Changelog

• Current image and Composer version are 0.3.5-beta (ghcr.io/apxcde/beacon:0.3.5-beta, packages.apexcode.dev). Do not install 0.3.4-beta — that tag was withdrawn.

• .env.example no longer ships a LICENSE_PUBLIC_KEY. The verifying key is embedded in config/licensing.php. Leave the env var unset unless you are running a forked distribution that signs its own licenses. Do not set it empty — Beacon will refuse to boot.

• Licensing 0.1.1 caches JSON-safe claims instead of PHP objects, which stops the Laravel 13 database-cache TypeError on every HTTP request. Images must not float back to licensing 0.1.0.

• MCP gained machine-readable schema resources, short agent playbooks, and five new prompt workflows, so an agent can read the contract and run common jobs without assembling HTTP by hand.

• MCP schema resources (application/json, public reference data — not tenant-scoped) sourced from the OpenAPI spec: beacon://schema/message, beacon://schema/thread, beacon://schema/contact, beacon://schema/business-number, and beacon://schema/error. Each returns the JSON Schemas for that entity — envelopes, enums, request/response shapes, and (for errors) the machine-readable error-code catalog — so an agent can introspect Beacon's contract before calling a tool.
• MCP guide resources (text/markdown, public reference data — not tenant-scoped): beacon://guides/sending-first-message, beacon://guides/handling-replies, beacon://guides/managing-contacts, beacon://guides/opt-out-and-compliance, beacon://guides/otp-flow, and beacon://guides/error-handling — short agent playbooks for the common workflows.
• MCP prompts: thread_reply_suggestions (tone-tagged reply drafts for the latest inbound message), support_handoff_summary (structured handoff packet for a thread), contact_enrichment_notes (note, tag, and field-update suggestions from recent activity), outreach_plan (audience-and-goal outreach plan with message variants), and otp_assistant (guided send_otp / verify_otp flow with resend and lockout handling).

• First public beta: HTTP API and MCP on the same install, Twilio send/inbound, team-scoped keys, first-run setup, threading, opt-out, idempotency, rate limits, OpenAPI, licensing, Docker.

• HTTP API for messaging (POST /text), threads (list, show, messages, replies polling), contacts (CRUD, upsert, by-phone, duplicates, merge, phone-number management), business numbers (CRUD, make-primary), and OTP (generate, verify).
• MCP server at /api/mcp exposing the full tool, resource, and prompt catalog documented in docs/mcp.md. Includes agent-native helpers: search_people_and_threads, get_contact_context, resolve_phone_to_context, summarize_thread, prepare_outreach_message, send_followup_to_contact.
• MCP prompts: draft_follow_up, summarize_conversation, merge_contact_decision, reply_triage.
• Twilio integration: outbound send, inbound webhook ingestion (/external/sms/inbound), message-status callbacks (/external/sms/status), OTP-status callbacks (/external/sms/otp-status), with X-Twilio-Signature validation.
• Tenant-scoped API keys (X-API-Key header, Authorization: Bearer, query/body fallbacks) with disabled-key support and a _test suffix for test mode (bypasses Twilio and licensing).
• First-run setup Livewire wizard: workspace, encrypted Twilio credentials, business number entry or Twilio purchase, API key generation.
• Authenticated dashboard: team switcher, active business-number picker, add-number modal, settings page.
• Threading model: outbound and inbound messages collapse into per-(business number, contact phone) threads with last_message_at cursor pagination.
• Opt-out detection: STOP/STOPALL/UNSUBSCRIBE/CANCEL/END/QUIT auto-suppress sends to that contact phone for the team.
• Idempotency layer: 24h dedupe window, body-mismatch detection.
• Token-bucket rate limiting: 10 req/sec burst 50, env-configurable.
• OpenAPI 3.1 spec served at /openapi.yaml.
• License enforcement with a grace period and test-mode bypass.
• Docker packaging: Dockerfile (Nginx + PHP-FPM), docker-compose.yml with Horizon and scheduler containers, optional MySQL profile, health checks.

These are intentionally deferred to v1.x:

• Dashboard thread viewer / contact manager UI (Beacon v1 is agent-driven; build a UI on top of the API if you need one).
• Managed credential rotation UI / CLI.
• Multi-secret webhook signature verification (current installation supports one Twilio Auth Token per Beacon instance).
• Quota- and billing-aware MCP capabilities (SaaS tier).

• PHP 8.4
• Laravel 13.2
• Pest 4
• Livewire 4 + FluxUI 2
• Horizon 5
• Sanctum 4