Changelog

Features

• Latency aggregation — hourly cron + aggregation function for engine latency history (OCR-203)
• Uptime tracking — health checks persisted to Supabase with daily uptime rollup (OCR-204)
• Provider comparison table — wired into engine detail pages (OCR-206)
• Engine rankings overhaul — real benchmark data with category breakdown (OCR-207)

Fixes

• DB column names — corrected to match actual schema (p50_ms not p50_latency_ms, removed avg_latency_ms)
• Uptime history columns — use actual DB column names for engine_uptime_history

Docs

• Playground guest demo verified — logged-out flow confirmed working on staging (OCR-209)
• Canonical tags audit — sitewide canonical tag verification (OCR-210)

Features

• Provider metadata seeding — metadata populated for all 19 providers in the database (OCR-201)
• Providers redesign — complete provider logos + homepage section polish (OCR-199)
• Vault-backed engines — GPT-4o, GPT-4.1 Mini, Claude Sonnet, Gemini 2.5 Flash enabled via Supabase Vault (OCR-196)
• Additional engines enabled — Claude Sonnet, Mistral Pixtral, DeepInfra, and Azure engines activated
• Engine detail page redesign — tab layout with provider cards (OCR-159)
• Model-centric URLs — engine URLs flattened to model-only slugs with 301 redirects (OCR-156)
• PaddleOCR configs — router configs added for pp-ocr-v4, pp-structure, and pp-ocr-multilingual
• Author field — author/creator field added to engines table (OCR-192)
• Engine cards redesign — provider badges added to engine list cards (OCR-158)
• Blue-green deploys — CI jobs added for prod + staging blue-green deployments

Fixes

• Placeholder data stripped — honest engine counts, fake usage charts removed (OCR-194)
• Engine detail bugs — Invalid Date, array parsing, language count issues fixed (OCR-184, 185, 187)
• Gemini slug — updated from gemini-2.0-flash to gemini-2.5-flash
• Engine release dates — updated with verified values
• Vault secret names — corrected in all engine configs
• Engine count claims — use "20+" not "40+" (18 live engines) (OCR-200)
• Engine detail sidebar — tabs and sidebar in proper 2-col grid layout
• Pricing tiers — replaced "Coming Soon" with "Standard" for live engines
• Autocomplete attributes — added to auth form inputs (OCR-125, OCR-126)
• Provider card — engine detail page always shows provider card (OCR-159)

SEO

• Breadcrumbs + H1 — added breadcrumbs, fixed H1 structure, noindexed dashboard routes (OCR-195)
• Canonical tags, H1, meta, JSON-LD — batch SEO fixes across site

Docs

• Docs expansion — audit of every endpoint, added examples and error codes (OCR-202)
• Repo references — updated after transfer to mothercoremasterchief-prog org

Infrastructure

• Router mirror removed — router moved to standalone repo; Rust CI check removed

Infrastructure

• Kanban status enforcement — done status reserved for prod-deployed items; agents use review status

Features

• Automated model discovery — discovery pipeline script fetches available vision models from OpenRouter, stages 132 engine configs (OCR-128, OCR-168)
• Real benchmark accuracy scores — placeholder labels replaced with actual benchmark results across engine catalog (OCR-134)
• Model discovery filtering — exclude non-OCR models, add Fireworks probes and Together serverless verification (OCR-133)
• EngineProvider type — new EngineProvider type + multi-provider compatibility helpers (OCR-154)
• ETL orchestrator — discover → probe → health check → report pipeline (OCR-170)
• Engine health check service — spec-compliant health checks using base64 images for all providers (OCR-169)
• ETL dashboard — internal ETL status dashboard at /internal/etl (OCR-172)
• Billing system — auto-topup trigger, invoice history API, payment-failure UI, DB migration (OCR-76)
• Conditional billing grace — grace period + auto-topup payment gating (OCR-144)
• Branded auth emails — custom Supabase signup and recovery email templates with SMTP config
• New engines — Kimi K2.5 and Qwen3-VL-8B added; dead Llama vision stubs disabled (OCR-127, OCR-150)

Fixes

• Responsive sort dropdown — fixed search bar cutoff on mobile
• Benchmark accuracy badge — overlay real accuracy onto all catalog DB queries (OCR-134)
• ESLint cleanup — fixed all 13 ESLint errors to unblock CI pipeline (OCR-139)
• CI test fixes — 25 failing tests fixed across 5 test files (OCR-146)
• API guard — reject oversized usage API keys, harden key lookup (OCR-129)
• Uptime card — improved range handling and no-data fallback (OCR-137)
• Router uptime — normalize engine ID lookup across slash/dash forms
• Security review CI — switched from Opus to Haiku (75× cheaper for pattern-matching)

Security

• Redirect + image URL sanitization — centralized sanitization to prevent open redirect and image injection (OCR-147)
• API security — auth + path traversal protection added to /api/internal/engines (OCR-180)
• Billing race condition — prevent auto-topup double-charge race condition (OCR-177)

Docs

• Repository map — REPOS.md added documenting site/router/benchmarks split
• Staging workflow — STAGING_WORKFLOW.md defining feature → dev → master → prod process (OCR-138)

Fixes

• Forgot-password redirect — preserve redirect context through forgot-password flow so users return to their original destination (OCR-88)
• Test infrastructure — fix heartbeat doc-test jest command for TypeScript/Vitest suites

Features

• JSON-LD structured data expansion — BreadcrumbList, FAQ, and Organization schema added across docs, engines, and pricing pages
• Changelog backfill — entries for Feb 25, 26, 28 backfilled from git history

Fixes

• Client API key storage — hardened with session-scoped fallback
• Playground guest demo — improved reliability for logged-out demo flow
• Engine count audit — removed stale hardcoded engine count copy
• CSP nonce — nonce prop correctly passed to next-themes provider
• Auth test stability — tracing-capture tests serialized at process level

SEO

• Unique meta descriptions — intent-aligned descriptions (140–160 chars) for auth, legal, and core pages
• OG images — og:image added to all pages missing it; page-specific images for key pages
• Crawlable copy — static copy blocks added to /compare, /playground, /status, and /login
• Mobile tap targets — all buttons meet 44px minimum for accessibility

Security

• CSP hardening — strict-dynamic, object-src none, GTM telemetry domains added
• SSRF + rate limiting — webhook test endpoint hardened with SSRF blocking and rate limits
• Stripe dedup — event deduplication + ledger insert column fix for webhooks
• Auth cookie — opaque HttpOnly auth marker cookie added (OCR-117)
• Webhook PATCH validation — URL validated against internal/private targets on update
• Middleware — /settings and /admin routes protected server-side (OCR-120)

