Changelog

What's new in Starh AI. Newest first.

> Backfill note (2026-06-25): entries between 2026-05-19 and 2026-06-24 were reconstructed from git log on main during a docs-to-reality reconciliation. All of the below is committed and live on starhacademy.com.

• ●New: `/admin/content-library` — a central place to upload documents (PDF, DOCX, PPTX, HTML, Markdown) instead of attaching them to one lesson at a time.
• ●"Build course" action — turns an uploaded file straight into a new draft course (unpublished, admin reviews and publishes when ready), reusing the existing content-transformation pipeline.
• ●This revives and finishes a build from 2026-09-02 that was completed but never merged — see SHARED_STATE.md for the full story. Not yet manually smoke-tested by a human — treat as freshly shipped.

Demo-prep session. Migrations 047–050, all applied to production and verified live.

Fixed

• ●Course creation was failing — the courses table's unique slug constraint didn't exclude soft-deleted courses, so recreating a course with a previously-used (and deleted) title threw a raw database error. Fixed with a partial unique index scoped to non-deleted rows.
• ●Cross-org account takeover via `org_members` — the insert policy didn't check org_id or role, only that you were inserting yourself. Any signed-in user could join any org on the platform as super_admin. Fixed in two passes: an initial fix scoped inserts to the org-creation and invite-match cases, then a follow-up (caught by automated review) closed a remaining gap where invite matching didn't check the actual invite token — redemption now goes through an atomic, token-keyed database function.
• ●Cross-org SCORM file access — leftover overlapping storage policies meant any org member could read, and in some cases delete, any other org's SCORM course files. Consolidated into org-scoped policies.

Changed

• ●SCORM upload limit raised 200MB → 1GB, with matching increases to function timeout and memory so large packages have a realistic chance of processing. Not yet load-tested with an actual large file.

Process

• ●Found and reconciled two migrations (045, 046 — a content-library feature) that had been applied to production on 2026-09-02 but never committed to this repo.
• ●CONTRIBUTING-AI.md corrected — it previously described pushing straight to main, which contradicted its own "never push to main directly" rule. main is now protected on GitHub; every change goes through a PR.

A large rework of the People/Performance area (design + capability). Migrations 033–040.

Design (Lattice-grade)

• ●New Person Profile drawer — click anyone anywhere to see their Overview / OKRs / Skills / Reviews / 1:1s / Recognition, aggregated live. Names across every tab open it.
• ●Refined tabs, Directory (summary strip + progress table + ⋯ quick-actions), and a new org-chart Organogram (top-down tree) alongside the List view.

Capability

• ●People works for learners now (added to their nav) with a role-aware Directory; admins keep the progress/stats view.
• ●OKR visibility — owner-controlled private / team / public.
• ●Admin edit-in-drawer — super-admins change a person's role + manager inline.
• ●Learner dashboard "Your team" — manager + peers + reports, upcoming 1:1s, and goals.
• ●The 1:1 system — schedule with a template (Weekly / Performance / Skill / Feedback + custom builder), a structured meeting form (template questions, action items, notes), and transcript-upload → AI autofill (paste a Google Meet transcript; Claude fills the summary, action items, and answers). Built so Google Meet OAuth can auto-pull transcripts later.

Uploads

• ●SCORM cap raised 200MB → 1GB (video already uploads direct to Mux). Large document upload (>4.5MB) still pending a direct-to-storage refactor.

> Build-gated + deployed per slice. Not yet visually smoke-tested — see SHARED_STATE.

Built after Sprint 9 (Samid's resequencing; the Sprint 12 gate was explicitly overridden). Scoped to OKRs only — body-language (MediaPipe) and the multi-layer readiness scorecard were not selected.

• ●Cascade OKRs — company → team → individual objectives with parent linking and progress roll-up, on a new OKRs tab in /people. Admins own company/team objectives; anyone owns their individual ones.
• ●Key results — each objective holds key results with a progress bar; a key result can link to a skill (Sprint 9), tying goals to the skill system. Objective % rolls up from its key results.

> Migration 038 applied to the live DB. Build-verified; not yet visually smoke-tested.

