> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vinmake.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Releases

> What shipped, newest first, with the defect each change closed and the page that documents it.

# Releases

Every entry here is a merged pull request across the two GreatBook repositories, dated by its merge.

<Info>
  **Status legend:** 🟢 **Live** · 🟡 **In Development** · ⚪ **Planned** · 🔵 **Future**
</Info>

Most of these are labelled `fix`, and that is not a sign of instability.
Each one is an adversarial review or a live run finding a way the book could be **wrong while balancing**, which is the only class of defect a ledger cannot detect for itself.

***

## 2026-08-09 - honest finance surfaces and canonical settlements 🟢

**web [#55](https://github.com/vinmaketeam/worthstate-ui/pull/55)–[#58](https://github.com/vinmaketeam/worthstate-ui/pull/58)** - *smallest-scope refusal, exact list authority, and a read-only settlement record*

* one shared trusted-response layer now keeps malformed evidence unavailable at field, row, cluster, page or view scope instead of inventing, hiding or reassuring around it
* Typewriter Documents, Review, Accounting Analysis, Audit, Files, Planning and Ledger consume server-owned totals, deterministic ordering and continuation, preserve unreadable rows, and require request-bound evidence before accepting a mutation
* `/books/settlements` reads the canonical payment/receipt register, immutable journal link, matching, allocations and provenance; it deliberately publishes no browser approval or execution path
* contradictory authorization evidence is quarantined without hiding the settlement, and valid cross-currency mismatches remain readable with the reason they cannot be totalled

Documented on [Trusted responses](/greatbook/features/trusted-responses) and [Canonical settlements](/greatbook/features/settlements).

## 2026-08-09 - bounded public MCP transport 🟡

**backend [#108](https://github.com/vinmaketeam/worthstate/pull/108)** - *harden the transport without activating it*

* a 256 KiB limit is enforced against both declared and streamed request size before authentication work proceeds
* synchronous tools run in a bounded eight-worker pool under one default 30-second end-to-end deadline, with sanitized overload and timeout failures
* rate limits are process-shared and the deployment runs four Uvicorn workers

At that release cut, the code was merged but public ingress, OAuth clients, identity bindings, provider trust and production ChatGPT/Claude connections were not active.
Public ingress was activated later and initially advertised registry `1.8.0`.
Registry parity was then restored at `1.14.1`; provider behavior remains unexercised.
See [MCP ingress and client status](/greatbook/greatbook/mcp-connection-and-ui).

## 2026-08-08 - bounded Clerk retrieval, Files continuation and the capability safety survey 🟢

**backend [#105](https://github.com/vinmaketeam/worthstate/pull/105)–[#107](https://github.com/vinmaketeam/worthstate/pull/107)**

* At this release cut, Clerk procedural retrieval read structured Cognee chunks under one bounded deadline; backend #133 later replaced that SOP path with the deterministic Git-rendered in-process index
* Files publishes server-owned offsets so every row remains reachable without a browser-invented continuation
* all 59 registry-blocked capabilities are classified against six guarantees, leaving 10 adapter candidates, 41 requiring named work and 8 explicit must-not-build outcomes at the survey's evidence cut

Documented on [The Clerk](/greatbook/agents/clerk), [Files](/greatbook/features/files) and [Why blocked capabilities stay blocked](/greatbook/greatbook/blocked-capabilities).

## 2026-08-03 - fail-closed reads and registry-projected MCP prompts 🟡

**backend [#100](https://github.com/vinmaketeam/worthstate/pull/100)–[#102](https://github.com/vinmaketeam/worthstate/pull/102)**

* statement failures are typed unavailable results rather than zero-valued reports, and customer-facing lists carry server-derived totals and continuation
* MCP `prompts/list` and `prompts/get` project only current, capability-executable and role-authorized skills from the authoritative registry; they do not create a second command catalogue
* Claude joined ChatGPT in the closed provider allowlist and exact-provider evidence gates

The provider migration deliberately created zero OAuth clients and zero trusted bindings.
Neither provider connection nor any connector was activated by these changes.
Documented on [Trusted responses](/greatbook/features/trusted-responses) and [MCP ingress and client status](/greatbook/greatbook/mcp-connection-and-ui).

