Changelog

Pact Voice is the fastest way into your CRM — your voice, no screen:

• Call the demo line — dial [+1 (424) 722-8627](tel:+14247228627) and start talking. Ask "what are my open deals?", "show me my accounts", "how's my pipeline looking?" and hear a short answer read back.
• Answers come from live workspace data — the agent routes each question to the same in-process MCP tools the app uses, so consent, cost, and audit apply exactly as they do everywhere else. It is not a scripted demo bot.
• Kept short on purpose — replies are capped so a phone call doesn't turn into a monologue.

The public demo line is live now. Turning Voice on for your own workspace is a guided setup step — pick a provider, get a number, set your compliance posture, and place a test call.

Voice can now act, not just answer — every action writes a durable ledger row and a call is capped at five actions:

• Text me the details — Pact sends an SMS to your own number on file through your connected messaging provider, respecting the opt-out list. This and note-taking are the verified-working pair.
• Add a note — "note on Acme that budget approved" logs against the account then and there.
• Email me / book a meeting / transfer me — each is wired to a real handler. When the mail provider or calendar isn't connected, Pact says so plainly instead of pretending; a transfer runs the compliance gate before it dials.
• Guardrails built in — a per-call action cap and a per-action cost ceiling stop an ASR mis-hear from fanning out texts or dials.

A pass over the voice router closed the "every question returns nothing" gap:

• "Opportunities" is a deal — reps say "opportunities" and "opps" far more than "deals". Those phrasings now route to your deals instead of dropping into the generic fallback.
• "My accounts" lists your accounts — "my accounts" / "show me my accounts" / a bare "accounts" now returns your account list rather than answering with segment analytics.
• Named look-ups land — asking for a specific account by name resolves to that record instead of a cold, contextless search.

The keyword router still runs first — it's free and instant. When it can't place an utterance, one small model call takes over instead of dumping to a generic search:

• Paraphrases resolve — "how's my pipeline looking?", "anything hot?", "who's about to close?" map to the right tool plus a filter/sort spec, so you don't have to hit a magic phrase.
• It asks when unsure — below a confidence threshold, Pact asks a short clarifying question rather than guessing wrong.
• It never breaks the call — if no model is configured or the call times out, the turn falls back to the previous behavior. The router is opt-in per tenant and only runs on the fall-through, so the cheap path stays cheap.

The cap is enforced on the server, not trusted to the caller:

• Per-tenant daily cap — a default daily ceiling per workspace, configurable, checked at call start and before each turn.
• A tighter cap on the demo line — the public number is clamped to a low daily budget so a runaway test can't bleed the budget.
• Graceful degradation — when the next turn would cross the cap, Pact says "I've hit your daily cap, let's continue via Pact's dashboard" and ends cleanly, rather than dropping the call or overspending.

The call and the app are two views of the same moment:

• Incoming ring — a routed inbound call fires a push to the assigned user's installed app so it rings and offers to open the call. This is strictly additive: it never changes how the call itself is handled.
• Live companion — open the call and the companion view follows it over a streaming (SSE) connection, with the transcript filling in as the conversation happens.
• Deep-linked — the ring opens straight to that specific call, not a generic inbox.

Voice actions went from "wired" to "runs on the call", and the record surface widened:

• Close a deal — "mark the Acme renewal closed won" updates the opportunity's stage on the call, with a spoken confirmation before the write.
• Create or update a contact or account — "add a contact named Jordan Lee at Acme" or "update Acme's website" writes the record then and there.
• It actually executes — the action executor is now wired into every turn, so a confirmed action is carried out rather than just acknowledged.
• Same guardrails — each call is capped at five actions, every write is confirmed first, and when a provider or calendar isn't connected Pact says so instead of pretending. Every action still writes a durable ledger row.

Voice is Pact's most expensive channel, so it comes with the visibility to run it:

• Every call, listed — see recent calls with duration and per-call cost in the admin console.
• Spend against the cap — today's voice spend and the remaining daily budget, so you know where you stand before the cap kicks in.
• Full transcripts — open any call to read exactly what was asked and answered, alongside the consent and audit trail.

Find it under Settings → Voice in the admin console at /admin/voice-mcp.

The compliance layer under Pact Voice — configured once, enforced on every call:

• Calling mode + TCPA gate — pick the calling posture for your tenant and let Pact refuse outbound attempts that fall outside permitted contact hours, instead of trusting a rep to check the clock.
• Do-not-call lists — maintained per tenant and checked before a number is dialed.
• Sensitive-data redaction — transcripts are scanned for personal, health, and card data and redacted automatically.
• Compliance vault — the unredacted originals are encrypted at rest for teams operating under a BAA, with access recorded on an audit trail.
• Recording consent — playback stays gated on the consent ledger, and state two-party-consent rules are applied from a maintained registry rather than a hand-copied list.

Set it up under /admin/voice-mcp.

Instead of assembling tools call by call, start from a recipe:

• Five starter recipes — SaaS renewal playbook, real-estate cold call, support escalation auto-route, RFP autofill from your won library, and post-call deal update.
• One-step install — a recipe lands in your workspace as an inspectable multi-step chain rather than a black box.
• Preview before you wire anything — steps whose provider isn't connected run as clearly-labeled emulated previews, so you can walk a whole recipe before committing an account.

Bring-your-own-key was spread across a dozen screens; it now has one home — at /admin/integrations:

• 51 providers in one catalog, spanning voice, language models, speech-to-text and text-to-speech, voice agents, messaging, CRM, warehouses, enrichment, and storage.
• One connect sheet — the same flow regardless of which provider you're wiring.
• Preview before you connect — see what a provider would do for you as a labeled emulated preview, so the decision to hand over a key is informed.

• Slack and Teams alerts — a post-call or missed-call summary arrives in the channel you choose, with buttons for View call, Book meeting, Mark won, and Escalate. Each button records who clicked it and opens the matching surface in Pact — the booking screen, the opportunity, the escalation inbox — so the click is a fast route to the work, not a silent state change.
• Mobile — the installed app rings on an incoming routed call and opens the live-call companion (transcript and running cost) while you talk. The audio itself stays on the carrier leg today; the app surfaces the call rather than accepting the audio, so the primary action is Open call. Browser-native answering is a tracked follow-up.
• Hardware handling, a live waveform, and the incoming ring are all in place on the mobile softphone.

Evaluating a feature used to mean wiring an account first. Now it doesn't:

• Full-fidelity previews — provider-backed surfaces render a realistic preview when the provider isn't connected, so you can judge the feature on its merits.
• Provenance you can see — a marker on the value and a banner on the surface state plainly that what you're looking at is emulated, not live. The rule is simple: an emulated value never appears without saying so.
• Real beats emulated, always — connect the provider and live data supersedes the preview.

This is deliberately conservative: it is a preview layer for provider-backed features, not a simulation of your data.

Inbound calls now behave like a phone system, not a single ringing endpoint:

• Routing per phone number — each number gets its own routing rules, so support and sales lines land with the right people.
• Queues with hold music — callers wait in an actual queue rather than hearing a busy tone.
• Press 1 for a callback — a caller can drop out of the queue and keep their place as a callback instead of holding.
• VIP priority — the accounts you flag jump the queue.

• Zero to a verified call — a step-by-step wizard covering provider choice, number, compliance posture, and a test call, with one canonical guide behind it.
• Multi-provider — the wizard works across the supported voice providers rather than assuming one.
• Preview instead of a dead end — if a step's provider isn't connected, it runs as an emulated preview marked with its provenance, so evaluating Pact Voice doesn't require wiring an account first. Previews are labeled as previews everywhere they appear.
• Compliance is part of setup, not an afterthought — the wizard walks you through the calling mode and consent posture before the first call.

• Multi-language transcripts — translate a call transcript using your own translation key, so a team reading in a different language than the customer spoke is no longer stuck.
• Weekly call topics — calls are clustered into topics each week with a trend chart and drill-down, so "what are customers calling about" has a real answer instead of an anecdote.
• Zoho CRM sync — call activity writes back to Zoho and syncs bidirectionally, joining the existing CRM connectors.

• Filter by module — the catalog groups by product area instead of presenting one long list.
• Deep-linkable tool pages — every tool has its own address you can send to a teammate.
• Corrected badges — the read-only / side effects badge was wrong for a set of tools. It now reflects what a tool actually does, which matters: that badge is how you decide whether to let an agent call something. This was a correctness fix, not cosmetics.
• The catalog is also the centerpiece of the homepage now, with a live tool count you can browse without signing in.

• Live diagrams render — the architecture designer's diagram was falling back to raw source; it now draws properly, using a bundled renderer that works under our content-security policy.
• SE team analytics — a dashboard for the solutions function, with real period-over-period deltas rather than placeholder numbers.
• Polish across the module — the RFP drafter, architecture designer, playbook library, win library, and analytics got a sweep: real KPI deltas, your-own-key embeddings for search, a Pact-branded PDF export, and honest empty states that tell you what to do next.