Docs

• API usage auth — examples migrated to Authorization: Bearer header, query param deprecated
• Rate limit guidance — practical retry and backoff documentation added

Features

• Admin dashboard pagination — server/query pagination added to admin users and requests tables

Fixes

• Status page health classification — fixed incorrect classification for engines with 0% success rate
• Signup form improvements — disabled native form validation, added terms/privacy consent copy
• Pricing CTA — hero CTA now correctly links to signup

Security

• SSRF protection — block private/internal webhook targets to prevent server-side request forgery

Features

• Phase 2 Parameter Normalization — SHIPPED — dpi, page_range, and detect_tables settings unified across engines; playground UI controls added for all three
• Email notification system — low-balance alerts, weekly digest, and per-user notification preferences (OCR-79)
• Analytics dashboard — engine usage pie chart and CSV export (OCR-68)
• Webhook management UI — full CRUD in dashboard settings (OCR-67)
• Onboarding checklist — shown on first dashboard visit to guide new users (OCR-71)
• Status page overhaul — live engine availability indicators + uptime metrics (OCR-70)
• Benchmark methodology page — /benchmark with 5-engine corpus results (OCR-72); updated with Surya results after CUDA restart fix (OCR-18)
• Rate limit visibility — dashboard widget showing daily quota and usage; header verification tests added
• Landing page conversion polish — improved hero CTA, live stats bar, social proof section
• API versioning header — X-API-Version response header + /v1/changelog endpoint
• Internal test dashboard — /internal/test for API smoke-testing without external clients (OCR-51)
• Engine detail pages — language support matrix and settings sections added
• Rankings overhaul — real benchmark data with category breakdown replacing placeholder scores (OCR-50)
• Latency chart on engine pages — recharts-powered 30-day latency trend + uptime toggle (OCR-45)
• Health alerter extended — spike detection + relay channel notifications (OCR-73)
• Playground language selector with 12 languages + Auto-detect (Phase 1 frontend)
• OCR test corpus: 10 synthetic images with ground truth; expanded to 5 categories × 2 images
• Real benchmark results: 6 engines × 10 corpus images; 5-engine subset published
• Accuracy scores tagged as Placeholder to be honest about benchmark status

Fixes

• P0: Auth-aware navbar — Dashboard shown when signed in, Sign In when not; was showing wrong state
• P0: Playground stale OCR response — fixed race condition that could return wrong-image transcription
• P0: API key migrated from localStorage to sessionStorage — prevents key leakage via browser history
• Server-side auth gating enforced on all /dashboard routes
• Email validation feedback added inline on signup form (OCR-49)
• Email validation + demo mode UX polished (#37, #43)
• Return-to URL preserved through login redirect on mobile
• Long filenames truncated in playground file upload UI
• CSP: ThemeProvider nonce wired; connect-src updated for Google Analytics
• Dashboard requests use JSON+base64 instead of FormData (OCR-51 QA fix)
• Compare-engines page: placeholder accuracy badges removed from production UI
• Broken engine configs fixed: Gemini 2.5 Flash model string updated; Fireworks/Together downgraded to 11B models
• Surya engine: removed (GPL-3.0 license incompatibility), then restored after Ben confirmed Open Rail-M startup license approval
• Type mismatch in demo engine selection fixed (Rust: clone &Engine to owned)
• Vault NULL handling fixed for providers with missing keys
• Replace broken SVG logos: OpenAI, AWS, Azure, Tesseract
• HTML email templates: user-provided values escaped to prevent injection (security)

SEO

• og:image added to root layout + Twitter card; stale engine count corrected
• Page-specific OpenGraph tags added for /login, /signup, /pricing, /docs
• Canonical tags added to all public pages (docs sub-pages, providers, compare, auth)
• FAQPage JSON-LD on /pricing; BreadcrumbList on /docs and /engines
• Sitemap priorities tuned; auth pages excluded from indexing
• /engines page: single H1 structure enforced; H1 visible on all viewport sizes
• Self-referencing canonicals added to /providers, /compare, /docs, /status, /changelog
• /providers and /compare added to sitemap

Docs

• Phase 1 parameter normalization design doc, changelog, and test reference (OCR-54)
• Phase 2 parameter normalization design doc updated
• API docs updated with engine monitoring endpoints, 413 error code, Retry-After header (OCR-54)
• Language mapping table added to API endpoints documentation
• Benchmark page updated to reference ocr-bench repo; rerun cadence section added

Security

• CSP nonce-based script policy — replaced unsafe-inline for scripts site-wide
• SSRF blocked via webhook URL validation (private/loopback addresses rejected)
• API key storage migrated from localStorage to sessionStorage

Tests

• Auth regression, content sanitization, and API health test suite
• Mobile E2E: 4 journeys covering homepage CTA, signup validation, login redirect, demo OCR
• Accessibility E2E: playground flow + auth recovery (OCR-81)
• Accessibility fix: accessible names added to playground result action buttons (OCR-81)

Features

• Phase 1 Parameter Normalization — SHIPPED — unified settings.language across all engines, native_settings passthrough, applied_settings response field
• Playground language selector dropdown (12 languages + Auto-detect)
• Language code mapping for 40+ languages (ISO 639-1 → engine-native)
• Chinese variant support (zh-Hans/zh-Hant)

Fixes

• Fix playground stale OCR response race condition (wrong-image transcription)
• Fix long filename overflow in playground file upload
• Migrate API key from localStorage to sessionStorage
• Fix vault NULL handling for missing provider keys

Docs

• API docs updated with settings.language, native_settings, applied_settings fields
• Language mapping table added to endpoints documentation
• Phase 1 test suite created (22 test cases, all passing)

Features

• Google Analytics 4 — GA4 tag (G-PL6YCPG4FY) added to all pages

Fixes

• Update stale meta tags — corrected to 21 engines live across 5 providers

Docs

• Multi-provider model routing design doc added
• Internal planning docs updated to reflect resolved security issues and current plan status

Features

• Providers page redesign — real SVG logos, full-text search, and category filters

Fixes

• Strip fabricated rankings data — only real ocr-bench scores are now shown
• Strip fabricated request counts, growth percentages, and placeholder announcements
• Disable sqlx statement cache for transaction-mode connection pooling (stability fix)

Other

• Add OpenOCR app with Supabase integration
• Initial commit from Create Next App

Other

• Enlarge hero title and match OpenRouter font weight
• Switch engines page to horizontal card layout
• Increase rankings chart granularity to 90 daily data points
• Link ranked engines to their detail pages
• Redesign rankings to OpenRouter layout: section, chart, 1-10 list
• Redesign rankings with radar chart, sparklines, and styled cards
• Replace rankings charts with category-based 1-10 ranked lists

