What we shipped
to main, every week.

8 deep-linkable vendor URLs (/compare/coreview, /compare/nerdio, /compare/syskit, /compare/bettercloud, /compare/avepoint, /compare/augmentt, /compare/lighthouse, /compare/horizontal-ai). Each ships a printable /print sub-route — Cmd+P / Ctrl+P produces a clean PDF directly from the browser, no server-side renderer.

CoreView, Nerdio, Syskit Point, BetterCloud, AvePoint, Augmentt, Microsoft 365 Lighthouse — internal docs at .luna/tenantiq/competitive/, every claim sourced. /compare page now shows 9 frames (8 competitors + the original Optimize365 9-category table).

Layout opened tenant-scoped real-time pipes on /ciso-demo and /compare causing reconnect-storms in console. Cookie-name drift (`__tenantiq_session` vs canonical `tenantiq_session`) in 2 files. WS handshake switched to fetch-then-ticket flow because SameSite=Lax blocks cross-subdomain cookies on Upgrade.

docs/sales/HOW_IT_WORKS.md (one-pager: 5-layer architecture, agent loop, 10 safety controls, trust boundaries, compliance map). docs/sales/CISO_DEMO_SCRIPT.md (8-step talk track, no slides, anticipated questions). Live page at app.tenantiq.app/ciso-demo.

TenantIQ now both ships and consumes MCP. Per-org KV-backed registry of external MCP servers (Microsoft Graph MCP, GitHub MCP, Moody's MCP, your own); aggregated tools/list across registered servers; tools/call forward via /api/mcp-external. Settings UI at /settings/mcp-clients. 6 unit tests.

POST /api/timewarp/:tenantId { at: ISO } reconstructs tenant config from latest snapshot before target + every drift in chronological order until target + audit log narrative. UI at /security/timewarp with datetime picker + 5 presets (1h–90d ago). 5 unit tests.

logAgentAction now publishes to TenantEvents Durable Object after every D1 insert. /api/agent-actions/stream forwards SSE through the DO; falls back to D1 poll if binding unavailable. 11 caller sites migrated.

Public-facing autonomous-agent feed scoped to the calling org. 24h summary cards (success / failed / rolled-back), filters by agent + status, AgentActionRow component with action-icon and metadata-aware subtitle. Pending-approval rows surface Approve & Abort buttons; Approve re-enqueues live with a 60s anomaly watch.

auto-fix-scanner cron picks eligible drift events hourly, matches against source-pinned recipes (only 2 ship today: legacy-auth CA revert, Microsoft Authenticator method re-enable), enqueues with per-tenant dryRun flag. auto-fix-handler runs runRemediation against real Graph; 60s anomaly watch; auto-rollback on alert spike. Per-tenant daily cap of 5.

/api/mcp full Streamable HTTP transport: initialize, tools/list+call, resources/list+read, prompts/list+get, SSE stream. 10 read tools (CIS / compliance / Intune / PIM / Defender / drift / alerts / skills / MSP-backups / tenants), 3 write tools (acknowledge_alert, acknowledge_drift, apply_skill_template — admin-role-gated server-side). 6 prompts wrap skill templates + posture explainer + QBR. Public unauthenticated /api/mcp-public namespace with scan_domain.

GET / POST / DELETE /api/mcp-keys. Plaintext shown once, SHA-256 hash stored. Auth middleware accepts Authorization: Bearer tiq_*. UI at /settings/api-keys with one-time copy, revoke, embedded Claude Desktop config snippet.

Fixed key tiq_demo_visitor_2026 maps to a synthetic 3-tenant org (Acme / Globex / Initech) with realistic CIS posture and drift events. Anyone can paste into Claude Desktop config and have a working integration in 60 seconds with no signup.

Anonymized aggregate counters on the landing — total scans, controls audited, findings raised, fixes auto-applied, drift reverts. Polls /api/stats/public every 30s with lerp animation. Full /leaderboard page with 7d agent activity rollup by agent / severity / action.

/scan/:domain now consumes SSE narration from /api/prospect/scan/sse — DNS / tenant / mail / federation / report stages emit running→done events as the page paints. Feels like watching a Claude agent work in real time.

Every 6h per active tenant: pick top 3 unfixed CIS controls, Claude drafts MSP-branded remediation email, Resend ships it to org's notification email. Skill-gated per tenant (auto-remediator skill must be active). 5h cooldown.

Every Claude-driven agent action records one row. Powers the live counter, /leaderboard rollups, and per-MSP timeline. Migration 0023 applied to prod D1.

Privileged Identity Management audit: standing privileged role assignments, perpetual assignments, MFA gap on privileged users, 4+ roles on one user. UI at /security/pim. Defender coverage from secureScoreControlProfiles classified office / endpoint / identity / cloud-apps. UI at /security/defender. 17 unit tests across both.

Intune scanner: 8 finding types across device hygiene + compliance policy + MAM. UI at /security/intune. MSP-wide /msp/backups rollup — every customer's backup health (ok / warning / error / off) in one view. Fixes 2 backups bugs found in audit (missing schedule routes, no MSP cross-tenant view).

CIS score-trend SVG chart with improving / regressing / stable verdict. Compliance gap explainer (Claude per-control, KV-cached 24h). Dynamic OG image for /scan/:domain shareable URLs.

OAuth callback wrote __tenantiq_session; auth middleware read tenantiq_session. Login completed, browser stored cookie under wrong name, /auth/me 401d. Imported SESSION_COOKIE from middleware/auth.ts so writer + reader stay locked. 2 regression tests pin the cookie-name contract.

Two stacked bugs. /api/auth/onboard-org didn't carry orgId in the OAuth state, so the admin-consent callback couldn't link the tenant to anyone. Page relied on window.close() which silently no-ops for non-popup tabs. Both fixed; 4 regression tests pin the state→orgId stash flow.

Layout effects gated on localStorage.tenantiq_user existing — when missing, auth.loading stayed true forever. Always probe /api/auth/me on mount; HttpOnly cookie is the only source of truth. Subsequently dropped localStorage entirely.