> ## Documentation Index > Fetch the complete documentation index at: https://docs.riktra.com/llms.txt > Use this file to discover all available pages before exploring further. # Changelog > What changed in Riktra, newest first. ### 📋 Management Summary Riktra's MVP is feature-complete. The product now does what it set out to do: a company records what it is trying to achieve, what it has decided and who owns what, and any AI assistant an employee already uses picks that up automatically — including when the direction changes. A person opening Riktra sees a short, scannable brief of what needs them today rather than a dashboard. The central promise is verified by an automated test that runs on every change: an administrator changes the company's direction, a colleague opens a completely new AI conversation, and that conversation reasons from the new direction without anyone re-explaining it. Two things a colleague should never see — another person's private notes, and anything an AI decided on its own — are enforced by the database rather than by convention, and are covered by tests that would fail if that ever slipped. Two short configuration steps remain before a real AI client can connect for the first live demo. Both are settings changes, not development work. ### 🛠 Technical Summary Next.js 16 (App Router) on Vercel, Supabase Postgres with row-level security as the tenancy mechanism on both the web and MCP paths, and a hosted Remote MCP server built on the MCP TypeScript SDK v2 with `mcp-handler`, serving both the current specification and the 2025-era protocol that Claude clients still speak. Thirteen phases across 24 pull requests. **234 tests** — 179 integration tests running against a real Postgres as genuine signed-in users (not a privileged client), plus 55 unit tests. Twelve architecture decisions recorded as ADRs, three of them corrections to the original plan after verifying time-sensitive assumptions against current documentation. Security posture is asserted rather than documented: `security_lint()` checks RLS coverage, role-scoped policies, `search_path` pinning on definer functions and `PUBLIC` grants on internal functions, and is asserted empty in CI. That check found two live gaps during hardening. ### 📂 Detailed Changes #### ✨ New Features * Company context: goals, ranked priorities with atomic reordering, decisions with supersession chains, open questions, responsibilities, working principles, context notes, system ownership. * Today and Me: a scannable daily brief, deterministic attention detection with resolve/dismiss, and private focus and context. * Governance: a generic proposal pipeline with review inbox, batch actions and near-duplicate detection. * Meeting ingestion: paste or upload a transcript, get reviewable candidates, with a sensitivity pass that withholds personal material entirely. * Remote MCP server with twelve tools (seven read, five write) and per-user OAuth. * Skills: organization-wide AI behaviour, versioned and rollback-able, delivered through four adapters. * Getting Started, ⌘K Quick Capture with in-product guidance, Morning Focus, full-text search, Debug Context and Debug Skills. #### 🏗 Architecture * Tenancy and privacy enforced by row-level security; the Context Router does no permission filtering by design, so a bug there returns too little context rather than someone else's. * Shared-truth versioning and revision counters enforced by database triggers, so no write path can forget them. * Private records versioned separately from shared truth, because the shared trail is organization-readable. #### 🔗 Integrations * Supabase OAuth 2.1 Server as the MCP authorization server; tokens are Supabase JWTs, so RLS applies to MCP calls automatically. * Vercel AI SDK for meeting extraction, behind a provider-agnostic interface. #### 📚 Decisions * ADR-005 Skills use transport adapters, native extension flag-gated — no client consumes Skills-over-MCP live. * ADR-006 MCP serves both wire protocols. * ADR-007 Supabase OAuth 2.1 Server, with the audience claim deliberately not validated against the MCP URL. * ADR-011 Versioning by trigger, private tables excluded. * ADR-012 Protected-resource metadata served path-qualified — the documented example advertises the origin alone and fails invisibly. #### 🐞 Bug Fixes * Three instances of Swedish inflection defeating word-boundary patterns; in the sensitivity pass this would have published pay discussion into company context. * Two live security gaps: a Postgres `PUBLIC` grant left the rate limiter callable, and Supabase default privileges exposed a table intended to be internal. * Priority reordering violated a check constraint; version snapshots could not be restored once generated columns existed; skills recorded no initial version. #### ⚠️ Outstanding * Supabase OAuth 2.1 Server is disabled — no AI client can connect until it is enabled with dynamic client registration. * `app.riktra.com` needs an `A` record pointing at Vercel, DNS-only.