Features

• scaffold rust router mvp and ledger schema proposal

Fixes

• resolve all lint errors
• make supabase clients lazy-initialized to prevent build-time crashes

Docs

• add project status report
• document static vs Supabase data sources in rankings page
• comprehensive README + NEXT_STEPS roadmap for collaboration

Other

• add .env.local.example and update .gitignore
• router-rust: add provider adapters, execution outcomes, and OCR status endpoint
• router-rust: add atomic OCR debit transaction with DB idempotency
• wip: align pricing types with OpenRouter-style USD credits
• migrate catalog data from static files to Supabase-backed data layer
• Fix catalog typing issues to keep build green
• Wire up frontend to Supabase backend

Features

• toast notifications, payment success handler, API health endpoint
• Stripe checkout integration — API route, webhook handler, wired pricing page
• playground URL input mode — paste image URL instead of uploading
• add page metadata for engines + playground (SEO)
• add robots.txt and dynamic sitemap.xml
• expand engines.json with real provider configs
• new users get $1.00 starter credits on signup with ledger entry
• router authenticates via SHA-256 key_hash with plaintext fallback
• apply ledger migrations, add usage_records trigger, fix API key hashing + dashboard column mappings
• complete catalog DB migration — market_share + docs_navigation tables
• flesh out http_json provider adapter with auth + templates
• unify dashboard activity from router + add migration SQL
• wire playground to Rust router via POST /v1/ocr

Fixes

• correct engine count from 50+ to 25+ on homepage hero and stats bar
• playground checks 'succeeded' status instead of 'completed'
• update SITE_URL to open-ocr.com, add GitHub link in footer

Docs

• mark Stripe checkout as done in NEXT_STEPS.md
• comprehensive .env.local.example and router .env.example
• add CONTRIBUTING.md with dev workflow, project structure, and conventions
• update README with live URLs (open-ocr.com, api.open-ocr.com)
• comprehensive status report update — all systems green
• add OpenAPI 3.0 spec for the OCR router API
• rewrite examples page with real REST API examples
• update authentication, SDKs pages with accurate API info
• update quickstart and endpoints pages with accurate API docs
• update NEXT_STEPS.md — mark completed items (playground, dashboard, key hashing)

Tests

• add Stripe checkout tests (fees, validation, cents conversion, webhook metadata)
• add constants tests (site metadata, nav items, footer links)
• add format utility tests (formatNumber, formatPrice, formatLatency, formatPercentage)
• add 7 more Rust provider tests, total now 57 (34 frontend + 23 Rust)
• add playground tests, total test count now 50 (34 frontend + 16 Rust)
• expand test coverage to 41 tests (25 frontend + 16 Rust)
• add Vitest test infrastructure with 14 frontend tests

Infrastructure

• add GitHub Actions workflow for frontend (lint, test, build) + Rust router (check, test, clippy)

Other

• move api key hashing migration to supabase/migrations/, apply market_share + docs_nav + key hashing migrations

Features

• add local engine management script (start/stop/status/health)
• add docTR OCR server script (port 8102)
• add docTR local engine config (port 8102)
• add Surya OCR engine (port 8103) - ML-based, high accuracy
• add realistic OCR benchmark test images
• add Tesseract and PaddleOCR local engine configs
• add Tesseract and PaddleOCR servers (ports 8101, 8102)
• EasyOCR server with /v1/ocr matching router schema
• PDF preprocessing middleware for universal PDF OCR support
• OCR benchmark harness with test corpus and accuracy scoring
• Supabase Vault integration for provider secrets

Fixes

• align upload_to_supabase with actual DB schema
• standardize health endpoints across all OCR servers (/health + /v1/health)
• cache Surya detection predictor to prevent 500 errors on OCR requests
• correct Surya engine config to match router schema
• benchmark discover_engines handles wrapped response format
• benchmark runner - correct payload format, add Idempotency-Key, fix engine IDs
• include typescript flag in Stripe singleton test assertion
• update Stripe API version in singleton test to match lib
• align Stripe API version with SDK for production build

Tests

• cover router status mapping in dashboard activity log
• add Stripe singleton coverage

Other

• disable PaddleOCR+Surya configs, add venv to gitignore
• ignore local deploy log artifact
• update OpenAPI spec with unified output schema, output_format support, and TextRegion model
• per-engine config files + unified output schema v1

Features

• Phase 3.2 — auto top-up API endpoint (SetupIntent + settings persistence)
• wire rate limiter into /api/health (60/min) and /api/webhook (10/min) routes — Phase 4.2 complete
• wire rate limiter into checkout route + add /api/admin/health endpoint (Phase 4.2/4.4)
• engine comparison tool — run same image through multiple engines side-by-side, parallel requests, latency + char count
• in-memory sliding-window rate limiter with tiered instances (API 60/min, auth 10/min, playground 20/min) + 5 tests
• live system status page — real-time engine health from router /v1/engines/health, auto-refresh 30s
• add URL input support to docTR server — download image via urllib, same pattern as EasyOCR/Tesseract
• in-memory engine metrics — rolling success rate + latency percentiles per engine
• language code normalization (en → eng) for OCR engines
• global search in navbar — always visible, filters engines page live, navigates from other pages
• global search in navbar on all pages, mobile-first — syncs with engines page filter
• add root / and /health endpoints to router for API discoverability
• add deploy-router.sh — standardized build+deploy script
• extract confidence, regions, and raw response in http_json adapter
• add /v1/engines/health endpoint — probes all local engines concurrently
• add CORS support to router — enables browser playground to call api.open-ocr.com directly
• deploy PDF preprocessor on port 8200 + add to local-engines script
• real-world benchmark runner with consensus scoring (no ground truth needed)
• add real-world benchmark images + download script (public domain sources)
• auto-refund credits on provider failure (closes phase4 TODO)
• add /v1/engines/stats and /v1/engines/:id/stats endpoints for provider reliability tracking
• add /v1/status endpoint with version, engine count, and uptime
• add per-key rate limiting to OCR endpoint (60 req/min default, configurable via RATE_LIMIT_RPM)
• local adapter now extracts confidence, regions, and raw response from local OCR engines
• wire provider_endpoints health tracking into OCR request pipeline
• add watchdog script for auto-restarting crashed OCR engines
• add health-check.sh for monitoring all OpenOCR services
• add 5 local OCR engine configs (PaddleOCR, Surya, OCRmyPDF, RapidOCR, Marker)
• add DeepInfra + Mistral engine configs for multi-provider routing
• add llm_vision adapter for multimodal OCR (OpenAI, Anthropic, Google, Together, Fireworks)
• seed provider_endpoints with multi-provider pricing for 8 LLM vision engines
• add provider_endpoints table for multi-provider routing + health tracking
• add URL input support to EasyOCR and Tesseract servers

