243 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	e1b2c8575c	fix: explicit m.mentions for ticket notifications and roasts (ahead of Synapse 1.164) ... Synapse 1.164 turns on MSC4210 by default: the legacy push rules that pinged when a user ID or display name appeared in the body are removed, so a message only notifies the users listed in m.mentions. - hookshot/tinker-tickets.js deliberately pings assignees/watchers (notify_users) with matrix.to links; those pings would stop. Return mentions: { user_ids: notifyUsers } (hookshot 7.3.2 v2 transforms support it). - matrixbot: send_html takes optional mention_user_ids; !roast mentions the target when given as a full Matrix ID. Winner announcements stay without a ping (the player is already in the room). No @room is sent anywhere. Lotus Chat already sends m.mentions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-27 20:04:27 -04:00
jared	54bdada04d	Merge pull request 'docs: Synapse 1.163.2 (Pillow 13 security update)' (#41) from docs/synapse-1.163.2 into main	2026-10-26 19:30:06 -04:00
Lotus CIandClaude Opus 5.5	8a2867e64b	docs: Synapse 1.163.2 (Pillow 13 security update) ... Upgraded on LXC 151 on 2026-10-26 from 1.162.0 (the README still said 1.159.0). 1.163.2 brings Pillow 13.0.0 (security fixes in the image thumbnailer). Upgrade notes checked: the new start-up check for limit_profile_requests_to_users_who_share_rooms does not apply (unset). Verified: /versions and federation version report 1.163.2, federation tester OK, no errors since restart, Synapse thumbnailer works with Pillow 13. Rollback package kept in /var/cache/apt/archives (1.162.0+trixie1). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-26 19:23:53 -04:00
jared	2e6e8e72b8	Merge pull request 'fix(cinny-nginx): own rate budget for content-hashed app files' (#40) from fix/asset-rate-limit into main	2026-10-24 17:39:18 -04:00
Lotus CIandClaude Opus 5.5	d36c782e56	ci(pip-audit): ignore filelock CVEs in pip-audit's own dependency ... pip-audit --local scans the whole audit env, which includes pip-audit's own CacheControl[filecache] -> filelock 4.1.0. Six new CVEs (fixed in 4.2.1) started failing every run; 4.2+ requires Python 3.11 and the audit env is 3.10. The bot does not use filelock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-24 17:35:45 -04:00
Lotus CIandClaude Opus 5.5	ad7d735739	fix(cinny-nginx): give content-hashed app files their own rate budget ... A cold page load fires ~75 requests within a second and the service worker precaches all ~126 build files at once (every deploy renames them), both past chat_limit's burst of 60. The excess got 503 "limiting requests": a fresh visit to /register/matrix.org rendered blank (4 chunks refused), and precache installs could fail after deploys. Like decorations (matrix #22), hashed js/css/fonts/images/wasm now use assets_limit (100 r/s, burst 400); pages and the webhook keep chat_limit. The deploy validates with nginx -t and restores the old config on failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-24 17:05:11 -04:00
jared	4bb2dd4449	Merge pull request 'feat(cinny-deploy): fail and alert when a deployed page references missing files' (#39) from fix/deploy-asset-check into main	2026-10-20 02:38:06 -04:00
Lotus CIandClaude Opus 5.5	8aea38fc67	feat(cinny-deploy): fail and alert when a deployed page references missing files ... After copying, check every script/stylesheet the app and call pages reference (src/href in both index.html files) exists in the webroot. If any is missing, log it, post an alert with the upstream checker's Matrix credentials (/etc/cinny-monitor.env, best effort) and exit 1. This would have caught the 2026-10-20 call-page outage at deploy time. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-20 02:28:52 -04:00
jared	963bc87c54	Merge pull request 'fix(cinny-deploy): the call page's scripts are deployed again (regression from #30)' (#38) from fix/deploy-call-assets into main	2026-10-20 01:55:37 -04:00
Lotus CIandClaude Opus 5.5	85c58d5ed0	fix(cinny-deploy): the call page's scripts are deployed again ... #30 added `rsync --exclude assets/` to keep old app assets, but an unanchored exclude matches every directory named assets, including public/element-call/assets/. Each deploy then updated the call page's index.html but not its hashed scripts, so after the lotus.28 deploy the call page requested files that did not exist (66 x 404 from 00:05 on 2026-10-20 until the assets were copied in by hand). The excludes are now anchored (/assets/, /public/element-call/assets/), and both asset directories get the same treatment: copied without --delete, pruned after 14 days, so an open call page keeps its scripts across a deploy. config.json stays unanchored on purpose (the production call config lives at public/element-call/config.json). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-20 00:19:47 -04:00