Built ahead of Sprint 8 (Samid's resequencing). Everything lives in an expanded /people hub (Directory · Org chart · Recognition · 1:1s · Reviews · Skill sign-off). No Hume tone scoring this sprint (deferred).

• ●Org chart — assign each person a manager (org_members.manager_id) and see the reporting tree.
• ●Manager skill sign-off — the AI Instructor now scores learners on the course's skills at the end of a session and files them as proposed (server-side, so they can't be self-forged). Managers/admins approve or dispute; only approved skills show to the learner (on /profile/skills). This is where AI skill scoring finally lands in the DB (Sprint 7 was verbal-only).
• ●Recognition Board — give peer kudos; org-wide feed.
• ●1:1s — managers schedule structured 1:1s with reports; both edit agenda/notes and mark done.
• ●Review cycles — admins open a cycle → one review generated per manager→report pair; reviewers submit summaries.

> Migrations 033–037 applied to the live DB. Build-verified (typecheck + lint + 32 tests + prod build on every slice) but not yet visually smoke-tested.

AI Instructor 2.0 (part 2)

• ●Full-screen "Teach me" mode — tapping "Walk me through this" opens a full-screen split (instructor on the left, narration on the right). The AI narrates the lesson and the words highlight in a karaoke read-along synced to ElevenLabs character timestamps. Pause/Resume/Exit; falls back to plain narration if timestamps aren't available.

• ●Content navigation — when the instructor's answer points at a part of the lesson, the lesson content now scrolls to that phrase and briefly flashes it (block/document/text lessons).

Content Transformation (generalised)

• ●"Convert to editable blocks" now works on Document, PowerPoint, and Video lessons, not just SCORM. Document imports (PDF/Word/PowerPoint/HTML/Markdown) have their text extracted at upload, and videos use the Mux transcript — so any of them can be rebuilt into editable text/callout/quiz blocks in one click.

> Compile/build-verified but not yet visually smoke-tested (needs a running app + live ElevenLabs). Remaining Sprint 7 polish, deferred pending on-device testing: highlighting keywords inside the lesson content panel during Teach-me (shipped as narration read-along instead), and video seek-to-timestamp for content navigation.

AI Instructor 2.0 (lesson-player instructor)

• ●Voice greeting on open — opening the instructor now speaks a short greeting (once per lesson, respects mute; primed for iOS inside the click).
• ●Suggestion chips — four starter chips ("What does this lesson cover?", "Test my knowledge", "Walk me through this", "Key takeaways") appear on open; tap to send. They disappear once the conversation starts.
• ●Tappable assessment cards — when the instructor quizzes you, the A/B/C options render as tappable cards instead of plain text; only the latest question is answerable, and the voice reads just the question.
• ●Spoken session summary — an "End & summarise" button gives a short spoken wrap-up of which of the course's skills you showed vs. should practise (no scores recorded — that's a later sprint).
• ●TTS timestamp support — /api/tts can now return character-level alignment (foundation for the upcoming live keyword-highlighting mode); default audio path unchanged.
• ●Fully bilingual (en/ar) + RTL. No DB migration. Grounded in the existing lesson-coach route (which already reads block/SCORM/video/quiz lessons).

Infra

• ●Deploy-author guard — git hooks (.githooks/pre-commit + pre-push, via core.hooksPath) refuse commits/pushes under any author other than samid@starhacademy.com, after a misconfigured identity silently blocked ~2 weeks of Vercel production deploys. Documented in CONTRIBUTING-AI.md.

Cleared the open audit log (2026-07-01 audit) and actioned the Supabase security-advisor digest. Branch fix/audit-open-and-supabase-security.

Fixed

• ●Voice barge-in is now reliable — pressing the mic, closing the panel, or muting during the brief TTS-fetch window no longer plays a sentence over you. useVoicePlayback now carries a generation counter and discards any request that resolves after an interruption.
• ●AI Instructor voice unified — the lesson-page instructor (AIInstructorAvatar) now uses the same shared, sentence-chunked playback hook as the course panel (UnifiedAI), so their behaviour can't drift and long answers stream sentence-by-sentence.
• ●`/api/mux/status` rate-limited — the upload-status poll is now capped (60/min) so it can't be hammered.