Fixes

• increase all balance round_dp from 2 to 6 — prevents /bin/bash.0005/page from rounding to /bin/bash.00
• increase debit precision from 2dp to 6dp — $0.0005/page was rounding to $0.00
• update local engine pricing to $0.0005/page, add docTR to engines.json, fix engine IDs (local/* → openocr/*)
• remove fake rankings data from nav, replace with coming-soon placeholder
• status page uses NEXT_PUBLIC_OCR_ROUTER_URL to match playground env var
• doctr server — pre-load model at startup, disable threading to prevent SIGBUS crashes
• repair engine-filters test — correct OCRCapability types, add missing OCREngine fields, use satisfies
• surya-server for v0.17 API - use FoundationPredictor
• add missing local engine entries to benchmark cost table (doctr, surya, tesseract)
• set TESSDATA_PREFIX so tesseract finds eng.traineddata
• tighter mobile search bar layout — single row, no stacking, less vertical padding
• improve mobile responsiveness across all pages — tighter padding, scaled-down card stats, no overflow on small screens
• rename local/ to openocr/ in engine apiIds — public-facing branding
• remove all duplicate 'available' fields breaking build
• remove duplicate 'available' field in DBEngine interface
• resolve clippy warnings (unused imports, map_or, borrowed refs)
• deploy script handles branch detection and rebase pulls
• respect method config in http_json adapter (GET support)
• add Idempotency-Key header to playground OCR requests and docs examples
• /v1/engines/health only probes local engines — skip external APIs without health endpoints
• add User-Agent header to http_json adapter
• graceful handling when provider_endpoints table missing + mock repo stats impls
• llm_vision adapter vault lookup uses Option not Result

Docs

• Phase 3.2 auto-topup API complete
• update PROJECT_PLAN — authorship amend complete, Rust toolchain blocker noted
• update PROJECT_PLAN — debit precision fix committed, blocked on Rust upgrade
• update PROJECT_PLAN — all 5 priority items complete, Stripe verified
• update PROJECT_PLAN — verification results, merge complete
• mark Phase 4.2 rate limiting as complete
• update PROJECT_PLAN with Phase 4.2/4.4 progress
• fix quickstart and endpoints to match actual router API schema (url/data_base64 fields, use openocr/easyocr as example engine)
• add Project Planner's PROJECT_PLAN.md and QA_LOG.md, gitignore surya log

Tests

• add engine filter/sort tests (availability sorting, search, providers, capabilities)
• add format utility tests (formatPrice, formatNumber, formatDate, formatLatency, formatPercentage)

Infrastructure

• run CI on dev branch pushes and PRs too
• add systemd service files for EasyOCR + Tesseract engines

Other

• Merge branch 'dev'
• merge: dev→master — resolve PROJECT_PLAN conflict (dev wins)
• Merge pull request #7 from Ben-ReadyChatAI/dev
• merge: resolve PROJECT_PLAN.md conflict (dev wins)
• seo: add /compare and /status to sitemap
• Merge pull request #6 from Ben-ReadyChatAI/dev
• merge: resolve conflicts (dev wins) for dev→master merge
• seo: add Open Graph, Twitter card, and robots metadata to root layout
• responsive: mobile fixes for auth pages, pricing tables (horizontal scroll), and spacing
• responsive: add mobile navigation for docs (dropdown) and dashboard (horizontal tabs)
• responsive: fix engine detail page and header for mobile
• responsive: fix padding, hero text, and button layout across all pages for mobile
• rename local/ engine IDs to openocr/ — hosted engines are branded OpenOCR, not 'local' to end users
• responsive: shrink navbar and logo on mobile (h-12, smaller logo text/icon)
• responsive: solid bg on sticky header, hide page title + view toggle on mobile, compact spacing
• responsive: sticky search bar on mobile (fixed below navbar)
• responsive: add floating filter FAB on mobile engines page
• responsive: remove nested scroll on mobile engines page — use normal page scroll on small screens, keep contained layout on desktop
• responsive: fix mobile layout for engine cards, navbar, page headers, and page padding
• feat(filters): move formats above capabilities in sidebar
• feat(engines): sort available engines before unavailable
• feat(engines): copy engine ID button, availability indicator, mobile responsive filters
• feat(engines): add EasyOCR engine + set non-zero pricing on local engines
• feat(db): add migration for engine availability + api_id columns
• feat(engines): add copy-API-ID button and availability indicator on engine cards
• fix(router): update test to match auto-refund behavior on provider failures
• feat(engines): sticky search/filters with independent scrolling engine list
• deduplicate tesseract engine config — move tesseract-5.json to disabled (local-tesseract.json is canonical)
• remove disabled PaddleOCR + Surya configs from active engines dir (already in disabled/)
• replace requests with urllib.request in OCR servers (fewer deps)