jared	8e5cdf50b5	Merge pull request 'feat(voice-limit-guard): enforce the limit at connect time too (#25)' (#37) from feat/voice-limit-connect-time into main	2026-10-19 23:34:04 -04:00
Lotus CIandClaude Opus 5.5	d3f389cab1	feat(voice-limit-guard): enforce the limit at connect time too (#25) ... The limit was only checked at token issue, and lk-jwt tokens last an hour, so a token fetched while there was space could be used to connect once the room was full. The reconcile loop now compares each limited room's distinct Matrix users with max_users and RemoveParticipants the people who arrived since the previous sweep, newest first, until it is back within the limit. People already in the call are never removed (lowering a limit mid-call kicks nobody); extra devices of one person never count twice. Fixes #25 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-19 23:30:15 -04:00
jared	f7ce35c636	Merge pull request 'fix(cinny-web): per-client rate limits; own budget for decorations' (#36) from fix/nginx-real-ip-decorations into main	2026-10-19 12:44:26 -04:00
Lotus CIandClaude Opus 5.5	a52d6a89bc	fix(cinny-web): per-client rate limits; own budget for decorations ... Every request reaches LXC 106 from Nginx Proxy Manager (10.10.10.27), and nginx had no realip config, so chat_limit (20 r/s, burst 60, keyed by $binary_remote_addr) was ONE bucket for the whole community: a scanner burst 503ed real users. Trust X-Real-IP from the proxy only, in both server blocks. Decorations (#22) now come from this host, and the profile picker can fetch all 629 thumbnails: ~500 of them 503ed in testing. /decorations/ gets its own zone (100 r/s, burst 700) instead of chat_limit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-19 12:41:46 -04:00
jared	adeb872abb	Merge pull request 'feat(cinny-web): serve avatar decorations from chat.lotusguild.org/decorations (#22)' (#35) from feat/decorations-package into main	2026-10-19 12:35:22 -04:00
Lotus CIandClaude Opus 5.5	b6380b6c8a	feat(cinny-web): serve avatar decorations from chat.lotusguild.org/decorations (#22) ... Decorations came through Nextcloud's public DAV: a new PHP session (four cookies) per image and no cache headers, on every decorated avatar. The set (629 decorations + thumbnails, 573 MB) is now a versioned Gitea generic package (avatar-decorations 1.0.0, 4 tar parts), pinned by sha256 in cinny/decorations.sha256. LXC 106's deploy installs it to /var/www/decorations-<version> (verified against the pin and the in-package manifest; previous version kept; failures leave the live set alone), and nginx serves /decorations/ with a one-week public cache. deploy/publish-decorations.sh publishes a new version and writes the pin. Fixes #22 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-19 12:32:34 -04:00
jared	96d1778bb4	Merge pull request 'fix(voice-limit-guard): two simultaneous joins can no longer both pass a full room (#25)' (#33) from fix/voice-limit-race into main	2026-10-18 19:46:01 -04:00
jared	0aa34123a8	Merge pull request 'fix(cinny-web): CSP for mozilla.org discovery and TikTok oEmbed; featured communities (#18, #20, #21)' (#32) from fix/web-config-csp into main	2026-10-18 19:45:52 -04:00
jared	070a94d0d7	Merge pull request 'docs(livekit): bind lk-jwt-service to 127.0.0.1:8071, not all interfaces (#24)' (#31) from fix/lk-jwt-loopback into main	2026-10-18 19:45:47 -04:00
jared	9b0cbc9db1	Merge pull request 'fix(cinny-web): no-cache for the app shell on SPA routes; keep old hashed assets 14 days (#23)' (#30) from fix/shell-cache-and-assets into main	2026-10-18 19:44:17 -04:00
Lotus CIandClaude Opus 5.5	fa0351084b	fix(voice-limit-guard): two simultaneous joins can no longer both pass a full room (#25) ... The limit was checked against participants LiveKit already had, so tokens issued but not yet connected were not counted: two users pressing Join together could both get into a 1-person channel. Serialise the check per room and give each admitted user a 30 s reservation, counted like a present user until LiveKit lists them or it expires. Refs #25 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 15:24:27 -04:00
