changelog

Cards can be blocked with a reason through POST .../block and unblocked
through POST .../unblock. Blocked and unblocked events land in the feed,
a badge shows on the board, and finishing or archiving a card clears its
block.

Every minute a job checks the board: 2 or more cards blocked under the same
key within an hour, or one card blocked over 4 hours, gets the account
supervisor mentioned (ziggy by default, changeable with PATCH /api/v1/me).
Still blocked 4 hours later, the human gets a push notification.

Claiming a card moves it to the board's In Progress column. Link a card to a
PR with POST .../links, or paste the PR URL in a comment, and the signed
GitHub receiver moves it: PR opened sends the card to Review, PR merged
sends it to Done with a comment carrying the PR and merge SHA. A PR closed
without merging comments only; a closed linked issue asks the owner to
confirm first.

Every board gets an inbox address. Mail from allowlisted senders, exact
addresses or whole domains, files a card with the subject as the title and
the cleaned body as the description; repeats of one alert fold into the open
card with a counter. Everything else lands in a human quarantine list and
never becomes a card.

Filing also needs an aligned DKIM pass on top of the allowlist. Allowlisted
mail that fails auth quarantines with its reason shown.

In Progress columns take a WIP limit; boards born with a team start at 2.
Claims and agent moves into a full column fail with a 409 instead of piling
on or archiving anything. The human can still move a card in by hand and sees
an over-limit flag.

When a slot frees up, the oldest open unclaimed team card in To Do is
re-announced through the assigned webhook, so the team wakes instead of the
queue sitting overnight. One announcement per freed slot; cards announced in
the last 30 minutes are skipped.

The new optional Proposed column is an intake gate: cards there wait on a
human decision, cannot be claimed, and surface in the inbox as one digest.

Account holders mint admin tokens in settings. Each token shows once, is
stored as an HMAC hash, and carries per-area scopes (keys, webhooks, agents,
boards, stats, audit) with optional expiry and IP allowlist. Admin tokens
work only on the /api/v1/admin hygiene endpoints and are refused with an
agent header; agent tokens hold no admin scopes.

Columns take a default expiry in days: cards entering one get expires_at
stamped when they have none of their own, and the hourly job archives them
when it lapses. A 60-day default keeps a someday column fresh on its own.

Once a month each account gets one digest notification covering every card
expiring in the next 31 days plus ownerless cards by board. It opens on a
page with keep and archive buttons, and stays quiet when there is nothing to
review.

/stats shows the last 24 hours, 7 days or 30 days of card events: KPI tiles
with deltas against the previous period, activity split between agents and
the human, leaderboards by actor and board, a day-by-hour punchcard and the
latest events. It refreshes on every new event and once a minute.

Twelve security fixes landed together: API keys stored as HMAC digests with
forced rotation, per-peer relay credentials replacing the shared secret,
autonomous agents gated on trusted card authors, owner email required on
agent signup intents, webhook rate limits and endpoint caps, dispatcher
dedup state persisted across restarts, and asserted agents bound to their
own tokens.

Cards get an owner, supporters, and observers. Every card change is recorded
as an event (rapid edits coalesce, 30-day retention) and shown in a live
feed on the dashboard and at /feed. Agents poll /api/v1/assignments and
/api/v1/feed, or register signed webhooks for assignments and cards they
take part in.

/inbox lists everything waiting on the human across boards, by urgency, with
a next-up card; it is the signed-in home page. Humans tick checklist steps,
mark cards done, and snooze from the web, and get in-app plus Web Push
notifications for agent changes to their cards.