## 2026-07-31 - final GreatBook accounting release 🟢

**backend #78–#84 · web #39–#41** - *exact replay, complete business mechanics, serialized Close, typed reversals and schema-owned currency*

* a journal source key now replays only exact immutable facts; versioned checksums preserve historical interpretation and current entries are permutation-invariant over complete line facts
* every owned AP/AR control writer pairs the control leg with its canonical obligation; foreign loan movements retain exact journal-line base evidence; factoring, PIT remittance and inventory adjustments keep their native business truth
* Close and supported accounting mutations share one organization lock, and a successful close certifies the exact journal tail, workpaper state and Books/finance authority fingerprint it rechecked under that lock
* a named human can use the checksum-bound HTTP reversal boundary for supported AP/AR, settlement, inventory/costing, payroll, loan, tax/VAT and adjustment events; unsupported or partial native state writes no GL-only mirror
* all 27 currency-bearing document schemas use the same 307-value uppercase ISO 4217 contract in Typewriter create/revise and staged review
* the final UI treats a lost decision response as unknown until canonical reread, exposes audit-read errors instead of false-empty evidence, keeps money in its reported currency and surfaces revision filing outcomes

The exact backend and UI cuts are live on GreatBook's canonical production target after the reset, demo reseed, accounting controls and UI cutover passed their release gates.
At that release cut no web UI action or MCP tool was claimed for typed business reversal; later web PRs #48 and #51 added source-screen staging and the registry v1.8.0 release added typed MCP staging through the shared staged-workspace resource, while production ChatGPT/Claude activation remains separate.

Documented on [Immutability and typed reversals](/greatbook/capabilities/immutability-and-hash-chain), [Fiscal periods and closing](/greatbook/capabilities/periods-and-close), [Money and supported currencies](/greatbook/capabilities/money) and [GreatBook workspaces](/greatbook/guides/greatbook-workspaces).

## 2026-07-31 - Accountant Wave D/F and read surfaces 🟢

* the period-scoped `close_gated` Auditor family and monthly `last_closed` job preserve open/missing/unevaluable periods as inconclusive and keep findings scoped to the period that produced them
* `DEPR-COVERAGE` requires one in-period charge for each positive-cost asset in service and still inside its useful-life window; dateless assets remain named inconclusive coverage
* Accounting Desk Allocations, Costing and Adjustments reads preserve exact decimal strings, stable journal links, paging and explicit empty/partial/error states

Documented on [The Accountant](/greatbook/agents/accountant), [GreatBook workspaces](/greatbook/guides/greatbook-workspaces) and [The Close checksums](/greatbook/capabilities/close-list).

## 2026-07-31 - the comprehensive GreatBook capability ontology 🟡

**backend #73 plus the typed reversal release, superseded by registry `1.14.1`** - *116 stable outcomes across 26 domains in the pinned source*

* 98 current, seven experimental, one queued, two deprecated and eight forbidden capability records
* current product behavior, executable MCP adapter, declared Apps resource and ordinary deep link recorded as separate facts
* 46 outcome records executable through 32 shared typed tools, distinct from the 50-tool release-source transport and 18-resource inventory (17 MCP Apps plus the JSON skill registry)
* deterministic coverage against DevCenter routes, five agent workflows, GreatBook web navigation and the pinned public documentation
* generic SQL, HTTP, route and finance writers plus model-selected authority remain explicit forbidden outcomes

The registry and MCP foundation are merged; transport hardening later merged in backend PR #108, while promotion, external identity, scope and administrator inputs remain release gates.
Public OAuth/MCP ingress initially advertised registry `1.8.0` and is now current at `1.14.1`; ChatGPT and Claude behavior remains unexercised end to end.