Security (database — migration `032_security_advisor_hardening.sql`, applied to live DB)

• ●Notification forgery closed — the notifications INSERT policy no longer let any signed-in (or anonymous) user create notifications for arbitrary users; inserts are now restricted to members acting within their own org.
• ●Org insert tightened — creating an organization now requires created_by = auth.uid() (was unrestricted).
• ●Internal DB functions locked down — handle_new_user (auth trigger) is no longer callable via the public API; current_user_org_role is no longer callable by anonymous clients; search_path pinned on three functions.
• ●Cleared 9 of the 12 advisor warnings. Two are deliberately deferred (public session-recordings bucket listing; Auth leaked-password protection — a dashboard toggle) and tracked in audits/AUDIT_OPEN.md.

From Samid's hands-on review (23 items). Merged to main and deployed to starhacademy.com on 2026-06-29. Spec: docs/specs/2026-06-26-system-stabilization-batch.md.

Fixed

• ●Voice no longer cuts off — scenario and AI Instructor now speak the full reply, not just the first sentence (instructor 500-char truncation removed). Shared, unit-tested sentence chunker.
• ●AI Instructor controls — mic reads green/live (not red), pressing the mic interrupts the avatar, and closing the panel / muting stops the voice. Applied to both the lesson instructor (AIInstructorAvatar) and the course one (UnifiedAI).
• ●Scenario generation — killed the repeated-"Chen" name bias (now culture/region-matched & varied); added a one-click role Swap ("You play" vs "The AI plays") to fix backwards generations.
• ●Lesson navigation — Prev/Complete buttons are now a sticky footer (stop drifting); the floating instructor no longer overlaps Mark complete; finishing a roleplay returns you to the lesson/course instead of dead-ending.
• ●Quiz — questions can have as few as 2 answer choices (was wrongly requiring all four slots filled).
• ●PDF lessons are labelled PDF, not "document".
• ●Performance — dashboard enrollment N+1 removed, course load parallelized, route loading skeletons added.

Added

• ●AI Instructor reads block lessons + the whole course (shared serialiseBlocks; lesson-coach is now course-wide).
• ●Roleplay Training vs Assessment mode — Assessment gates lesson completion on the passing score; Training always completes. Set in the scenario builder.
• ●Voice picker filters — gender + accent filters over the live ElevenLabs list.
• ●AI Instructor avatar + voice unified with roleplay — same photo set + same voice picker, chosen in Settings → AI Instructor (stored as JSON in the existing column — no migration).
• ●Mux upload status — uploader polls and shows "Ready" when the video is playable.
• ●Reports — visual facelift (icon stat cards, completion bars) ahead of the dedicated reports revamp.

Notes

• ●No DB migration required. organizations.ai_instructor_avatar now holds JSON for customized instructors (legacy preset ids still parse).
• ●Build-verified (typecheck/lint/build/unit) before merge. Live verification on starhacademy.com in progress — if anything regresses, Vercel instant-rollback restores the previous production deploy.

Added

• ●Rise-like interactive blocks — lessons can now use tabs, accordions, flip cards, and image hotspots, not just text and media. Richer, more interactive lessons without leaving the builder.
• ●Content-freshness monitoring — courses can track a source URL and flag when source material may have changed, so content doesn't silently go stale.
• ●AI course-health sweep — an AI pass that scores course quality and surfaces gaps (missing assessments, thin lessons, outdated material).
• ●Skills system upgrade — skills now carry rubric levels and scoring descriptors, backed by a library of 124 universal skills.

Added

• ●Question bank with AI generation — build a reusable bank of questions (MCQ, true/false, short answer, scenario). Claude can generate questions for you; pull them into any quiz from a picker.
• ●Skills library — full org-level skill CRUD with AI suggestions on courses and Conversation Lessons; earned skills now flow onto certificates.
• ●SCORM → editable blocks migration wizard — convert a SCORM package into a native, editable block lesson. Claude Haiku generates the blocks from the extracted text, so legacy content becomes editable instead of locked in a black box.
• ●Trial-gate polish + bank-transfer billing — clearer app-wide trial banner and a bank-transfer billing page (first customers pay by transfer; Stripe comes later).