Lotus CIandClaude Opus 5.5	61ed3c64e3	feat(cinny-web): featured communities on Explore, matching the desktop app (#20) ... chat.lotusguild.org's config.json has never had featuredCommunities, so Explore → Featured was empty on the web while the desktop app showed the Lotus Guild space, Homelab, Jellyfin and matrixrooms.info. Add the same set (decided 2026-10-04). Fixes #20 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 02:37:16 -04:00
Lotus CIandClaude Opus 5.5	be0ff3b854	fix(cinny-web): allow the TikTok oEmbed lookup in connect-src (#18) ... TikTok short links (vm.tiktok.com/…, tiktok.com/t/…) resolve their video id via https://www.tiktok.com/oembed, which the CSP refused, so their cards always failed on the web. The player itself was already allowed (frame-src https:). Fixes #18 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 02:37:16 -04:00
Lotus CIandClaude Opus 5.5	93078858c1	fix(cinny-web): allow www.mozilla.org in connect-src so mozilla.org login can discover its homeserver (#21) ... mozilla.org/.well-known/matrix/client 301s to www.mozilla.org, which the CSP refused, so choosing mozilla.org always said "Failed to connect". Fixes #21 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 02:37:16 -04:00
Lotus CIandClaude Opus 5.5	076340227f	docs(livekit): bind lk-jwt-service to 127.0.0.1:8071, not all interfaces (#24) ... voice-limit-guard (:8070) is meant to be the only way to get a LiveKit token, but lk-jwt-service bound :8071 on every interface, so any LAN host could mint an unguarded token (no max_users, full publish sources in audio-only rooms). The guard runs on the same LXC: document the loopback bind in the setup steps and the port table. Refs #24 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 01:27:00 -04:00
Lotus CIandClaude Opus 5.5	bf770fed83	fix(cinny-web): no-cache for the app shell on SPA routes; keep old hashed assets 14 days (#23) ... SPA URLs (/, /home/…, /login/…) are rewritten to /index.html inside location /, which set no cache headers, so browsers heuristically reused a stale shell after a deploy, and rsync --delete had just removed the assets it referenced: a blank app until the shell expired. Send no-cache for the rewritten shell (map on $uri; location / now includes the security headers, since add_header drops the inherited ones), and stop deleting previous builds' hashed assets: prune after 14 days. Fixes #23 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 01:26:02 -04:00
jared	b1335a830f	Merge pull request 'docs: registration is closed (SSO/LLDAP only); note Draupnir encryption status' (#29) from readme-sso-registration into main	2026-10-16 18:55:36 -04:00
Lotus CIandClaude Opus 5.5	cf42d0aab0	docs: registration is closed (SSO/LLDAP only); note Draupnir encryption status ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 18:52:37 -04:00
jared	6c50f51feb	Merge pull request 'Revert Draupnir Rust crypto (#26)' (#28) from revert-draupnir-rust-crypto into main	2026-10-16 18:40:05 -04:00
Lotus CIandClaude Opus 5.5	cabc393b6b	Revert Draupnir Rust crypto (#26): it fails to start without a device-bound token ... With experimentalRustCrypto: true, Draupnir 2.9.0 exits on startup with "Encryption not possible: server not revealing device ID": its access token is not bound to a device, which matrix-bot-sdk crypto requires. Restores experimentalRustCrypto: false so the deploy hook brings it back. To enable encryption later, give Draupnir a device-bound access token (a normal password login) first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 18:36:16 -04:00
jared	72a3e3ba17	Merge pull request 'draupnir: enable Rust crypto so it can read commands in the encrypted management room' (#26) from draupnir-rust-crypto into main	2026-10-16 18:34:55 -04:00
jared	162d8b5a80	Merge pull request 'landing: describe SSO sign-up, drop dashes and hyphens from the page text' (#27) from landing-sso-wording into main	2026-10-13 02:48:19 -04:00
Lotus CIandClaude Opus 5.5	d17c40e79f	landing: describe SSO sign-up, drop dashes and hyphens from the page text ... The "How to Join" steps still said to register with a token from Jared; accounts now come from LLDAP and people sign in with Lotus SSO. The steps now read: ask Jared for a Lotus Guild account, open chat.lotusguild.org and sign in with Lotus SSO, join the space. The contact line asks "Questions or need an account?" and the server details say "Invite only". Visible text no longer uses em dashes, en dashes or hyphens (dashes became colons, commas, full stops or "to"; compounds became separate words), in the hand-written parts and in data/features.json / comparison.json, with index.html regenerated by build.py. Package names (matrix-js-sdk, matrix-rust-sdk, matrix-dart-sdk, matrix-sdk-crypto-wasm) and D-Bus keep their hyphens; markup, URLs and <code> are untouched. The reviewed date displays as "September 26, 2026" (datetime attribute stays ISO). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-13 02:36:25 -04:00
