What's new.

Fixed

• Published public forms now open in external website embeds without forcing respondents through employee or beta sign-in.
• Anonymous visitors can submit responses, register engagement events, and add or remove form uploads on published forms.
• Existing published form links and iframe embed snippets remain unchanged.

Security and compatibility

• Creator beta gating remains enabled for the builder, workspace administration, and private APIs.
• Unpublished, archived, closed, and quota-exhausted forms continue to use existing publication, validation, and response limits.
• Public framing exceptions apply to the published form route; application and authentication screens remain protected.

Verification

• Added regression coverage for published public routes and framing configuration. Live external-domain iframe verification is required after deployment.

Fixed

• The public /changelog page now displays the official Markdown release history instead of an outdated hard-coded page.
• The latest release appears first, with earlier feature, improvement, security, and limitation notes following.
• Synchronized stale public release metadata with the current application version.

Improved

• Added a deterministic release-data generator and a build-time consistency check. Future application and Cloudflare builds reject a changelog that does not match the latest package version or checked-in public release data.
• Updated the public changelog browser regression test to verify the latest version and earlier releases.

Compatibility

• No change to form submission handling, authentication, or workspace permissions.

Added

• Added a centered visual logic canvas with draggable question nodes, visible connections for existing rules, and drag-to-connect or click-to-connect actions that save conditional visibility rules. The standard logic editor remains available for AND/OR groups, comparisons, show/hide actions, and precise rule editing.
• Added keyboard movement and focus handling for the visual logic dialog, including Escape to close.
• Added working Workflow controls for submission confirmation, submit button text, maximum response count, scheduled closing, and closed-form messaging. These use the established form settings and validation paths; external notifications and approvals remain deferred.
• Added a modular Live Display Studio with nine tile types, including responses, views, starts, completion rate, goal progress, form QR, heading, announcement, and last sync status.
• Added tile reordering via drag-and-drop and accessible move controls, plus add/remove actions and configurable 12-tile limit.
• Added new display color accents, light and dark backgrounds, and custom announcements. Tile order and design options persist in validated display URL settings.
• Refreshed form-builder block cards with clearer selected states, polished choice controls, dropdowns, sliders, NPS previews, and type labels.
• Added regression tests for display tile settings and saved layouts.
• Added a pull-request CI guard requiring a changelog change whenever application or package code changes.

Limitations

• Visual connections currently create “show target when source is answered” rules; the detailed editor controls other operators and actions. Moving graph cards is a local editing visualization, not persisted layout across sessions.
• Workflow actions are limited to the form's existing submission and closing behaviors. Email notifications and approval automations are not enabled.
• Display customization is stored in the viewer URL, which continues to require the existing form analytics permissions.

Release verification

• Production deployment and automated release checks are tracked separately in GitHub Actions. Interactive signed-in browser QA of the visual editor and display drag-and-drop remains necessary.

Added

• Added 20 new form templates (50 total), including robotics, events, research, creator collaborations, and operations. Template validation guards against duplicate slugs and invalid definitions.
• Added a fullscreen control for Live Displays with escape-key compatibility and clear fallback messaging on unsupported browsers.
• Added delete controls for dropdown, multiple-choice, and checkbox options, retaining at least one required option and using collision-resistant IDs for new choices.
• Added six design presets and a read-only visual logic map in the builder. Existing logic rule editing remains authoritative.
• Added ten form blocks: phone, time, month, week, slider, NPS, percentage, currency amount, color, and a highlighted callout. Included server-side answer validation and analytics support.
• Expanded conditional logic with AND/OR groups and numeric greater-than/less-than comparisons.
• Added a live engagement panel with five-second refresh, completion and start rates, and a disconnected state.
• Expanded signed-in Home with recent forms, weekly response activity, and management shortcuts.
• Replaced the Settings placeholder with a workspace/account overview and links to existing management tools.
• Added create/switch controls for up to two owned workspaces per account, with a membership-validated selection cookie, same-origin writes, and protected private-beta workspace boundaries.

Not in this changeset

• The logic map is read-only. Visual drag-to-connect branching, scoring, calculated fields, and alternate ending screens are not implemented.
• Live analytics currently refreshes aggregate engagement every five seconds; historical segmentation, true unique-visitor funnels, and cohort reporting are not included.
• Workspace management supports creation and switching, but does not yet include workspace deletion, renaming, or permission editing beyond existing member-management tools.

Release verification

• Automated checks and deployment must be confirmed separately. Interactive signed-in browser QA is still required for workspace switching and published form workflows.