Changed / Performance

• ●Much faster Conversation Lessons — /api/chat switched to Claude Haiku, the response now streams, TTS starts on the first sentence instead of waiting for the whole reply, and a warm-up ping on page load removes the cold-start pause. The voice loop feels real-time.

Added

• ●Full Arabic (RTL) translations across the learner-facing app.
• ●AI Instructor conversational voice loop — voice input auto-sends, so the AI Instructor is a continuous spoken conversation rather than push-to-talk.

Fixed

• ●SCORM lessons now auto-mark complete when the SCO reports completion.
• ●Conversation Lessons correctly mark progress after the roleplay finishes.

Added

• ●Full-screen lesson viewer and a redesigned learner dashboard.
• ●PDF storage for document lessons.

Fixed

• ●Course-builder textarea focus, PDF upload reliability, SCORM bucket config, light-theme toggle, and bundling the pdfjs-dist worker correctly in the Vercel Lambda.

Added

• ●Server-side SCORM upload with multi-file support and AI Instructor course mode (the coach understands the whole course, not just one lesson).

Security

• ●Fixed IDOR and Zip-Slip vulnerabilities in the SCORM upload route; staging path is now derived server-side. Two-phase upload resolves the 413 on large packages.

Added

• ●Rewritten homepage around the L&D-infrastructure story — full copy, pricing, FAQ, and proof.
• ●StarhAcademy logo implemented across nav/footer/favicons/OG image; brand tokens aligned to the logo blue (#2A93EC); Space Grotesk typeface.
• ●SEO/GEO: per-page metadata on all vertical landing pages, JSON-LD schema, sitemap.xml, robots.txt.
• ●New for-training-providers, about, and blog pages.
• ●301 redirect from starh-ai.vercel.app → starhacademy.com.

Added

• ●AI Content Import, Course Skills, and Live Sessions.
• ●UI/UX overhaul — inline content builder, "Ask Star" panel, a full theme pass, and a redesigned app shell + dashboard.
• ●Auth redesign — login, signup, and onboarding rebuilt on a shared AuthShell.

Changed

• ●Enforced the semantic colour design system across auth, admin, analytics, and all learner views (no more hardcoded colours).

Changed

• ●Finishes the nav unification from PR #36. The five /dashboard/* sub-pages (analytics, team, ask, settings, profile) had their own v1-style headers — a second nav system. They now all use the shared AppHeader. Page-specific controls (analytics period selector, team refresh, ask "new chat") moved into a sub-bar inside the content.

Known follow-up

• ●/billing still uses hardcoded bg-gray-950 colours instead of the theme system — it needs a full re-theme pass, not just a header swap, so it's deliberately left for a dedicated task.

Changed

• ●One nav bar, not two. The signed-in product had the v1 dashboard header and a bolted-on LMS nav stacked on top of each other. They're now a single unified AppHeader — logo, role-aware tabs, + Create dropdown, Ask Starh, theme toggle, role-preview, user menu — on every page.
• ●Role-aware navigation:

- Learner → Home · Learn · Practise - Instructor → + Assess · Reports · + Create ▾ (New course / scenario / assessment) - Super Admin → + Admin hub

• ●Role-aware Home. /dashboard is no longer the same scenario list for everyone:

- Learner → "Welcome back" + Continue learning + jump-in cards (Courses / Practise / Skills). - Instructor → Create shortcuts + a peek at their courses. - Super Admin → an org rollup strip (learners, enrollments, completion %, certificates) on top of the instructor view.

• ●New `/practise` page — the voice-scenario library (the grid that used to live on /dashboard) now has its own home, reached from the Practise tab.

Behind the scenes

• ●New components/lms/AppHeader.tsx; old TopNav.tsx removed. 14 LMS pages swapped over to AppHeader.
• ●Old v1 header items rehomed: Scenarios → Practise tab; Analytics → under Admin; Team / Billing → user menu.

Fixed

• ●Adding a section no longer uses a raw browser `window.prompt` — it was a native dialog that looked broken and out of place. Replaced with a proper themed in-app modal (PromptDialog).
• ●Delete confirmations ("Delete lesson?", "Delete section?") were raw window.confirm — now proper themed ConfirmDialog modals with a danger style.
• ●Light/dark toggle is now on every LMS page — it was missing from the courses list, course detail, lesson viewer, course authoring, and the new-course page. Added to TopNav (covers reports/assess/automations/certificates/skills) and as a fixed control on the pages without a TopNav.

