What shipped this week.

Summon Animal on demand, gated per user

A footer icon and a Shift+A shortcut call the mascot immediately, released behind a new per-user feature flag audience with audited grant and revoke so the trigger reaches one person first with no DOM or listener rendered for anyone else. Feature flags gain a users audience the whole platform can reuse.

Product noteReleasing to a single named user before widening exposure keeps the feedback loop tight and the blast radius near zero.

Co-investors are recorded only when the words say it invested

Extraction now classifies each candidate co-investor as fill, suggest or reject based on whether the source snippet states that the entity invested, rejecting subject-line tags, senders, outside counsel and celebrity names that previously passed on shape alone. Ambiguous firms land in the review queue as suggestions instead of becoming values.

Product notePrecision on a decision-grade field comes from requiring evidence of the claim, not from recognising the shape of a name.

Incident co-investor values restored to their prior state

A service-role RPC with a dry-run mode reverts the peers values the enrichment job wrote during the one-hour incident window, restoring each deal's earlier value rather than blanking it and leaving any field a person edited since untouched. The nine affected deals read as they did before the job ran.

Product noteA clean revert respects two orders of precedence at once: human edits over machine writes, and prior state over empty state.

Every deployment is checked for a visible Animal

A deployed guard now runs on each Vercel preview and production deployment, verifying that every sprite asset answers, the frames contract is the current version, all four roaming surfaces mount with real size and a driven appearance paints on screen. A regression in the mascot is caught by CI before a person notices.

Product noteReading production first and then automating the exact check that would have caught the report converts a one-off investigation into a standing safeguard.

Animal always loads fresh assets and says when it cannot

Sprite URLs now carry a content hash so a browser can never hold a stale frames contract after a swap, load status is published and shown on the status page with a Show Animal now control, reduced-motion visitors get a static poster and the appearance timer persists across navigation. The invisible-mascot report is resolved at its root cause rather than patched.

Product noteMaking failure states visible to users is as much a part of a fix as removing the failure itself.

Lane totals explain themselves

Each swimlane header total now opens a tooltip stating what is summed, how many deals in the lane carry a proposed allocation and how the figure is rounded, with live numbers drawn from the same labels and formatting the deal page uses. A headline like 33 deals and $8.5M is no longer read as a claim about every deal in the lane.

Product noteEvery aggregate on a dashboard should disclose its coverage, because a number without its denominator quietly misleads.

Co-investor writes held behind a runtime switch

A runtime-read kill switch stops the enrichment job from writing the peers field until the extraction meets the precision bar, flippable without a deploy and covered by tests that prove other fields keep flowing. The one field known to produce false positives is contained while the rest of the pipeline keeps working.

Product noteShipping a narrow, reversible hold for the failing part preserves the value of everything that works instead of pausing the whole feature.

Fix a blocked stage move without leaving the board

The Move Blocked dialog now renders the same field controls as the deal page for every unmet gate requirement, with a live remaining count and a Save and move action that re-runs the gate server-side before the card advances. Deal owners clear a gate in place instead of bouncing between the board and the detail page.

Product noteMeeting users at the moment of friction, rather than redirecting them to a form elsewhere, is how a control turns from a blocker into a workflow.

Extraction now asks for the fields the gates actually check

The email extraction schema covers all six gate-field gap groups, from classification and founders to ARR, historical revenue and fund terms, with every figure carrying its period and source text so a forward number can never land in a trailing column. Correspondence that plainly states a fact now fills the field instead of leaving it to be typed by hand.

Product noteClosing the loop between what the pipeline demands and what the intake collects removes manual work at its source rather than at its symptom.

Stage gates no longer wait on AI-produced fields

AI summary, risk flags and similar deals are removed from every gate, with the removal audited per gate and the trigger and editor hardened so those checks cannot be re-added. A deal move is now blocked only by facts a person can supply.

Product noteA gate is only legitimate when the people it stops can satisfy it themselves; anything else is a system failure dressed as governance.

The changelog record is current through the week of 31 August

The agentic record gained its 29 and 30 August supplement and the first six entries for the week of 31 August, and the product changelog for the week of 24 August was backfilled from 19 to 38 published entries with six plumbing pull requests recorded as deliberate exclusions.

Product noteA changelog is only useful as a record if the gaps are closed the week they appear.

The OKR agent can look up the key results it writes to

A read-only endpoint now returns the full objective and key-result ID map behind the agent token, unblocking the nightly dual-write that had been sheet-only since 27 August because the write endpoints required UUIDs the platform exposed nowhere.

Product noteAn automation that cannot discover its own targets is one that silently stops writing.

Every deal carries the fund and asset class from the categorisation sheet

The Animal AI Training Categorization sheet was applied to production as 40 field changes across 18 deals under a named system actor with pre-image guards, while three mappings the database cannot express were reported for Jay rather than guessed.

Product noteA data pass against real records earns trust by declaring exactly how many changes it expects and refusing to run if the count differs.

The accuracy replay scores the second look production already gives

The shadow replay had been counting every email the extractor called non-deal as an unreachable miss, when production gives those messages an attach-only rescue pass; the replay now runs the same rescue, lifting the measured curated-history accuracy from 60.1 to 62.8 percent and shrinking the extractor miss bucket from 54 to 39.

Product noteA benchmark that models a pipeline nobody runs steers the roadmap toward the wrong fixes.

The matcher recognises a company however the email spells it

An email that says Echo, Putt Shack or The Familie V 2.0 now auto-attaches to Echo Soccer LLC, Puttshack or The Familie when exactly one deal answers to that name, using the same same-company rules that previously only broke ties between two candidates.

Product noteA signal that is safe as a tie-break becomes safe as evidence once it is gated on uniqueness.

Animal walks with a proper arm swing, on a machine-readable contract

The v9 asset pack redraws the walk cycle with contralateral arm swing and the drumstick redrawn per grip, and every placement number moves out of the player into the frames file, so the sprite's feet and peek edges come from the contract rather than a runtime canvas measurement.

Product noteWhen the art file declares its own anchors, a re-cut of the pack changes one JSON file instead of a rendering engine.

A doubled email address reads as one person

HTML-to-text conversion prints a linked address twice, sometimes glued together, which made one correspondent look like two strangers to the relationship matcher; header and attribution lines are now normalised at the source and on the 16 stored messages already affected.

Product noteIdentity keys have to be canonical before they are compared, or the matcher learns nothing from the history it has.

The mascot is called Animal, and its tooltips no longer get clipped

Every user-facing sentence about the mascot now says Animal, and the shared tooltip is portalled to the page body with viewport-aware placement so it can no longer be cut off by a bordered panel on System Config, AI settings or the OKR pages.

Product noteA rename done in copy rather than code keeps routes, assets and tests stable while the product says the right thing.

A company an email only names is not a deal

Naming a company in passing no longer creates a deal record for it; unless the company is a party to the correspondence, states economics or appears in the subject, the email goes to review instead, closing the source of eight junk records and the attachments they were stealing.

