v1.7.0
Hardened for go-live
Your database, migrations, and AI endpoints get real guardrails: live-database RLS validation before deploy, destructive migrations blocked in CI, an app-owned AI system prompt, and a threat model you can hand to a reviewer. Planning and learning also gain independent second opinions, and the clone-to-deploy path was re-audited end to end. A go-live with fewer surprises.
Added
- A second opinion on your plans: the spec-driven /plan step now runs an independent, risk-routed review that reads your plan with fresh context and escalates to specialist reviewers when it touches auth, payments, or schema. Advisory, never a blocking gateFeature
- Your captured lessons check themselves: /learn can run an opt-in soundness pass on a freshly written micro-lesson, and relevant past lessons resurface automatically when you start work on a related issueFeature
- Prove your live database is locked down before launch: pnpm db:validate:drift reads the database you actually deployed and fails if any table is missing row-level securityFeature
- A threat model you can hand to a reviewer: a living map of every trust boundary — auth, RLS, billing webhooks, AI endpoints, secrets, supply chain — the control defending each, and the gate that turns red if it breaksFeature
Changed
- A fresh clone reaches go-live with fewer surprises: the clone-to-deploy path and environment contract were re-audited, so setup requires exactly the Supabase variables the app actually reads — no failing on unused ones, no passing on missing onesImprovement
- Your deployed app ships as your product: builds no longer carry Sinter's own brand identity in their metadata, and setup now warns when secret-scanning tooling is missing instead of failing quietly laterImprovement
- The design system is now built CSS-first on Tailwind v4: every token lives in a native @theme block in one stylesheet, so restyling is a single-file editImprovement
- Node 22 is the supported toolchain floor, so your local and CI environments matchImprovement
- Steadier integrations: Stripe subscription webhooks settle correctly in any delivery order behind a documented idempotency contract, and the Supabase MCP ships hosted, authenticated, and read-only by defaultImprovement
Security
- Your app owns the AI system prompt: the chat and generate routes send a server-authored prompt and treat any client “system” message as untrusted, with a response-token ceiling, an input-context budget, and a per-user upload quotaSecurity
- Destructive migrations are blocked by default — DROP TABLE/COLUMN, TRUNCATE, DROP SCHEMA/TYPE, dropped constraints, and unqualified DELETEs — and the Supabase service-role client is confined behind an explicit allowlistSecurity
- Gate integrity: the dependency-audit and shell-injection-lint checks now block in CI rather than passing silently, and the end-to-end test suite is a required status check on mainSecurity