Behind the scenes

• ●New components/ui/Dialog.tsx — ConfirmDialog + PromptDialog: Esc to cancel, Enter to confirm, click-outside to dismiss, focus management, busy state.

Added

• ●Rich-text lessons can now have real structure. The authoring textarea was plain text — even though the lesson renderer already supported headings, lists, bold, quotes and code blocks, authoring could only produce one flat paragraph. Now you write markdown and it converts to the full document shape.
• ●Supported: # headings, **bold**, *italic*, ` code , bullet & numbered lists, > blockquotes, `` fenced code blocks.

Behind the scenes

• ●New lib/markdown.ts — markdownToDoc() (markdown → renderer doc shape) and docToMarkdown() (reverse, for editing existing lessons). No TipTap/ProseMirror dependency. Verified against a multi-block fixture: all block types + inline marks + round-trip.

Added

• ●Course authoring was add-only — you could create sections and lessons but never remove or reorder them. Now:

- Delete a lesson — trash icon per lesson, with a confirm that spells out what else goes (quiz, survey, uploaded media, learner progress). - Delete a section — trash icon per section; confirm warns it takes the lessons with it. - Reorder lessons — up/down chevrons move a lesson within its section; disabled at the ends.

Behind the scenes

• ●New lib/lms.ts helpers: deleteLesson, deleteSection, swapLessonOrder, renameLesson.

Added

• ●The lesson viewer now has a sticky course outline down the left side — every section and lesson, with completion ticks, the current lesson highlighted, and one-click jump to any lesson. Turns the viewer from a prev/next slideshow into a real LMS.
• ●Outline header shows live course progress (X of Y lessons, % bar).
• ●Lesson header shows a "Completed" badge once done.
• ●Outline refreshes the moment a lesson is completed (mark-complete, quiz pass, survey submit, SCORM completion).

Behind the scenes

• ●New getAllLessonProgress(enrollmentId) in lib/lms.ts — one query for the whole enrollment instead of per-lesson.
• ●New CourseOutline component; lesson viewer restructured to a two-column layout.

Added

• ●The AI Instructor can now answer questions about SCORM lessons. Previously it RAG'd over rich-text content only — SCORM material lives inside an uploaded zip it couldn't see, so the coach was blind on those lessons.
• ●On upload, the browser (which already unzips the package) extracts the visible text from every HTML file in the package — strips <script>/<style>/tags, decodes entities, collapses whitespace, capped at ~40KB.
• ●That text is stored on scorm_packages.extracted_text (migration 014) and fed into /api/lesson-coach's context for SCORM lessons, exactly like rich-text lessons.

Behind the scenes

• ●Migration 014: scorm_packages.extracted_text.
• ●ScormUploader gained extractPackageText() — runs during the existing client-side unzip, zero extra round trips.
• ●/api/scorm/register accepts + stores the extracted text (server-side cap at 50KB).
• ●/api/lesson-coach resolves the lesson body from scorm_packages.extracted_text when lesson_type === 'scorm'.

Added

• ●The course.enrolled automation trigger now fires. When a learner enrols in a course, /api/automations/enrolled runs any matching automations (e.g. auto-enrol them in a prerequisite, award an onboarding skill). Server re-verifies the enrollment before firing — a client can't spoof a trigger for a course it never joined. Non-blocking: a broken automation never stops the learner starting the course.

Added

• ●Playwright smoke tests now cover everything shipped in PRs #19–#28: 16 tests total.

- All four vertical marketing pages render their hero + CTA. - All three legal pages render. - New API endpoints (quiz/survey submit, Mux upload, SCORM register, assess invite, certificate AI redesign) reject unauthenticated calls cleanly with a 4xx — never a 5xx. - Candidate-facing assess endpoints handle bogus magic-link tokens gracefully. - /assess/[token] with a bad token shows the friendly error state instead of crashing. - /changelog loads.

