changelog

2026-06-27 · brand redesign

• new landing under the HalcoPay name — cream + emerald palette, lowercase voice
• brand tokens v2: brand/tokens/tokens.json and tokens.css
• new privacy policy and terms & conditions, adapted for our self-hosted model
• backend identifiers MVGATEWAY_* kept for backward compatibility

sprint 21 · subprocess plugin hosting (opt-in)

• MVGATEWAY_PLUGIN_ISOLATION_MODE=subprocess runs each plugin in its own process
• posix rlimits enforced: cpu, memory, file descriptors, child processes
• per-call wall-clock timeout, json-rpc ipc over stdin/stdout, 1 mib frame cap

sprint 20 · cross-signing for publisher key rotation

• operators can import a new publisher key only after verifying it's cross-signed by the previous one
• scripts/mvg-trust.py import handles the verification + transparency-log write

sprint 19 · prometheus recording + alerting rules

• 8 recording rules: http rate, p95/p99 latency, webhook success/permanent ratios, plugin denial rate, sandbox timeouts
• 7 alerting rules with runbooks: api/worker down, http error rate, http latency, webhook success low, webhook permanent spike, plugin audit denials, sandbox timeouts
• docs/ALERTING.md as on-call runbook

sprint 17 + 18 · invoice delivery history + trust-store transparency log

• per-invoice webhook delivery history in the admin ui — every attempt, response code, and next-retry timestamp
• trust-store mutations append to <DATADIR>/trust/transparency.jsonl

sprint 16 · observability instrumentation

• prometheus metrics for webhooks (delivery count by classification, duration histogram)
• plugin runtime denials counter, sandbox invocation counter and duration histogram
• worker exposes its own /metrics endpoint
• reference grafana dashboard committed to the repo

sprint 15 · per-publisher key rotation with overlap window

• multiple keys per publisher can be active simultaneously
• per-key expires_at in trust store schema v2

sprint 14 · self-contained github actions ci + ghcr release

• four ci workflows: ci.yml, tests-full.yml, docker-build.yml, release.yml
• tagged releases publish to github container registry with provenance attestation

sprint 13 · publisher signature verification

• ed25519 signature verification at install time
• schema-pinned manifest validation via sha-256

sprint 12 + 12.5 · signed webhook delivery engine

• signed webhooks with replay protection
• retry schedule: 60s → 5m → 30m → 2h → 12h with permanent-vs-transient classification
• worker lifespan wired up to drain in-flight deliveries cleanly

earlier sprints

sprint 1 through 11 covered the foundational work: rebrand baseline, coin-sdk boundary, docker stack, plugin loader hardening, supabase admin integration, plugin capability sandbox, sandboxed hooks, live checkout via supabase realtime, subprocess sandbox option.

see the git history for every commit.