Documented on [Capability lifecycle and anti-drift](/greatbook/greatbook/capability-registry) and [GreatBook through MCP](/greatbook/greatbook).

## 2026-07-31 - typed staged-domain adapters 🟡

**backend #72** - *commit reviewed outcomes through named canonical services*

* W3 Matching accept/reject/undo
* Typewriter approve/submit
* adjustment approve/reject
* fiscal close/reopen
* the existing guarded workflow resume

Every adapter binds an exact target version, verified human/organization/role, canonical validation, idempotency, audit evidence and reversal or compensation to the staged workspace's exact-revision single-use confirmation.
No generic writer was introduced.
At that release cut, merged code was not a claim that the production MCP connection was active.
Public ingress was activated later, initially advertised registry `1.8.0`, and is now current at `1.14.1`.
It has not been exercised through ChatGPT or Claude.

Documented on [GreatBook workflows and guarded actions](/greatbook/greatbook/workflows-and-guarded-actions).

## 2026-07-27 - one model of the same transaction 🟢

**backend #14** - *the reconciliation knowledge graph and the `recon` check family*

GreatBook's records for one transaction live in several systems at once, and nothing in a relational schema said those rows were one thing.
So "is this the same bill, and which copy is the document of record" had no query behind it.

* a generated **concept ontology** - 16 concepts and 13 relations, built from the document registry rather than authored twice - checked into git and pinned to the database's own `CHECK` constraints by a test
* an **instance graph** in Postgres under org-scoped RLS, projected from the GL and intake every three hours, idempotent by fingerprint and never deleting
* asserted **edges** and proposed **links** kept in separate tables: an edge is a fact a writer already committed, a link is a proposal that names the rule which made it
* a fourth Auditor check family, `recon`, which reports **inconclusive** rather than clean over a graph older than six hours
* the control-account tie reuses the Accountant's own `AP-CONTROL` / `AR-CONTROL` Close checksums rather than re-deriving the comparison

Documented on [The reconciliation ontology](/greatbook/capabilities/reconciliation-ontology) and [The Auditor](/greatbook/agents/auditor).

## 2026-07-26 - the currency on every line 🟢

**backend #11** - *state the document's currency on every posted line*

A 1,000 USD bill posted 1,000 dong: balanced, hash-chained, in an open period, and **tying**, because the AP obligation was derived from the same wrong number.

The engine could always do this correctly - it resolves the rate as of the entry date and refuses when the book holds none - it was simply never handed a currency, and an absent currency is not "unknown", it is an assertion that the amount is already in the base currency.

* every posted line now states its currency, and **no** line states a rate: the rate is the engine's to resolve inside the posting transaction
* a localised spelling resolves through an alias table (`₫`, `VNĐ`, `đồng` → VND, accent- and case-blind), an ISO-shaped code is upper-cased, and anything else raises at propose time rather than being read as the base currency
* a bare `$` was deliberately **removed** from that table: five currencies print it, and a guess that is right most of the time is the worst kind on a money path
* a foreign obligation with no base-currency amount is now refused outright

Documented on [FX is as-of-date](/greatbook/capabilities/fx) and [Payables and input VAT](/greatbook/gl/rules-payables).

## 2026-07-26 - input VAT splits onto 1300 🟢

**backend #9** - *split recoverable input VAT onto account 1300*

A supplier VAT invoice put its whole gross into inventory: no input-VAT asset, and a VAT return with nothing to declare.
It balanced, so nothing caught it.

* a payable now posts **three** legs: `Dr <coded> net / Dr 1300 VAT / Cr 2000 gross`
* the **gross is the anchor** and the net is derived, so the entry balances however the document was written
* the VAT is **read** from a stated amount or from `gross - net`, never inferred from a rate
* a triple that does not add up raises and posts nothing
* the `tax_entries` register line travels with the leg in the same transaction, so GL `1300` stays tied

Documented on [Payables and input VAT](/greatbook/gl/rules-payables) and [VN VAT and statutory tax](/greatbook/capabilities/subledgers/vat-statutory).