Added

• Expanded authenticated Live Displays with real-time aggregate form views, form starts, submission totals, and completion rates.
• Added dashboard and spotlight layouts, violet/teal/blue accents, selectable statistics, and optional submission goals with progress visualization.
• Added an optional QR code linking directly to the published form, respecting the existing controlled beta access policy.
• Enabled portable display configuration through validated URL parameters; no database migration or new public display access is required.

Verification

• Automated CI, deployment and in-browser checks must pass before considering this release live.

Fixed

• The release update watcher now compares the manifest against the version actually bundled in the client instead of a potentially stale build-time environment fallback.
• The update banner clears if the latest manifest matches the current client, including after refreshing into an updated release.
• The release manifest uses the package version as its canonical version source to prevent drift between build and production configuration.

Verification

• Release safety checks and deployment status must be verified in GitHub Actions; the release date is not evidence of a successful deployment.

Added

• Added an authenticated full-screen Live Display for form submission counts, accessible from form analytics.
• Added a scoped, aggregate-only display endpoint; individual answers and respondent details are not exposed.
• Displays automatically refresh every five seconds and show a disconnected state during network failures.

Scope and verification

• Private display requires the same analytics authorization as the source form. Public sharing, donations, and goal tracking are not included.
• The release is gated on automated checks and the production deployment workflow; this changelog is not evidence of a successful deployment.

Improved

• Reduced duplicate session and workspace membership reads during server rendering while keeping authentication and tenant authorization checks on the server.
• Added cursor pagination for forms, workspace members, and response-form lists. Form list queries select only the metadata needed by the table.
• Cached validated published form definitions by immutable publication version. Response quota checks remain uncached and are read fresh.
• Added D1 indexes for workspace form ordering and workspace member ordering based on observed query plans.

Operations

• Enabled Cloudflare Workers Issues detection and query-string redaction in the Worker configuration.
• Cloudflare CPU telemetry remains available in Workers Observability. Beacon alert delivery was not configured because the authenticated ingestion contract was unavailable for this release.

Compatibility

• Preserved workspace authorization, public submission endpoints, form response storage, and the /api/forms JSON array response. The API provides pagination links in response headers.

Added

• Added an adaptive builder workspace with searchable, categorized components, page and section navigation, and field properties.
• Added editable sections and questions with supported field insertion, duplication, reordering, deletion, autosave status, and a preview that follows the same form schema.
• Added a design studio with safe theme presets, color, typography, width, card styling, and classic, multi-step, and conversational presentation choices.
• Added shared public-form presentation modes with step progress, Back/Next navigation, per-step validation, and server-validated submission through the existing response flow.

Changed

• Preserved existing fields, form settings, authorization, immutable published versions, and submission storage. Added only optional schema properties; no database migration is required.
• Updated the current-release labels and public manifest for v0.2.0.

Deferred

• Multi-column canvas layout, cover and logo asset uploads, workflow automation, and a template marketplace remain deferred because the current schema or safe asset/workflow architecture does not support them.

Security

• Theme values use constrained schema fields and native color controls; custom CSS and HTML are not accepted. Existing server-side validation and workspace authorization remain in place.

Breaking

• No form submission, response storage, URL, or public API contract changes.

Added

• Added a versioned read API for workspace forms and submitted responses, protected by scoped, expiring, revocable API keys.
• Added the Developer / Integration area for managing API keys and response-submission webhooks.
• Added signed webhook deliveries with encrypted signing secrets, bounded retries, and a published API reference and OpenAPI document at /docs and /openapi.json.

Security

• API keys are stored as hashes and checked against workspace authorization and explicit scopes. Webhook signing secrets are encrypted with the Cloudflare WEBHOOK_SECRET_ENCRYPTION_KEY secret.
• Webhook payloads exclude response answers. Delivery uses HTTPS-only destinations, manual redirect handling, and a bounded timeout.

Breaking

• No existing form submission or URL contract changes.

Added

• Added dedicated analytics for each form, including response totals, completion and participation metrics, and question-level answer summaries.
• Added visual response charts, including trend graphs and pie charts for choice distributions, alongside detailed breakdowns for individual questions.
• Added 25 form templates across common event, education, business, customer feedback, and planning workflows.

Changed

• Analytics are scoped to the selected form so response data and visual summaries stay tied to the form being reviewed.
• Template browsing now includes 25 additional ready-to-edit starting points.

Security

• Analytics continue to use workspace-authorized form data; no public response access or authorization changes were introduced.

Breaking

• No URL or submission API contract changes.

Added

• Added a per-form Responses landing page with each form's submitted-response count and a direct link to review its responses.
• Added a confirmed, per-response delete action for authorized workspace Owners and Admins.

Changed

• Linked response counts in the forms list to the matching form's response page; counts now include submitted responses only.
• Form response pages show submitted responses with individual detail links and CSV export.