• Twenty role pages — the /for/ set now covers the whole go-to-market team, with dedicated Support, Sales Engineering, Voice, and Customer Marketing pages, grouped under a Solutions menu instead of a flat list.
• Explore first — the calls to action were reworked so you can look around the product before signing up, rather than every path funneling to a form.
• No stranding — a link that takes you into another module now carries a way back, so cross-module navigation doesn't dead-end.
• A feature registry underneath: one source of truth for what a workspace has access to, driving gating, navigation, and discovery consistently instead of each surface guessing.

• The sitewide accent moved to Pact's real indigo (#3A4690), retiring the purple placeholder that had been shipping in its place.
• Applied consistently across the marketing site and the app, along with the wax-seal motif, so the brand reads as one thing rather than two.
• Mobile pipeline views went full-bleed in the same pass.

• Microphone — the softphone was telling reps to grant a microphone permission they had already granted; it now reads the real permission state.
• SE demo pages — a canceled request could poison the page and leave it stuck; navigating quickly between demo pages now works.
• Compliance audit — the voice compliance audit view was querying the wrong columns and returning nothing useful; it now reads the real audit trail.

An outage is only useful if it changes the system. What changed:

• Restart contract — the process now restarts on failure by policy rather than by luck, and the watchdog's shutdown path is bounded so it can't hang on the way out.
• Health checks are back on, with the lag watchdog behind its own startup gate so a slow cold start can't trigger a recycle loop.
• Self-recycle on event-loop lag — if the app stops responding promptly it recycles itself instead of serving a hanging page, with concurrency limits set to what the machine can actually handle.
• An external uptime probe that watches from outside our own infrastructure, so we don't depend on the failing system to tell us it's failing.
• A documented rollback path, plus fleet checks before and after a deploy and a blocking login smoke test, so a bad release is caught and reversed quickly.

The demo environment was also moved to larger machines with a warm minimum, so it stops falling over under burst traffic.

Calling is now a first-class surface, not a bolt-on:

• In-app softphone — place and receive calls in the browser over WebRTC, with numbers auto-provisioned so you can dial on day one.
• Outbound call campaigns — sequenced dialing with voicemail drop and automatic retries, so a call list works itself instead of living on a sticky note.
• Voicemail intelligence — missed voicemails are captured, transcribed with your own transcription key, and come back with a drafted reply you can send or edit.
• Recording, retention, and consent — record calls with per-tenant retention windows and legal hold, and playback is gated on the same consent ledger the rest of Pact enforces.
• Post-call action items — every call can extract its own action items into a review inbox afterward.
• Missed-call auto-triage — an unknown inbound number can auto-create a contact and a follow-up task and drop a card in your inbox, so nothing slips.
• AI voice agents — configure a bot to handle a call flow and rehearse it with a simulated test call before it ever talks to a customer.
• Your provider — connect SignalWire, Plivo, or Vonage, or bring your own SIP trunk, behind one voice interface.

Voicemail lives at /inbox/voicemail; number, agent, recording, and provider settings are under /admin/voice-mcp.

Support is now its own module, not a repurposed CRM view — at /support:

• Unified inbox — email, chat, Slack, WhatsApp, and voice land in one thread per customer, so the conversation follows the person across channels.
• AI ticket triage — incoming tickets are classified, routed to the right queue, and the right people are notified, without a human sorting the pile first.
• Ticket sentiment — a rolling sentiment score per ticket auto-escalates the ones turning sour and floats them onto an at-risk dashboard.
• SLA management — set response and resolution policies, watch live countdowns, get an 80%-of-budget warning before a breach, and read a weekly SLA report.
• Support analytics + CSAT — a completed satisfaction loop: send a survey, collect the score, and see volume, resolution time, and satisfaction trends on one dashboard.
• Knowledge-base suggestions — as an agent drafts a reply, relevant KB articles surface right in the composer; helpfulness votes (anonymous for customers) boost the best articles in search, and the KB stays readable offline.

The pre-sales side of the house gets its own module — at /se:

• RFP drafter — upload an RFP, extract the questions, and get draft answers pulled from your win library, each with a confidence level and citations back to the source.
• Architecture proposal designer — compose a proposal with cost bands and a live Mermaid diagram, then export it to PDF for the customer.
• Demo sandboxes — provision a demo environment from a vertical seed template and share a prospect link, with a lifecycle so stale sandboxes clean themselves up.
• Playbook library — curated playbooks with hybrid search, versioning, and usage analytics, so what works gets reused.
• Win library — extract reusable evidence from won deals (consent-gated), so the next proposal starts from proof, not a blank page.

Enrichment now runs on your terms — at /enrichment:

• Bring your own providers — a provider-adapter framework runs your enrichment sources in a waterfall (fall through to the next source when one comes up empty), with a consent gate on every lookup.
• Budget guardrails — set per-team budgets and choose what happens at the threshold: alert, throttle, or block. See a cost preview before a run and a threshold alert when you're close.
• Live signal detection — define rules that watch for buying signals and fire an action when one lands, so a change in an account becomes a task instead of a missed moment.

Get Pact's data into your warehouse without a fragile export script — at /admin/warehouse:

• Analytics entity registry — pick exactly which entities sync, so you own the shape of what lands downstream.
• Budget auto-pause — the sync pauses itself before it blows a spend budget instead of running up a surprise bill.
• MCP tools — configure and inspect the sync from an AI client over MCP, alongside the admin surface.

• One canonical Edit button now sits on contact, account, lead, case, and campaign detail pages.
• No more guessing whether a field is editable inline or which overflow menu hides the edit action — the affordance is where you expect it.

• The MCP tool sandbox now shows results as type-aware tables and charts, so you can read what a tool returned at a glance.
• Guardrail states — consent-filtered rows, rate-limit and cost signals — render inline instead of hiding in the payload.

• No more prefetch storm — the sidebar was firing hundreds of prefetch requests in the first few seconds after load; links now prefetch on hover, which cut the request burst dramatically and made navigation feel immediate.
• One call for unread counts — the separate badge pollers across the shell were consolidated into a single request and the background polling that piled up behind them was removed.

• Widgets now report the real reason they couldn't load, so a failure is diagnosable instead of a shrug.
• Calendar and seat-cap actions (on /meetings and module assignment) show what went wrong — a full seat pool, a disconnected calendar — instead of a silent no-op.
• The cap nudge banner is guarded against a malformed limits payload, so bad data can't blank the upgrade prompt.

• Module switcher — it no longer vanishes when a fetch fails; it now shows an honest zero-state, a retry, a search box, and a Cmd+Shift+M shortcut, and caches the module list so it stops flickering. A ghost-module bug that shrank owners' and admins' module coverage is also fixed.
• Journeys — an enrollment that reaches a terminal wait step now completes instead of looping indefinitely.
• Seats — seat counts reflect only live users, orphaned seat assignments are purged with a proper cascade, and Pact-internal tenants are exempt from seat caps and metering.
• Postgres 500s — a batch of database-only errors is fixed across case and routing-rule creation, meeting contact resolution, the SE scorecard and /se/today, and module assignment, so the new Support and SE modules behave the same on production as in test.

Internal work you feel as a more durable, steadier platform:

• Object storage — the blob layer moved behind an object-store seam with the writer cut over and a backfill worker, so files and attachments no longer depend on a single machine's disk.
• Steadier web tier — the reliability watchdog was tuned and clamped below the memory cliff it guards, sibling instances are prevented from recycling at the same moment, and both machines stay warm so you don't hit a cold "try again" load.
• Honest cost reporting — the internal cost rollup retired a stale line item and now stamps the source of every figure, so the numbers we run the business on are trustworthy.

The MCP server grew from a read-only window into a working surface:

• Entity write tools — create and update accounts, contacts, and deals, and add notes, from Claude, Cursor, or any MCP client, alongside the existing read tools. The catalog now spans 115 tools. Writes require explicit write:* scopes, run on a tighter rate limit, and the consent gate refuses contact writes targeting suppressed or withdrawn subjects.
• A prompt library and pact:// resources — reusable, parameterized prompts and addressable records, so a client can pull the exact context it needs instead of pasting.
• Per-client MCP-only keys — issue a key that works over MCP and nowhere else, scoped by plan tier, with per-key limits.
• Call audit — every tool call is logged with who, what, and when, visible in admin.
• Tool sandbox + client guides — try any tool with synthetic data before pointing it at real records, and follow per-client setup guides for the popular MCP clients.

Why it matters: your AI assistant stops being a reporter and starts being an operator — under keys, limits, and an audit trail you control.