Product noteThe cheapest way to keep a pipeline clean is to stop it inventing entities it cannot justify.

The mascot is checked on the deployed build, not just in the repo

Two Playwright suites now run against a live deployment: one proves every sprite sheet is served byte-for-byte as the manifest describes, with transparent corners, and the other walks the mascot through its behaviour checklist, from walk timing to staying out of the way of a dialog.

Product noteA feature that lives in the browser is only verified where the browser sees it, so the QA runs against the URL people use.

Deal notes, the intelligence pipeline and the save bar are live

Deal comments and files now flow through the intelligence pipeline, the deal edit form has a save bar with an unsaved-change guard, and typing during an in-flight save is no longer lost; two earlier merges had landed on each other's branches rather than main, so this is the first time the work reached users.

Product noteWhen a rescue is needed, target main directly and verify the ancestor, because the branch graph does not care what the merge button said.

A System Config page explains the mascot and the pipeline

A new System Config tab introduces the mascot with a live gallery of its five moves, an animated explainer of how an email becomes a deal (attach, review, or open a new deal) and a section on what it fills in, all rendered through the same frozen art contract the roaming sprite uses.

Product noteExplaining the automation in the product, in the words of the pipeline that actually runs, is part of earning trust in it.

Field history reaches the deal page

Hovering or focusing a field label now reveals a clock button that opens that field's change history, backed by an append-only record of every edit; the feature had merged into a dead branch and never reached the live product until now.

Product noteMerged is not the same as shipped, and the only test that matters is whether the change is on the branch the product deploys from.

The replayed mailbox is filed where Jay's Drive says it belongs

Three approved production passes refiled 203 replayed emails onto the deals a human had already filed them under, archived the 22 records a passing mention had invented, and left every move as an auditable reassignment the timeline and accuracy read model understand.

Product noteA correction run ships as reviewable scripts and plans, not as a console session nobody can replay.

Updates sit alongside Delivery Performance

Delivery Performance gains an Updates tab that shows the same product and agentic changelog feed as the public Updates page, deep-linkable and reading from one shared query so the two surfaces cannot drift apart.

Product noteOne feed rendered in two places beats two feeds that have to be kept in step.

One company, one deal record

The deal records the replay fragmented (Echo beside Echo Soccer LLC, RX3 beside RX3 Growth II, a domain and a truncated name posing as companies) were consolidated from a plan Jay approved, with every step naming the record by id and current name so a stale plan aborts instead of merging the wrong company.

Product noteA production edit script should refuse to derive its own scope; the human approves exactly what will move and the run proves it moved exactly that.

Mail is filed with the relationship, not the company it mentions

When an email's correspondent has a history with one deal, that continuity can now outrank a company the body merely names, so a Breakaway update that mentions a portfolio company stays on Breakaway; the rule fires only on strong, unambiguous evidence and never on shared intermediary addresses.

Product noteWho the mail is with is often better evidence than who the mail is about, provided the system is strict about what counts as a relationship.

Closing paperwork is deal mail too

Signature packets, subscription agreements, wire confirmations and capital-call notices were being classified as not deal-related and never reached routing; the extractor now treats an investment's execution lifecycle as deal mail.

Product noteA definition written for opportunity mail silently discards the mail that proves the deal happened.

chore(security): keep the #331 owner-default RPCs off the SECURITY DEFINER surface (#282)

This week, the product moved forward with chore(security): keep the #331 owner-default rpcs off the security definer surface (#282). Summary

Riff the drummer roams the platform

A 16-bit drummer mascot now wanders four surfaces of the app with a sprite engine and state machine driven by a checksummed asset pack, always behind the controls and never in the way.

Product notePersonality ships under the same discipline as everything else: scoped stories, a QA checklist and a verified asset manifest.

A re-run creates one deal per company, not one per email

The settings re-run now remembers deals it created moments earlier so a burst of mail from a new company yields a single deal, intermediaries can no longer claim a company's attachments, and a cleanup script retires the duplicates the old behaviour left behind.

Product noteIdempotence is a property of the whole run, not of each item in it.

The new matching rules reach the existing backlog

Bumping the routing configuration version makes every email decided under the old rules eligible for re-evaluation, so the fixes for legal-entity conflicts and intermediary domains apply to mail already in the review queue, not just what arrives next.

Product noteA rule change that only affects future input leaves the backlog wrong for as long as it lives.

The rematch leaves settled mail alone

The rematch pass that runs when a deal is created now checks whether a message already has a terminal or human decision, so mail attached to one deal is no longer re-suggested for an unrelated new one.

Product noteEvery work list that asks about a message must ask the same question, or the newest one will relitigate the rest.

Test deals are flagged at birth

Synthetic deals are now marked as test data by code at creation, including those created from email intake, and a backfill flagged the ones that had slipped onto the live board with a record of how they were identified.

Product noteA flag the seed can forget to set is not a boundary; a flag the compiler enforces is.

Shared law-firm and fund-admin domains stop hijacking matches

Replaying 518 archived emails through production matched 136 of 471; the four causes behind most misses are fixed, starting with intermediary domains that appear on many deals no longer counting as company identity.

Product noteA replay against real mail is the only benchmark that tells you which rules are wrong rather than which tests are green.

Mini-golf counts as golf

The fund router now recognises putting, putt-putt and mini-golf vocabulary, so golf-entertainment deals route to Brekky Golf instead of the catch-all, and a deal can be held back from a backfill run.

Product noteClassification vocabulary should be widened from real misses, one honest example at a time.

Seven admin screens became two config hubs

Intelligence Config gathers Extraction, Accuracy and AI Settings in pipeline order, and System Config gathers Gate Rules, Users and Feature Flags, both on the same keyboard-navigable tab strip the Delivery Performance page uses.

Product noteGrouping settings in the order the system runs them teaches the pipeline while you configure it.

Deal ownership follows a rule, not an accident

Automation no longer defaults new deals to whoever was created first (in practice Jay, on 61 of 65 real deals); owner defaults are now configuration with a never-owner rule, and each deal's fund is assigned by deterministic vocabulary rules with a stated rationale.

Product noteA default that nobody chose is still a decision, so make it explicit and make it auditable.

The pipeline can be viewed in swimlanes

The board now groups deals into lanes by Fund, Owner, Lead investor or Deal type, with a picker that remembers your choice per browser; lane counts and totals exclude test deals and say so.

Product noteGrouping logic lives in one pure module so every lane answers the same question the same way.

Swimlanes by age and last activity, and Backlog stays put

Deals can be laned by how long they have been in the pipeline or how recently anyone corresponded, youngest first, and Backlog deals no longer disappear when a grouping is active.

Product noteTime-based lanes answer the question a pipeline review actually asks: what has gone quiet.