Lotus CIandClaude Opus 5.5	77e719183a	draupnir: enable Rust crypto so it can read commands in the encrypted management room ... The management room is end-to-end encrypted, but Draupnir ran with experimentalRustCrypto: false and Pantalaimon off, so it could post there (its own messages are unencrypted) but never saw commands: its last reply to a command was ~57 days ago, and `!draupnir rooms add …` sent from Lotus on 2026-10-13 was ignored. The same command sent unencrypted worked at once (✅, joined dco-memes-minecraft). Merging deploys via lxc110-draupnir.sh, which restarts draupnir. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-13 01:34:10 -04:00
jaredandClaude Opus 5.5	7c857bea1e	docs: record the Devdesk hookshot webhook ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 23:34:02 -04:00
jaredandClaude Opus 5.5	f2db3b1b3e	hookshot: DevDesk "Claude needs you" webhook (devdesk#28) ... devdesk-notify-matrix on CT 126 posts here when a Claude session waits for input and no browser tab or SSH client is attached. Deploying this transform creates the Devdesk hook in Spam and Stuff. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 23:30:31 -04:00
jaredandClaude Opus 5.5	5efd214ebe	docs: record the Ci-Alert hookshot webhook and how to look up hook UUIDs ... The Ci-Alert hook existed (created when ci-alert.js was deployed) but its URL was never set in Gitea, so every repo's notify-failure job skipped. The org secret MATRIX_WEBHOOK_URL now points at it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 19:08:53 -04:00
jared	e988465906	Add MIT license	2026-10-03 00:16:58 -04:00
jared	effa27da3d	Merge pull request 'cinny config: status banner from the Kuma page (cinny #124)' (#17) from config-status-pages into main ... Merge pull request #17: cinny config status banner (cinny #124)	2026-09-29 13:24:51 -04:00
Lotus CIandClaude Opus 5.5	8d80ebf4c2	cinny config: status banner from the Kuma page (cinny #124) ... Adds `statusPages` for matrix.lotusguild.org → the Kuma status page https://isitup.lotusguild.org/status/matrix (groups Homeserver, Voice calls, Login). The banner code (cinny #255) and the CSP (#16) are already live; production's config.json comes from this file, so without this entry the client never asks Kuma. The LXC 106 deploy merges it into the live file and keeps server-only values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-29 12:35:55 -04:00
jared	0914339180	Merge pull request 'cinny CSP: allow the Kuma status page (cinny #124)' (#16) from csp-kuma-status into main ... Merge pull request #16: cinny CSP allows the Kuma status page (cinny #124)	2026-09-29 12:28:30 -04:00
Lotus CIandClaude Opus 5.5	9fcbd410f2	cinny CSP: allow the app to read the Kuma status page (cinny #124) ... Add https://isitup.lotusguild.org to connect-src so the client can fetch the public status JSON (GET /api/status-page/matrix and /api/status-page/heartbeat/matrix) for the homeserver status banner. Read-only public JSON, no credentials; nothing else changes. The live snippet (/etc/nginx/snippets/cinny-security-headers.conf on LXC 106) was identical to this file before the change; install it by hand with a backup and `nginx -t` (the deploy script only handles cinny/nginx.conf). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-29 12:08:45 -04:00
jared	d76d276da4	Merge pull request #15: LXC 106 deploy: merge config.json, self-update (#13)	2026-09-28 18:52:30 -04:00
Lotus CIandClaude Opus 5.5	8d47df711d	fix(lxc106): deploy script merges config.json and updates itself (#13) ... LXC 106's matrix-deploy hook has not fired since May: Gitea posts to 10.10.10.6:9000, which webhook.service binds to 127.0.0.1. The same hooks (same secret) are served by webhook-lotus on :9001; the Gitea hook is being re-pointed there. Before it starts firing again: - cinny/config.json is merged into the live file instead of copied over it. The live file carries gifApiKey (injected by lotus_deploy.sh), empty in git, which a copy would blank. Repo keys win except where the repo value is empty and the live one isn't. Backup goes to /root/config-backups; the live file is left untouched on error. - The script installs its own updates (deploy/lxc106-cinny.sh → /usr/local/bin/matrix-deploy.sh, after bash -n). Until now repo edits to it never reached the server. - A hooks.json change restarts webhook-lotus 15 s after the script exits, since that listener is the one running this script. - README: port 9001, the file list, and the history. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-28 18:47:49 -04:00
