Changelog

Product updates, newest first. Follow the repo on contact Ruligent for commit-level detail.

July 2026 — Teams, workflows, and hardening

• Team seats: invite people to your organization with admin or member roles. Invite tokens are shown once, bound to the invited email, expire in 7 days, and are revocable. Seats per plan: 1 (Free, Founder), 3 (Operator), 10 (Business), custom (Enterprise).
• Roles that fail safe: members can read everything, resolve approvals, run venture tasks, and activate kill switches; only admins can manage policies, keys, billing, webhooks, and org settings — or turn a kill switch back off.
• Workflow chains: run validate_and_plan, repo_improvement, or launch_prep as one pipeline. At autonomy level 3+ each completed step triggers the next; approval-gated steps always pause for a human. At level 4, approved tasks now resume without a second click.
• Report sharing: opt-in public pages for venture reports at /share/r/<slug> — revocable at any time, excluded from search indexing.
• Webhook retries: three inline attempts with backoff, then hourly retries up to six total before a delivery is marked dead. Full delivery history in Integrations.
• Webhook SSRF protection: webhook URLs pointing at private or internal hosts are refused (privately deployed deployments can opt out).
• Scheduled maintenance: an hourly authenticated cron now sweeps audit retention, overdue approvals, expired sessions, and webhook retries — no longer only lazily on request.
• Stricter page security: a same-origin Content-Security-Policy now ships on the marketing site and dashboard, not just API routes.
• "Guarded by Ruligent" badge for projects that route agent actions through Ruligent — snippets in the docs.

July 2026 — Venture Mode

• Projects & command center: create a project from an idea, a repository, or an existing business; the overview shows tasks, pending approvals, reports, top risks, and month-to-date agent spend.
• 7 agent roles: Validation, Product, Engineering, Design, Launch, Growth, and Operations — analysis and drafting in v1. Agents draft; you decide.
• Autonomy levels 0–4 per project, from Advisor (suggest only) to Autonomous (execute within strict policies). Level 5 is restricted until enterprise approval. External communication, spend, destructive actions, and production deploys always require a human approval, at every level.
• Task engine routed through the guard: every execution is a guarded, audited event (agent venture:<projectId>, tool venture.<role>.<kind>) — org policies, kill switches, spend limits, and the audit trail apply exactly as for any external agent.
• Project memory: record decisions, preferences, and rejected ideas; agents honor them, and you can view or delete every entry.
• Read-only repository analysis: structure, manifests, docs, tests, CI, and license via the GitHub API — never writes to the repo.
• Launch-readiness scoring: deterministic checks across 10 categories computed from real project and org state; levels from NOT_READY to PUBLIC_READY. No LLM involved.
• Fail-closed LLM tasks: without an ANTHROPIC_API_KEY, document tasks return llm_not_configured — nothing is fabricated.
• New pricing: Free ($0), Founder ($49/mo), Operator ($199/mo), Business ($499/mo), Enterprise (custom). Legacy Pro/Starter orgs resolve to Founder and Team to Operator, keeping their existing Stripe price.

July 2026 — Launch preparation

• Plan tiers introduced with hard-stop limits and no metered overage. This lineup was superseded in August 2026 by the current Founder / Operator / Business pricing; orgs on legacy plans keep equivalent-or-better limits automatically.
• Active-policy caps and audit retention are now enforced per plan, with clear policy_limit_exceeded errors and automatic retention purging.
• Policy simulator: dry-run any hypothetical agent/tool/action call against your current policies without creating an audit event.
• JSON audit export alongside CSV (Business plan).
• Marketing site, docs hub, security overview, and legal pages shipped.
• Security hardening: strict security headers and locked-down CORS on all responses.

June 2026 — v0.1.0: the core gateway

• Guard endpoint (POST /v1/guard): kill switch → spend limits → policy rules → default effect, with explainable structured decisions and idempotency keys.
• Policy engine: priority-ordered allow / block / require-approval rules, glob matching on agent/tool/action, cost floors, per-rule rate limits, risk levels.
• Approvals: approval queue with 24-hour expiry, reviewer identity, notes, and webhook events.
• Audit events: append-only decision log with filtering and CSV export.
• Spend limits: day/month USD caps at org, agent, and tool scope; approved calls count toward spend.
• Kill switches: org-wide, per-agent, and per-tool.
• Signed webhooks: HMAC-SHA256 with per-endpoint secrets and delivery history.
• Developer access: REST integration is available now; package publication remains gated until Ruligent namespace ownership is verified.
• MCP gateway: stdio proxy that guards tools/call for any MCP server, fail-closed.
• Dashboard: overview, agents, activity, approvals, policies, spend, kill switch, integrations, billing, settings.
• Storage: Postgres (Supabase-ready) with SQLite fallback for local development.
• Billing: Stripe Checkout with signature-verified webhooks; simulated checkout in development.