Features

• DB schema for OpenRouter-style provider metadata + latency history
• docs expansion — error codes, language support, auth guide (#2)
• overhaul engine rankings page — comprehensive benchmarks
• provider listing and profile pages with nav link
• port conflict detection at startup — prevents crashloops
• add engine-ports.json — canonical port registry for local engines
• engine registry audit — remove Marker, add metadata to all 20 engines
• backfill changelog with 5 dated entries from git history
• API test harness with web dashboard (services/test-harness)
• JWKS/ES256 support for JWT session auth — no legacy secret needed
• playground session auth — logged-in users can use playground without API key
• JWT session auth for playground — accept Supabase access tokens alongside API keys
• add engine slot machine animation to homepage hero
• hero animation variants showroom page (7 styles)
• shimmer CTA button on homepage — animated gradient border + hover glow
• comprehensive API integration test suite (scripts/integration-test.sh)
• structured error logging for all 4xx/5xx responses
• per-engine request timeout enforcement with 504 Gateway Timeout
• graceful shutdown on SIGTERM/SIGINT
• error alerting script with consecutive-failure threshold and recovery detection
• compare page file upload + result enhancements
• add file upload to compare page
• switch email from Resend to Microsoft Graph API
• add /reset-password page for password recovery flow
• improved dashboard empty states with onboarding CTAs
• playground UX overhaul + content cleanup
• session-based playground + remove salesy banners
• provider cost reconciliation framework (migration 009 + margins API)
• friendly error when PDF sent to image-only engine
• E2E smoke test script — 27 checks, all passing
• add warning field to OCR response when no text detected
• warning field on empty OCR results
• API key scope selector in dashboard UI
• API key scoping — read-only vs full-access keys
• SSR fallback content for /engines and /playground pages
• billing stress test suite + historical fix script
• billing integrity test suite (16 tests) + admin reconciliation API
• provider cost reconciliation — track upstream spend per request
• stale request cleanup — auto-refund stuck 'processing' requests
• changelog page, low balance alerts UI, webhook docs
• changelog page with launch day entry + footer link + sitemap
• changelog page with auto-generated entries from git history
• admin dashboard — users, OCR requests, ledger (auth-gated)
• 'How We Built OpenOCR' technical deep-dive blog post
• free tier banner on /engines + outreach drafts (Reddit, Product Hunt)
• blog system + launch post + HN Show draft
• usage dashboard — CSV export + date range picker
• email notification system — low balance alerts, welcome emails, weekly summaries
• free tier messaging — prominent $1.00 credits callout on docs + pricing clarity
• enhanced usage dashboard with engine breakdown, period selector, cost overlay
• interactive 'Try it' panels on API docs + fix usage page type error
• custom 404 page + enhanced usage dashboard with engine breakdown
• error boundary + empty states for dashboard pages
• password strength indicator on signup form
• separate Available vs Coming Soon engines on /engines page
• add 'Why use OpenOCR?' comparison section to homepage (M4)
• middleware auth redirect for /dashboard — no more flash of empty content
• homepage polish + og:image (M3)
• SEO improvements — JSON-LD structured data, sitemap updates
• SEO/SSR audit — server-side metadata for playground, rankings, compare, status pages
• rankings page with real engine benchmark data
• rankings page with real benchmark data (M3)
• playground guest demo mode + hide empty Rankings from nav
• add usage() methods to Python + TypeScript SDKs with README examples
• X-RateLimit-Limit/Remaining/Reset headers on /v1/ocr and /v1/usage
• GET /v1/usage endpoint — paginated OCR history with API key auth
• privacy policy + terms of service pages (#4 from backlog)
• forgot password page + mobile nav fix (M1.4)
• 10MB request body size limit + 6 new tests (body limit, CORS, health)
• structured engine_call_failed error events for monitoring (M2.3)
• per-engine rate limiting enforcement from cost_controls.max_requests_per_minute
• hide SSO buttons in prod via NEXT_PUBLIC_ENABLE_SSO feature flag
• add per-engine cost_controls config + spend tracking schema (M2.2 prep)
• add Anthropic Claude Sonnet to frontend catalog + cloud E2E test script
• add cloud engine E2E test script — verifies Gemini, GPT-4.1 Mini, GPT-4o
• RapidOCR engine live — 6th local engine, 9th available total
• enable OpenAI GPT-4.1 Mini + GPT-4o as cloud OCR engines
• add Gemini 2.0 Flash to frontend engine catalog + scene-text capability type
• enable Google Gemini 2.0 Flash — first cloud OCR engine live
• TypeScript/Node SDK v0.1.0 — sync/async OCR, batch, polling, engines (12 tests)
• Python SDK v0.1.0 + fix docs engine names
• add OCRmyPDF as 5th local engine (port 8105, systemd, E2E verified)
• return full extracted_text in OCR response (was preview-only)
• Phase 5.1 — Batch OCR endpoint (POST /v1/ocr/batch)
• Phase 5 — GET /api/usage endpoint with pagination, date filtering, engine filter, summary stats. 6 new tests (101 total).
• Phase 2.3 — fallback routing when primary engine fails with retryable error
• re-enable Surya v0.17 as openocr/surya engine (port 8103)
• add engine availability status to /v1/engines response
• Phase 4.3 — async OCR mode with webhook callbacks
• Phase 2.2 — provider-keys CRUD API (POST/GET/DELETE /api/provider-keys)
• provider API key management route + test (Phase 2.2 cleanup)
• Phase 2.2 — integration test for external engine missing API key
• Phase 3.2b — wire auto top-up toggle to API + Stripe Elements card collection

Fixes

• validate base64 input upfront + add Retry-After header on rate limits
• inline OG image route segment config (Next.js requires static literals)
• dashboard smoke test expectation + remaining SEO double-branding
• standardize local engine provider to 'local' in router configs
• docs layout title template for sub-page SEO
• SEO meta tags — unique titles, descriptions, OG tags for all pages
• remove unsupported payment methods (AliPay, crypto) from all pages
• remove unsupported payment methods from FAQ
• remove unsupported payment methods (AliPay, Crypto)
• rename Self-Hosted to Open-OCR.com per Ben's request
• add errors + languages to docs sidebar nav
• suppress credits warning flash during dashboard loading
• EasyOCR lang code mapping — convert tesseract codes (eng) to easyocr codes (en)
• suppress credits warning flash during auth loading
• show skeleton loader instead of credits warning during dashboard load
• add overflow-hidden to filename container for proper truncation
• truncate long filenames in playground file upload
• remove broken slot machine from hero per Ben
• remove 'Fair Pricing', 'free' language per Ben's feedback
• slot machine — fixed-width container, no trailing text, no layout shift
• slot machine gap — auto-width grid sizer instead of fixed width
• auto-topup test expected 404 but route returns defaults for unknown users
• stabilize flaky tracing-capture tests
• 'Create free account' → 'Create account' in CTA section
• changelog wording — cloud engines 'in catalog' not 'ready'
• repair 34 broken tests caused by coming_soon engine rejection
• add missing OCRCapability types for new engines
• sync engines.ts with live API availability + pricing
• reject coming_soon engines with 400, add error boundaries, clean webhook log
• auto-topup returns defaults for missing profiles instead of 404
• return 413 JSON envelope for oversized payloads
• pricing table shows Coming Soon badge + fallback provider name
• playground auto-selects first available engine instead of coming_soon
• playground error state when engines fail to load
• suppress autofill yellow on non-auth inputs + fix email sender address
• kill browser autofill yellow highlight on all inputs
• overhaul compare page — session auth, all 6 engines, no autofill
• add is_active column to api_keys table
• getProfile uses correct column names from prod DB + defensive defaults
• resilient dashboard getProfile — fallback columns + safe defaults on error
• bulletproof fetchProfileName with 3s timeout + auth debug logging
• auth sign-in redirect loop — middleware was checking cookies but Supabase JS uses localStorage
• auth callback 500 — x-forwarded-proto contains 'https,http' from Cloudflare
• auth form button stuck on Loading, improve error display
• auth callback route + emailRedirectTo for confirmation emails
• auto-save API key to localStorage for playground
• 3 QA bugs — playground demo, login validation, footer links
• rebuild prod, resolve 502 — all pages live
• add User-Agent header to surya + rapidocr image downloads
• P0 regression — scope column query broke auth on live DB
• improve JSON deserialization error messages for OCR requests
• 2 failing dashboard tests — mock chain missing .gte() after usage date filter
• How It Works steps match actual user flow
• refund billing bug — failed OCR requests now properly refund credits
• og:image 25+ → 20+ engines for accuracy
• accurate stats per Chief review — 20+ engines, remove uptime claim
• switch prod+staging to production builds, remove fake aggregateRating from JSON-LD
• signup copy — '100 free pages' → '$1.00 in free credits' (was inaccurate)
• update stale engine count copy (25+ → 20+)
• quickstart guide polish + SDK usage() tests
• engine detail 404 — rename DB slugs local/* → openocr/*, add missing engines + providers
• docs use correct API response field names (cost_debited, provider_latency_ms, extracted_text)
• JSON parse errors now return proper error envelope instead of raw text
• profile balance precision (numeric(10,2) → numeric(12,6)) + commit RLS insert policies
• SECURITY DEFINER functions for ocr_requests/ledger RLS bypass (P0)
• add missing RLS INSERT/UPDATE policies for router (P0)
• hide Next.js dev indicator, fix mobile filters overlap, fill engine detail sidebar
• SET LOCAL role=service_role to bypass Supabase FORCE RLS in debit + credit transactions
• usage API auth (hash key before lookup), remove false dev-key claim, clean footer placeholders
• remove fake dev key fallback from compare page, require API key
• add DB connection retry with exponential backoff on startup
• RapidOCR price was $0.00/page (billing bypass bug), set to $0.0005
• replace unwrap() with proper error handling in engine_stats_handler
• add venv/services/sdk to eslint ignores — CI lint now passes (0 errors)
• resolve all ESLint errors in test files — CI green
• deploy.sh handles local-ahead-of-origin gracefully (exit 128 fix)
• Python SDK test — update assertions for url field + Idempotency-Key header
• remove duplicate Content-Type headers in llm_vision adapter
• Gemini URL input — download images to base64 instead of file_data URI
• SDK uses correct field names (url not data, Idempotency-Key header, cost_debited/provider_latency_ms parsing)
• SDK engines() parses 'data' key from router + add 10 unit tests
• pass actual page_count to async OCR provider (was hardcoded to 1)
• store full extracted_text in DB for async OCR polling
• hardcode easyocr/tesseract endpoint URLs (env vars were unset, resolving to empty)
• always use rustup toolchain in deploy script (system rustc 1.75 too old for Cargo.lock v4)
• pin transformers<5.0 for surya-ocr 0.16.7 compat (pad_token_id crash)
• deploy-router.sh handles same-file case (skip cp when source=dest)

