# Changelog New features, architectural changes and improvements to the template. Release notes are curated from repository history. Dates reflect integration into the main branch; grouped entries are not semantic-version tags. Each entry links to its implementation and current developer guide. ## aescolab demo: catalogs, results, bookings and the order pipeline 2026-10-20 The backend of the aescolab showcase with row-level security on every new table, a fictional seed and demo controls. The aescolab showcase gets its backend. Global catalogs (61 Biomarkers, three packages, 58 fictional Partner Practices and German postcode centroids) are readable signed out. Patient health data lives in the personal Organization: Result Sets stay invisible until the lab releases them, enforced by row-level security. Practice search works by postcode and radius, availability is computed in Europe/Berlin across the daylight-saving switch, and two patients racing for one slot get one booking and one conflict. The admin pipeline moves a Lab Order one step at a time and, at `results_ready`, releases the results, writes the plan and a Result Notice; admins see metadata only. The seed loads everything fictional, idempotently and relative to the run, with exactly two sign-in accounts. `DEMO_MODE` enables the demo controls. - [aescolab demo backend](/docs/features/aescolab-demo) - [ADR-0014: health data tenancy and global catalogs](/docs/adr/0014-health-data-tenancy-and-global-catalogs) ## aescolab demo: the web portal, finder, booking, import and pipeline board 2026-10-20 German patient portal with the Energy Score, a practice finder with real booking, lab-PDF import with AI or rules, and the admin pipeline. The aescolab showcase gets its web screens. Patients see their Energy Score as an A–E gauge with the change since the last test, every value with its reference and optimal range, a trend per Biomarker, a retest comparison and a plan whose summary names the engine that wrote it. Signed out, anyone can search the 58 fictional partner practices by postcode and radius, open a page per practice and book a real slot; the login sends them back to the booking. A lab PDF is turned into text in the browser and parsed by the configured model (default `gpt-6-luna` for OpenAI) or the deterministic rules parser; each row is reviewed before it becomes a Result Set. Ops staff move orders through a five-lane board with buttons and can reset the demo. Details: [aescolab demo](/docs/features/aescolab-demo), [lab report import](/docs/features/lab-import). A design pass then matched the screens to aescolab.de: white pages with moss and apricot bands, Satoshi medium headings, pill buttons in apricot or gray instead of dark ones, moss labels, a light footer, and glass panels (header, score, packages) over soft brand light that turn solid when transparency is reduced; the hero entrance and hover lift stop with reduced motion. Token mapping: `docs/design-tokens.md`. ## Agent skills from upstream and the /pr template 2026-10-19 Matt Pocock's skills and pstack come from their upstream sources through the official installer, /pr joins the skills, and pull requests open with its Summary, Evidence and Merge Danger sections. Matt Pocock's skills and pstack are installed again from their sources with the official `skills` installer, so `skills-lock.json` matches what upstream ships. `pr` is new from Matt Pocock. `design-an-interface` and `resolving-merge-conflicts` are gone because upstream deleted them, and `writing-great-skills` is gone because upstream renamed it to `writing-for-agents`, which the repo already had. `domain-modeling` keeps this repo's ADR header rules and was not reinstalled. pstack adds `correct`, `in-your-own-words`, `ketchup`, `principle-attack-the-premise`, `principle-explain-the-number` and `principle-test-behavior-not-implementation`, and seven pstack skills follow upstream edits. pstack's `teach` and `tdd` stay out, so the names keep pointing at Matt Pocock's skills. A new pull request opens with the `/pr` sections: Summary (a diff sketch, file tree or pseudocode, no Mermaid), Evidence (before and after) and Merge Danger (one-way or two-way door, blast radius). The checks list below them is unchanged. The template says that a merge to `main` deploys to production and that migrations, RLS changes, secret or env changes and feature removals are one-way doors. Skills that name `GLOSSARY.md` read this repo's `CONTEXT.md`. - [Review checklist](/docs/development/review-checklist) - [Pull request template](https://github.com/CarlosZiegler/template-cloudflare/blob/main/.github/PULL_REQUEST_TEMPLATE.md) - [Domain docs for agents](https://github.com/CarlosZiegler/template-cloudflare/blob/main/docs/agents/domain.md) Sources: [Matt Pocock skills](https://github.com/CarlosZiegler/template-cloudflare/commit/680e461), [pstack skills](https://github.com/CarlosZiegler/template-cloudflare/commit/4d02247). ## Earlier updates - 2026-10-19: [Ponytail from the official plugin](/docs/changelog/2026-10-19-ponytail-plugin) - 2026-10-17: [One folder per backend feature, tagged errors and written rules](/docs/changelog/2026-10-17-backend-structure) - 2026-10-17: [One folder per mobile feature, and the API aliases are gone](/docs/changelog/2026-10-17-mobile-structure) - 2026-10-17: [The web app is organized by feature, like the backend](/docs/changelog/2026-10-17-web-structure) - 2026-10-16: [Auth and tenant security fixes](/docs/changelog/2026-10-16-auth-and-security-fixes) - 2026-10-16: [Database, Worker and web performance](/docs/changelog/2026-10-16-performance-and-placement) - 2026-10-16: [Row-level security per Organization](/docs/changelog/2026-10-16-row-level-security) - 2026-10-15: [AI assistant and one tool catalog](/docs/changelog/2026-10-15-assistant-and-agent-tools) - 2026-10-15: [Dependency round, i18next fix and ReUI controls](/docs/changelog/2026-10-15-dependency-round-and-reui) - 2026-10-15: [Developer documentation and changelog](/docs/changelog/2026-10-15-developer-docs-and-changelog) - 2026-10-15: [Documents and large uploads](/docs/changelog/2026-10-15-documents-and-large-uploads) - 2026-10-15: [Landing page redesign](/docs/changelog/2026-10-15-landing-redesign) - 2026-10-15: [Landing sections and project skills](/docs/changelog/2026-10-15-landing-sections-and-project-skills) - 2026-10-14: [Trace and code block primitives](/docs/changelog/2026-10-14-trace-and-code-blocks) - 2026-10-13: [TanStack Start 1.0, OG images and durable imports](/docs/changelog/2026-10-13-start-og-and-imports) - 2026-10-12: [Payments, native screens and a new landing page](/docs/changelog/2026-10-12-payments-and-native-experience) - 2026-10-03: [Runtime and recovery hardening](/docs/changelog/2026-10-03-runtime-and-recovery) - 2026-09-25: [Authentication foundations and performance](/docs/changelog/2026-09-25-auth-and-performance) - 2026-09-24: [Platform dependency alignment](/docs/changelog/2026-09-24-platform-dependencies) - 2026-09-03: [oRPC and Drizzle upgrades](/docs/changelog/2026-09-03-typed-api-upgrade) - 2026-08-25: [Typed domain operations and a real dashboard](/docs/changelog/2026-08-25-typed-domain-and-dashboard) - 2026-08-24: [Agent connections and native account security](/docs/changelog/2026-08-24-agent-connections-and-account-security) - 2026-08-13: [Cloudflare email and shared UI](/docs/changelog/2026-08-13-email-and-ui) - 2026-07-30: [An enforced client/server boundary](/docs/changelog/2026-07-30-client-boundary) - 2026-07-24: [Native interface foundations](/docs/changelog/2026-07-24-native-foundation) - 2026-07-13: [Administration and data workflows](/docs/changelog/2026-07-13-admin-and-data-workflows) - 2026-06-10: [Setup, storage and localization](/docs/changelog/2026-06-10-setup-storage-and-i18n)