Lotus CIandClaude Opus 5.5	9baafd4928	cinny: load Element Call from call.chat.lotusguild.org (cinny #43) ... Sets elementCallUrl so the web app frames the call page on its own origin (desktop keeps its bundled copy). Applied on LXC 106 in place (the live file also carries the injected gifApiKey; backup in /root/config-backups/), since the matrix-deploy webhook there has not fired since May. Rollback: remove this key (live: restore the backup) and new calls use the bundled same-origin page again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-27 11:52:52 -04:00
jared	97d9416b01	Merge pull request #12: nginx for Element Call on call.chat.lotusguild.org (cinny #43)	2026-09-27 02:32:07 -04:00
Lotus CIandClaude Opus 5.5	9c5a183025	feat(cinny): nginx for Element Call on call.chat.lotusguild.org (cinny #43) ... - cinny/nginx.conf: a call.chat.lotusguild.org server block that serves ONLY /public/element-call/ (the same files chat.lotusguild.org already serves there) and 404s everything else, including source maps and dotfiles. - cinny/nginx-security-headers-call.conf (new snippet): frame-ancestors https://chat.lotusguild.org instead of X-Frame-Options SAMEORIGIN, which would block the now cross-origin parent. - cinny/nginx-security-headers.conf: the app's Permissions-Policy delegates autoplay/camera/display-capture/microphone to the call origin (without it the cross-origin frame's getUserMedia is refused). Outer quotes switched to single: the inner "origin" quotes broke nginx parsing. Nothing changes for users until config.json sets elementCallUrl (separate step). Snippets are installed by hand on LXC 106; nginx.conf deploys on merge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 23:24:32 -04:00
Lotus CIandClaude Opus 5.5	1dccca914c	landing: re-verify every client claim (reviewed 2026-09-26) ... Each client's card and all 64 table cells were checked against its latest release (source at the release tag, changelogs, official docs): Cinny v4.12.7, Element Web v1.12.29, Element X 26.09.2, FluffyChat v2.9.5, Commet v0.5.0, Nheko v0.12.1. ~95 cells corrected, notes tightened, chips made consistent (platforms / SDK / one calling chip). Notable: - Cinny: calls, voice rooms and screenshare via Element Call are stable (card gained the calling chip); ring, who-reacted, read receipts: yes; polls: no. - Element X: cannot START a screenshare (mobile web views have no getDisplayMedia) — chip is now "Voice & Video". - FluffyChat: threads, pinning, media gallery, custom status, QR invites: yes; calls still experimental (DM-only, legacy 1:1). - Commet: web app + Windows/Linux, no macOS; screenshare, widgets (v0.5.0), favourites: yes; "Beta" chip dropped (not self-described). - Nheko: calls are 1:1 only and only in Linux builds; threads: yes; no release since Aug 2025. - Element: no bookmarks or scheduling; custom status is Labs; QR invites and sort order: yes. - Lotus Chat: Vodozemac yes (Rust crypto), widgets yes, push = only while open (no background push yet); desktop app is Windows + Linux (the feature list said macOS). - Vodozemac is yes for every js-sdk client now (Rust crypto). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 16:53:07 -04:00
Lotus CIandClaude Opus 5.5	f0017f4d5a	landing: structured feature groups, single-source comparison table (#11) ... - The ~1,800-word fork paragraph becomes 7 titled groups, one short line per feature, plus a link to LOTUS_FEATURES.md. - Single source: landing/data/features.json + comparison.json, rendered into index.html by landing/build.py between BEGIN/END markers (all 71 table rows re-render with identical cell text). - CSS moved to landing/style.css; build.py inlines it because the LXC 139 deploy copies index.html only. - "Client comparison last reviewed" stamp driven by comparison.json. - CI job `landing-fresh` fails if index.html drifts from its sources. - Feature list brought up to date: 629 avatar decorations in 28 categories, mic level meter + remembered per-person volume, search operators, paste-as-code, thread "Mark all read", pinch-zoom/swipe media viewer, room widgets with a permission prompt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 15:11:50 -04:00
Lotus CIandClaude Opus 5.5	e28256ab3a	docs: note the Element Call headers exception ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 19:26:52 -04:00