Docs

• update forge state — base64 fix committed, waiting on P0
• update forge state — all overnight QA tasks complete
• update forge state — cargo test + smoke test done
• update forge state — both sprint tasks done
• update forge state after port map doc
• add ENGINE_PORTS.md — canonical port map to prevent overlaps
• update forge state after easyocr running server fix
• update forge state after engine audit + easyocr fix
• update forge state after test harness
• close relay keys + JWT secret items in NEEDS_BEN
• UI bug fixes can go straight to prod per Ben
• update forge state after JWKS upgrade
• update forge state + NEEDS_BEN after JWT session auth
• add staging-first deploy rule to VALUES.md (per Ben)
• update chief state — E2E OCR verification complete, all 6 engines passing
• update forge state after integration test suite
• update chief state — prod deploy fix, QA sweep results
• update forge state after structured error logging
• update forge state after timeout enforcement
• day 1 close — state files + plan updated
• close P3 #9, update forge state
• update chief state + plan — playground errors fixed, compare upgraded
• email blocker resolved — Graph API sending confirmed working
• update NEEDS_BEN — email code wired, awaiting Mail.Send permission
• update pre-launch checklist - password reset, robots.txt, HTTPS verified
• update plan + forge state after completing P2#6 and P3#9
• add load test results for tesseract engine
• pre-launch checklist — blockers, should-haves, ready items
• mark PDF error handling done, update plan + done log
• mark cargo PATH fix done, update plan + done log
• move empty OCR handling to done, update plan
• add Vercel redeploy blocker to NEEDS_BEN
• add SDK publishing + migration 008 to NEEDS_BEN
• move API key management UI to done
• track PROJECT_DONE.md in git (was untracked)
• update plan — API key scoping complete, dev→master merged
• move SSR conversion to done, update plan
• update status + plan for billing stress test completion
• update plan + done for billing integrity work
• update plan, done, needs-ben for changelog + low balance + webhook docs
• update plan + done for admin dashboard, outreach, blog
• update plan + done for blog system and HN draft
• update plan + done for email notifications and CSV export
• update plan + done for free tier messaging
• move usage dashboard polish to done
• move interactive API docs to done, clean plan
• move error states to done, update plan
• update PROJECT_STATUS
• update plan + done
• update project plan + done files
• update PROJECT_DONE with latest shipped items
• update PROJECT_DONE.md with latest completed items
• update plan + done — SEO audit phase 1 complete
• update plan + done files — rankings shipped, SEO tagged
• log playground demo + hide rankings to DONE
• adopt 3-file planning structure (Ben's split)
• update PROJECT_PLAN with SDK + engine guide
• engine comparison guide with latency data and use-case recommendations
• backup strategy + Sentry/Supabase items in NEEDS_BEN
• update PROJECT_PLAN with X-RateLimit headers
• update PROJECT_PLAN with infra tasks
• update PROJECT_PLAN with /v1/usage endpoint
• update PROJECT_PLAN with engine detail 404 fix
• update PROJECT_PLAN with docs fix and user test backlog
• update user test backlog with resolved items
• add user test backlog from prod walkthrough
• update PROJECT_PLAN with JSON error envelope fix
• update PROJECT_PLAN + QA_LOG with M1 gate pass and balance fix
• P0 resolved, balance precision fixed, M2 changelist compiled
• P0 RLS bug documented in project plan
• update M1 audit report — all 7 steps PASS after RLS fix
• M1 audit report (M1.1 walkthrough + M1.4 UI issues)
• update PROJECT_PLAN — M2.3 structured logging test done, deploy timer disabled, 253 tests
• update ROADMAP.md — M1.2/M1.3 done, M2.2/M2.3/M2.4 partial, 252 tests
• update PROJECT_PLAN — 10MB body limit, PR #8 merged, 252 total tests
• update PROJECT_PLAN — compare page fix, usage API audit
• update PROJECT_PLAN — 4 auth edge case tests, 246 total tests
• mark gh auth token resolved
• update NEEDS_BEN.md — add gh auth blocker
• update PROJECT_PLAN — Playwright E2E suite done
• update PROJECT_PLAN — DB retry fix done, git push blocked
• update PROJECT_PLAN — M2.3 structured error monitoring done
• add VALUES.md and NEEDS_BEN.md — shared mission + blocker queue
• update PROJECT_PLAN — headless E2E feasibility confirmed
• update PROJECT_PLAN — QA status 8:48 AM, 242 total tests
• add NEEDS_BEN.md — blockers that need Ben's input
• update PROJECT_PLAN — per-engine rate limiting enforcement
• update PROJECT_PLAN — RapidOCR billing fix, external E2E suite, SSO flag
• update PROJECT_PLAN — production safety audit, unwrap fix
• update PROJECT_PLAN — 117 Rust tests, 240 total
• update PROJECT_PLAN — 108 Rust tests, 231 total
• update PROJECT_PLAN — 104 Rust tests, 227 total
• update PROJECT_PLAN — 99 Rust tests, 222 total, M2.2 prep
• update PROJECT_PLAN — 96 Rust tests, 219 total
• update PROJECT_PLAN — 91 Rust tests, 214 total
• update PROJECT_PLAN — 87 Rust tests, 210 total
• update PROJECT_PLAN — M1.2 verified, M1.3 RLS audit complete
• add Supabase RLS audit — all tables pass (M1.3)
• add ROADMAP.md — go-to-market plan from Planner
• update PROJECT_PLAN — 3 fallback tests, 80 Rust, 203 total
• update PROJECT_PLAN — ESLint fix, git attribution, 2 rate limiter tests (77 Rust, 200 total)
• update PROJECT_PLAN — cloud keys removed, 3 new batch tests (75 Rust)
• update PROJECT_PLAN — 2 new Rust async tests (72 total)
• update PROJECT_PLAN — deploy service fix (9536ed0f4)
• update PROJECT_PLAN — Python SDK test fix, 193/193 tests green
• update PROJECT_PLAN — Claude Sonnet catalog entry, ANTHROPIC_API_KEY blocker
• update PROJECT_PLAN — RapidOCR live, 9 engines available
• update PROJECT_PLAN — OpenAI duplicate Content-Type bug fix
• update PROJECT_PLAN — 8 engines available (OpenAI GPT-4.1 Mini + GPT-4o live)
• add engine quality benchmark — Surya wins accuracy, Tesseract best speed/accuracy
• update PROJECT_PLAN — Gemini Flash live, 6 engines available
• update PROJECT_PLAN — TypeScript SDK v0.1.0 (193 total tests)
• update PROJECT_PLAN — SDK bug fix + 10 Python tests (181 total)
• update PROJECT_PLAN — Python SDK v0.1.0 shipped
• update PROJECT_PLAN — API endpoints docs shipped
• add batch OCR, async OCR, and engine status to API endpoints reference
• update QA status — 5/5 engines, E2E test covers OCRmyPDF
• OCRmyPDF engine live, 5/5 engines healthy
• async page_count billing fix in project plan
• update QA status with 2:10 AM E2E verification + async polling fix confirmed
• async OCR polling text fix in project plan
• full extracted_text bug fix in project plan
• endpoint URL fix + E2E test script in project plan
• Phase 5.1 batch OCR complete, 171 total tests
• Phase 5 usage endpoint complete, 167 total tests
• Phase 2.3 fallback routing complete
• 1:08 AM heartbeat — 161 tests green, deploy script fix, all systems nominal
• surya crash fix documented, 4/4 engines healthy
• Surya v0.17 re-enabled, 4/4 engines healthy
• engine availability status + deploy script fix
• Phase 4.3 async OCR complete
• Phase 2.2 provider-keys CRUD complete, 95/95 tests
• mark Phase 2.2 complete in PROJECT_PLAN
• verification on main complete, progress remote synced
• mark Phase 3.2b complete