Dragging a card across lanes reassigns it

Moving a deal into another Fund, Owner, Lead investor or Deal type lane now writes that attribute, and a combined lane-and-stage drop writes the lane first so stage gates evaluate the new value rather than the old one.

Product noteTwo axes on one drop only work if the order of writes matches the order the rules are checked in.

Inbound email is processed within a minute

Extraction, embedding, and routing now run on one-minute schedules guarded by database leases that prevent overlapping runs, and routing waits for vector signals before making a terminal decision on any email.

Product noteTightening a feedback loop is only safe once concurrency and ordering are guaranteed first.

Rejecting a deal no longer waits on the AI

The reject gate stopped demanding reviewed risk flags, a requirement AI generation often never produced, by switching the criterion off through a new active flag rather than deleting it, so deals can be rejected today and the rule's history survives.

Product noteSoft-deactivating a gate criterion keeps the audit trail while unblocking the workflow the same day.

Test users vanish from every operational list

Synthetic accounts created by automated testing are now flagged at the database and excluded from owner pickers, analytics and board counts, so the people you can assign a deal to are the people who actually work here.

Product noteA boundary that lives in the schema holds for every screen; one that lives in a query holds for that screen only.

Stage gates are edited in the product, not by migration

Admins can now open /admin/stage-gates, see the five gates in pipeline order, switch any criterion on or off, and add checklist items that someone must tick before a deal can move; every change keeps its history.

Product noteWhen the rule that blocks a workflow can be changed by the person who owns the workflow, engineering stops being the bottleneck.

One number leaves the page

The July benchmark cost-per-point card is removed from Delivery Economics, leaving the extra-value card to carry the section while the benchmark itself continues to anchor the spend chart's reference line.

Product noteRemoving a redundant number is product work too; every figure on a page should earn its place.

Test deals disappear from view, reversibly

Synthetic test deals are now hidden behind an admin-only preference enforced by row-level security rather than component filters, so no current or future read path can leak them, and the data survives intact for when it is wanted.

Product noteChoosing a reversible visibility boundary over an irreversible purge preserves options while solving the problem.

The spend story lives in one place

The spend-versus-traditional trajectory moved from the OKR tab to Delivery Economics, so the tab reads as one narrative from cost per point through extra value to cumulative spend, and the descoped O4 KR3 no longer weighs on Q3 scoring.

Product noteRemoving a dead key result from the scoring keeps the scorecard describing reality.

The test-deal boundary survives its own audit

Post-merge verification of the new visibility boundary against production found paths where synthetic deals still reached matching metrics and email search; both leaks are closed in a single migration.

Product noteVerifying a security boundary against production after merge is what separates enforced from intended.

An email that names the deal now reaches the deal

Six of six emails Jay matched by hand carried the deal name in the subject and still parked in review; subject-name and thread signals now count as strong evidence, so those emails attach on their own.

Product noteA manual review session is the best training data there is, provided someone reads it as a pattern rather than a to-do list.

Cards say why a deal was rejected and which fund it belongs to

Rejected deals show their rejection reason as a red label on the card, and every card carries a fund-coloured line and badge (GL red, BG green, KV blue) so a glance across the board tells you whose deal it is.

Product noteThe board is read in seconds, so the two facts people ask about most belong on the card itself.

Empty contact fields fill themselves from the thread

A scheduled pass now reads a deal's whole correspondence and fills in contact name, email and phone where they were blank, and only where they were blank; nothing a person entered is ever overwritten.

Product noteFill-empty-only is enforced in the database so the guarantee does not depend on any caller remembering it.

New deals sweep the backlog for mail that already arrived

Creating a deal, or changing its name or domain, now triggers a bounded rescan of unmatched mail so earlier correspondence lands in the review queue instead of being lost to timing, and a reply into an already-matched thread is treated as conclusive.

Product notePutting the trigger in the database means every creation path present and future inherits it for free.

Inapplicable fields are locked, not hidden

Deal pages now show both the Fund and Company fieldsets at all times, with the inapplicable one locked behind a stated reason and a one-click path to classify the deal, ending the era of 21 undiscoverable fields; Correspondence also moved above Matched emails.

Product noteShowing a locked control with its reason teaches the data model; hiding it just hides the work.

The agentic record is current through this week

The agentic development changelog gained its week of 24 August entries plus a 22 and 23 August supplement, seeded through a guarded migration that was rehearsed twice against production inside a rolled-back transaction before landing.

Product noteRehearsing a data migration in a rolled-back transaction gives production evidence without production risk.

Stage gates are enforced by the database

Deals now pass through five seeded gates, from Backlog exit to Reject entry, enforced in the database rather than the UI, with human-only not-applicable marks and a new flag that separates test deals from real ones.

Product noteEncoding the workshop's gate criteria as data means process changes ship as migrations, not rewrites.

Delivery economics greets you first

Delivery Performance is reorganized into four tabs, with Delivery Economics as the default view, so the cost-and-value story opens the page and OKRs, the roadmap, and the extra-work ledger each get their own space.

Product noteLeading with the economics tab puts the question stakeholders actually ask on the first screen.

Extra value is summed from scores, not asserted

The Extra Value card on Delivery Performance now reflects the retro-scored points for all fifteen unplanned items, so the dollar figure is computed from per-item evidence, and the OKR application itself is marked delivered.

Product noteClaiming value only after each item carries a score keeps the delivery narrative auditable.

Every gate requirement can be satisfied in the product

Walking one deal by hand through all five stage gates exposed seven required fields with no control anywhere in the product; each now has one, so a deal can clear every gate without a SQL write.

Product noteWalking the happy path by hand before declaring a workflow done is how hidden dead ends get found.

Synthetic deals can be retired safely

A new archive-then-purge script clears the 153 synthetic deals that were still live match candidates for inbound email, defaulting to a dry run and refusing to delete unless the operator states the expected deal count.

Product noteDestructive tooling that demands the operator predict its effect converts a risky cleanup into a checked one.

Delivery Performance holds up at 320px and 200% zoom

A manual visual pass at 320px width, 200% zoom, and grayscale found real defects on the Delivery Performance page, including a tooltip that forced horizontal scroll at every viewport width; all are fixed in the presentation layer.

Product noteDeclaring a page done only after the constrained-viewport checks is the difference between shipped and verified.

Delivery has a financial ledger

The OKR surface became Delivery Performance: objectives roll up by quarter, and a new financial layer shows cost per story point, quarterly spend rebalancing, and the statement-of-work link, with every figure read from the database rather than hardcoded.

Product notePutting delivery cost beside delivery output lets the spend conversation happen on evidence.

The changelog record stays complete

The agentic development changelog gained its week of 17 August entries plus a supplement covering 15 and 16 August, seeded through a guarded migration that cannot duplicate rows on re-application.

Product noteA changelog that backfills its own gaps is a record, not a marketing page.