Changed

• ●Candidate assessment scores are now real — previously the candidate flow recorded a hardcoded placeholder score. Now the roleplay engine reports the actual AI-scored result back to the assessment.
• ●New endpoint POST /api/assess/record-scenario — token-validated, writes one assessment_results row per scenario with the real score-session output + transcript.
• ●/roleplay/[scenarioId] detects ?assess=<token> and reports the scored result after the session.
• ●/api/assess/submit now reads recorded results from the database and averages them — it no longer trusts any client-supplied score.
• ●Candidate page simplified: "I've finished" just advances; the score was already captured server-side by the roleplay tab.

Added

• ●`/legal/terms` — Terms of Service draft tailored to Starh AI (per-seat SaaS, AI voice + LMS, Dubai-registered): subscriptions/trials/billing, acceptable use, Customer Content ownership, AI-output disclaimer, liability cap, UAE governing law.
• ●`/legal/privacy` — Privacy Policy covering the real data flows: voice recordings + transcripts, third-party AI/voice processing, Supabase storage, Stripe billing, retention, and data-subject rights. States plainly that we don't sell data or train third-party models on Customer Content.
• ●`/legal/refund` — Refund Policy: free-trial-first, 14-day money-back guarantee, renewal-error handling, what's non-refundable.
• ●Footer links on the landing page and the signup consent line now point to the real pages (were href="#").

> Note: these are solid starting-point drafts and should be reviewed by counsel before Stripe billing goes live — especially the liability cap, governing-law clause, and voice-data retention period.

Added

• ●`/admin/certificates` — visual designer for the org's certificate template. Pick a preset (Classic / Modern / Bold / Minimal), tune accent / background / text colours, swap font pairs and border styles, live preview with sample data.
• ●AI redesign — paste a brand description ("Bold tech startup, deep teal + warm cream, sans-serif") and Claude Haiku returns a new palette + font pair JSON. WCAG-AA contrast enforced in the prompt.
• ●Shared `<CertificateRender>` component — used by both the designer preview and the public /verify/[code] page, so what the admin designs is exactly what learners and HR teams see.

Behind the scenes

• ●Migration 013: organizations.certificate_template jsonb with a sensible default.
• ●New endpoint: POST /api/certificates/ai-redesign (Claude Haiku, rate-limited).
• ●/verify/[code] now pulls the issuing org's template via a join — falls back to the default if the org's template JSON is missing or malformed.

Added

• ●`/for-training` — "An LMS where every skill is rehearsed, not just read" → emphasises Learn mode, replaces TalentLMS/Docebo/LinkedIn Learning.
• ●`/for-sales-enablement` — "Your reps practise the pitch before the call that matters" → emphasises Practise mode, competes with Yoodli/Second Nature/Quantified.
• ●`/for-recruitment` — "Assess candidates on real conversations, not just CVs" → emphasises Assess mode, competes with HireVue/Vervoe/Karat/TestGorilla.
• ●`/for-customer-service` — "Train your team on de-escalation before the angry call" → Learn + Practise blend for contact-centre and hospitality buyers.

All four lead into the same signup flow but show vertical-tailored hero copy, six features each, competitor replacement table, and social proof quote.

Behind the scenes

• ●Shared VerticalLanding component in components/marketing/ — same layout, six props per page.
• ●Each route includes SEO metadata (title + description) tuned for the vertical.

Added

• ●View as dropdown in TopNav — super_admins can preview the product as Instructor or Learner; instructors can preview as Learner.
• ●Amber banner at the top of every page during preview, with one-click "Exit preview".
• ●`useRole()` vs `useRealRole()` — the existing hook now returns the preview role for UI gating; a new useRealRole() hook returns the true DB role for permission checks before writes.
• ●Preview state persists across page navigation via sessionStorage, clears on sign-out.

Behind the scenes

• ●AuthContext gained previewRole + setPreviewRole; never touches the real DB role.

Added

• ●Automations engine — TalentLMS-style trigger → action rules. Build "if-this-then-that" workflows that fire when learners hit key events.
• ●Triggers (Phase 1): lesson completed, quiz failed, course enrolled, course completed, survey submitted, assessment passed.
• ●Actions (Phase 1): enrol in another course (auto-cascade), award a skill at any level, send email (stub), notify admin (stub).
• ●Admin UI at /admin/automations — toggle, edit, see one-line trigger → action summary.
• ●Synchronous evaluation — triggers fire inline from /api/quiz-submit, /api/survey-submit, /api/assess/submit, and /api/certificates/issue. No queue, no missed events.
• ●Run history — every fire is logged in automation_runs with success/failure status and error message.

