@wf/kanban

0.1.0-alpha.5 — fail-closed host policy and bounded audit trail

The first Kanban release on the BrightOps registry. As in 0.1.0-alpha.3, authorize and admit allow an operation only when they return true synchronously; any other answer, including the promise an async callback returns, refuses it with DENIED, and a refused promise now names the reason. A hook must be a function, undefined or null when the client is created, or creation fails with INVALID; 0.1.0-alpha.3 let a falsy hook such as false switch its check off and threw TypeError on every call for any other non-function. A hook removed or replaced by a non-function later refuses instead of switching off. validateCard must refuse by throwing synchronously; a returned promise now refuses the write, where 0.1.0-alpha.3 let it commit before its verdict. The cards a write or retry hands back, and those a restore preview reports it would restore, now pass admit as a board.read of those cards before anything commits. The MCP adapter refuses to start with an empty, whitespace-only, non-string or over-256-character host actor. Resolve permission lookups before calling the client.

New limits.historyOverflow setting. The default, fail, keeps the existing behavior. With trim-oldest, a long-lived board keeps accepting writes: its oldest history events and retry receipts give way to fit maxHistory, maxReceipts and maxBoardBytes, and cards never do. Before rolling back to 0.1.0-alpha.3, remove historyOverflow from the YAML, which that version rejects, and raise maxHistory, maxReceipts or maxBoardBytes for any board that trim-oldest kept at its limits, which would otherwise refuse writes.

The archive carries the BrightOps Commercial SDK License and notices for the React code bundled in kanban.browser.js, and its type declarations no longer import the package's private CSS modules. YAML and saved boards are otherwise unchanged. The Python wrapper wf-kanban 0.1.0a7 bundles this version; install it from the BrightOps Python index as the guide describes.

0.1.0-alpha.4 — not distributed

An internal build. Its changes are part of 0.1.0-alpha.5.

0.1.0-alpha.3 — browser board repair

Fix a stylesheet rendering error that could leave the embedded case-work board blank. Python consumers use wf-kanban 0.1.0a6. Public APIs, YAML and saved boards are unchanged; retain earlier exact archives for rollback.

0.1.0-alpha.2 — @wf scope

Use @wf/kanban. Replace imports and dependencies on @workforce-sdk/kanban; YAML and application data stay unchanged. Retain the previous exact archives and lockfile for rollback.

0.1.0-alpha.2 — private preview

Refresh the private preview against WF Core 0.3.0-alpha.2 and MCP 2026-07-28. Export package-owned configuration schemas where applicable for isolated host validation. Existing YAML schema and stored data remain unchanged. Previously delivered archives keep their exact versions and hashes.

0.1.0-alpha.1 — prepared preview

Canonical WF package ownership, YAML configuration, versioned compatibility metadata, and publisher attribution. Registry publication is separate from this source delivery.

Initial standalone public API with account-scoped durable boards, revision-safe writes, policy admission, lifecycle-managed UI, and explicit MCP activation.