The Platform Alignment Release

We’ve officially deployed a massive platform-wide update across the entire ecosystem! This release unifies our core backend infrastructure, upgrades system security against automated abuse, replaces ad-hoc CDN pathing with private S3 proxying, and surfaces extensive new tooling for both creators and staff.

1. Architectural Consolidation & Backend Refactoring

We’ve streamlined our core microservices to improve reliability, cut down on deployment overhead, and elevate overall developer velocity: * Infernoplex Ported to Go: Our standalone Rust Discord-tracking bot has been ported directly into Popplio’s Go codebase under the infernoplex/ package. Running alongside Arcadia in a single binary, it natively handles server setup wizards, invite creation, leaderboards, and background emoji/sticker synchronization.

• Sorbet API Native Hosting: Internal HTTP dispatching for server metrics and team member cleanups is now served directly through Popplio. * Modular Codebase Restructuring: Monolithic backend routes have been broken down into domain-specific submodules. Additionally, gateway presence settings are now restricted strictly to production nodes to prevent staging environments from altering public bot statuses.
• Ops Note: Deployments now require adding the infernoplex: block to your config.yaml. The legacy Rust service should be decommissioned.

2. In-House Proof-of-Work Vote Captchas

To eliminate botting and automated vote manipulation without relying on intrusive third-party tracking services, we have launched popplio/captcha:

• HMAC & Single-Use Tokens: Challenges are HMAC-signed to prevent client-side token forging, while solved nonces are immediately consumed by Redis to block replay attacks.
• Seamless Client-Side Execution: The frontend automatically solves challenges on vote triggers via crypto.subtle (lib/captcha/pow.ts). The flow is completely invisible to regular users beyond a brief "Verifying…" status.
• Opt-Out Flexibility: Entity owners retain full control and can toggle captcha requirements via captcha_opt_out.

3. GitHub-Backed Changelogs & Native S3 Asset Proxying

• GitHub as Source of Truth: We’ve retired the old database-backed changelog table. The public /changelog route now pulls directly from GitHub Releases across configured repositories, caching for 15 minutes to stay well under rate limits.
• Private Asset Proxying: Asset references no longer rely on brittle path guessing. Assets are stored in a private S3 bucket and served securely through same-origin proxy routes: /cdn/[...path] handles uploaded partner logos, team avatars/banners, and entity banners. /cdn/avatar-mirror/... mirrors Discord avatars into the bucket, serving cached copies for 24 hours to reduce rate limits on Discord’s CDN.
• Authenticated Upload UI: Server-validated S3 upload pipelines are now active across admin partner editors, team settings, and entity edit modals.

4. Comprehensive Dashboard & Developer Tools

• Webhook Management: Bot and server owners now have access to a full webhook management interface. Create, edit, and delete webhooks, manage event whitelists, execute test deliveries with variable inputs, and audit paginated delivery logs.
• API Token Controls: Generates self-service personal and entity-scoped API tokens with custom expirations and granular permission pickers.
• Team Transfer & Real-Time Stats: Bot owners can now shift bot listings between eligible teams directly from the dashboard. Detailed page view counters, invite click tracking, and bot uptime results are also live across entity dashboards.

5. UI Customization, Navigation, & Staff Operations

• Tabbed Customize Drawer: Restructured into Colors (12 accent options), Fonts (added Inter and Space Grotesk), Layout (Compact, Comfortable, and Wide containers), and Content (site-wide NSFW hide and thumbnail blur toggles).
• Navigation & Mobile Upgrades: Expanded header dropdowns ("Browse" and "Community") simplify site navigation, while mobile viewports receive anchored dropdown clamps and inline quick-action cards.

Staff Panel Expansion (/admin):

Added three brand-new administrative management suites:

• Blog Manager (/admin/blog): Full CRUD interface for creating, editing, and drafting public news posts.
• Partner Manager (/admin/partners): Managed featured partner listings with strict URL validation.
• Disciplinary Templates (/admin/staff/disciplinary-types): Full template management for staff warning and suspension systems.