• One search box, the whole workspace: tasks, notes, logged emails, and custom-object groups now come back from the same query as accounts, contacts, and deals.
• Results stay tenant-scoped and permission-checked per entity type.

Why it matters: "I know it's in here somewhere" now has one answer box instead of four.

• Seven new locales — Arabic, Hebrew, Hindi, Indonesian, Turkish, Polish, and Dutch — bringing the app to 14 languages including English.
• Real right-to-left layouts for Arabic and Hebrew: mirrored navigation, correctly-ordered controls, and RTL-aware components, not just translated strings.
• Locale-aware date, number, and currency formatting extends to every new locale.

Three upgrades to the surfaces sales teams live in:

• Pipeline board controls — collapse the stages you're not working (folded stages stay drop targets, so drag-to-move still works) and pick a card density — comfortable, compact, or spacious. The board remembers both per device.
• Deal detail, two-rail — the deal page now puts activity and detail side by side under an inline header, so updating a deal doesn't mean pogo-sticking between tabs.
• Favorite dashboards — star the boards you check daily and they float to the top of the dashboards hub.

• Desktop — a two-column liquid-glass hero, a problem → solution → proof arc, and an interactive tour of the live product as the centerpiece. Claims on the page are limited to what's actually shipped.
• Mobile — a dedicated six-beat story tree: the scroll dropped from ~34 phone screens to ~13, and the primary calls to action sit in the thumb zone.
• Both trees share one live product demo — touch it, no login.

• Contact reads now resolve feature flags and decryption keys once per request instead of once per row.
• On workspaces with tens of thousands of contacts, the people list went from tens of seconds to under a second.
• The same fix applies to every surface that reads contacts in bulk — lists, search results, and exports.

• Per-widget error states — each dashboard widget renders its own readable error with a retry button; the rest of the page keeps working.
• Section boundaries — an error in one dashboard section is contained there instead of taking down the route.
• The AI "What's happening" summary moved off the request path: the dashboard renders immediately and the summary streams in when ready, instead of blocking or showing "Couldn't generate a summary."

• Empty and loading states across the app now use the same primitives — no more mystery blank panels while data loads.
• Destructive actions (delete, revoke, disconnect) use a proper in-app confirmation dialog with a typed danger zone where it matters — the raw browser confirm() popup is gone.
• Motion polish — hover-lift and focus-ring behavior is consistent everywhere, and toasts arrive top-right with a spring instead of jumping.

• Reports automatically include the error ID, build ID, and timestamp of what you hit, plus your user and workspace identifiers.
• A Copy diagnostics button puts the same bundle on your clipboard for tickets filed elsewhere.
• No more "can you tell us roughly when it happened?" round-trips.

We ship many times a day, and the installed (PWA) app could get caught mid-update:

• The app now detects a stale-build load failure and reloads itself once, automatically — no more error screen where retrying just re-broke the same way.
• Edge caching was tightened so a cached page can no longer reference files a newer deploy removed, and the service worker itself is never cached by the CDN.

If you saw "something didn't work" right after opening the installed app, this was it.

A batch of fixes that make the language switcher behave like it should:

• The picker is hidden on pages that aren't translated yet instead of offering a switch that half-works.
• Your language survives sign-in — it no longer snaps back to English after the post-login navigation.
• The UI flips immediately when you switch; saving the preference happens in the background, so a cold backend can't make the switch look dead.
• Saving your language no longer errors for workspace accounts, and the menu closes on select instead of blocking clicks.

• Schema explorer — the desktop entity diagram is back (the growing schema had tripped a clustering threshold and turned it into thumbnails), mobile gets a legible module grid, and pinch-zoom on iOS no longer crashes the page.
• Real-time notifications — the live notification stream reconnected for all sessions; it had been failing authentication since a recent auth change.
• Offline banner — the "you're offline" banner now confirms connectivity with a real probe before showing, instead of sticking on-screen while you're clearly online.
• Contact detail rail — side panels no longer wrap awkwardly at narrow widths.
• AI status checks — availability probes from dashboards no longer count as AI agent calls, which had made AI features look rate-limited or erroring when they weren't.

• Enrichment lookups now carry explicit tenant scoping at the query layer, closing a class of cross-tenant read risk before it could be reached.
• The migration-safety gate in CI was raised to cover every migration through the current head, so schema changes keep getting checked against the same bar.

Your data is yours, and getting it out is never a paid feature:

• Full export of accounts, contacts, opportunities, activity, sequences, and the consent ledger, with inline attachments and a signed manifest so the archive is verifiable end to end.
• Import a previously-exported archive back into a tenant. The format is versioned (v1.1), and minor version bumps are accepted under a family rule so an export never expires the moment we ship an improvement.
• One-shot download tokens with a short audit window, so a link you hand to your data team can't be replayed later.
• Available on every plan, including Free — data portability is a right, not an add-on.

Why it matters: there's no lock-in tax. You can leave with everything, or move a workspace between environments, whenever you want.

Bring Pact to the tab you're already on:

• Cross-browser (Chrome, Edge, Firefox) on Manifest V3, with a shared polyfill so behavior matches across engines.
• PKCE sign-in — the OAuth flow never exposes a client secret in the extension.
• Cmd+K everywhere — the same command palette you use in the app, on any page.
• Calendar context for the account or contact in view, so you walk into a meeting already briefed.

Why it matters: the CRM meets you where the work happens instead of asking you to switch tabs.

Global by default, not as a bolt-on:

• Six locales — Spanish, French, German, Portuguese, Japanese, and Simplified Chinese — across the app and the marketing pages.
• Locale-aware formatters for dates, numbers, and currency, plus localized system email templates.
• A coverage dashboard at /pact-admin/i18n/coverage with a freshness analyzer, so a stale string shows up as a gap instead of shipping silently in English.

Why it matters: international teams see Pact in their own language, down to how a date or an amount is written.

Everything you need to go from Free to paid without talking to sales:

• Stripe Checkout + Customer Portal — start, change, or cancel a subscription and manage payment methods yourself.
• Reverse trial — new workspaces begin on the full paid experience and settle onto the right plan when the trial ends, so you evaluate the real thing.
• Cap-aware upgrade — when a workspace reaches a plan limit, the upgrade is one click, with the affected limit named plainly and no manufactured urgency.
• Usage metering + a usage dashboard so you can see consumption ahead of any usage-based line item.
• Admin surfaces show a clear "configure Stripe keys" banner and disable checkout CTAs until the keys are in place — no half-wired states.

Why it matters: buying and managing Pact is self-serve and honest, with the limits and prices stated plainly.

The evidence a security reviewer asks for, without a sales call:

• Security log and a bug-bounty page, so the security posture and how to report an issue are public.
• Uptime gates wired into the homepage and PWA, so status is honest and visible.
• Self-serve export from the same surface — see the always-free portability above.
• security.txt (RFC 9116) at the apex for coordinated disclosure.

Why it matters: a prospect's security team can self-serve most of their diligence from one place.

Health that shows its work:

• A held-out evaluation on the churn model, plus deal-lifecycle sentiment folded into the score, on a real scheduler.
• A HealthScoreWidget that frames the raw score as a grade, a severity, a trend, and the per-signal (SHAP) contributions behind it.
• Health and risk cards stacked in the account rail, so "why is this account red" has an answer on the call, not in a notebook.

Why it matters: a CSM can defend a renewal number with the specific signals that moved it.

Two AI surfaces grounded in your own records:

• Natural-language search on more lists — opt in and narrow a list by typing what you want instead of building a query.
• AI deal-room brief — a per-deal summary with the sentiment delta, a competitor rollup, and any decision-maker changes, so you catch a shift before it costs you the deal.

Both cite the records behind their claims and run on the same consent-filtered, cost-attributed loop as the rest of Pact's AI.

More ways in, and more places to work:

• HubSpot + Pipedrive importers with schema discovery, field-history handling, and an editable mapping step — so a switch keeps your structure instead of flattening it.
• Native Discord app with chat actions and deal rooms — turn a channel into a CRM record and advance a deal without leaving the conversation.

Why it matters: moving to Pact is guided, and the team keeps collaborating where it already does.

• Automation gap-fill — event triggers, a delete-record action, and save-as-template, so a workflow you tuned once becomes a starting point for the next.
• Real-time editing safety net — an opt-in conflict-and-undo banner and an offline retry queue, so two people on the same record (or a dropped connection) never silently lose an edit.

• Warm auth surfaces — a gentle mesh-and-grain backdrop on sign-in and sign-up.
• In-app surface atmosphere — an opt-in toggle in Settings → Appearance layers subtle depth beneath the glass surfaces across the app. Off by default, per-browser, and it honors reduced-motion, reduced-transparency, and forced-colors.