The security warning list is now an audited surface

All 44 SECURITY DEFINER advisor warnings were audited against production grants: one genuine over-grant, which let any signed-in user rewrite deal receipt dates, was revoked, and the remaining 43 are recorded as the platform's accepted RPC surface with written rationale.

Product noteAuditing findings to a documented baseline turns a warning count into a security posture.

The roadmap works by keyboard, in any locale

End-to-end testing of the new Roadmap tab surfaced four presentation defects, now fixed: month abbreviations no longer vary by ICU build, tooltips dismiss with Escape, and the tabs move with arrow keys.

Product noteAccessibility follow-through in the same week as the feature is what keeps it from becoming debt.

The seven-month plan is visible on one page

A new Roadmap tab lays out July 2026 through January 2027 as a month-by-month checklist under a computed AHEAD, ON TRACK, or BEHIND verdict, with an API that keeps it current as work ships.

Product noteA roadmap verdict computed from shipped work stays honest in a way a hand-updated slide never does.

Reviewers can check the model against the email

The match review page now shows the original message body directly beneath the extracted output, visible by default and expandable, so a doubted score can be checked against its source.

Product noteShowing the evidence beside the inference is what makes a review more than an approval.

Each feature owns its own switch

OKR gating moved onto its own flag, leaving the dashboard switch reserved and off for the analytics work it was named for.

Product noteOne flag per feature stops an unrelated release from being blocked by a shared switch.

The document library reaches deal detail

Deal detail now shows documents grouped by category with the current version prominent, prior versions one expander away, and drag-drop upload that rolls back cleanly instead of leaving a phantom file.

Product noteAn upload that fails visibly and completely earns more trust than one that half succeeds.

IC packs assemble themselves

An IC pack now composes from records the deal already holds, frozen as a snapshot alongside a completeness checklist and a target IC date, so the committee reviews a fixed version of the deal.

Product noteFreezing a snapshot at assembly time makes a committee decision reviewable against exactly what was presented.

Deal documents have a home

Deals now carry a document library with immutable versions, private storage, per-deal checksum dedupe and automatic promotion of email attachments by reference, so no attachment bytes are duplicated.

Product noteServer-chosen storage paths keep an upload surface safe without trusting anything the client sends.

Features can ship dark

Runtime switches now gate product surfaces, administered from a page restricted to the product lead by an explicit email allowlist rather than the broader admin role.

Product noteSeparating who can release from who can administer keeps rollout decisions with one accountable owner.

Every AI setting is documented in one place

The AI settings page now covers 113 audited variables across nine feature groups, each with its current value, default, source, editability and a plain-language note on what good looks like.

Product noteMaking configuration legible to non-engineers turns a tuning surface into a governance one.

Forwarded chains are read as separate messages

A forwarded email is now split at its boundaries and each segment extracted with its own sender and date, so one company's figures no longer merge with another's and a deal is not filed under the introducer.

Product notePreserving provenance through every transformation is what keeps attribution correct downstream.

Extraction reads what the sender actually wrote

Replies are now stripped of their quoted chain before extraction, with the reply graph reconstructed so each message contributes its own words and only identity context from those above it.

Product noteRemoving duplicated input at the source improves accuracy more reliably than asking a model to ignore it.

Email content stays out of the logs

Every error path in the email pipeline now passes through one redaction boundary, so addresses, phone numbers and quoted message text no longer reach production logs or admin-visible failure records.

Product noteA single boundary for sensitive text is auditable in a way that scattered discipline never is.

Statements are attributed to the person who made them

Extraction now returns commitments, next steps, metrics, terms and claims bound to the message author who wrote them, with identity taken from parsed provenance rather than from the model.

Product noteDeriving identity from structure rather than inference keeps the record defensible.

One brief for the Eval and DD conversation

Each deal now assembles a read-only brief from what it already knows, drawing its summary, risk flags and confirmed term-sheet fields into a single meeting document that cannot contradict the deal card.

Product noteRe-presenting existing records instead of re-deriving them removes an entire class of inconsistency.

Summary and risk quality is measured, not asserted

Summaries and risk flags are now scored against a hand-labelled set of twelve historical deals, and a prompt or model change cannot go active without a new version id and a passing evaluation.

Product noteA measurable baseline turns model changes from a matter of opinion into a matter of evidence.

Existing deals answer to a text message

The SMS channel now updates fields, moves stages and reports deal status, with every reply carrying a deep link and every call recorded on the deal's communication history.

Product notePre-checking a stage gate before writing means a blocked move changes nothing at all.

Texted deals keep their conversation

A deal created over SMS now shows the exchange that created it, and the agent actions taken on it, exactly as an email-created deal shows its source thread.

Product noteModelling a new channel on the proven shape of an existing one keeps the audit trail uniform across both.

A person turns a parsed term into deal data

Parsed term-sheet fields now pass through a review screen where each value is confirmed by hand, with amendment history preserved so a later sheet never silently overwrites an earlier one.

Product noteNaming a single system of record removes the ambiguity of two places holding the same number.

Term sheets are read, not yet trusted

PDF term sheets are now parsed field by field with confidence, page and verbatim excerpt attached, and every value waits in review rather than entering deal data.

Product noteHolding machine output in a pending state by default stops an extraction error from becoming a recorded fact.

Deals arrive pre-read

Each deal card now carries a digest of what changed in its correspondence, timestamped and linked to the exact messages behind it, so a discussion can start without re-reading the thread.

Product noteRegenerating only once a burst of activity settles keeps a summary both current and inexpensive.

Risk signals surface next to the deal

A deal now shows the risk flags drawn from its own email evidence, each traceable to the message that raised it, and advisory only so nothing quietly moves a stage.

Product noteConstraining model output to a governed taxonomy keeps judgement with the people who own the decision.

Add agentic development changelog entries for week of 10 August 2026

This week, the product moved forward with add agentic development changelog entries for week of 10 august 2026. Summary Seeds seven `agentic` changelog entries for `week_start = '2026-08-10'` (entry_date 2026-08-14) in a new migration, following the same shape as `20260807235900_agentic_changelog_week_0803.sql`: editorial rows with `pr_number`/`pr_url` null, `published` left to its default, `sort_index` 1..7, and a `not exists` guard on `(category = 'agentic', week_start)` so re-application is idempotent.

The record holds the message as it was sent

Every agent action over SMS now carries the inbound text as a required input, so the communication record stores what the sender wrote rather than a reconstruction, and a call without it is refused.

Product noteAn audit trail is only as strong as its weakest entry, so incomplete provenance is better declined than stored.

Deals can start from a text message

ANIMAL gained a machine interface, so a text can create a deal, look for existing matches, or attach a note, with duplicate detection handled by the same matcher the email pipeline uses.

Product noteReusing logic already proven in production keeps a new channel consistent with the one users trust.

Session replays worth watching

Replays now show page content as it appeared on screen and name the person behind the session, while typed values stay masked and recording remains off unless a deployment enables it.

