Changelog

What shipped, and when. Each release lists what changed and its testing record.

2026-10-22 — The operator, named in the body

The About, Contact, and Privacy pages now name the operating company — 2351485 ALBERTA INC. (AIMLDS), Calgary, Alberta, Canada — in their body text, not only in the footer seller strip: About says who builds and operates LetsAskIt, Contact says who you are writing to, and the Privacy Policy names the operator as the data controller.

Testing: content-only change to three pages plus this entry. Release-gate scan on the release tree: PASS_WITH_FINDINGS (0 secrets, 0 must-gate failures, 0 known vulnerabilities — the same standing disposition as the 2026-10-22 billing release). Live read-back of all three pages follows the deploy and is recorded in the operations log.

2026-10-22 — Stripe billing is live

The paid plans now run on live Stripe. LetsAskIt Pro ($19/month) and LetsAskIt Team ($79/month) are live products on the AIMLDS Stripe account — the seller of record is 2351485 ALBERTA INC. The billing worker holds a live restricted Stripe key scoped to exactly what it needs (creating checkout sessions and reading subscriptions back), and a live webhook endpoint delivers subscription events to the worker so entitlements switch on and off automatically. Until today the billing rail ran in Stripe test mode while this cutover was staged and proven; no customer was ever charged against the test rail.

This release also updates the ip-address library (10.7.2 → 10.7.4) in the dependency lockfile, clearing a newly published advisory (quadratic-time parsing of a malformed IPv6 zone identifier). The library reaches this project only through the MCP SDK’s optional Express transport, which LetsAskIt does not use — verified absent from the shipped worker bundle — and the update is taken anyway so the tree carries no known advisory.

Testing record. This step changes configuration, not code — the billing code itself shipped earlier under the release gate. Behaviour proof on the live rail, leg by leg: the public discovery document reports live mode; a Pro API key is refused at the MCP endpoint (403 — MCP is a Team feature) and a revoked key is refused outright (401); creating a checkout for the Team plan returns a live Stripe checkout session; an unsigned webhook call is rejected (401). The entitlement cycle was then proven live at $0: a trial Team subscription created in the live account was delivered to the worker, signature-verified, recorded as an active Team entitlement (grant), and cancelling it was delivered and recorded the same way (revoke). The test subscription and test customer were removed after the proof; $0 was charged at every step. The full real-money cycle — card payment, grant, cancel, revoke, refund — stands proven on this account’s shared billing pattern (codetopo, 2026-10-18) and in LetsAskIt’s own sandbox cycle (2026-10-14); under the fleet’s proof standard it is not re-run per product. Release state: billing cutover complete and in effect. The running code batch remains the 2026-10-21 release candidate in its one-week soak (window to 2026-10-28).

2026-10-21 — Purchase confidence on every page

Every page on this site now carries the same transaction strip in its footer: who you buy from (2351485 ALBERTA INC., operating as AIMLDS), that Stripe processes payments, and one-click routes to Pricing, Terms, Privacy, this release log, and Contact. The pricing page gains a “Buying, in plain terms” section stating the seller of record, what a subscription is licensed to (your API key), how refunds work, and where the privacy policy and this log live. The transaction items are identical on every surface; only the product, its licence, and its prices vary — the same standard applies to every AIMLDS product’s buying pages.

This release also updates the hono web framework (4.13.9 → 4.13.13), clearing a newly published advisory (GHSA-5r4p-p66f-jhc7: a path-decoding bypass in its static-file helper). LetsAskIt does not use that helper — the site is served by the hosting platform, not the worker — and the update is taken anyway so the shipped framework carries no known advisory.

Testing record. Release gate verdict on this release: PASS WITH FINDINGS — machine scan clean (no secrets, no must-gate failures, no known vulnerabilities after the framework update); the carried finding is the standing set of development-only dependency vulnerabilities (via the local dev emulator; they do not ship to customers), watched by an audit step in CI. Unit/integration suite: 131 tests, all passing, including the billing and checkout regressions. Live proof on deploy: the transaction strip and the plain-terms section were read on the served homepage, pricing page, and Studio page, and every link in the strip (Pricing, Terms, Privacy, Releases, Contact) resolves. Release state: RELEASE CANDIDATE — this batch runs live under watch from 2026-10-21 and earns the word “release” after a clean one-week soak (window to 2026-10-28).

