CHANGELOG.md

Rama main · réplica de lectura del repositorio original.

# Changelog

All notable changes to BitRiver Live should be documented in this file.

The format is inspired by Keep a Changelog and the project follows the SemVer policy described in [`docs/versioning.md`](docs/versioning.md).

## [Unreleased]

### Changed

- Qualified React/React DOM 19.3.0 and HLS 1.7.3 with a portable Windows/Alpine
  viewer lockfile. Controlled metadata-only HLS transport fixtures and explicit
  playlist-failure/retry coverage remove proven browser-test races without
  changing the real player, capability assertions or zero-retry CI policy.
- Qualified immutable QEMU 4.4.0, Buildx 4.4.1 and build-push 7.4.0 action pins
  with a cross-workflow guard; release-only execution remains a candidate gate.
- Corrected release references to identify RC22 as historical/rejected and
  distinguish patched successor preparation from publication or stable approval.
- Added a manual no-checkout Ubuntu 24.04 host-qualification workflow for
  signed public candidates, including package/systemd/Docker lifecycle,
  authenticated OME and restart recovery, retained-data uninstall, and
  sanitized evidence with explicit XOA/NPM limitations.
- Replaced pre-release-only onboarding with current RC13 download, Docker
  Desktop, Ubuntu package, first-stream, Nginx Proxy Manager, and recovery
  guidance backed by the published artifacts.
- Removed the unimplemented GitHub Pages viewer path and aligned public docs
  with the Node 24 / Next.js 16.2.11 release baseline.
- Cleaned up tracked temp files and release-evidence logs so the repository reads like a public project instead of an internal working directory.
- Added public collaboration and governance surfaces: `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, issue templates, and a PR template.
- Reworked the root README around an honest first-success path, explicit support boundaries, and a simpler architecture overview.
- Added `SUPPORT.md`, issue-template contact links, and clearer maintainer-priority guidance so newcomers can tell where to ask for help and what the project actively supports.
- Tightened the top of `docs/quickstart.md` so install paths, expected first success, and supported scope are clear before the advanced operator details begin.
- Corrected public GitHub repository URLs in packaging/docs metadata and clarified release-stage wording so the public release surface reads consistently.
- Fixed a stale quickstart link in `web/viewer/README.md`.
- Replaced dated internal release-check reports with a cleaner release-notes layout under `docs/releases/`.

### Fixed

- Corrected the VOD upload implementation guide to describe shipped validation,
  recording publication, retries and cleanup, with actual operator limitations.
- Upload creation now rejects client-supplied storage references and media
  capabilities, preventing newly forged cross-owner raw-source reads/deletes.
  Invalid multipart requests clean up their pending file immediately. Both JSON
  and multipart integrations must omit the four server-managed fields listed in
  [the upload security boundary](docs/security.md#upload-source-ownership-boundary);
  upgraded instances need a provenance review of existing upload references.
- Pinned the viewer's transitive Handlebars tooling dependency to 4.7.10 for
  critical JavaScript-injection advisories. Nested lock copies are checked;
  existing audit thresholds remain unchanged and published candidates need
  separate qualification.
- Creator setup browser qualification now controls the simulated encoder state
  explicitly, so background polling cannot skip its offline-state assertions.
- Production Go dependency `golang.org/x/crypto` now requires patched v0.55.0
  after critical CVE-2026-56854 invalidated RC22 for stable promotion.
- Viewer dependencies now require Next.js/ESLint config 16.3.8 and
  brace-expansion 5.0.12. A provenance-preserving local braces fork bounds
  nesting and validates ASTs for the unpatched tooling-only advisory; its
  attack/compatibility tests and removal review are documented in dependency
  policy. The successor must still pass blocking release scans.

## [v1.2.3-rc.13] - 2026-08-03

### Added

- A deterministic signed `bitriver.release-set/v1` root covering every public
  payload, five exact image digests and signature bundles, SBOMs, dependency
  pins, sanitized workflow evidence, and remaining external gates.
- A protected stable-promotion transaction that can copy one accepted
  candidate byte-for-byte without rebuilding it, plus signed rollback metadata
  and append-only candidate revocation.

### Changed

- Candidate tags are now the only build inputs. Stable tags and `latest` cannot
  be produced by the candidate workflow.
- Release consumers can verify one exact root before selecting packages or
  image digests; stable promotion refuses incomplete, cross-candidate, revoked,
  or mismatched evidence.

### Verified

- All 46 public assets were downloaded and matched their server-reported and
  published SHA-256 values; `CHECKSUMS.txt` covers the other 45 assets.
- Checksum-matched Cosign v3.1.2 verified the release-set root and five exact
  GHCR image signatures against the RC13 tag workflow identity.
- Anonymous pull-only deployment passed real 1080p RTMP, decoded OME and
  transcoder media, offline transition, chat/moderation, VOD, and aggregate
  health in release run `30795492882`.

See [`docs/releases/v1.2.3-rc.13.md`](docs/releases/v1.2.3-rc.13.md) for the
signed-root identity, install entry points, and remaining target-host gates.

## [v1.2.3-rc.12] - 2026-07-31

### Fixed

- Release packages and launcher archives now stamp the exact immutable
  candidate tag into all five first-party image defaults. RC11 packages named
  unpublished stable `v1.2.3` images and should not be used for a first-time
  package installation.

### Added

- Public checksum-covered binaries, launcher archives, Linux `.deb`/`.rpm`
  packages for amd64/arm64, a Windows MSI, a Homebrew formula, signatures, and
  software bills of materials.
- Anonymous multi-architecture images for the API, viewer, SRS controller,
  transcoder, and OME configuration helper under `ghcr.io/prohibitedtv`.

### Verified

- Package install/inspect/remove on Ubuntu 24.04, Debian 12, and Rocky Linux 9.
- Pull-only tagged deployment with bounded OME startup and an eight-stage gate
  covering RTMP, decoded live media, offline transition, chat/moderation, VOD,
  and aggregate status.
- A 33-asset public prerelease with 32 checksum entries covering every other
  asset and retained passed publication scans bound to commit `3a9572f0`.

See [`docs/releases/v1.2.3-rc.12.md`](docs/releases/v1.2.3-rc.12.md) for install
entry points, evidence boundaries, and known limits.

## [v1.2.3] - Planned public release

### Highlights

- Operator-managed single-host live-streaming stack with a Go control plane, Next.js viewer, SRS ingest, OvenMediaEngine playback, FFmpeg-based transcoding, Postgres, and Redis.
- Canonical deployment contract built around the repository-root `.env` and `deploy/docker-compose.yml`.
- Source-based quickstart, packaged launcher workflows, multi-platform release artifacts, and CI/release automation.
- Operator docs for quickstart, upgrades, security hardening, monitoring, and release execution.

### Notes

- This changelog entry is the current public-release draft and should be finalized when the tag is published.
- Release-specific operator steps should be captured in the matching note under `docs/releases/`.