Product notePrivacy controls serve better when tuned surface by surface than when applied wholesale to everything.

Website fields accept what people actually type

A bare domain in a deal's website field now saves cleanly, with the implied scheme supplied instead of a validation error on a visibly filled input.

Product noteMeeting users at their input habits removes friction that no amount of clearer error copy would.

Correspondence detail level genuinely changes

The Summary and Dense controls on a deal's correspondence timeline now change how much of each message is shown, and a reader's own expansions hold until the next switch.

Product noteA control that looks interactive but changes nothing costs more confidence than an absent one.

A guard against the duplicate that caused it

Beyond clearing the leftover migration, filename validation now rejects two migrations with identical bodies, so the copy-instead-of-rename shortcut cannot recur.

Product noteEach incident is worth one automated check, so the lesson outlives the moment it was learned.

One canonical migration per change

The identical second copy of the unmatched-email migration was dropped, returning the required database test suite on the main branch to green.

Product noteA single canonical migration per change keeps any fresh environment reproducible from history alone.

Delivery pipeline unblocked

A version collision between two concurrently merged schema changes was resolved, restoring the checks that guard every pull request and the route to production.

Product noteTreating a red shared branch as the highest-priority item stops finished work from queueing behind it.

Seed agentic changelog entries for the week of 3 August 2026

This week, the product moved forward with seed agentic changelog entries for the week of 3 august 2026. Summary Seeds the 7 agentic-development changelog entries for `week_start = '2026-08-03'` (entry_date 2026-08-07), following the same pattern as the week-of-27-July seed (PR #170 / `20260731010000_agentic_changelog_week_0727.sql`): `category = 'agentic'`, null `title`/`pr_number`/`pr_url`, `sort_index` 1..7, wrapped in an idempotency guard.

Schema changes reach production again

The duplicated migration that halted every production deploy was removed, so database changes flow through without disturbing the history already applied.

Product noteChoosing the remedy that preserves recorded state avoids trading a short outage for a long reconciliation.

Session replays, off by default

Session replay became an environment-level switch rather than a code decision, staying off until a deployment explicitly enables it. Input masking ships as part of that configuration, so an enabled replay still cannot leak what was typed.

Product noteObservability tooling earns its place faster when the privacy default is settled before the feature is turned on.

Search across deals and correspondence from anywhere

A keyboard-summoned palette now searches deals and email together from any screen, grouping results and returning only what the viewer is permitted to see.

Product noteA visibility boundary becomes dependable once a named test gates it, so cross-fund isolation now fails the build rather than a review.

Unmatched counts admit when they cannot be read

The unmatched-email card now reports an unknown count instead of an implied zero, and the database function it depends on finally reached production.

Product noteSurfacing uncertainty holds up better than presenting a confident number that quietly happens to be wrong.

Create Deal says what is missing

Submitting a deal without a company name or fund returns a clear message in the form instead of failing silently behind a native browser prompt that mobile users never saw.

Product noteValidation that lives only in the browser leaves the failure path untested.

Drops land even between the columns

A card released in the gaps around the board settles in the column it overlaps, and end-to-end coverage holds that behaviour in place.

Product noteOverlapping fixes should converge on one implementation, with tests marking the boundary each one covers.

Email to deal in minutes, not hours

Extraction now runs in parallel on a tighter cron cadence, removing a 25-emails-per-hour ceiling that had held mean email-to-deal latency near 105 minutes.

Product noteMeasuring where the time actually goes prevents optimizing a stage that was never the constraint.

A batch of emails becomes one new deal

The review queue can turn several selected emails into a single new deal in one confirmed step, and the batch either completes in full or leaves nothing behind.

Product noteBulk actions become safe once partial success is designed out of them.

Columns accept a card anywhere

Dragging a deal highlights the destination column across its whole area rather than only the thin gaps between cards, so the drop target matches what the board looks like.

Product noteInteraction affordances have to agree with the visual boundaries people already read.

Mis-routed mail can be moved, with a record

A single message or a whole thread can be re-assigned to the right deal from the correspondence timeline, and every move is kept in an append-only history of who moved what and when.

Product noteCorrections deserve an audit trail, since the record of a change is what makes trusting automation reasonable.

The pipeline board is usable on a phone

Board chrome collapses into one row and a bottom nav, lifting the visible column from 43 to 74 percent of a phone screen, and cards now lift on a long press instead of hijacking every scroll.

Product noteMeasuring the constrained case before and after keeps a mobile fix from becoming a matter of opinion.

The matching blind spot is visible

The Gmail admin view shows how many ingested emails are attached to no deal, derived from existing routing data so every attach and re-assign moves the number with no counter to drift.

Product noteInstrumenting a gap before building tooling for it keeps the next decision grounded in evidence.

Three missing weeks restored to the changelog

The public changelog again carries every week from 13 July onward, and a reconciliation check compares merged work against published entries so a silently failing weekly job cannot thin the record.

Product noteA reporting pipeline needs a check that fails loudly, because a page that merely looks quiet reveals nothing.

OKRs split into update and work beyond the line

The OKR command center opens on the objectives update, with work beyond the line one tab away, ending a single long scroll.

Product noteSeparating distinct reading intents beats stacking them in one column.

The confidence bars explain themselves

Hovering the match confidence bars on a thread header now describes what the weighting means, matching the explanation individual messages already carried.

Product noteAn indicator that needs outside explanation is not yet finished.

Deal mail reads as a conversation

The correspondence panel on a deal is now a threaded timeline, newest activity first, with collapsible threads, messages in sent order, and match confidence shown as visual weight. A weak match can be corrected in a single tap.

Product noteBuilding on an existing read model rather than beside it keeps visibility rules in one place.

Delivery economics reports money actually spent

The spend chart now plots logged actuals instead of the contracted retainer forecast, removing $280,000 of reported spend that was never incurred, and the savings headline follows the corrected figure. Months with nothing logged simply end the line.

Product noteA metric that quietly mixes forecast into actuals is less useful than no metric at all.

Search respects who can see what

Results are scoped to the funds and deals each person is entitled to, sensitive hits are recorded for audit, and the whole query stays under a second.

Product noteAccess rules that hold inside search are what let a fast tool loose on confidential data.

Search across the pipeline

Deals can be found by name, company and the content of their correspondence, with results ranked by relevance.

Product noteSearch is the shortest path between remembering something and acting on it.

Deal attachments in one gallery

Every document that arrived with a deal's email is now browsable from the deal, opened through short-lived private links.

Product noteConfidential material stays confidential when access is granted per view rather than per file.

See exactly what the extractor did

An observability page shows recent extractions, what was pulled from each message and where the process fell short.

Product noteConfidence in a model comes from being able to inspect its output, one message at a time.

The agentic development record covers the week of 27 July

The Updates screen now carries the week of 27 July in the agentic development record, keeping the account of how the work gets done as current as the product itself.

