Accounts and sign-in 0.13.0
- Every answer names its request (X-Request-Id). Each call made with a developer key, an app's token, an app's token exchange or an MCP tool is recorded for the account whose console shows it, with its route, answer and how long the service took (never the person an app acted for), and counted by minute, hour and day with latency percentiles. The console reads them: metrics, breakdowns, events and one request by its id, a service account's for its organization's managers.
- Records the Privacy Notice of 2026-10-21.5 (what the console measures) with each sign-up.
- A developer token with the new notify:send scope may send the account's own phones a notice (POST /identity/native/push/send with Authorization: Bearer alyd_...): the same closed kinds and limits as the app's, refused from a browser, logged in the token's log. Apps (Sign in with Alelyon) are never offered it.
- deploy the identity service at the version's commit, with PRIVACY_VERSION 2026-10-21.5, after a data-disk snapshot and after the website release that carries that text.
- deploy the identity service at the version's commit, after a data-disk snapshot; no setting changes.