# Changelog

Notable changes to the public QuassLabs API. Dates are release dates.

This file covers the API surface that callers depend on — endpoints, request and
response shapes, auth, and pricing. Internal refactors that change nothing a
caller can observe are not listed.

We follow one rule about breaking changes: **a field that has been documented is
not removed or retyped without a new path version.** Adding a field to a response
is not a breaking change, so treat unknown fields as forward compatibility rather
than an error.

## 0.1.0 — 2026-07-22

Initial public release.

### Endpoints

Seventeen endpoints, live at `https://api.quasslabs.com`:

**Writing and prompts** — `humanizer-score` (detect AI-writing tells, with the
exact patterns that fired), `humanize` (rewrite to remove them),
`alignment-gate` (grade a system prompt against a 45-criterion safety rubric).

**Engineering decisions** — `model-advisor` (recommended model, fallback chain and
per-run cost for a task), `dependency-check` (dependency-manifest hygiene),
`log-analyzer` (error clustering and anomaly detection over a log file),
`log-audit-creator` (generate an audit-logging spec from a feature list).

**Delivery and QA** — `ticket-lint`, `acceptance-criteria-validator`,
`coverage-check`, `defect-triage`, `sprint-health`, `worklog-guardrail`.

**Other** — `diagram-contrast` (WCAG-AA contrast QA and auto-fix for Mermaid and
SVG diagrams), `saas-metrics` (SaaS health metrics and a ranked focus list),
`blm-land-lookup` (US Bureau of Land Management land status by coordinate),
`uploads` (presigned S3 PUT for the file-ingesting endpoints; unmetered).

Every one is deterministic except `alignment-gate`, which is the only endpoint
with a model in the request path.

### MCP

The full toolset is available over Model Context Protocol at `POST /mcp` —
JSON-RPC 2.0 over Streamable HTTP, stateless, with JSON-RPC batching. `tools/list`
advertises only endpoints that are deployed and enabled, and `tools/call` forwards
your key so auth, rate limiting and metering behave exactly as they do over REST.
The gateway is not itself metered, so calling through MCP costs the same as
calling directly.

### Auth and billing

- `Authorization: Bearer qlk_...` on every request. Keys are stored only as a
  SHA-256 hash.
- Credits are decremented per successful call — 1 for most endpoints, 2 for
  `alignment-gate`, `log-analyzer` and `log-audit-creator`. `uploads` is free.
- Rate limits are per key and per endpoint, checked *before* the credit
  decrement, so a `429` is never billed.
- Calls that fail with a `5xx` are refunded automatically.

### Documentation

- OpenAPI 3.1 spec at `openapi.json`, with full response schemas for every
  endpoint — generated from the same tool definitions that back the MCP server,
  so the two cannot disagree.
- OpenAI function-calling definitions at `openai-tools.json`.
- `llms.txt` and per-endpoint markdown for machine consumption.

### Trying it in the browser

The reference page has a working request console. It calls the API directly —
no proxy, and nothing about your key is stored or sent anywhere else — which
works because the API permits cross-origin requests with an `Authorization`
header. Use a low-credit key when testing rather than a production one; the key
is typed into a web page, and that is worth treating as a key you can rotate.

There is no public demo key yet. If one is issued it will be a dedicated
low-credit key with a spend cap and a rotation schedule, not a production
credential — a spendable secret published on a docs page needs both.

### Known gaps

- **There is no way to read your credit balance.** No endpoint returns it and no
  response header carries it; today you discover exhaustion via
  `402 insufficient_credits`. This is the next thing to fix.
- `convert-diagram` and `supply-chain-scan` are built but not deployed — their
  container images are not published yet. They are deliberately absent from
  `tools/list` and from the OpenAPI spec rather than advertised and broken.