Product noteA delivery record only informs decisions while it is published on the same cadence as the work.

Migration mistakes caught before they reach a branch

Continuous integration now rejects duplicate or malformed migration filenames in about a second, replacing an opaque database failure that used to surface thousands of log lines deep.

Product noteThe cheapest place to catch a class of failure is the first gate it can pass through.

Suspicious mail is flagged before it reaches a deal

Messages showing signs of impersonation are marked with a risk flag, and mail that yielded nothing usable no longer raises a false alarm.

Product noteA warning only keeps its meaning while it stays rare, so suppression rules ship with the flag itself.

The AI settings are readable in plain English

An admin panel now lays out the thresholds and models behind extraction and matching, each explained in ordinary language rather than configuration keys.

Product noteMaking automation legible to the people who own its outcomes is a prerequisite for tuning it.

A deal's correspondence loads in one request

Threads and their messages are read through a single query behind the deal emails endpoint, so a deal's mail arrives in sent order without a round trip per message.

Product noteShaping the read model before the interface keeps performance a design decision rather than a later repair.

Seed agentic changelog for week of 20 July 2026

This week, the product moved forward with seed agentic changelog for week of 20 july 2026. Summary Adds the **Agentic Development** changelog entries for the week of **20 July 2026 → 26 July 2026** (week ending 26 July; Friday run, evidence covers 20–24 July).

Deal cards read cleaner on the board

The redundant stage badge is gone from deal cards and the drag overlay, leaving the column to carry the stage and the card to carry owner and age at a glance.

Product noteRemoving duplicated signal is as much product work as adding features, because every element on a card competes for the same attention.

Owners and locations are easier to get right

Deal owners are chosen by full name from a picker, geography offers city suggestions as you type, and the redundant sector field is gone.

Product noteConstrained inputs beat free text whenever the value will later be filtered or reported on.

Privileged database routines locked down

Internal routines that run with elevated rights can no longer be invoked by anonymous callers, closing a gap flagged by the database security advisor.

Product noteSecurity findings get treated as delivery work with a verified fix, not as a note for later.

GL-E15: idempotent OKR sheet catch-up script

This week, the product moved forward with gl-e15: idempotent okr sheet catch-up script. Summary The `/okrs` command center was backfilled from the Google Sheet on 2026-07-10 and hadn't been synced since, while the tracking agent kept writing to the sheet. This adds `scripts/catchup-okrs.mjs`, an **idempotent** catch-up that upserts only the sheet deltas into the `okr_*` tables (service role via `SUPABASE_SECRET_KEY`). It never deletes or reorders existing rows. The data catch-up was run directly against the DB; this PR just commits the reusable tool alongside `scripts/seed-okrs.mjs`.

The deal record settles on its agreed fields

Deals now carry the agreed field set for funds and direct companies, with classification, ownership and reporting fields named and ordered the way the investment team uses them.

Product noteLocking the data model early is what keeps later reporting from becoming an archaeology exercise.

Investment leads appear by name

Lead selection and deal detail now show full names instead of initials, so it is obvious who owns what.

Product noteNames carry accountability in a way that abbreviations never quite manage.

Classification asks less and shows more

Deal type is now derived from the subclass instead of being entered twice, the classification fields follow the order people actually fill them in, and the stage is visible on the card.

Product noteEvery field that can be derived is a field nobody has to maintain.

Sort the board the way you are thinking

The board can be ordered by date created, last updated or name, so the same pipeline can be read as a queue, a freshness check or a lookup.

Product noteOne board serving several questions beats several views nobody keeps in sync.

Your board sort is remembered

The chosen sort order persists between visits, and the board sub-header no longer overflows on narrow screens.

Product notePreferences that reset are preferences people stop setting.

One Updates screen for both changelogs

The product changelog and the agentic development record now sit behind tabs on a single Updates screen, sharing one entry point in the navigation.

Product noteRelated records are easier to keep current when they live one tab apart.

Add OKR command center recurring-update runbook (GL-E15)

This week, the product moved forward with add okr command center recurring-update runbook (gl-e15). Summary

Review works on a phone

The review queue and the ignored-mail list now lay out as cards on small screens instead of a table that has to be scrolled sideways.

Product noteTriage happens between meetings, which makes the phone layout a primary surface rather than a fallback.

Genuinely new companies open their own deal

When an email describes a company with no deal behind it, the platform now recognises the shape of a new opportunity and creates the deal, holding it aside until someone assigns the fund.

Product noteAuto-creation is only safe with a quarantine state, so nothing enters the pipeline unowned.

Gmail timestamps read in your own timezone

The Gmail integration screen now shows times in local time and states when the mailbox connection next renews itself.

Product noteOperational screens are read under time pressure, so they should not ask the reader to convert anything.

Create a deal straight from a reviewed email

Review items for companies that are genuinely new can now become a deal in place, with the fund chosen at the point of creation.

Product noteRemoving the copy-paste step between triage and creation is where a queue stops feeling like extra work.

Match confidence explains itself

Each review item now explains what its confidence score means in a tooltip, with the underlying match signals tucked into a collapsed panel for anyone who wants the detail.

Product noteProgressive disclosure keeps a screen calm while still making the reasoning available on demand.

Fix skipped review_create_as_new_deal migration (version collision)

This week, the product moved forward with fix skipped review_create_as_new_deal migration (version collision). Summary The "Create as new deal" review action failed in production with `Could not find the function public.review_create_as_new_deal(p_deal_id, p_decision_id) in the schema cache`. Root cause: **two migrations shared the same version prefix `20260721000000`**, having been authored on separate branches:

Guard realtime deal mapper against partial UPDATE payloads

This week, the product moved forward with guard realtime deal mapper against partial update payloads. Summary End-to-end testing of the needs-fund board (#148, GL-E05-S10) surfaced a crash that takes down the **entire** Kanban board when a realtime `postgres_changes` UPDATE arrives with a partial `new` record. In `patchDealFromRow` (`src/hooks/useRealtimeDeals.ts`):

Matching accuracy is now measured, not assumed

A dashboard tracks how often mail is routed correctly, where the misses cluster and how the numbers move week to week.

Product noteA stated accuracy target only becomes real when the number is on a screen somebody looks at.

Internal mail no longer attaches itself to deals

Messages from colleagues are no longer mistaken for deal correspondence, and a new Auto assigned tab shows exactly what the pipeline attached without being asked.

Product noteShowing what automation did unprompted is the fastest way to notice when it is wrong.

Agentic development gets its own page

The record of how the agent itself is evolving now lives on a dedicated page with its own navigation entry, separate from the product changelog.

Product noteTwo different audiences read those two records, and separating them keeps each one legible.

Ignored email is visible and reclaimable

Mail the pipeline set aside is no longer invisible: an Ignored view lists it, and anything wrongly skipped can be pulled back into routing.

Product noteEvery automated exclusion needs a way back, otherwise the quiet false negatives are the ones nobody finds.