Tests

• add API key scope enforcement tests (140 Rust tests)
• structured error logging (engine_call_failed) field validation — M2.3
• 4 new auth edge case tests (unknown key, empty bearer, sk- only, Basic scheme)
• add 12-test Playwright E2E browser suite (signup, engines, API, auth, CORS)
• headless browser E2E feasibility check — 5/5 staging pages load via Playwright
• add 9 new tests — PDF detection, LLM vision edge cases, cloud engine PDF routing (117 Rust tests)
• add 4 new Rust tests — engine stats endpoints, concurrent debit, root endpoint (108 Rust tests)
• add 5 new tests — health, status, engines list, engine metrics (104 Rust tests)
• add 5 new tests — CORS header validation (4) + async webhook storage (1) (96 Rust tests)
• add 4 new tests — idempotency replay/independence + insufficient balance/multi-page (91 Rust tests)
• add 7 request validation edge-case tests — auth, engine, input, idempotency (87 Rust tests)
• add 3 fallback routing edge case tests — both-fail refund, non-retryable skip, engine attribution (80 Rust tests)
• add rate limiter integration tests — 429 enforcement + key isolation (77 Rust tests)
• add 3 batch OCR tests — success, insufficient balance, mixed engines (75 Rust tests)
• add async polling text + webhook URL acceptance tests (72 Rust tests)
• add OCRmyPDF (port 8105) to E2E test script, 6/6 engines passing
• Phase 4.3 — async mode unit tests (success + failure/refund)

Infrastructure

• uptime monitoring (5-min timer) + logrotate config
• rebuild router with OpenAI Content-Type fix + all 8 engines
• rebuild router with async page_count + polling text fixes
• rebuild router binary with full extracted_text + batch OCR + fallback routing

Other

• update project state files
• Merge remote-tracking branch 'origin/dev'
• Merge pull request #15 from Ben-ReadyChatAI/feat/docs-expansion
• sprint: assign Forge 2 tasks, clean up Chief done items
• split plan into sprint + backlog, Planner controls work flow
• update chief state — Framer Motion CTA shipped
• rebuild: router binary with graceful shutdown support
• rebuild: router binary with 413 envelope + 404 JSON fixes
• Pre-launch checklist: close 7 items, add health monitor script
• Security headers: configured in next.config.ts, update checklist
• Add security headers (CSP report-only, X-Frame-Options, Referrer-Policy, Permissions-Policy)
• update chief state + verify API key revocation in checklist
• Hide blog from homepage and navbar per Ben's request
• feat(router): add X-Processing-Time header to all API responses
• feat(router): return JSON error envelope on 404 for unknown routes
• update project files — dashboard fix logged, plan updated, QA root cause documented
• remove auth debug logging (sign-in verified working)
• error audit results, plan cleanup, HTTPS issue found
• update PROJECT_DONE with auth redirect fix
• update project files — playground UX + content fixes done
• add Supabase auth URL settings to NEEDS_BEN
• migration 009 applied to prod, update project files
• update project files — done log + plan cleanup
• update project files
• update NEEDS_BEN — Azure email replaces Resend
• run migrations 007+008 on prod, update NEEDS_BEN
• run migrations 007+008 on prod, add 008 sql file, clean up NEEDS_BEN
• remove stale archive copy of PROJECT_DONE.md
• Merge pull request #13 from Ben-ReadyChatAI/feat/comparison-section
• Merge pull request #12 from Ben-ReadyChatAI/feat/homepage-polish
• sync PROJECT_PLAN, NEEDS_BEN, QA_LOG, add PROJECT_STATUS
• use SECURITY DEFINER functions for RLS bypass instead of SET LOCAL role
• Merge pull request #9 from Ben-ReadyChatAI/fix/m1-ui-issues
• Merge remote-tracking branch 'origin/fix/usage-api-auth' into dev
• structured engine error logging for monitoring (M2.3 prep)
• clean stray binary, gitignore it, update QA_LOG
• Merge branch 'dev'
• ops: install rustup 1.93.1, rebuild router — debit precision fix now live

