Changelog · what shipped

Engine, data, UX, security — in plain product voice

Curated entries — not the git log. Each item explains what changed for the reader of the site, why it matters, and links to where you can verify it live. Tags by area: engine, data, ux, security, seo, mobile, api.

2026

dataengine

100% daily coverage on the 375-stock universe

Cron architecture redesigned: every ticker in the universe gets a fresh APEX score every trading morning, plus a recompute-zscore pass on the full cross-section.

cron-job.org runs nine 10-stock batches between 06:00 and 06:16 UTC. A GitHub Actions workflow then sequences another 29 batches for offsets 90 through 370. After all 38 batches land, recompute-zscore rebuilds the cross-section μ/σ that the z-score composite relies on. Result: 374 of 374 dedup-deduped stocks have an updated_at within the last hour by 06:30 UTC.

/status
seo

Schema.org JSON-LD on every ticker, blog post, and pattern page

Centralised typed schema library emits FinancialProduct, Article, and BreadcrumbList graphs on ~395 URLs.

A typed builder library (src/lib/seo/json-ld.ts) generates Schema.org JSON-LD for ticker pages (FinancialProduct with sector, exchange, APEX score, verdict, price as PropertyValues), blog posts (Article + Breadcrumb via the shared BlogShell), and pattern pages (Article + Breadcrumb). Site-wide Organization + WebSite schema rides in the root layout. Result: rich-snippet eligibility on Google + structured citation hooks for ChatGPT, Perplexity, Claude.

security

Public security page + RFC 9116 disclosure

/security publishes the live security posture; /.well-known/security.txt gives bug-bounty researchers an instant contact.

The /security page lists 13 in-place controls (HSTS preload, CSP whitelist, DENY frame-ancestors, EU data residency, cron Bearer auth, admin role checks, cookie isolation, scheduled key rotation, public math invariant battery) and 7 roadmap items (2FA + WebAuthn, CSP nonce, per-IP rate limits, CSRF tokens, SOC2 Type I readiness, audit log, bug-bounty programme). Each claim is independently verifiable via headers, code, or endpoints — nothing is a marketing assertion.

/security
api

Public API documentation page

/docs catalogues seven read-only JSON endpoints anyone can hit without an API key.

Live (/api/health), pipeline freshness (/api/status), aggregate track-record (/api/track-record), 60-day HMM regime history (/api/regime-history), 21-invariant math battery (/api/diag/engine), single live quote (/api/quote), 30-day sparkline (/api/sparkline). Each entry shows method, path, parameters, sample response, cache policy. Covers the read surface only — authed and admin endpoints are intentionally excluded.

/docs
engine

APEX v10 forward-return engine + 21 live invariants

Unified Bayesian formula composes every engine layer into one coherent forward-return distribution per horizon — and a public diagnostic endpoint verifies the math has not regressed.

E[r_h | F] = m_h + α(z) · A_regime · M_pattern · K_tail composes the 12-factor composite, conformal interval, regime posterior, pattern confluence, and copula tail-dependence into one expected return per 1d / 7d / 30d / 90d horizon, with a 90% confidence interval and P(positive). All multipliers asymptote to 1.0 under missing data — the prior mode degrades gracefully to pure factor signal. /diag/engine runs 21 invariants (neutral z = drift, max-bull/bear bounded, bull/bear symmetric, variance positive, P ∈ [0,1], CI symmetric, monotone in horizon, 27-cell stress matrix finite) on every request.

/diag/engine
mobileux

Mobile-first card layout for /dashboard/stocks

Phone width below 600px collapses each row into a 3-line card — ticker pills + action top, name middle, change + score + sparkline bottom.

Previous responsive rule kept a 6-column grid even at 320px, which overflowed on iPhone SE. The CSS rewrite uses nth-child grid-area assignments — JSX is unchanged, the row stays a single Link, tap target preserved across the whole card.

/dashboard/stocks