The system is CSS-only where it counts and composes with the existing ambient theme, so it stays within the homepage performance budget.

Platform depth for teams building on Pact:

• Per-call API metering with tier enforcement, so usage is measured and limits are honest.
• Webhook replay window — re-deliver events a consumer missed instead of losing them.
• Deep-link association files at the web apex so links open the native apps.
• Vertical custom fields seeded per industry template, so a new workspace starts with the fields its vertical actually uses.

• Activation funnel — a 30-second signup-to-first-action path, so a new user does something real fast.
• Role demos at /for/sales, /for/marketing, and /for/cs — touch the product for your role, no login, with an honest "what's illustrative" footer.
• The pricing page moved to a clean four-tier structure with plain-language limits.

Defense in depth on the thing that matters most — your data staying yours:

• Row-level security hardening across the data plane, with CI gates that fail a PR lacking isolation coverage and Postgres regression tests that assert cross-tenant reads are denied.
• Staff-bypass audit — any support access is logged and visible on an admin surface.
• Step-up policy — sensitive operations can require re-verification. It ships off by default, so nothing changes until an admin opts in.

• Static marketing render + route-aware CSP — public pages serve from the edge cache instead of re-rendering per request.
• Per-route perf budgets with a dashboard at /pact-admin/observability/perf, plus an interaction-responsiveness (INP) gate, so a regression fails CI instead of reaching users.
• Design tokens moved to 11-stop, WCAG-verified color scales with status, elevation, type, and surface tokens — one source of truth for contrast.

A batch of correctness and access fixes:

• Analytics — an error boundary surfaces a readable state instead of an unhandled crash, and an owner leaderboard renders an em-dash for a null win rate instead of a broken cell.
• i18n — the language selector no longer 401s silently in production, and it now works across all marketing pages.
• Marketing — a stale pricing slug that crashed server rendering on the landing page is fixed.
• Accessibility — real headings, skip links, correct input types, and labeled controls on sign-up, sign-in, and the pricing calculator, plus a sweep of route aliases and redirects so old links resolve.

Internal work customers feel as a faster, steadier platform:

• Managed CI runner — the heaviest build/deploy jobs run on a native (no-emulation) runner, so releases are faster and less likely to stall in a queue.
• Runtime self-healing — auto-restart and rollback, circuit breakers, tenant-throttling, and a SHA-rollout gate that verifies a deploy actually reached the running app before calling it done.
• Declarative alerting and additional smoke gates (signup flow, chunk-404, auth non-5xx) so a regression pages on-call before it reaches you.

Your AI assistant can now work your CRM directly — at https://api.pact.place/mcp/:

• Nine tools, live today — query_accounts, query_contacts, query_deals, query_pipeline_health, get_metric_explanation, ask_workspace, list_agents, fire_agent, and read_briefing.
• Consent-native — every record passes the same consent gate the product enforces; suppressed or withdrawn subjects are filtered out and the hidden count is reported back to the agent.
• BYOK-respecting — contact PII is read through your tenant's encryption keys, never around them.
• An audit row per call — tool, client, argument digest, latency, result count, and what the consent gate hid.
• Cost-attributed and rate-limited — AI tool spend lands in your usage ledger and is echoed in the response; per-tenant and per-tool limits stop runaway agent loops.
• Native OAuth — standard discovery metadata plus Dynamic Client Registration, so MCP-native clients connect with no pre-shared keys. Scoped pact_live_* API keys work too.

Setup guides for Claude, Cursor, and custom clients: [/integrations/mcp](/integrations/mcp).

One agent is useful; a chain of them is a process — at /admin/agents → Orchestrator:

• Five prebuilt orchestrations — lead → qualified, stalled-deal rescue, account 360 brief, inbox → action (with branched routing), and inbound funnel health.
• Explicit handoff contracts — each step declares exactly which fields of the previous agent's output it consumes; no prompt-soup between agents.
• Gates and forks — a qualification gate stops the chain on a non-fit; a fork routes an inbox item to support or sales by intent.
• Three new roster agents — account qualification (ICP fit from firmographics + engagement), site optimization (first-party tracking stream), and data validation (a measured SQL profile of your data — null rates, duplicates, out-of-range values — not guesses).
• Yours to edit — installing an orchestration materializes a normal workflow, fully editable in the visual builder. Every step stays consent-gated, cost-attributed, and audit-trailed.

Pact's dashboards can now live anywhere you need them:

• Signed-token embeds — each embed is authorized by a short-lived signed JWT minted by your backend; no Pact accounts for your viewers.
• White-label — your branding on the embedded surface, not ours.
• The guarantees travel with the data — rows are consent-filtered and every view is audited and metered, exactly as in-app.
• Five starter templates and an in-app configurator at /admin/embed to compose, brand, and preview an embed before you ship it.

• Layout shift on the dashboard is gone — the welcome hero and KPI strip no longer jump as data arrives; cumulative layout shift on the home and dashboard routes dropped from 0.62 to 0.02 in production measurement.
• Steadier under load — fixed a server-side memory growth pattern that could slow the web app during long sessions, plus a structural watchdog so it can't recur silently.

Zapier-class automation, native to your CRM data — at /admin/workflows:

• Visual canvas with real branching — conditions actually fork execution paths, not just filter a list.
• 4 trigger types and 12 actions spanning records, sequences, notifications, and webhooks.
• Test-run mode — execute a workflow against a sample record and read every step's outcome before you arm it.
• Versioning — published workflows are immutable snapshots; edit a draft, compare, then promote.
• Consent-gated by construction — any step that touches a contact checks the consent ledger at execution time and records a consent_blocked outcome instead of silently sending. Automation a DPO can sign off on.

Switching CRMs is the moment vendors fear and we optimize for — at /admin/migrate:

• Schema-aware mapping — Salesforce Accounts, Contacts, and Opportunities map to Pact's model with owner assignment and field history preserved.
• Dry-run first — a full reconciliation report (counts, collisions, unmapped fields) before a single record is written.
• Consent state carries over — opt-in/opt-out status lands in the consent ledger with provenance, so day-one sends are as compliant as day-100 sends.
• Deduplication built in — existing records match on identity, not blind inserts.

HubSpot, Pipedrive, Close, and Apollo importers are next on the roadmap; the CSV importer covers them today.

Procurement teams shouldn't have to take a marketing page's word for it — /trust renders from the same compliance registry the product enforces:

• Code-backed status — each framework's state (compliant / in progress / available) comes from the live trust-center payload, not hand-edited copy.
• ISO 27001:2022 program — 93 Annex-A controls tracked in-product with a risk register and Statement of Applicability.
• SIG-Lite auto-fill — generate vendor-questionnaire answers from the same control data.
• DSAR, BAA, and sub-processor documentation linked from one place.

Conversational answers over your own CRM data, built the Pact way:

• Citations on every answer — each claim links back to the source records it was derived from; no unsourced assertions.
• Consent-filtered retrieval — records you're not permitted to use never enter the context window.
• Resistant to prompt injection in your data — retrieved content is treated as data, not instructions.
• Audited — every question, answer, and citation set lands in the audit trail.
• Threads: ask a follow-up and the engine keeps the conversation's context.

The transparent weighted health score now has an ML sibling:

• Churn-risk model with per-signal explanations — every score ships with the contribution of each input signal, so "why did this account turn red" has a real answer.
• Risk gauge on account pages and the CS at-risk view — the explanation renders next to the number, not in a data team's notebook.
• The weighted baseline stays — weights you can see and tune live — and both layers are auditable back to source events.

Two ways to type less and capture more:

• Voice notes — tap the mic on any contact, company, or deal, talk, and Pact transcribes the audio, tidies the filler words, and attaches a clean note to the timeline. Works hands-free in the field on the mobile app.
• Magic Compose — an Apple-Intelligence-style menu on any text field: rewrite, shorten, expand, or change the tone, always in your tenant's brand voice. Changes land as a side-by-side diff you approve or reject — nothing is auto-saved.

Both run on a live model call and respect your AI cost controls.

The nine-agent framework now closes the loop:

• Override-and-learn — every agent suggestion can be accepted, edited, or rejected, and that feedback is stored per tenant so the agent's next pass reflects how your team actually works.
• Agent browser at /agents — a directory of every available agent with a detail page showing recent runs, accept/override/reject rates, and where each agent plugs into your workflow.
• Admins get an aggregate trust view to spot which agents are pulling their weight and which need tuning.

No black boxes: you can always see what an agent proposed and why before it touches a record.

Connect Pact to the rest of your stack without a services engagement:

• Public marketplace at /integrations — browse 73 connectors across CRM, marketing, data, billing, and support, each with what it syncs and how to set it up.
• Connection platform at /admin/integrations/connections — configure each connection's field mapping, sync schedule, and direction, and watch its health from one place.
• Custom webhooks with HMAC-signed delivery for anything not in the catalogue, reusing the same encrypted credential store as the first-party connectors.