2026-10-15 — Transport, history & hardening (release-gate re-run findings)

The 2026-10-15 release-gate re-run of the product as a whole returned six findings below the critical line. All six are fixed in this release:

Testing record. Release gate verdict on this release: PASS WITH FINDINGS — machine scan clean (no secrets, no must-gate failures); the carried finding is the same set of development-only dependency vulnerabilities (via the local dev emulator; they do not ship to customers), watched by an audit step in CI. Unit/integration suite: 131 tests, including new regressions for the private-address rules (31 address cases), the host checker, and the shaped checkout failure. Live proof on deploy: the HTTP address redirects to HTTPS with the HSTS header present, a bogus /.well-known/ address returns 404, and the Studio history flow (create a job, reload, re-open it from the list, delete it from the list) was completed in a real browser. Release state: RELEASE CANDIDATE — this batch runs live under watch and earns the word “release” after a clean one-week soak.

2026-10-14 — Ownership & privacy fixes (release-gate findings)

An independent release-gate review found that voice profiles and jobs were not properly fenced per customer. This release fixes that family end to end:

Testing record. Release gate verdict on this release: PASS WITH FINDINGS — machine pass clean (no secrets, no must-gate failures); the one carried finding is a set of development-only dependency vulnerabilities (via the local dev emulator; they do not ship to customers) now watched by an audit step in CI. Unit/integration suite: 126 tests, including new ownership regressions for each finding above. Live proof: the gate's probes were repeated against production — anonymous profile lists come back scoped, foreign profiles cannot be used or deleted, foreign jobs cannot be read, per-browser free quotas are separate — and the full Studio journey (create a voice profile, create a pack, delete the job, delete the profile) was completed by clicking through the live page as a new customer.

2026-10-14 — Repository consolidation & reviewer follow-ups

Production had been shipping from release branches while the repository's main line waited on a CI billing fix. That fix landed, and the full stack (server card, Stripe billing, and the ownership/security release below) is now merged into main and deployed from it — so what is in the repository is exactly what runs. Three follow-ups from the independent re-run of our release gate are also closed:

Testing record for this release. Gate verdict (machine scan + deep review): pass with findings — the only findings are the already-dispositioned development-only dependency advisories (production dependency audit is clean and gates every deploy). The independent gate re-run confirmed all 13 findings from the security release below as solved on the live product. Test suite: 128 passing, 0 failing, including the new regression test. CI green on every merge; post-deploy probes on the live site: health OK, the MCP endpoint refuses unauthenticated calls, and the billing webhook refuses unsigned posts.

2026-10-14 — Paddle teardown complete

The old Paddle presence is fully closed: the LetsAskIt Pro and Team products are archived in both the live and sandbox Paddle accounts, and both Paddle webhook destinations to this site are deactivated. Nothing Paddle remains connected to LetsAskIt. (This also retires the old Paddle webhook secrets noted during the Stripe release's security review — with the destinations deactivated, those secrets no longer authenticate anything.)

2026-10-14 — Stripe billing rail

Billing

Testing record: 126 automated tests pass (typecheck + lint clean), including Stripe cases for signature verification, the subscription lifecycle, automatic key granting, checkout-session binding, and event-ordering. Release gate: PASS WITH FINDINGS (machine scan + deep review; the only findings are development-only dependency advisories, dispositioned — the production dependency audit is clean). Customer journey proof (test environment, completed 2026-10-14): a real subscription was created and cancelled in Stripe, and Stripe's own signed webhook events drove the whole cycle with no manual steps — the test key upgraded from Pro to Team when the subscription bound to it (the MCP endpoint went from refusing the key to accepting it), and reverted to Pro and unlinked when the subscription was cancelled. The hosted checkout page leg is covered by the automated suite and will be re-proven end-to-end when the account's live mode is activated.

v0.4.0 — 2026-09-27

Production launch

Earlier