Confident matches attach themselves; the rest wait for a human

Mail now routes by confidence: a strong match attaches to its deal automatically, a borderline one goes to review, and a clearly new company is flagged as a new deal.

Product noteAutomation is safest when its threshold is explicit and everything below it is handed to a person.

Email reading runs on schedule again

The hourly job that turns new mail into structured deal data was being redirected to the login page before it could run; it now executes as intended, with a check that keeps every scheduled job reachable.

Product noteA scheduled job that fails silently is worse than one that is missing, so the fix ships with a test that would have caught it.

Emails find the deal they belong to

Extracted details are now matched against existing deals by name, domain and meaning rather than exact spelling, and each candidate carries a score explaining why it ranked where it did.

Product noteRanked candidates with visible reasoning let a person overrule the system instead of guessing at it.

A review queue for the judgement calls

Anything the matcher was unsure about lands in a review screen where it can be accepted, rejected or reassigned to another deal, and every decision is recorded.

Product noteCapturing the human decision is what turns a queue into training data for the next round of matching.

[GL-E05-S3] Fix routing work-list to not repeat terminal side effects on config bump

This week, the product moved forward with [gl-e05-s3] fix routing work-list to not repeat terminal side effects on config bump. Summary

[GL-E05-S1] Batch extraction eval harness

This week, the product moved forward with [gl-e05-s1] batch extraction eval harness. Summary

test(e05): add 100-email fictional matching-hardening corpus with ground-truth labels

This week, the product moved forward with test(e05): add 100-email fictional matching-hardening corpus with ground-truth labels. What

[GL-E05-S2b] Embedding service: generation + backfill + dimension-mismatch plan

This week, the product moved forward with [gl-e05-s2b] embedding service: generation + backfill + dimension-mismatch plan. Summary

[GL-E05-S6] Extraction corpus v2 + sector taxonomy + prompt hardening

This week, the product moved forward with [gl-e05-s6] extraction corpus v2 + sector taxonomy + prompt hardening. Summary

ci: auto-apply Supabase migrations to prod on merge to main

This week, the product moved forward with ci: auto-apply supabase migrations to prod on merge to main. Summary

The app fits properly on a phone

Footer navigation now respects the safe area on modern iPhones, so the bottom row is reachable instead of tucked under the home indicator.

Product noteMobile polish is not cosmetic when the affected control is how people move around the product.

Deal emails read themselves into structured fields

Incoming mail is now read for the details that matter — company, fund, stage, amounts, people — so a message arrives as the beginnings of a deal record instead of text somebody has to retype.

Product noteExtraction earns its place only when the output is structured enough to act on, which is why the fields mirror the deal model exactly.

Every changelog week now opens with what it meant

Each week on the changelog carries a short Week in Review: the business outcome of the work, a conservative estimate of what a traditional team would have spent on the same scope, and how the actual delivery compared.

Product notePublishing the comparison alongside the work keeps delivery claims measurable rather than rhetorical.

Align footer logout with nav items using a list

This week, the product moved forward with align footer logout with nav items using a list. Summary The footer logout button was visually out of line with the other nav links because the nav was a bare flex row and logout was wrapped in a `<form>` (block element) rather than sharing the same layout as the links.

Connecting Gmail says which account to use

The Connect Gmail step now states plainly that the shared deal mailbox is the account to authorise, removing the most common way the setup went wrong.

Product noteOne sentence of guidance at the point of action prevents a support conversation later.

Signing out is one tap from any screen

A logout control now sits in the footer navigation alongside the other destinations, so ending a session no longer means hunting for it.

Product noteBasic account controls belong where people already look, not behind a menu they have to learn.

Nothing in the deal inbox gets processed twice — or lost

Inbound mail is now handled exactly once even when Gmail redelivers it, and anything that cannot be read is parked in a holding queue for review instead of disappearing.

Product noteA pipeline is only trustworthy when its failures are visible, so parking bad messages beats dropping them quietly.

Email attachments are captured to private storage

Inbound attachments now extract into a private, service-role-only bucket with a metadata row each, and blocked or oversize files are recorded with a reason rather than silently dropped.

Product noteRecording rejected inputs instead of discarding them keeps a complete, auditable trail of what actually arrived.

Gmail integration status explains itself

The admin Gmail page now carries plain-language tooltips on each operational field, so connection health, capture timing, and watch expiry read clearly without external documentation.

Product noteExplaining operational state in place lowers the expertise required to keep an integration healthy.

ci: manual workflow to run the real Gmail staging-inbox e2e (GL-E04-S4)

This week, the product moved forward with ci: manual workflow to run the real gmail staging-inbox e2e (gl-e04-s4). Summary Wires the real send-to-self Gmail staging-inbox e2e (`e2e/gmail-staging-inbox.spec.ts`, GL-E04-S4 / AC3) to actually run — it previously only ever **skipped** because the standard `Playwright e2e` CI job passes placeholder Supabase creds and no Gmail secrets. This test sends and deletes real email against the production/preview mailbox + DB, so it must not run on every PR; instead it gets a dedicated **manual** workflow.

Add agentic changelog entries for week of 13 July 2026

This week, the product moved forward with add agentic changelog entries for week of 13 july 2026. Summary Seeds the `agentic` changelog track for the week of 13-19 July 2026 (week_start `2026-07-13`, entry_date `2026-07-17`). These are authored editorial rows, not PR-sourced, so `pr_number`/`pr_url` stay null and `published` uses its `true` default, matching the existing `20260710190000_agentic_changelog_seed.sql` pattern.

chore: remove gmail-e2e-token helper; document OAuth Playground minting

This week, the product moved forward with chore: remove gmail-e2e-token helper; document oauth playground minting. Summary Removes the throwaway `scripts/gmail-e2e-token.mjs` helper now that both `GMAIL_E2E_REFRESH_TOKEN`s (animal@ → prod, test@ → preview) have been minted and set. As agreed in #104, the script was a temporary utility to decrypt a stored refresh token from `gmail_integrations`; it's no longer needed.

Email capture recovers from interruptions on its own

Ingestion now checkpoints against already-saved messages and skips ones that have vanished, so an interrupted mailbox backfill resumes where it left off instead of starting over.

Product noteDesigning for resumability up front keeps a long-running sync from becoming an all-or-nothing gamble.

The deal inbox connects securely to the platform

An admin can now link the dedicated animal@grosslabs.com mailbox through Google sign-in, with access tokens encrypted at rest and a daily job renewing the Gmail watch so capture never lapses.

Product noteAutomating credential renewal removes the silent expiry that quietly breaks most email integrations.

The public changelog stays current on its own

The weekly changelog job now tracks a resumable cursor and backfilled the entries an earlier gap had missed, so shipped work reaches the public page without manual catch-up.

Product noteMaking a recurring job resumable ensures a single missed run repairs itself rather than compounding.

