Changelog

• The office responds: hover any agent for what it is doing, click for its panel, and give it work without leaving the room
• Carry a figure to another desk — seating is drag-and-drop, and the room keeps the arrangement
• Decorate mode — move the furniture where you want it; illegal drops (blocking a walkway, landing on a seat) are refused rather than saved
• A shareable public office link at /o/your-slug — read-only, no task text, no names, revoked by rotating the slug
• A link card so the office advertises itself when the link is pasted anywhere
• New front door: the landing page is one night, 20:14 to 05:58, with the real renderer running the office section

The office stopped being a picture of your team and became the place you work with it.

• Agents belong to the workspace, not to a single project — hire an agent into a project instead of inventing a new one, up to three projects each
• A management panel per agent: character type, colour, permissions, autonomy dial and its own activity log
• The pixel office — a rendered room driven by real state, with five room themes, three character styles, and a night that follows your clock
• Desks are yours to name and seat, from Settings or by asking an agent
• Routines and watchers: the team acts on a schedule and reacts when things happen
• The working day has a shape — standup, a handbook the whole company shares, per-agent scorecards, agent memory, handoff between agents, and a task board that persists
• An agent can staff the inbox, and asks you when it does not know

The Team tab became the place you run a company from, rather than a list of assistants.

• Customer-host TLD switched from coagentic.app to coagentic.site after the .app was found squatter-registered (along with .io / .co / .dev / .com / .net / .org / .biz)
• Cloudflare Email Routing live for coagentic.work — catch-all + three explicit aliases (contact@, security@, support@) forward to a single Outlook inbox; DMARC moved off GoDaddy's default reporting target so we actually receive auth-fail reports
• Marketing-site contact form replacing the mailto link — rate-limited 5/hour/IP, honeypot-protected, persisted to a contact_messages table and emailed via the BullMQ pipeline
• Pre-launch honesty pass on the public surface: removed fabricated PGP fingerprint and 404 download link, removed unverifiable $2-5K bounty rates, replaced contractual-sounding patch SLAs with soft 'we aim to' wording, aligned payments copy with Polar.sh across privacy / terms / subprocessors / security pages, and replaced the fake testimonials on /customers with use-case cards
• Customers personas folded into the landing page under 'Who it's for', /customers route deleted
• /compare and the six per-competitor pages removed — pre-launch peers (Lovable, bolt.new, v0, Bubble) don't run them and the unverifiable rows were a maintenance liability
• /status page and its API endpoint removed — fake green light without real per-component monitoring; we'll point at statuspage.io / Better Stack / Instatus when production traffic begins
• Dead RSS and email-digest links pulled from /blog and /changelog (no real generators were behind them)

Pre-launch surface trimmed and de-risked: every claim on the public site is now either factually true today or explicitly soft-edged.

• Customer-facing per-project analytics page — visitors, leads, AI assistant chats, workflow success rate
• Per-project Analytics tab in project navigation
• Founder Ops dashboard — separate Next.js app at ops.coagentic.work, behind Cloudflare Tunnel + Access
• Cookie-less marketing-site visitor analytics (Redis-backed daily salt, isbot bot filter, GDPR-defensible)
• Audit log + Errors + Workflow runs viewers in the Ops dashboard
• Tenant detail view with suspend / restore / refund / grant-admin actions, every action audit-logged

Track phase of Launch + Track + Grow shipped — customers can finally see how their own business is doing.

• Docker fullstack parity — apps/admin runs in the same compose as web/api/agent locally and in production
• Cloudflared tunnel service in production compose, no public port exposure for the admin
• API token cache write-through with DB fallback — externally minted tokens recognised on next request, no API restart needed
• 90-day retention cron on marketing_page_views; daily 03:15 UTC prune
• One-shot setup-admin-local script: grant is_admin + rotate API token + write apps/admin/.env in a single run
• Missing message_tokens table CREATE added to migrate.ts (admin /metrics/costs was 500'ing on fresh DBs)

• Pricing page rewrite — 4 paid tiers: Free / Starter ($25) / Pro ($79) / Business ($199)
• Animated rainbow border on the Business card via conic-gradient + @property
• DeepSeek-only smart hybrid LLM: Flash by default, Reasoner for code generation and orchestration; OpenAI fallback removed
• Cost-protective metering on agent messages, site-assistant chats, workflow runs, and per-project file storage
• Comprehensive SEO pass: site-wide JSON-LD (Organization + WebSite + SoftwareApplication), per-page FAQPage / Article / BreadcrumbList schemas, dynamic OG image at /opengraph-image, expanded sitemap with /compare/[slug] dynamic routes
• Landing page reframed around the three-phase story: Launch + Track + Grow, customer's payment options (Polar / iyzico) marketed instead of ours
• Competitor comparison pages for Lovable, bolt.new, v0, Wix, Bubble, Webflow

• GDPR data export, account deletion, and email change with verification
• Toast + confirmation modal — replacing browser alert/confirm everywhere
• Prometheus /metrics endpoint, structured JSON logs (pino), OpenTelemetry tracing
• Husky + lint-staged + commitlint + Dependabot + Renovate + gitleaks
• Public /security page with bug bounty + responsible disclosure

• Affiliate / referral program (20% commission, 30-day cookie)
• Welcome email queued via BullMQ on every sign-up
• Free trial (14 days) + annual billing + Polar-handled VAT/sales tax
• Public /status page with live API health snapshot
• OpenAPI 3.1 spec at /openapi.json + Swagger UI at /docs
• Sentry error reporting (API + Next.js)

• Admin tools: tenant list, suspend/restore, refund, impersonation
• Visual workflow editor (drag-drop nodes)
• Image optimization pipeline (sharp + on-the-fly resize)
• i18n framework (next-intl) — English + Turkish scaffolds
• Playwright E2E tests for sign-up → first project flow
• DPA + sub-processors legal pages

• BullMQ-backed job queues with retry (webhook delivery, email, workflows)
• Per-tenant Redis-based rate limiting (sliding window)
• Custom domain DNS verification + Let's Encrypt automation
• Production runbook + DPA draft

• Full Postgres relational migration (24 stores, 33 tables)
• Drizzle ORM + automatic migrations on boot
• Removal of JSON snapshot system