Features

• engine latency time-series — migration, rollup function, and API endpoint
• update frontend to 10-image benchmark scores, update methodology text
• expand ocr-bench from 3 to 10 images with full benchmark results
• add license to all per-engine config files
• populate license field across all engines
• add License column to rankings table + license data per engine
• track engine licenses — show open-source license badges across site
• add GT Match column to rankings page with ground-truth similarity scores
• ground-truth similarity metric + benchmark with GT scores
• load real ocr-bench scores into rankings page
• CI benchmark regression script for ocr-bench
• add Quality column to rankings page (ocr-bench plumbing)
• ocr-bench engine benchmark — 6 engines × 3 images with scores
• wire ocr-bench quality scores into compare page
• add word_accuracy metric + polish README for ocr-bench v0.2.0
• scaffold ocr-bench — open-source OCR quality scoring library
• Phase 6 rankings overhaul — sortable table, doc-type benchmarks, filterable matrix
• enhanced changelog script with date range and tag support
• log watchdog script with relay alerting
• Phase 5 — engine provider comparison table on detail pages
• Phase 5 — provider comparison page with sortable table, summary cards, privacy section
• Phase 2+3 — latency rollup cron + uptime tracking pipeline
• apply provider metadata migration + seed engine strengths/weaknesses
• welcome CTA on dashboard for new users with 0 requests
• changelog auto-generation script from git commit prefixes
• Retry-After header on 429 error responses (RFC 6585)
• skip-to-content link + nav aria-label + fix docs double-branding

Fixes

• P3 auth bypass on low-balance-check + strip version/uptime from unauthed /v1/status
• add 10MB client-side file size limit to playground upload (P2)
• pdf_preprocessor .max(100) → .clamp(1,100) — was extracting 100 pages from 1-page PDFs
• validate page_count on single /v1/ocr endpoint (P0 credit injection)
• make license optional on OCREngine type for static data compat
• remove 'free' language from pricing page, update accuracy to ocr-bench scores
• rankings page — default sort by quality, fix engine count, honest methodology
• webhook fallback for missing increment_credit_balance RPC
• scope RLS policies to service_role (P2 security)
• detect mid-word space insertion in char_separated metric
• session auth for OCR — audience validation + nullable api_key_id
• compare page UX — elapsed timer, progress bar, cancel button
• rename local→openocr in per-engine router configs
• replace self-hosted/local language with OpenOCR-hosted, add 60s timeout to compare page, add OpenOCR provider
• rename 'local' provider to 'openocr' everywhere
• remove fake req/week stats, rename Trusted→Planned providers
• add strengths/weaknesses to static engine data
• disable x-powered-by header + fix navbar search on all pages
• actionable error messages in playground (#23)
• filter provider sidebar to only show providers with real engines
• strip internal fields from /v1/engines public API response
• dashboard title metadata + extract DashboardShell client component
• filter all engine listings against router API (eliminates stale DB entries)
• filter non-routable engines from playground + hide Try in Playground for unavailable engines
• compare page fetches engines dynamically from API
• add session JWT fallback to compare page (was API-key-only)
• add apple-touch-icon + icon.png, improve auth/balance error messages in playground
• escape dollar-brace in Python f-strings for JSX compatibility
• escape JSX-incompatible f-string in examples page
• friendly error messages for network failures in playground + compare
• honest engine count copy — '6 engines live, 20+ planned'
• honest engine counts (6 live, 20+ planned) + fix self-hosted branding remnant
• base64 validation handles unpadded input — auto-pad before decode

Docs

• benchmark methodology README
• expand endpoints (usage, status, rate limits) + add session auth and rate limit sections to auth page
• update forge state — changelog backfill done, sprint clear
• backfill changelog for Feb 24 — 6 sections, 25+ items from git history
• add PDF support documentation page
• launch readiness checklist — compiled from overnight sprint
• update forge state
• update forge state — timeout audit + stress test done
• rewrite examples page with live engines + SDK patterns, add 2/24 changelog
• update forge state — router rebuilt, Retry-After live on prod
• overnight report 2/24
• update forge state — router rebuilt, all pages verified

Tests

• add base64 validation + coming_soon engine integration tests

Infrastructure

• add Claude security review on PRs

Other

• P3: strip internal details from /api/health response
• update forge state + add latency migration to NEEDS_BEN
• security: fix open email relay + atomic webhook credit update
• security: fix P1 IDOR vulnerabilities + admin/health auth
• update chief state
• content: update changelog for Feb 24 + review outreach drafts
• Update CHIEF_STATE.md — sprint tasks done, staging
• Add API test dashboard + expand docs SDKs with per-endpoint examples
• Cross-link /compare and /compare-engines pages
• Phase 4: wire latency chart, uptime card, strengths/weaknesses, provider trust into engine detail pages
• update chief state — Phase 2+3 done, sprint clear
• security: enforce CSP + add HSTS header
• update chief state — sprint clear, both tasks done
• Sprint tasks 16,22,24,39,40 verified complete — SDK docs + Lighthouse
• update chief state after engine filtering sweep
• ops: add router log persistence + server baseline doc

Features

• Session-based playground auth — Logged-in users can now use the playground without an API key. Uses JWKS/ES256 JWT validation via Supabase public keys.
• API test harness — Internal testing dashboard (Tailscale-only) for orchestrating API test cases across all engines.

Fixes

• Credits warning flash on login — Dashboard no longer flashes "No credits remaining" during profile loading. Shows skeleton loader until data is ready.
• Filename truncation — Long filenames in the playground file upload now truncate properly instead of overflowing.
• Slot machine removed — Broken hero animation removed from homepage until properly fixed.
• Copy cleanup — Removed "Fair Pricing" and "free" language from marketing copy.

Infrastructure

• Router upgraded to JWKS/ES256 for JWT validation — no shared secret needed.
• EasyOCR language code mapping fixed (Tesseract eng → EasyOCR en).
• Surya engine temporarily disabled due to server bug.