Roadmap: shipped milestones and the plans ahead

An authoritative .NET auth backend and a browser-based admin panel.

• core-api rebuilt on .NET 10 / ASP.NET Core Identity backed by PostgreSQL.
• Email verification, per-IP rate limiting, and an admin approval workflow.
• Razor admin panel — users, pending queue, system config, audit log — on a non-public listener.
• Password reset end-to-end and production deployment cutover.

Control over who can create spaces, and a public surface to find and join them.

• Configurable space-creation policy, propagated into the chat-domain admin gate.
• Opt-in discoverability with descriptions and topic tags; a Discover panel with search and tag filters.
• Request-to-join flow for invite-only spaces — approve, decline, and re-request.
• Per-owner anti-spam quota and instance-admin moderation (un-list any space).

LetsChat in the browser, plus the realtime engine moved onto the current release line.

• Hosted browser client at app.<domain> — single-tenant, auto-discovers its instance, no install.
• Reliability-first WebSocket compression with automatic downgrade so a browser can never get stranded.
• SpacetimeDB bumped 2.2 → 2.5 in lockstep (CLI, npm SDK, Rust crate, server image).
• MinIO browser CORS, web join links, and a dismissable "also on desktop" prompt.

One account, one permanent identity — derived rather than stored, and immune to database wipes.

• core-api issues the realtime-database access token as an OIDC provider; the database verifies it against a published JWKS.
• Identities derive deterministically from issuer + account, so they survive a wipe and never need relinking.
• Retired the stale-token and relink bug class outright — tokens are minted on demand and never stored.
• Breaking deploy: SPACETIME_OIDC_PRIVATE_KEY must be set before upgrading, or core-api refuses to start.

Nothing is lost: every message mirrored to PostgreSQL, and destructive migrations made survivable.

• A .NET replication worker mirrors the chat domain into a PostgreSQL cold archive.
• Destructive schema migrations become a safe wipe-and-rebuild from the archive.
• Scheduled backups of all data, wired into the production compose stack.
• Part B (evicting cold history from the hot set to cap server RAM) remains ahead.

The first stable release — no half-finished surfaces left in the UI, and a deployment you can upgrade and roll back.

• Pinned messages and in-channel message search — the last placeholder buttons are now live features.
• Voice presence made server-owned: presence rows are connection-scoped and swept on disconnect, ending the join/leave desync.
• The realtime module owns id allocation, so rebuilding from the cold archive can no longer collide with auto-increment.
• Production images pinned by LETSCHAT_VERSION with immutable version and commit tags, published for amd64 and arm64, plus a documented upgrade/rollback runbook.