The quote-to-cash chain now runs all the way through the books:

• Invoices — a first-class invoice object with a branded PDF, a hosted /p/invoice pay page, and a /sales/invoices board. Pay routes to Stripe; Pact never auto-debits.
• Refunds & chargebacks — issue a refund with contra-revenue and deferred-revenue reversal handled correctly.
• ASC 606 revenue recognition — point-in-time vs. ratable schedules, a CFO month-close, and a balanced double-entry journal CSV your accounting team can import.

Built on the existing CPQ and order lifecycle — order fulfillment is decoupled from financial status, with an append-only order-events ledger.

Every piece is live and tenant-scoped:

• Leads at /leads — a first-class Lead object with lifecycle states, scoring, conversion to account + contact, web-form capture, and round-robin / weighted routing.
• Multi-pipeline at /pipeline — deals are no longer single-pipeline. Define your own pipelines with configurable stages, mandatory entry / exit criteria, gated advance with explicit override audit, per-stage automations, and multi-currency forecast rollup.
• Cases (support tickets) at /cases — case lifecycle with SLAs, auto-routing rules, knowledge-base deflection, and conversion to deal.
• Multi-step approvals at /admin/approvals — branching, multi-step approval processes for discounts, refunds, and any custom object. Builds on the existing single-step framework.
• Team selling, compensation, and sharing rules — multi-rep deal participation with per-rep splits, compensation plans (quota and commission), and record-level sharing layered on top of RBAC.
• Forecast command center at /forecasting — rollup, commit / most-likely / best-case overrides, quota and commission, accuracy tracking, cohort trends, and velocity.
• Visual behavioral segment builder at /segments — live count preview, behavioral predicates (page view, form submit) correlated by contact ID, and campaign A/B tests scored with a real chi-square test (p-value, lift, confidence — tri-state, not a thumbs-up).
• Contact 360 — Relationship Strength — a per-contact score on /accounts/[id] summarizing interaction frequency, recency, and reciprocation across email, calls, meetings, and replies.

Why it matters: the full sales motion now lives in one product — from first lead through close, approvals, support handoff, and forecast — without bolt-on tools.

• E-invoice formats — Peppol BIS 3.0, UBL 2.1, and CFDI 4.0 generation with a validation oracle. Submission to AP and PAC providers is human-gated.
• Automated tax — pluggable engine with Avalara and TaxJar adapters, exemption support, and a flat-rate fallback when no provider is configured.
• Plaid ACH and wire reconciliation — encrypted Plaid token storage, an exact-match wire matcher on reference + amount (auto-reconcile when both match, manual queue otherwise), and buyer-initiated Stripe ACH.
• Polished quote PDF — branded header, repeat thead on long quotes, signature block, accept / draft watermark, page numbering, archivable filename, and a print stylesheet that matches the on-screen surface.

• Today / Coach summary on real Claude — the daily summary on /home is a live model call grounded in your own data, not a templated string. Three features that were misclassified as Hybrid were corrected on the public catalogue at /ai-features, which now shows 37 Real, 22 Hybrid, and 0 Not yet AI.
• Magic Compose brand-voice retrieval — hoisted into a leaf module so the brand-voice path that was silently dead in Magic Compose is now wired end-to-end. Existing Magic Compose flows benefit automatically.
• Campaign Builder agent — drafts a multi-step campaign (subject lines, body, sends, follow-ups) from a brief and lets you optimize before sending. Lives in /admin/automations and on the campaign editor.

Why it matters: every AI feature classified as "Real" actually runs a live model call on every request — and the catalogue is the same registry that powers the in-app honesty badges and a CI gate that blocks any feature shipped as "AI" without a real model call.

• Break-glass admin recovery — a sealed, audit-logged path back into your tenant when SSO is misconfigured, so you can never lock yourself out.
• SAML group → role JIT — first-time sign-in maps SAML groups to Pact roles automatically.
• SP-side request signing — Pact signs its SAML AuthnRequests so identity providers can verify them.
• SCIM enterprise extension — supports employee number, department, manager, and cost center.
• Metadata-URL setup + Workday-tested guide — paste your IdP's metadata URL and Pact configures the rest. End-to-end tested with Workday.
• HMAC-signed webhooks with rotation — every outbound webhook carries a signature; admins can rotate the signing secret with a grace window so subscribers never miss a beat.
• Per-tenant inbound credentials and quota usage — see exactly which integration is sending what, with rate-limit headroom at a glance.

Why it matters: enterprise admins can stand up SSO, SCIM, and signed webhooks without filing a support ticket, and have full visibility into who's authenticated and what's hitting their tenant.

• Contact detail page — grid columns constrained so long identifiers no longer overflow at 320 px; the What's-happening card body no longer goes blank after refresh; $5,000k currency rollup formats correctly.
• Pipeline kanban virtualization — measureElement is wired correctly, so deal cards no longer overlap on tall stages.
• Visual builder drag-from-palette — every visual builder (sequences, journeys, workflows, custom workflows) now accepts a drag without crashing the canvas. Hardened against WebKit, mobile gestures, agent-built canvases, and empty canvases.
• Buyer Lens — pill wrap and a properly responsive 4-column channel grid that no longer cramps at 320 px.
• Pull-to-refresh — gated on scroll position so accidental pulls during reading don't trigger a refetch.

Internal improvements that customers don't see directly but feel as fewer deploy delays and tighter release safety:

• Vercel build headroom — Node heap and twitter-image runtime literals tuned so Vercel builds don't run out of memory partway through.
• Deploy guards — our deploy.sh wrapper refuses to deploy unmerged HEAD and pre-flights every pending Postgres migration before the cutover, so a botched release is caught before any user-visible change.
• Tighter security CI — the auth-hygiene scanner now recognizes require_module as a valid authorization guard, so the gate flags real issues without false positives that previously blocked unrelated PRs.

A new help layer that sits on top of the existing help bubble:

• Hover, click, or keyboard-focus the ⓘ icon to open a glass tooltip with a short description and a deep link to the relevant docs.
• Ask AI inline — the answer streams back in under two seconds, grounded in the specific control you asked about. If the AI doesn't have enough context, it says so instead of guessing.
• Wired into ten real controls today across API keys, notifications, appearance, and the dashboard, and rolling out to more surfaces every week.
• Touch devices get a full-width bottom sheet so the content never clips a screen edge; the controls without a help entry stay clean — no clutter where there's nothing to say.

Two surfaces, one source of truth:

• Public catalogue at /ai-features — every AI feature Pact ships, classified as REAL (a live model call on every request), HYBRID (model plus deterministic logic), or NOT YET AI, with the provider, surfaces, and what it does. No marketing fluff; the same registry powers the in-app honesty badges and a CI gate that blocks any feature shipped as "AI" without a live model call.
• Admin browser at /admin/ai/features — card grid with classification chips, search, filters, and sorts; a tenant-wide 30-day spend hero; and a cost-optimization panel with concrete recommendations (model efficiency, large-context warnings, low-usage flags, cache health).
• Per-feature detail page with a curated sample input/output, the last 20 anonymized runs, the system-prompt overlay (and whether you've overridden it), where the feature is used in the product, and tailored recommendations for that feature only.

Why it matters: admins can see exactly what every AI feature does, what it costs, and where to tune it — without filing a ticket or reading code.

A new gallery at /dashboards/new with eight category-grouped templates, each composed over real tenant-scoped data and clonable with one tap:

• Sales velocity — weighted pipeline, win rate, time-to-close trend, win rate by source, forecast by category.
• Deal aging — stale deals (>30 days idle), slipped close dates, aging buckets, average age by stage.
• Win rate by source — by source, industry, deal size, rep, and quarter.
• Rep ramp — deals and activity per rep, win rate by rep, tenure.
• Activity intelligence — activity mix, daily volume, per-rep load, sequence engagement.
• Customer success scorecard — health distribution, NPS trend, at-risk accounts, renewals.
• Marketing attribution — first-touch source pipeline and revenue, channel mix, engagement.
• Executive scorecard — ARR, bookings QTD, win rate, coverage, health, NPS plus trends.

Every template inherits the existing dashboard builder's anomaly badges, AI insight summaries, and threshold alerts.