Security

• Response deletion is authorized on the server, constrained to the active workspace, removes associated uploaded files, and records an audit event.
• Response deletion remains unavailable to roles without the response.delete permission.

Breaking

• No URL or submission API contract changes.

Changed

• Renamed the product Helios Gather (short name: Gather), part of the Helios product family and Helios Array suite; its former name was Helios Forms.
• Applied the violet and midnight brand palette, the supplied Helios Gather logo, updated app icon, and Inter typography across the product surfaces.
• Updated product positioning to Spreadsheets & Data Analysis while keeping current capability descriptions accurate to structured form collection and response analytics.
• Preserved existing authentication, authorization, workspace, API, and published-form behavior.

Security

• No authentication, authorization, tenant boundary, or data handling changes.
• Public release metadata contains only product name, version, channel, and release date.

Breaking

Release dates are recorded as dates only after the corresponding update is pushed or deployed. The v0.1.0 release predates this date-recording policy; its exact push date was not recorded.

• No URL or API contract changes. Historical release notes retain their original product name.

Fixed

• Aligned the OAuth request with the registered organizations OIDC scope and read the matching Lucion Global organization role from the documented UserInfo claim.
• Removed the undocumented membership endpoint and the email-domain restriction; a verified email is accepted only when the Identity claim confirms the configured Lucion Global organization administrator role.

Security

• Non-admin member claims remain denied because Identity normalizes other organization roles, including Guest, to member; no Forms session is created for ambiguous or malformed claims.

Breaking

• Lucion Global non-admin accounts cannot use Forms Identity sign-in until Identity exposes a role claim that distinguishes regular members from Guests.

Fixed

• When Identity returns Guest, an unknown role, or no matching Lucion Global membership, the callback removes the linked user's Forms workspace membership and revokes existing Forms sessions before denying sign-in.

Security

• Prevented a previously issued Identity admin-role projection from surviving a later denied Identity callback.

Breaking

• None.

Added

• Connected Helios Forms staff sign-in to the public Lucion Identity client using OpenID Connect Authorization Code with PKCE and the exact production callback.
• Added the shared Lucion Global Forms workspace under the Lucion Global organization in the production Forms database.
• Added server-side lookup of the signed-in user’s Lucion Identity organization memberships for the configured Lucion Global organization.

Changed

• Configured the public Lucion Identity client ID, callback, organization, and Forms workspace as nonsecret Cloudflare Worker variables. No client secret is required for this public PKCE client.
• Advanced Helios Forms from v0.1.2 to v0.1.3 and aligned the public manifest, production and development versions, release banner, changelog, current site labels, and footer.

Fixed

• Forms now grants workspace access only when a verified Identity membership matches the configured Lucion Global organization and maps to a supported Forms role.
• Guest, unknown, mismatched, malformed, oversized, or unavailable membership data fails closed and cannot create an authorized Forms session.

Security

• The integration requests only the OIDC sign-in scopes and the read-only, self-scoped identity.organization.read API permission needed to resolve the user’s own memberships.
• Membership lookup uses a fixed Identity endpoint, bearer-token authorization, a ten-second timeout, and a bounded response size. Tokens remain server-side.

Breaking

• None.

Added

• Published a detailed public release history on /changelog for v0.1.2, v0.1.1, and the v0.1.0 Foundation release.
• Added dated release metadata and clear Added, Changed, Fixed, Security, and Breaking sections to the v0.1.2 notes.
• Added changelog-specific responsive styling for release sections, category headings, dates, and nested lists.

Changed

• Advanced Helios Forms from v0.1.1 to v0.1.2 using the required one-step patch successor.
• Aligned the root package, public release manifest, production and development Wrangler configuration, release API fallback, client watcher fallback, shared footer, About page, Status page, and Security page with v0.1.2.
• Kept the Lucion Release Update Banner active with the public /release-manifest.json endpoint. Returning clients on an older build can detect v0.1.2 and refresh.
• Updated the Security overview to disclose that Identity integration code exists but production SSO configuration is absent; the staff sign-in path remains unavailable.

Fixed

• Fixed the public changelog page and shared footer reporting v0.1.0 after v0.1.1 had shipped.
• Replaced the changelog page's single Foundation summary and undated forward-looking paragraph with a dated history of shipped capabilities and known release limits.
• Corrected current-release version labels on the About, Status, and Security pages.

Security

• The public manifest continues to expose only product release metadata and uses Cache-Control: no-store.
• No security controls were added in this release. Previously recorded upload-abuse, retention, orphan-cleanup, dependency-audit, and production Identity configuration findings remain open.

Breaking

• None.