Behind the scenes

• ●Migration 012: automations, automation_actions, automation_runs + three enums.
• ●runAutomations(event) in lib/automations.ts — idempotent action handlers (enrol checks for existing enrollment, skill upserts with on-conflict-ignore).
• ●Trigger config supports shallow filtering — e.g. only fire when courseId matches a specific course.

Added

• ●Assess Mode — magic-link candidate assessment competing with HireVue / Vervoe / Karat. Recruiter bundles voice scenarios + scoring rubric into an assessment, generates one-tap invite links per candidate, sees a ranked leaderboard of completed candidates with pass/fail vs threshold.
• ●Magic-link invites — POST /api/assess/invite mints 128-bit hex tokens; recruiter copies link directly from the UI (email-send integration coming PR #23).
• ●Zero-signup candidate flow — /assess/[token] is fully public. Candidate sees branded intro, runs each scenario through the existing voice roleplay engine, and submits.
• ●Leaderboard view with pass/fail badges and per-candidate drill-down.
• ●TopNav now exposes a dedicated Assess tab for instructors and admins.

Behind the scenes

• ●Migration 011: assessments, assessment_invites, assessment_results tables + assessment_invite_status enum + org-scoped RLS.
• ●New endpoints: POST /api/assess/invite, POST /api/assess/start, POST /api/assess/submit.
• ●Token entropy: ~128 bits (16-byte randomBytes hex). 30-day default expiry.

Added

• ●SCORM authoring — drop a SCORM 1.2 or 2004 .zip onto a lesson. The browser unzips it locally (fflate), parses imsmanifest.xml for the entry point + version, and uploads every file to Supabase Storage. No SDK, no server-side zip handling.
• ●SCORM player — same-origin iframe with hand-rolled window.API (1.2) + window.API_1484_11 (2004) bridge. Buffers CMI, persists on Commit/Terminate, and on beforeunload via sendBeacon.
• ●Progress resume — re-entering a SCORM lesson restores cmi.suspend_data and bookmark state from the last session.
• ●Auto-completion — when the SCO sets cmi.completion_status = 'completed' or cmi.success_status = 'passed', the lesson is marked complete in the LMS and rolls up to course progress + certificate eligibility.

Behind the scenes

• ●Migration 010: scorm_packages + scorm_progress tables, scorm_package_id column on lessons.
• ●New scorm-packages Supabase Storage bucket (private, 500MB max per file).
• ●New endpoints: POST /api/scorm/register, POST|GET /api/scorm/track, GET /api/scorm/file/[lessonId]/[...path] (same-origin streaming proxy for the iframe).
• ●Storage RLS: only super_admin / instructor can write; org members can read via signed URLs.

Added

• ●In-browser video upload — upload .mp4/.mov/.webm directly from the lesson authoring page. File goes browser → Mux (skipping our server, no Vercel body limits, no bandwidth tax).
• ●Adaptive HLS playback with hls.js — quality auto-scales to the learner's connection. Native HLS on Safari.
• ●Signed playback URLs — every play request mints a fresh 6-hour JWT. Asset can't be hot-linked or shared outside the platform.
• ●Auto-poll while transcoding — lesson viewer waits and refreshes when Mux finishes encoding.

Behind the scenes

• ●Migration 009: mux_asset_id, mux_playback_id, mux_upload_id, mux_status columns on lessons.
• ●New endpoints: POST /api/mux/upload, POST /api/mux/webhook (signature-verified), GET /api/mux/sign.
• ●No SDK — uses Mux REST API directly via fetch. JWT signed with node:crypto (RS256).
• ●New env vars (Vercel): MUX_TOKEN_ID, MUX_TOKEN_SECRET, MUX_WEBHOOK_SECRET, MUX_SIGNING_KEY_ID, MUX_SIGNING_KEY_PRIVATE.