Turns Pact's existing controls — tenant isolation, RBAC, append-only audit log, GDPR deletion, sub-processor management, encryption — into systematic, auditor-ingestible evidence:

• SOC 2 readiness scorecard at /admin/compliance/soc2 — per-criterion coverage across all five SOC 2 Trust Services Criteria, with per-evidence-type freshness.
• Automated nightly evidence collection for six evidence types (access review, audit-log retention, vendor/sub-processor schedule, customer data deletion, encryption posture, processing-integrity controls). Manual evidence (change management, vulnerability scans, backup-restore test, incident response, tenant-isolation CI gate) is surfaced as an honest gap list with collection instructions — never fabricated.
• Tamper-evident bundles — SHA-256 hashes over every artifact's exact bytes, a manifest hash over the sorted set, and an optional HMAC-SHA256 signature. Verifiable end-to-end; any byte-level edit is detected.
• One-click monthly bundle + multi-period auditor package, each with an auditor-facing index PDF.
• Self-serve HIPAA BAA at /admin/compliance/baa — preview the addendum with your covered-entity name pre-filled, download a signed PDF with a matching document hash.

Why it matters: enterprise prospects' auditors can be handed a polished evidence ZIP covering every SOC 2 criterion on the spot — and HIPAA-covered customers can self-serve a BAA without going through legal back-and-forth.

Every seeded record now carries an is_seed_data flag, and the Admin → Data management surface gained a "Seeded emails" card with a DEMO badge and a one-click purge button (with a type-DELETE confirm and an audit-log entry). Use it as part of your go-live checklist to clear the demo emails the workspace shipped with — your real, customer-entered contact emails are never touched.

Two internal improvements that customers don't see directly but feel as a faster, more reliable platform:

• Recurring preview-environment cleanup — a unified engine reaps closed-PR preview databases, branches, and deploys on a nightly schedule and after every release, with safety rails that never touch open PRs, protected branches, or anything labeled keep-preview.
• Daily branch-hygiene sweep — automated audit of long-stale branches with a rolling tracking issue, so engineering work stays focused and the deploy surface stays clean.

Each persona gets its own walk-through of the surfaces it uses daily, anchored to real screens:

• CRM — accounts, contacts, deals, follow-ups, pipeline.
• Customer Success — health, at-risk accounts, playbooks, workload.
• Marketing — sequences, templates, AI steps, forms, attribution.
• Admin — users, integrations, audit log, AI usage, health.

Tours auto-start on first sign-in, resume if you leave mid-way, and can be replayed any time.

• Hybrid search — results are ranked across all entities using keyword and semantic matching together, so the right account, contact, or deal surfaces first.
• Graceful calendar links — calendar URLs redirect sensibly instead of dead-ending in a 404.
• Cross-module navigation — jumping from one module to another preserves your context, with a breadcrumb back to where you came from.

• Inbox triage — sorts and prioritizes incoming messages.
• Deal coach — suggests the next best move on an open deal.
• Customer-success save — flags at-risk accounts and drafts a save play.
• Sequence personalizer — tailors outbound steps to each recipient.

Trigger an agent yourself, or schedule it to run on its own.

• AI features return an honest "not enough information" rather than inventing details when context is thin.
• Untrusted input (record content, email bodies, uploads) is fenced from instructions across every AI surface, hardening against prompt injection.

• SSO required is now enforced at sign-in — closing a real gap where password login still worked when SSO was mandated.
• Audit log retention prunes on a schedule per your policy.
• Downloadable DPA — generate and download your Data Processing Addendum as a PDF.
• Cookie consent banner for public surfaces.
• Sub-processor list is tenant-aware and kept current.

• Three CRITICAL and three HIGH severity fixes shipped, including cross-tenant access paths.
• A new tenant-isolation gate runs in the test suite, so a route that derives a record from a request body instead of the auth context fails the build.

Read-heavy analytics and dashboard queries are served from a separate database replica. The result is faster reports and a snappier app everywhere, because reporting load no longer contends with interactive reads and writes.

The new /developers hub gathers everything you need to build on Pact:

• Quick-starts for API keys, your first call, OAuth, and webhooks.
• Copy-paste SDK examples in curl, TypeScript, and Python.
• An integration cookbook with end-to-end recipes.
• A redesigned webhook console with delivery health and per-subscription stats.

Connect Microsoft 365 calendars through a guided admin wizard — the same step-by-step flow already used for Google, so there's one consistent way to set up either provider.

Calendar OAuth credentials now resolve from your workspace's integration credentials, fixing a dead end where setup pointed at a platform store you couldn't reach.

• Two-way sync with Google and Microsoft calendars.
• Public booking pages at /book/<your-slug> so anyone can grab time with you.
• Round-robin team booking distributes meetings across a team.
• Confirmation emails are sent automatically on booking.

Set the mood of your workspace from Settings → Appearance. Eight ambient themes — Aurora, Ocean, Rainfall, Fireplace, Forest, Snowfall, Cosmos, and Minimal — each tuned for performance, with a mobile override that actually takes effect on phones.

Every ambient theme now has a proper light and dark variant. Previously some were eye-searing in light mode or blank in dark mode; each is now tuned for both.

• A consistent liquid-glass surface system across the app's panels and sheets.
• Fixed a build step that was dropping the -webkit- blur prefix, so iOS Safari 17 and earlier now get true frosted blur rather than a flat fallback.

• Tinted glass cards and a gaussian veil keep content legible over ambient backgrounds.
• The floating action buttons (Help and AI) are now coordinated into one stack instead of colliding.

Inputs no longer steal focus on page load on touch devices, so the keyboard stays down until you actually tap a field. The command palette still opens the keyboard, because there you asked for it.

• Dashboards animate on load — staggered cards, count-up metrics, an anomaly pulse, and a fade-in for insights.
• New workspaces get pre-populated demo dashboards so the product looks alive on day one.
• Admins can wipe demo data from Admin → Data management whenever they like.

• Lead routing assigns inbound leads to the right rep.
• Click-to-call and a power dialer for working a list fast.
• Threaded SMS keeps text conversations in one place.
• AI call transcripts capture and summarize calls.
• A mobile dialer for selling on the go.

What changed

A new admin surface — /admin/forms — replaces the old "embed this iframe and pray" workflow.

• Drag-and-drop builder — every field type you'd expect (text, email, phone, dropdown, radio, multi-select, consent checkbox, hidden tracking fields) drags onto a live preview. Reorder, duplicate, or delete with a single click.
• Custom-field mapping — fields you've defined under Admin → Custom fields show up directly in the builder. A new lead-capture field can be wired into the form, mapped to the contact column, and live within the same minute.
• Starter templates — common shapes (Contact us, Demo request, Newsletter signup, Event RSVP, Beta access) come pre-built so you don't draw from a blank page.
• Hosted form sites — every form gets a public URL on pact.place, mobile-first, your branding, no iframe required. Embed it as a link, drop it in a marketing email, or share it on social.

Why it matters

Forms are where customers tell you they want to talk to you. Until this PR, you needed an engineer to ship a form change. Now any marketer can build, publish, and edit a form without leaving Pact — and every submission lands as a contact with consent recorded, so the marketing engine can take it from there.

What changed

The dashboard now follows a layout owned by you, not Pact.

• Editor at `/admin/page-layouts` — pick the page, pick the scope (default, role, group, user), drag the blocks into the order you want, then save.
• Cascading scopes — when Pact renders the dashboard it walks user > group > role > tenant > default and uses the first layout it finds. Power users can override the org-wide default for themselves; everyone else inherits the layout admins set for them.
• Graceful fallback — if your custom layout points at a block that no longer ships (e.g. a removed module), the renderer silently falls back to the next layer instead of throwing.
• Audit log — every layout change is recorded with who, when, and what changed. Roll back from the audit trail without losing other in-flight edits.

What's editable today

Dashboard v1 is the first page on the cascade. More pages (account detail, pipeline, inbox) will follow as we extend the block registry. The contract for adding a new editable page is one entry in web/src/lib/page-layouts/registry.tsx.

Why it matters

Sales leaders, customer-success leads, and product marketers each want a different dashboard. Until now they all looked at the same one and complained. Page layouts ship a real answer instead of "we'll add a toggle eventually."

What changed

/admin/schema-explorer is a new interactive map of the entire Pact data model.

• Auto-layout ERD — every ORM table renders as a card, every foreign key as an edge. The graph (185 nodes, 241 edges in the current snapshot) is computed server-side from Base.metadata.tables and served by GET /v1/admin/system/schema-graph.
• Side drawer per table — click a node to see its columns, their types, nullability, and the foreign keys leaving and entering the table.
• Tier filtering — toggle the tier chips to focus on just the public surface, the authenticated tier, or the staff/internal tables. Makes it tractable to answer "what does a customer actually see?" in one screen.
• Mobile pinch-zoom — the canvas pans and zooms on touch, so on-call engineers can reason about the model from a phone during an incident.

Why it matters

Until now the schema lived in models/*.py and a couple of out-of-date diagrams. Onboarding engineers and customer-facing teams now have a single, always-current ground truth for "what data does Pact actually store, and how is it connected."