## 2026-07-26 - a written amount is the number its schema declares 🟢

**backend #10** - *typewriter numerics*

Magnitude suffixes are refused, leading-zero grouping is fixed, and a written amount is read as the type its schema declares rather than coerced.

## 2026-07-26 - the review page tells the truth 🟢

**web #12** - *a review deep link opens the document it names*

Six defects found by an adversarial review of the usage guide **on the live app**, each reproduced before it was fixed.
The worst was not cosmetic.

* a `/books/review` deep link matched only the selected tab's rows and **fell back to the first row**, so "open in review" could land on a different, real, actionable document with live Approve and Reject controls and no message anywhere. It now resolves against the whole queue, moves the tab to one that shows the row, and confirms an unknown id directly - an id the backend refuses selects **nothing** and shows a by-id banner
* "Send back" was rendered enabled on every non-terminal row while the server accepts only a `flagged` row, so on every composed document it was a guaranteed conflict whose error named an internal verb. The control now mirrors the server's own rules and renders **disabled with a reason**
* Refresh used to re-read the list but not the record on screen; it now refreshes the selected row, posting gate and trail while preserving a half-typed rejection reason
* the review page printed raw UTC while other pages printed the same instants in local time - one event, two times, seven hours apart
* a bare `$` appeared against dong figures, about 25,000× off at face value. Money now goes through one formatter, reads the base currency the endpoint returns, and renders `BASE` rather than dollars when the currency cannot be read
* the approval trail showed a time and a dot and named nobody, on the one page whose purpose is "who signed this". Completed steps now carry approver identity and time; the UI shows the resolved identity or the recorded stable user id rather than guessing

Documented on [The review inbox](/greatbook/guides/review-inbox) and [Typewriter documents](/greatbook/api/typewriter).

## 2026-07-26 - the Auditor answers the whole question 🟢

**backend #8** - *answer every check family a multi-part request names*

"Run a full check of the books: hash chain, accounting invariants and orphan scan" ran **two of three** families and named none of them in the reply.

* a multi-part assurance request now runs every family it names
* an all-clear over an unverified family is refused

Documented on [The Auditor](/greatbook/agents/auditor) and [Guardrails](/greatbook/agents/guardrails).

## 2026-07-26 - the AP obligation a control credit stands for 🟢

**backend #6** - *open the AP obligation a document-posted bill's control credit stands for*

Found by the **first live Close run**: the Bookkeeper posted `Dr expense / Cr 2000` and opened nothing, so GL `2000` carried a balance no bill accounted for and the AP control tie failed on every document-originated payable.

* the obligation is opened in the **same transaction** as the entry, through the backend's own single obligation writer rather than a second insert
* its base amount is read back off the **posted** control leg, so the sub-ledger and the GL cannot disagree
* a payable that names no supplier is refused
* `party_code` prefers the resolved party-master id, and the resolution outcome is recorded in the posting audit detail so fallback rows stay findable

Documented on [Payables and input VAT](/greatbook/gl/rules-payables) and [Settlement](/greatbook/capabilities/subledgers/settlement).

## 2026-07-26 - the Typewriter lane 🟢

**backend #5** and **web #10** - *the propose-only document composition lane*

* a schema-driven builder over the canonical 146-type document schema, themed into the product's own design system
* a live preview, a stored PDF whose exact bytes are hashed, a versioned documents table where a correction is a **new version** naming the one it supersedes
* an approval chain, and an idempotent hand-off into the Clerk's intake queue
* the agent lane is **propose-only**: it can draft, and it cannot file

Documented on [The Typewriter](/greatbook/agents/typewriter), [Compose a document](/greatbook/guides/compose-a-document) and [Typewriter documents](/greatbook/api/typewriter).

