Skip to main content

Industrial parts & procurement · Bangladesh-first, globally extensible

GRITNOX

Changelog

A release record you can audit.

Implemented product changes for the Gritnox concept, separated from roadmap ideas and demo claims. Validation limits are documented rather than hidden behind a version number.

Current v0.5.1Implementation record
Read project documentation
v0.5.1Current20 October 2026

Compact dashboard workspaces and responsive operations

Unifies buyer, seller and administrator dashboards around one compact shell, shared primitives and responsive record layouts.

Dashboard shell

  • Desktop navigation is 236px wide and collapses into an accessible mobile drawer that closes on route changes.
  • The dashboard header is reduced to 56px and the content frame now uses one consistent 16px rhythm.
  • Page titles, descriptions, controls, panels, statuses, loading states and empty states share one compact type and spacing scale.

Operations

  • Product creation and editing now use responsive panels, inline validation and a page-level publish action.
  • Support, seller requests, payments, profile, categories and footer management now use the same panel, feedback and control system.
  • Login now opens at the top on mobile instead of auto-scrolling past the page shell to the first field.
  • Mobile authentication pages lead with the form, while the security context remains available below and the desktop split layout is unchanged.
  • The administrator seller directory replaces a fixed-width scrolling table with responsive records.
  • The administrator store registry now uses the same responsive record pattern, including mobile field labels and release controls.
  • Product gallery edits now preserve retained images, persist removals and reject image IDs that belong to another product.
  • Active dashboard controls use the local SVG icon registry rather than icon-font markup.
  • Browser alerts and confirmations were replaced by inline errors and confirmation panels in the migrated flows.
v0.5.0Released18 October 2026

Demo workspaces, case studies and currency-safe operations

Adds an isolated role-based demo, visual case studies and a consistency pass across analytics, catalog administration and inherited public routes.

Demo workspace

  • Buyer, seller and super-administrator entry points resolve fixed server-configured accounts from a role key.
  • Demo users have unusable passwords, normal session controls and dedicated throttling.
  • A scoped seed command creates paid order history, catalog stock, support, chat, notifications and a payout request.
  • Role deep links enter the requested workspace once and can switch identity without a redirect loop.

Case studies

  • Added a visual decision record for evidence-aware discovery, server-enforced authorization and demo isolation.
  • Added demo and case-study links to the header, footer and sitemap.
  • Each case study links to a working surface instead of relying on a static claim.

Operational consistency

  • Seller analytics now expose paid-only sales, growth and trends by currency.
  • Administrator product and store rankings use fulfilled units rather than summing unlike currencies.
  • Catalog administration now uses GBP, real inventory states and inline feedback.
  • Category and product forms now use industrial terminology instead of inherited grocery placeholders.
  • Legacy public routes redirect to canonical Gritnox pages; dead fabricated components were removed.

Interface and catalog polish

  • Rebuilt buyer orders, chat, seller application, payments, store customization, categories and footer management on shared dashboard primitives.
  • Chat now fills the dashboard viewport, and every rebuilt panel has consistent mobile spacing, feedback and empty states.
  • Login and registration modals stay inside the viewport and scroll internally on short screens.
  • Homepage categories, part cards, part detail and equipment records now carry illustrative industrial photography.
  • Every photo has a visible author and licence credit linked to its Wikimedia Commons source file.
  • Added a local catalog image mirror command and documented the source register and removal inventory.

Security hardening

  • The API now denies access by default; public catalog and intake endpoints opt in explicitly.
  • New passwords use Django's memory-hard Scrypt hasher with PBKDF2 fallback for existing accounts.
  • The password policy now requires 12 characters across signup, reset and server validation.
  • Remember-me sessions last 14 days; standard sessions remain browser-session cookies.
  • Django admin and API sessions share the same auth-version revocation check.
  • Added an authentication and authorization control document covering the role matrix, demo isolation and deployment gates.
v0.4.0Released18 October 2026

Secure accounts, role workspaces and marketplace operations

Completes the session-based account lifecycle, server-enforced authorization, buyer and seller analytics, administrator operations and administrator-controlled storefront release.

Account security

  • Moved authentication into an HttpOnly session cookie with CSRF protection and no browser-stored credentials.
  • Added login throttling and lockout, password change and reset, email verification, generic recovery responses and sign-out-everywhere.
  • Added account-wide session-version revocation and immediate rejection of inactive accounts.
  • Email changes require the current password, clear verification and notify both the old and new addresses.

Authorization

  • Enforced buyer, seller and administrator permissions across every dashboard and API queryset.
  • Prevented role self-escalation, seller self-approval, store self-activation and cross-vendor mutations.
  • Public discovery requires an active store, approved and non-suspended seller, and active account.
  • Multi-seller order status changes, withdrawal transitions and guest order lookup now have explicit controls.