What changed

The Pact Internal Ops console (/pact-admin, gated to is_pact_staff) was a feature-complete but rough surface. This change makes it usable on the phone and honest in its empty states.

• Tenants page (/pact-admin/tenants) — switched from a too-wide table to a mobile-first card layout. Each tenant card shows the things ops actually scans for (plan, status, last activity, support flag) without horizontal scrolling at 375px.
• Visible actions — "Impersonate", "Suspend", and "Open billing" used to hide behind a triple-dot menu that nobody discovered. Primary actions are now buttons; the rare ones stay in the menu.
• Meaningful empty states — Trials, Backups, and Health used to render a blank panel when the underlying list was empty. Each now says what the panel is for and how to add something to it.
• Relative-time fix — the "Last active 2 hours ago" string was misreading the timestamp on /pact-admin/tenants and /pact-admin/trials, making every row look stale. The shared fmtRelative / formatRelative helper has been fixed and the call sites unified.

Why it matters

The Internal Ops console is the surface our team reaches for during an incident — usually from a phone, away from a desk. A console that requires a laptop is a console that nobody uses.

What's now in admin

This release closes the last small gaps in three enterprise controls that already shipped most of their functionality earlier in the quarter:

• Audit log at /admin/audit-log and /admin/security/audit-log — searchable, cursor-paginated, with before/after diffs on edited rows, source IP, and CSV / JSONL / XLSX export. A watch subscription will notify you when a row matching your filter lands.
• GDPR self-service export — your end users can request a copy of their data from /v1/me/privacy/export; admins manage requests at /admin/privacy. Each export is delivered as a signed-URL ZIP. Deletions carry a 30-day grace period with an email cancellation token, so a tap of a wrong button doesn't permanently lose someone's data.
• Rate-limit visibility at /admin/security/rate-limits — per-tenant policies, per-API-key sliding-window counters, and the choice of block, log_only, or throttle mode per route, with sampled audit events. Plan-tier defaults are pre-loaded.

Why it matters: customers on enterprise plans now have one admin surface that answers *"who did what?"*, *"can my users get their data?"*, and *"what's hitting my API right now?"* — without needing to file a support ticket.

What happened on 2026-05-28

Our Upstash Redis instance hit its monthly request quota at 03:34 UTC. Every Redis command started returning a quota error. The rate-limit dependency propagated that error to FastAPI — which meant every authenticated request, including /v1/auth/login, returned an HTTP 500. Users were locked out of the app for about fifteen minutes until we switched the counter to an in-memory backend.

Fail-open rate limiting

The rate-limit code now wraps every backend call in a guard. If the counter backend errors for any reason — quota, network, missing instance — the request is allowed through (rather than 500-ing), and a degraded-counter metric increments. A WARN line is logged with the error class, count, and route; Sentry tags the request rate_limit.degraded=true. The next time the counter is unhealthy, on-call gets a notification at the alarm threshold, not an outage at the quota.

Normal behavior is unchanged: when Redis is healthy, no warning fires and the counter stays at zero. When the backend genuinely denies a request, callers still get an honest 429.

Loud errors on the API reference

During the outage, the staff and authenticated tier tabs on /api-reference showed an infinite loading spinner instead of an error, because the spec-fetch effect had no timeout or error UI. The fix:

• 15-second timeout on the fetch, then a structured error state.
• Four error kinds — timeout, auth, network, http — each with the right call to action and a "Try again" button that re-runs the fetch without a page refresh.
• 401 / 403 prompts you to re-authenticate instead of looking like the docs are broken.

Why it matters: the next time a downstream dependency hiccups, auth stays up and the docs don't lie about it. A full postmortem lives at docs/incidents/2026-05-28-auth-outage.md.

/admin/ai/inventory

A sortable, color-coded table of all 32 audited AI features Pact ships. For each feature: the feature ID, display name, classification (REAL 14 · HYBRID 17 · NOT YET AI 1), provider, endpoint, and the UI surfaces it appears on. The same registry powers the public "Powered by Claude" honesty badges and a CI gate that fails any PR which lets a feature ship as "AI" without a live model call.

/admin/ai/cost-breakdown

Per-feature AI spend with a nested per-user drill-down. Filter by user and by time window — last 1, 7, 30, 90 days, or all-time. The view reads the raw AI usage ledger directly, so feature totals reconcile exactly with their per-user rows; no rounding, no double counting.

Why it matters: admins can answer two questions on the spot — *"which of my users is driving AI cost?"* and *"how real is each of the AI features we're paying for?"* Both pages are admin-only and recover work from two earlier chips that died mid-merge.

Public /status

The new /status page shows, for everyone, with no sign-in required:

• An overall status banner — operational, degraded, or major outage.
• Seven component health rows (API, Web app, Auth, Marketing engine, Sequence engine, Webhooks, Background workers), each with a 90-day uptime sparkline.
• A live list of active incidents and the rolling 90-day incident history.
• A one-field email subscription, plus an RSS feed for IT or status-monitoring tools.

A background health probe runs every minute, records a row per component, and feeds the sparklines without sitting on a shared web connection.

Admin /admin/status

Pact admins and owners get an incident-management console at /admin/status:

• Report a new incident — name, impact, affected components, opening update.
• Post updates as the incident progresses; mark it resolved when it's over.
• Every mutation writes an audit log entry, and the page is gated by the same role checks the rest of /admin uses.

Why it matters: customers can stop pinging support to ask "is it just me?" — they can see the truth on /status. And the next incident gets a clean public timeline instead of a Slack thread no one outside Pact can read.

One place for the API surface

We had three different ways to browse the API — anonymous /docs/api, an authenticated /dev page with a staff toggle, and a staff-only /internal-docs/api. Customers had no idea which was which.

The new `/api-reference` page lives inside the signed-in shell, replaces all three, and:

• Detects the highest tier your role is cleared for from your session and renders that by default.
• Shows a pill toggle for Public / Authenticated / Pact staff. Pills you can't access stay visible but disabled, with a lock icon and a tooltip explaining what would unlock them — so customers can see that a higher tier exists without being able to peek.
• Honors a ?tier= URL parameter for deep-linking, silently clamped to what your role is allowed to see.
• Is wired into the existing Developer nav group: API Reference, API keys, Webhooks.

The old /dev and /internal-docs paths now redirect to the unified surface. The authoritative gate is still server-side: even if someone fabricates the tier param, the OpenAPI proxy returns 401/403 unless the caller is actually cleared for that tier.

Why it matters: discoverability. The API reference is now reachable from the in-app sidebar like every other Pact surface, and it always opens at the right depth of detail for who's looking at it.

/login: actually centered now

The sign-in form used min-h-screen (which resolves to 100vh) for vertical centering. On mobile, 100vh is the height with the address bar hidden — so when the URL bar is showing, a "centered" card sits noticeably below the visible middle of the screen, and its bottom can clip off-screen. Swapped to 100dvh (dynamic viewport height), which tracks the current visible viewport and re-centers as the URL bar shows or hides. Verified on a Pixel 7 (Chromium) and an iPhone 14 Pro (WebKit) emulator.

Landing page: Sign in is now discoverable

In the installed iOS PWA, the marketing landing's "Sign in" was rendered as a faint ghost link, crammed against the system status icons because the header had no safe-area inset. Two changes:

• The header now respects the device's top safe area, so the logo and the Sign in button clear the notch and Dynamic Island.
• "Sign in" is now a solid primary button — high contrast, clearly tappable, harder to lose against the status bar.

Why it matters: if someone has the PWA installed and lands on the marketing page, getting back into the app is now an obvious one-tap action. And the sign-in form itself is correctly positioned the first time on every device profile we tested.

The combined symptom

Reported as: *"tapping a segment in the iOS PWA logs me out."* It was two separate bugs stacked together.

Bug 1 — dead in-app link

The segments list linked each row to /segments/[id] — a route that never existed. Tapping a segment landed on a 404. (The correct path is /marketing/segments/[id].) Every segment row now links to the right place.

Bug 2 — 404 looked like a logout

There was no dedicated "not found" page inside the signed-in shell. Any 404 fell through to the root, marketing-shell "not found" — which has no sidebar, no top bar, and a "Home" button pointing at the signed-out landing page. The session was never actually cleared, but the chrome vanished, so it read as "I just got logged out."

A new not-found page now lives inside the signed-in shell. A 404 keeps the sidebar, top bar, and your session visible, and shows a friendly back-to-dashboard link instead of dumping you at marketing.

Why it matters: in the installed PWA, the navigation feels coherent again. A typo in a URL won't masquerade as a session expiry. End-to-end tests for both the segment-builder and journey-builder paths landed alongside the fix so this regression doesn't recur.