## 2026-07-26 - the fifth graph is graded 🟢

**backend #7** - *grade the typewriter graph and close the coverage gap that hid it*

A served graph was ungraded, and the coverage guard did not notice - which made the eval board look complete while one lane was unmeasured.

* the Typewriter lane gets its own dataset and evaluators
* the coverage guard is tightened so an ungraded served graph fails the gate rather than passing quietly
* baseline expected-failure markers are made conditional rather than blanket

Documented on [The regression gate](/greatbook/proof/regression-gate) and [The scoreboard](/greatbook/proof/scoreboard).

## 2026-07-26 - duplicates are flagged, not crashes 🟢

**backend #4** - *flag duplicate intake documents instead of crashing, and correct money-path attribution*

* a duplicate document is flagged for a human instead of raising
* the posting checker of record is read from the **journal entry**, never from the intake approver - two different people under strict separation of duties

## 2026-07-26 - per-agent SOP rulebooks 🟢

**backend #3** - *per-agent SOP rulebooks, plus duplicate line-item flagging*

Each agent's rulebook is **generated from the code that enforces it** - the Bookkeeper's account map from the posting rules, the Auditor's families from its scope, the Accountant's checklist from the close steps.

A hand-retyped rulebook drifts, and a drifted rulebook is worse than none: the agent then cites, with a citation, a procedure the system no longer follows.

Documented on [The SOP store](/greatbook/agents/sops) and [SOP versus code](/greatbook/agents/sop-vs-code).

## 2026-07-25 - the mandate-gated money path 🟢

**backend #2** - *mandate-gated agent money path over a canonical GL*

The release that made an agent able to reach the ledger at all, and the one that took five rounds of adversarial review to make safe.

* the ledger engine, its 18 GL invariants, the per-org hash chain and the event stream over the canonical schema
* the seven sub-ledgers and the generated Close control inventory, now 104 checksums, as live queries
* the Bookkeeper pausing before `post`, and the **posting mandate** that makes releasing that pause unforgeable
* source-specific separation of duties: three distinct authenticated people on document-originated postings, and a named non-agent human who did not propose an Accountant adjustment
* database-level maker-is-not-checker constraints, head-only approval, and the revocation of anonymous read

Documented on [The posting mandate](/greatbook/capabilities/posting-mandate), [Maker-checker](/greatbook/capabilities/maker-checker) and [The security boundary](/greatbook/proof/security).

## 2026-07-25 - the passthrough is scoped 🟢

**web #8** - *scope the LangGraph passthrough to the chat's own graphs and threads*

The browser could reach the agent runtime's state API through the UI's proxy.
It is now scoped to the chat's own graphs and threads, which is the layer *above* the posting mandate - the mandate is what holds if this one is bypassed.

## 2026-07-24 - the workspace 🟢

**web #1, #4, #5, #6** - *the UI, the Books workspace, and the review inbox*

* the product re-based on a chat UI with session authentication and **server-gated** finance data
* an agent-profile switcher with per-agent threads
* the Books workspace: Ledger, Transactions, Review, Reconciliation, Payments, Files, Actions
* finance pages made crash-safe against a degraded backend, so a missing table renders an empty state rather than a stack trace

## Earlier

**backend #1** - the product plan, the competitive research and the adversarial review that the whole build was specified against.

***

## What is not here

This page lists what **shipped**.
Two other pages carry the rest of the honest picture:

* [What is next](/greatbook/changelog/roadmap) - tracked and not yet done
* [The direction](/greatbook/changelog/future) - where the product is going

## Related

* [What is live](/greatbook/status) - the current status board, component by component
* [The GL pipeline](/greatbook/gl/roadmap) - the ledger's own roadmap in detail
* [The security boundary](/greatbook/proof/security) - what has been attacked, and what held