What has changed

All notable changes to this project will be documented in this file. The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

Added

• —infra: HAProxy (port 8080) + Caddy reverse proxy (ports 80/443) serving all three Astro static apps via systemd services (`verbitas-landing`, `verbitas-web`, `verbitas-docs`) on ports 4321–4323; Cloudflare DNS A records for verbitas.io, www, v, verify, console, and docs subdomains all set to proxied mode pointing at 195.201.225.182

• —`apps/docs`: Complete developer documentation site — 33 new pages: Introduction, Quickstart, Concepts (Provenance & C2PA, Watermarking, Verification States, Recipes), API Reference (Authentication, Sign, Verify, Lookup, Recipes, Audit Log, Errors), SDK Guides (Python, TypeScript, Go), MCP Server (Overview, Installation, Tools Reference, Security), Guides (First Sign, EU AI Act, BYOK KMS, Webhooks, Custom Recipes, Enterprise Onboarding), Reference (Verification States, Meter Kinds, Recipe Schema, OpenAPI), and Compliance (Positioning, GDPR, Sub-Processors); Starlight dark editorial theme with Verbitas OKLCH palette and Instrument Sans / JetBrains Mono typography; `src/content/config.ts` with Starlight docs collection schema; `@astrojs/[email protected]` pinned for Astro 4 compatibility; build passes with 57 pages

• —`apps/landing` complete marketing site: 38 pages covering homepage, pricing, verify, developer/enterprise/AI-company/newsroom/compliance audience pages, product pages (API, SDK, MCP, watermark, C2PA), blog hub with 5 sample posts, changelog page, and programmatic SEO routes for industries, use cases, comparisons, and frameworks — built on Astro 4 + Tailwind + React with the Verbitas dark editorial navy design system (Cormorant Garamond / Instrument Sans / JetBrains Mono, OKLCH palette), sitemap generation at `sitemap-index.xml`, and all copy/disclaimer rules from `COMPLIANCE-POSITIONING.md` enforced throughout

• —`apps/web` complete redesign: dark editorial navy design system (Cormorant Garamond / Instrument Sans / JetBrains Mono), public provenance verifier with multi-signal breakdown, manifest permalink pages (`/m/[manifest_id]`), widget embed documentation, security policy page, and full admin console (`/console/*`) with dashboard, asset browser, audit log, billing, settings (API keys, webhooks, KMS, team), recipe editor, and tenant management gate — all building to static output with `pnpm build`

Fixed

• —G-E3: charge.dispute.created webhook now freezes tenant status in DB (was only logging SECURITY_ALERT)

Changed

• —infra: Split `console.verbitas.io` Caddy route from verifier — now issues a `302` redirect from `/` to `/console/` before proxying to port 4322, so visiting the console subdomain lands on the admin console instead of the verifier homepage
• —infra: Fixed `verbitas-docs` systemd service — removed `-s` SPA-fallback flag from `serve` command (Starlight generates per-page HTML, no fallback needed) and corrected `npx` path to `/usr/bin/npx`; added Caddy-level `redir / /introduction/ 302` for the docs root so bare domain redirects cleanly
• —infra: `docs.verbitas.io` root `index.html` now uses a `