The changelog doubles as proof: every entry names the site problem that caused it.
JUL 16
Stored-XSS fixesFIXED
The document viewer now renders in a locked-down sandboxed frame, and imported checklist HTML is run through an allowlist sanitizer. A malicious seed file can no longer script against the app.
JUL 16
Auth hardeningIMPROVED
Production now refuses to run without a real session secret, the dev auth bypass is ignored in production, first-run setup is token-gated, and changing your password invalidates every other session.
JUL 16
Test suite + CI gateNEW
A real automated test suite now covers the role/permission matrix, the band→actual→verdict math, and the money gates. Nothing merges without it green.
JUL 14
Procurement order-by alertsNEW
Roof panels nearly slipped through plan review. Order-by dates now derive from the schedule and get loud two days out.
JUL 3
Band bar rounding at small amountsFIXED
The $200–400 floor-sealer line rendered its dot outside the track. Sub-$1k lines now scale correctly.
ashiba.ai
THE BUILDER'S FIELD OFFICE
足場 ashiba — the scaffolding you stand on to build.