Invited teammates can sign in on the first try

Gross Labs users invited to the platform are now pre-provisioned so their Google sign-in links to the assigned role immediately, removing the rejection that used to block a first login.

Product noteClosing the gap between invitation and first sign-in keeps onboarding friction from eroding early trust.

Inbound deal email is captured into structured records

Verified Gmail notifications now flow through history sync and MIME parsing into a deduplicated store of raw emails, turning the CC'd inbox into the first stage of the deal pipeline.

Product noteMaking the capture path write-once and replay-safe means the same message can never create duplicate work downstream.

Hold unsupported TypeScript and ESLint majors

This week, the product moved forward with hold unsupported typescript and eslint majors. Summary Dependabot currently proposes two majors that the Next.js lint stack cannot load:

OKR scores now read as percentages

Key result and objective progress now shows as clear percentages across the command center, replacing raw scores so status is legible at a glance.

Product noteSmall legibility choices compound: a number people can read instantly is a number they will actually act on.

Objectives now compare at a glance

A new overview chart ranks every objective's rolled-up score in one view, so the quarter's leaders and laggards are obvious before drilling into any single goal.

Product noteA comparison view turns a list of scores into a decision aid for where attention should go next.

New releases announce themselves in the app

A refresh banner appears whenever a new version ships, so long-lived tabs pick up improvements without users ever hitting a stale build.

Product noteClosing the loop on deployment means shipped work reaches users the moment it exists.

OKR data lands on a secured, audited foundation

The objectives, key results, evidence, and spend behind the OKR command center now sit in a normalized model with row-level security and immutable audit history from the first migration.

Product noteEnforcing access rules at the data layer before the feature ships makes confidentiality a property of the system rather than a later patch.

Changelog gains a dedicated agentic-development track

The public changelog now separates product releases from the story of how the agent itself is evolving, giving stakeholders two clear narratives on a single page.

Product noteSeparating streams of work by audience keeps each update legible instead of blurring the signal together.

CI actions pinned to close a supply-chain gap

Every third-party GitHub Action in the build pipeline is now pinned to an exact commit, so a repointed upstream tag can no longer slip unreviewed code into a release.

Product notePinning the supply chain converts a class of invisible risk into something reviewed on every change.

OKR progress keeps itself current

Daily updates now flow into the command center through a secure, dedicated write path, so scores and activity stay fresh without anyone editing the tracker by hand.

Product noteAutomating the update path removes the reporting tax that quietly lets most goal trackers drift out of date.

OKR command center goes live

A dedicated OKRs space brings the whole quarter into one view — every objective, the key results beneath it, the daily activity and evidence behind each score, and spend measured against benchmarks.

Product notePutting goals and the evidence for them in one place turns OKRs from a quarterly ritual into a living instrument the team can steer by.

Weekly product changelog goes live

A public record of shipped outcomes now keeps every stakeholder aligned on what moved the product forward each week, without a single status meeting.

Product notePublishing outcomes, not output, keeps the team accountable to user value rather than activity.

Sign-in redirects hardened against tampering

Post-login redirect paths are now strictly validated, closing an open-redirect vector before it could ever be abused.

Product noteActing on security findings within days keeps the cost of each fix small and the trust dividend large.

Product decisions get an evidence base

Privacy-safe analytics now capture how the pipeline is actually used, tying feature investment to observed behaviour rather than opinion.

Product noteInstrumenting early means the roadmap can be argued from data before instincts calcify.

Dependencies are now scanned before they ship

Automated dependency and security scanning runs on every change, with a triaged baseline so new findings stand out immediately.

Product noteContinuous scanning turns supply-chain risk into a routine review item instead of a crisis.

Everyone sees the same board, live

Realtime sync pushes every stage move and edit to all open boards within moments, ending the refresh-to-check habit during pipeline reviews.

Product noteShared live state removes an entire class of coordination errors between deal owners.

Stage gates keep incomplete deals from advancing

Dragging a deal forward now checks its exit criteria first, listing exactly which fields are missing instead of allowing a silent skip.

Product noteEncoding the investment process into the tool protects decision quality without adding meetings.

The kanban board goes live on real deal data

The pipeline board now reads and writes directly to the production database, with optimistic updates keeping every move instant.

Product noteShipping the live path behind an already-validated interface converts prototype confidence straight into production value.

Gate rules become editable — with a paper trail

Admins now manage stage exit criteria from a dedicated console, and every rule change is written to an audit log.

Product noteLetting the process evolve in-product, with history, keeps governance and agility from being a trade-off.

Deals become real, structured records

The pipeline now runs on a Supabase-backed deal model with full create, edit and archive flows, turning ad-hoc deal notes into decision-grade data.

Product noteArchiving instead of deleting preserves the full history of every negotiation at no cost to focus.

Landing page puts sign-in one step from anywhere

The public homepage now doubles as the login screen, cutting the path from arrival to pipeline down to a single form.

Product noteRemoving steps from the most-travelled journey compounds into real time saved every day.

Secure sign-in becomes the front door

Magic-link authentication with role-aware sessions now protects every route, so confidential deal data is only ever visible to the people it belongs to.

Product noteBuilding auth before features means security is a property of the system, not a retrofit.

Drag-and-drop now lands exactly where you point

Kanban drops resolve by pointer position rather than card geometry, so moving a deal between stages feels precise even on a crowded board.

Product noteSmall interaction fixes in the core loop matter more than new surface area.

Deal form shows what each stage will ask of you

Per-field badges mark which inputs each stage requires, and a by-stage layout lets owners fill a deal out in the order the pipeline will demand it.

Product noteMaking the rules visible inside the form prevents rejected moves instead of explaining them.

Access rules are now tested on every change

A pgTAP test matrix runs in CI against every role and table, so no code can merge if it would loosen who can see or edit deal data.

Product noteTurning security policy into an automated gate makes protection continuous rather than periodic.

Admins invite teammates with the right role from the start

An admin-only invite flow assigns each new user their role at the moment of invitation, so access is correct before first login.

Product noteEncoding permissions at onboarding avoids the drift that comes from fixing access after the fact.

ANIMAL brand system lands with light and dark themes

A complete brand system — monochrome palette, editorial typography, motion and theming — now gives the product a distinct, premium identity across every screen.

Product noteEstablishing design tokens early makes consistency the default rather than a cleanup task.

Kanban pipeline takes shape with a working prototype

A mock-data kanban board and deal views let the team walk the full pipeline — Backlog through Addepar — and react to real screens before any backend was committed.

Product notePrototyping the workflow with mock data surfaces design feedback while changes are still cheap.

Platform foundation laid with typed, secure scaffolding

The deal intelligence platform starts on a Next.js, Supabase and TypeScript foundation, giving every future feature type safety, managed auth and a database with row-level security from day one.

Product noteChoosing boring, well-supported infrastructure up front keeps later sprints focused on user problems rather than plumbing.