Added

• ●Courses, lessons, quizzes — full LMS layer on top of the existing voice-roleplay platform. Lessons can be video, rich text, quiz, voice scenario, SCORM, or survey.
• ●AI Instructor — a Claude-powered tutor on every lesson page. Knows the lesson + surrounding lessons in the course and answers learner questions inline.
• ●Certificates — auto-issued when a learner completes all required lessons in a course. Public verification URL at /verify/[code] for HR teams.
• ●Skill graph — universal skills taxonomy (Active Listening, Discovery Questioning, etc.). Passing a quiz auto-awards the linked skills at Aware (level 1). Learner skill profile at /profile/skills.
• ●Unified dashboard — single Home / Learn / Practise / Library / Admin nav across the whole signed-in product.
• ●Reports + eNPS — /admin/reports shows per-course completion, average scores, learner counts, certificates issued, and a list of every survey with response counts.
• ●Survey lesson type — author embedded surveys with rating, NPS, free-text, single-select or multi-select questions. Results aggregated at /admin/surveys/[id] with NPS score, rating distribution, choice counts, and sample text answers.

Behind the scenes

• ●Migrations 004–008 applied to production Supabase (LMS foundation, quizzes, certificates, skills, surveys + feedback).
• ●New API routes: /api/lesson-coach, /api/quiz/[id], /api/quiz-submit, /api/survey-submit, /api/certificates/issue. All gated by assertActiveTrial + assertRateLimit.

Added

• ●Trial countdown — every dashboard now shows "X days left on your free trial" so you always know where you stand. Banner turns amber in the last 3 days.
• ●Trial-ended screen — once your 14-day trial finishes, you'll see a friendly screen with "Choose a plan" or "Need more time? Chat with us" buttons. All your scenarios, sessions, and team data stay exactly where they were.
• ●Seat enforcement — invitations now respect your plan's seat limit. Starter = 10 seats, Growth = 50. Pending invites count too.
• ●Plan & billing — accessible from the user menu (admins only). Switch monthly/annual, upgrade, or open the Stripe customer portal to update card / cancel.
• ●Workspace Settings page — moved organisation profile (name, industry, description, product context) out of the Teams tab into its own dedicated page. Settings updates now reflect everywhere instantly.
• ●Logo links to home — clicking the Starh logo in the dashboard header takes you back to the dashboard.

Fixed

• ●Trial-ended state on cancellation no longer accidentally drops your seat count.
• ●Org-settings save now refreshes the rest of the app immediately (no more "I changed it but it didn't show up").

Behind the scenes

• ●Server-side trial enforcement on all AI/voice endpoints. Even direct API calls are blocked after trial ends — your costs stop.
• ●Per-org trial timestamps (trial_ends_at) added to the database with proper backfill.
• ●Admin tools at /admin: trial countdown column, "+7/+14/+30 days" extend buttons, member role change.

Added

• ●Live chat with the Starh AI team via Crisp — bottom-right bubble on every page. Talk to us about bugs, feature requests, or anything else.
• ●This page — /changelog — so you can always see what's new without us having to email everyone.
• ●In-app feedback is coming next: a "Send feedback" button on the dashboard that posts straight to our triage queue.

Fixed

• ●Resolved an issue where some new sign-ups were blocked with a "row violates row-level security policy" error. Cleaned up legacy tables that had been added outside our normal release process.

Fixed

• ●If you'd previously seen yourself being bounced back to "Set up your organization" even though you already had one, that's resolved.
• ●The app now correctly waits to verify your account before deciding where to send you, and gracefully recovers when an authentication token expires.

Changed

• ●Migrated to a newer text-to-speech model (eleven_flash_v2_5) — same voice library you already know, with ~75ms response latency.
• ●Migrated transcription to Groq Whisper Large v3 Turbo, which is significantly faster and more cost-efficient. The previous transcription provider remains as automatic fallback.

Performance

• ●Per-session voice cost reduced ~57%, which keeps the unit economics of "unlimited scenarios" sustainable as we scale.

Why it matters

• ●Lower cost per session means we can keep current pricing competitive while staying profitable. No price changes are needed for existing customers.

Looking for older history? This changelog starts in late April 2026. Earlier work — initial app, super-admin panel, Skill Drill mode, audio bug fixes — was shipped before we had a public release log. Ask in chat if you need details on a specific feature.