Calendar publication and API reference rebuild", "summary": "Retrospective archive of the documentation changes recorded on 2026-08-21.", "changes": [ "Published Calendar 1.4.0 with bounded availability-slot calculation under the approved Calendar scope and authority model.", "Added a full-depth page for every approved HTTP operation from checksum-pinned OpenAPI snapshots.", "Added request, response, authorization, operational, security, workflow, and contract-history context.", "Preserved preview and restricted availability labels; documentation does not imply general API availability." ] }, { "id": "retrospective-2026-08-20", "version": null, "date": "2026-08-20", "prelaunch": true, "title": "Contract security declaration unification", "summary": "Unified approved contract security metadata and corrected the Vision Core routed host.", "changes": [ "Unified approved contracts on the visionBearer HTTP bearer security scheme.", "Normalized scope declarations to x-required-scope while preserving CRM scope descriptions and Calendar claim metadata.", "Corrected Vision Core's documented routed host; Accounting, CRM, and Calendar remain gateway-only.", "No operations, parameters, or schemas changed." ] }, { "id": "retrospective-2026-08-15", "version": null, "date": "2026-08-15", "prelaunch": true, "title": "Initial access publication", "summary": "Published the initial pre-v1 access, webhook, and contract documentation baseline.", "changes": [ "Documented short-lived machine credentials, JWK discovery, installed-App context, publication lifecycle, and server-only integration guidance.", "Documented signed webhooks, bounded retries, replay protection, rotation, revocation, and exhaustion evidence.", "Recorded OpenAPI 3.1 and App API manifest validation.", "Capabilities remain preview/pre-v1 pending separate staging and production acceptance." ] } ] }