Operations

  • Added live buyer spend, seller revenue and administrator marketplace analytics with currency-separated charts.
  • Added an administrator store-release console with activation safeguards and real registry metrics.
  • Added profile and security management with session facts and account-wide revocation.
  • Validation and deployment gates are documented without substituting illustrative dashboard data.
v0.3.1Released18 October 2026

Public-surface resilience and deployment hardening

Removes the public interface's dependency on a third-party icon CDN, strengthens mobile navigation and failure states, and moves inherited marketplace defaults out of the Django deployment configuration.

Public-surface resilience

  • Replaced Font Awesome markup across the Gritnox public surface with a local, dependency-free SVG icon system.
  • Added compatibility for both short icon names and Font Awesome-style aliases so navigation, actions and record cards resolve consistently.
  • Expanded mobile navigation with search submission, account, sourcing-list, help, documentation, trust and contact actions.
  • Added active-route semantics and clearer mobile navigation labels.
  • Rewrote temporary-outage states as product-facing recovery guidance instead of developer instructions.
  • Reduced the public API timeout to 12 seconds so degraded states surface quickly instead of leaving long-lived skeletons.
  • Collapsed catalog-driven homepage sections when records are unavailable, replacing empty section shells with a single recovery notice or a purposeful empty state.

Deployment hardening

  • Removed inherited BeOrganic host, origin and sender defaults from Django settings.
  • Added HTTPS redirect, secure-cookie, HSTS, referrer-policy and frame-protection settings for non-debug deployments.
  • Made the MongoDB database name configurable and aligned its default with Gritnox.
  • Added fail-fast protection against running production with the development-only secret key.
  • Made Redis-backed throttle caching opt-in, corrected its cache location, and retained a per-process fallback for local runs.

Verified checks

  • TypeScript type checking passes for the frontend.
  • The scoped Gritnox lint configuration passes.
  • Jest suite passes, including icon-resolution regression coverage.
  • Django system checks pass with the revised configuration.
  • 390px mobile emulation confirms no horizontal overflow, and the mobile menu, contact-topic preselection and icon rendering were visually verified.
v0.3.0Released18 October 2026

Public trust, contact and production hardening

Adds the public policy and documentation layer, a validated contact intake, stronger discovery metadata and operational safeguards around the existing product slice.

Public surfaces

  • Added help center, trust and safety, privacy, terms and accessibility pages.
  • Added a functional contact intake backed by a persisted ContactInquiry record and generated reference.
  • Added a visual design-system reference and a project documentation hub.
  • Expanded the footer with a complete public policy and support navigation.

Accessibility and shell

  • Added a skip-to-content link and a named main landmark.
  • Added reduced-motion behavior to the global stylesheet.
  • Improved document structure, accessible disclosure lists and mobile document navigation.

Production hardening

  • Added sitemap, robots policy, web manifest, social preview metadata and canonical URLs.
  • Added security headers and disabled the framework disclosure header.
  • Added branded loading, error and not-found states.
  • Documented validation boundaries instead of presenting blocked checks as complete.
v0.2.0Released18 October 2026

Catalog, fitment evidence and procurement workflow

Introduced the purpose-built Gritnox catalog and the path from part discovery to a persisted request for quotation.

Discovery

  • Added catalog categories, manufacturers, parts, equipment and supplier APIs.
  • Added identifier-aware search, equipment-model matching, supplier-SKU matching and exact-match ranking.
  • Added URL-driven category, manufacturer, evidence and availability filters.
  • Added the parts, part-detail, equipment and supplier directories.

Evidence and offers

  • Added typed specifications, alternate identifiers and cross-reference relationship types.
  • Added fitment states for verified, supplier-claimed, unverified and rejected evidence.
  • Added supplier offers with condition, currency, MOQ, stock, lead time, warranty and freshness.
  • Prevented mixed currencies from collapsing into a misleading lowest price.

Procurement

  • Added a browser-local sourcing list with editable quantities.
  • Added a server-validated RFQ endpoint with duplicate-line and known-part checks.
  • Added generated RFQ references and explicit demo-only confirmation states.
v0.1.0Released17 October 2026

Gritnox foundation

Established the independent product direction on top of the inherited marketplace application.

Foundation

  • Introduced the Gritnox design direction, shared shell and technical UI primitives.
  • Added the first catalog, procurement and demonstration-data models.
  • Added the idempotent seed command for illustrative records.
  • Documented the product thesis, inherited scope and demo boundaries.

Preserved capability

  • Retained inherited authentication, seller, store, checkout, order and support behavior.
  • Added a supplier onboarding page aligned to the inherited vendor workflow.
  • Added legacy-route redirects for the original about pages.

Verification

How this changelog treats validation

A feature is listed only after the source exists in the application. Build and type-check status is recorded separately from database-backed tests because the MongoDB environment is not always available in the development workspace.

The current repository documentation identifies database migrations, backend tests, lint and end-to-end workflow checks that must pass before any production claim is made. See project documentation and the repository docs/gritnox-runbook.md.