- HMAC on the email forwarding webhookThe same per-workspace signing secret that protects the signal webhook now protects inbound email parsing.
- API v1 expanded: tasks + sourcesGET/PATCH /api/v1/tasks, GET/POST /api/v1/sources, with plan-tier enforcement. The MCP server is now exclusively a protocol-translation job.
- Share link 14-day sparklineEvery public share page now records a per-render event; the share button surfaces a 14-day SVG sparkline of who's actually reading.
- ISO 42001 governance docsLoop Desk's controls are mapped to ISO/IEC 42001 control families: human oversight, transparency, risk management, data governance.
- Desk health scoreA 0-100 score from loop liveness, signal flow, cycle activity, and approvals + sources. One number, four explainable parts.