What was happening

When a tenant didn't yet have enough sends or audience signal, the API correctly returned an empty body — and two shared layout components, the module-permissions provider and the "viewing as" header, tried to read array properties off that empty object. The exception bubbled into a render crash that looked like an outage on the Personalize and Send-time windows surfaces.

What changed

Both components now treat an empty payload as "no data yet" instead of dereferencing into it. The genuinely empty states the marketing surfaces already shipped (No audience yet, Add more sends before we can recommend a window) now render cleanly instead of being masked by a runtime error.

Why it matters: new tenants and any segment lacking signal will see the intended empty state from now on, not a blank screen. Existing tenants with data are unaffected.

You should know what's actually AI

Three label variants, driven by a single feature registry on the backend:

• Powered by Claude (green) — always calls Claude; errors loudly if the model isn't configured.
• Hybrid: Claude + rules (blue) — calls Claude when configured, falls back to rule-based logic otherwise.
• Not yet AI (red) — surfaces marketed as AI that don't yet make a model call. We're calling that out as honesty debt instead of hiding it.

Each badge has a tooltip with the provider and endpoint, plus a link to "How AI works in Pact" for the longer explanation.

Why it matters: when a screen says "AI", you can now confirm — without reading a docs page — whether that's a real model call or a smart-looking heuristic. No AI feature can over-claim how real it is, because the badge is generated from the same registry the backend uses to enforce live model calls.

Two blank-panel bugs, one solved surface

The /docs/api reference is rendered by Redoc inside a CSP-strict iframe. Two bugs were making it disappear:

1. Cross-origin spec fetch. The page tried to load its OpenAPI spec from app.pact.place while sitting on www.pact.place. The strict connect-src 'self' blocked the request and Redoc rendered an empty pane.

2. Stale Content Security Policy nonce on client-side navigation. When you reached /docs/api via an in-app link (rather than a hard refresh), the iframe inherited a CSP nonce minted at the parent's original load — different from the one stamped on the freshly rendered Redoc script. The script was blocked and the panel went blank until you hit refresh.

What changed

• The OpenAPI spec is now proxied same-origin from /api/openapi-public, so the fetch is matched by connect-src 'self' and triggers no CORS preflight.
• The Redoc iframe now lives at /docs/api/redoc, a dedicated route that mints a fresh per-request nonce on every load — hard refresh and SPA navigation alike.

Why it matters: the API reference is now load-stable. You can click into it from the docs sidebar, refresh, or open it cold from a bookmark — it renders every time, no white pages.

Why this matters

Until this week, the auto-generated FastAPI spec was served anonymously and exposed every internal route — admin, impersonation, replay-cost — alongside the genuinely public endpoints. The MDX guides on /docs had the same problem: a single sidebar listed staff-only Self-hosting pages next to the public quickstart.

This release closes that gap end to end. Every API route and every docs page is now classified into one of three tiers:

• Public — what anyone on the internet can see.
• Authenticated — what a signed-in customer of your tier sees.
• Pact staff — internal surfaces, only visible to Pact employees.

What you'll notice

• The full /openapi.json and /docs//redoc endpoints on the API origin are gone. Three filtered specs replace them: /api/openapi-public, /api/openapi-authenticated, /api/openapi-staff.
• /docs only renders public articles to anonymous visitors. Signing in unlocks the authenticated tier; staff additionally see the Administration section.
• Search is tier-aware — anonymous search never returns titles or excerpts from gated pages.
• A CI guard blocks any PR that would publish a staff or authenticated MDX snippet through a public surface.

For customers building integrations: if a route disappeared from your reference, it was never meant to be public. Use the in-app API Reference (/api-reference) to see the routes your role actually has access to.

Real AI, or nothing

Two marketing surfaces used to show stand-in content: Personalization was a "ships next" placeholder, and Send-time windows quietly fell back to a hardcoded "9:30–11am Tue/Wed/Thu" when a segment didn't have much send history. Both are now wired to the same production AI optimizers the rest of Pact uses.

Personalization

Enter a base subject line and Claude rewrites it for each audience segment's dominant role and industry — the exact optimizer that already runs inside journeys. Each suggestion is generated live, and segments that don't change are clearly marked "No change" rather than padded with invented variants.

Send-time windows

Every segment is now routed through the real send-time optimizer (engagement history → tenant default → AI inference). Recommendations are labeled Engagement-backed or AI-inferred so you can see where each window came from. Applying a window rewrites the hour-of-day on every scheduled campaign for that segment.

Honest empty states

When a segment lacks the signal to ground a recommendation — no audience yet, or fewer than 100 delivered emails — you'll see a clear "add more data" prompt instead of a confident-looking number that isn't real.

Why it matters: you can trust what these screens tell you. Every subject line and send-time window is now produced by the same AI that powers the rest of your workspace, and when the data isn't there yet, Pact says so plainly instead of guessing.

One fix, two symptoms

The top navigation bar handled the device "safe area" (the strip behind the notch, Dynamic Island, and status bar) inconsistently across layouts. That produced two opposite problems on phones:

• On iPhone, the docs header sat *under* the status bar, so the "Menu" label was partly hidden behind the clock.
• On Android, the installed app reserved iOS-only spacing it never needed, leaving a large white gutter above the icon bar.

Both are now resolved with a single rule applied to every sticky top bar — the in-app bar and the docs header alike. The safe-area reservation only kicks in on Apple touch devices that actually need it, so iPhone and iPad PWAs get the right padding while Android and desktop are left untouched.

Why it matters: if you use Pact installed to your home screen, the top bar now lines up correctly on every device — nothing clipped behind the status bar on iOS, no wasted space on Android.

White-label branding

Agency tenants on the Agency plan can now configure a fully custom brand identity applied across all client-facing surfaces.

Configurable in Settings → Brand:

• App name shown in the browser tab and email footers
• Primary logo (SVG or PNG, shown in the top bar and sidebar)
• Favicon
• Custom sender domain for outbound sequences (requires DNS verification)
• Accent color for the UI

Branding changes take effect immediately for all sub-tenants managed under your agency account.

Contact your account manager to enable the Agency plan.

AI agents

The Ask AI panel (⌘K → "Ask AI", or the ✨ button in the top bar) now supports agentic tasks that go beyond simple Q&A.

Try asking:

• *"Research Acme Corp and summarize their recent news"* — pulls public data and returns a brief
• *"Draft a follow-up email for my last call with Jordan Smith"* — uses call notes and contact history
• *"Which accounts in my book are most likely to churn?"* — scores your pipeline using engagement signals

How it works:

Agents run in the background and stream results token by token. You can keep working while they run. Results are copied to the clipboard or inserted into the editor.

All agent activity is logged in Activity → AI for audit purposes.

Bulk operations

List views now support row-level multi-select. Use the checkbox in the table header to select all visible rows, or click individual rows to build a selection.

Available bulk actions:

• Tag — apply one or more tags to all selected records
• Add to sequence — enroll the selection into any active sequence
• Update field — set owner, status, lifecycle stage, or any custom field
• Export — download as CSV in the background; a toast links to the file when ready
• Delete — moves records to the trash (restoreable for 30 days)

Actions run server-side in batches of 100. A progress banner keeps you updated.

Public REST API

Your Pact account now has a stable public REST API, secured with per-tenant API keys.

Get started:

1. Go to Settings → Integrations → API Keys

2. Generate a key and store it securely (shown only once)

3. Pass Authorization: Bearer <key> on every request

Full reference docs at /docs/api. The same OpenAPI spec powers the built-in API explorer.

What's available

• Accounts and contacts — read, create, patch
• Sequences — list, trigger, pause
• Segments and tags — read
• Webhook events for real-time push

Rate limit: 1 000 req/min per key. Raise limits from the API Keys page.

What shipped

Plan picker & checkout (/billing/upgrade)

Choose from Starter, Pro, or Enterprise tiers. Clicking "Start Starter" or "Start Pro" opens a Stripe-hosted checkout session and returns you to the billing admin page on success. Enterprise routes to the sales team.

Stripe Customer Portal (/billing/portal)

Tenants can now update their card, download invoices, or cancel their subscription directly from the Pact billing admin page. Clicking "Manage billing" launches the Stripe Customer Portal in-tab.

Operator billing panel (/pact-admin/billing)

Pact staff get a live view of:

• Stripe mode — live / test / unconfigured / no-op
• MRR & ARR — summed from active + trialing subscriptions
• Subscription counts by status (active, trialing, past_due, canceled…)
• Failed-payment queue — tenants in past_due / grace_period / soft_lock with links to their tenant detail page

Anti-abuse guards

Tenants with a hard_lock dunning state receive HTTP 402 on checkout. Attempting to start a second active subscription for the same plan returns HTTP 409.

Go-live runbook

Full step-by-step instructions in docs/ops/stripe-go-live.md. Set Stripe keys via Admin → Platform secrets — never via fly secrets set.