Prepared: 2026-10-15

Added

• Added a File upload field to the form builder. Form owners can set a one-to-three file limit and choose PDF, JPEG, and PNG types.
• Added FilePond upload controls to published forms, with a 5 MB per-file limit and server-side MIME and file-signature validation.
• Added private D1 BLOB storage for uploads using one-megabyte chunks, with a 100 MB deployment-wide quota and workspace-authorized downloads from response details. Uploads are tied to the published form field and cannot be attached to another form or field.
• Added upload metadata migrations for D1 and local SQLite.
• Added a release-version command and tests for the requested version cycle: 0.1.0 → 0.1.1, 0.1.9 → 0.2.0, and 0.9.9 → 1.0.0.
• Added the Lucion Release Update Banner styling and dependency disclosures for FilePond.
• Added an internal Legal Product Profile that records confirmed file-upload flows and leaves unresolved legal facts explicitly blocked for review.
• Added a role-aware /admin staff console for Lucion Global with distinct Owner, Admin, Manager, Member, and Guest views.
• Added a Lucion Identity OpenID Connect sign-in flow using discovery metadata, Authorization Code with PKCE S256, one-time state, nonce validation, and server-side session roles.
• Added local setup guidance for the Forms client registration, exact HTTPS callback, stable organization ID, and verified role and organization claim paths.

Changed

• Updated the product version and public release manifest to 0.1.1.
• Exposed the Lucion Release Banner manifest at /release-manifest.json with no-store caching and retained the existing API path as a compatibility alias.
• Updated the privacy notice, terms, and security threat model to describe file handling and its current limits.
• Updated the release watcher to follow the supplied Lucion banner contract while preserving non-forced refresh behavior.
• Updated workspace authorization so Member sessions can create and publish forms they own, read submitted responses, and access analytics while team administration remains restricted.
• Replaced the unavailable R2 dependency with chunked D1 storage so file upload does not require a separate R2 subscription.
• Updated Lucion Global Forms roles so Members can read submitted responses, while Managers and Admins can also export and manage submissions; Owner keeps full access and Guest remains denied.
• Mapped Identity Members and Managers to dedicated server-side workspace roles so their response permissions do not broaden legacy Editor or Form Creator memberships.
• Added a Forms-only role projection that maps verified Identity organization roles to the app's workspace permissions.
• Added the organizations OIDC sign-in scope to the Helios Forms authorization request and registered client, so Identity can return consented organization context.

Fixed

• Reject uploads whose file signature does not match an allowed PDF, JPEG, or PNG content type.
• Restrict response file downloads to authorized workspace members and only to files attached to that response.
• Keep a successfully processed FilePond upload in the submitted answer so its stored file remains linked to the response and available for authorized download.
• Fail closed for absent, Guest, mismatched-organization, or unrecognized Identity role claims; no staff data is rendered without a server-verified role.
• Limit Identity staff sessions to one hour and keep state, nonce, PKCE verifier, tokens, and confidential-client configuration on the server.
• Keep role resolution fail-closed: the organizations scope exposes organization context and administrator status, but does not by itself establish the app's five distinct role assignments.
• Keep external API-key and webhook administration unavailable until those features and their permissions are implemented; this release grants no API-management capability.

Security

• File objects are private and served as forced downloads with no-store and nosniff headers.
• Uploads are not ready for broad production use until durable public-upload abuse limits, orphan cleanup, and an approved retention schedule are established. D1's deployment-wide quota limits database growth but does not replace those controls.

Breaking

• None.

• Added temporary email/password sign-in and account creation with server-side PBKDF2 hashing, per-account workspace provisioning, and shared Helios sessions.
• Added the Lucion Identity OAuth/OIDC authorization-code + PKCE adapter with D1-backed one-time state, JWKS ID-token validation, verified userinfo claims, and Helios session issuance.
• Added explicit Identity workspace/email admission configuration; the adapter fails closed until registered client credentials and deployment values are supplied.
• Added a TypeScript monorepo, versioned form model, field registry, standalone logic engine, workspace authorization boundary, and release-manifest contract.
• Added a workspace shell, forms dashboard, templates, navigation, and responsive three-panel builder with inspector editing, drag-and-drop and keyboard reordering, undo/redo, preview, autosave, optimistic revision conflicts, and publication.
• Added a public published-version renderer with server-side validation, conditional show/hide logic, response persistence, idempotency, and accessible completion/error states.
• Added workspace-scoped response tables, version-aware CSV export with formula-injection mitigation, audit events, and event-backed analytics.
• Added post-publication sharing with stable public links, branded QR downloads, workspace collaboration invitations, and a public Contact page powered by the form renderer.
• Added Prisma schema, D1/SQLite migrations, security documentation, and unit, integration, end-to-end, and accessibility test scaffolding.