Quilt Connect now also works on private stacks, and adds support for Databricks, ChatGPT, and Codex as MCP clients. This release also moves package metadata to per-bucket Iceberg tables for faster and cheaper querying, especially from Tabulator, and adds Glacier rehydration from file preview. Benchling entries gain referenced-entity search and multi-bucket search, while QuiltSync adds a CLI, background Autosync and workflows.
+
+
+
+
New Quilt Platform Features
+
+
+
Private Quilt Connect
+
Quilt Connect now uses the same network configuration as the rest of your Quilt stack. This allows OAuth sign-in to Quilt's Platform MCP Server from local MCP clients such as Claude Code, even if you don't have a public endpoint or are using a web-application firewall.
+
+
+
+
MCP Support for Databricks, ChatGPT, and Codex
+
Quilt Connect now supports Databricks, ChatGPT, and Codex as MCP clients. Stack admins can specify Databricks and ChatGPT hosts in ConnectAllowedHosts, or use localhost for access by Codex.
+
+
+
+
+
Benchling Entities and Cross-Bucket Search
+
This release bundles v0.19 of the Benchling Webhook:
+
+
Each auto-generated entry package contains the full list of referenced objects, as both package metadata and a links.json file. This includes both the unique identifier and human-readable names, so you can search or query to find every experiment that references plasmid QB-2743.1.
+
You can disable automatic package creation by not setting a default bucket. Instead, the App Canvas uses the new Iceberg catalog to search every bucket for packages with metadata that reference the notebook name (for example, experiment_id = EXP00012345) and displays those instead.
+
+
+
+
+
+
+
Iceberg Package Metadata
+
Quilt users can now query package metadata directly as Iceberg tables in Athena—package revisions, tags, manifests, and entries—instead of relying on Athena to crawl individual JSONL manifests on every query. If you can read a bucket in the catalog, you can query its Iceberg tables using your existing session credentials.
+
This uses per-bucket tables of the form {bucket}_package_{revision,tag,manifest,entry}.
+
Tabulator and in-catalog package surfaces use the new layout transparently. Tabulator queries now hit this index instead of doing a full S3 scan through Glue/Athena SerDe tables, making queries cheaper and faster with unchanged permissions. External consumers of the old global tables must migrate to the per-bucket names and use UNION ALL for cross-bucket queries.
+
+
+
+
+
Glacier Rehydration from File Preview
+
Archived S3 objects in Glacier or Deep Archive can now be restored directly from file preview in the Quilt Catalog. Choose restore tier and duration; Quilt tracks restore state from S3 metadata, and managed read/write roles get s3:RestoreObject.
+
+
+
+
+
+
QuiltSync & CLI
+
+
Background Autosync
+
QuiltSync adds an opt-in Autosync loop with independent Pull and Push toggles. Auto-pull refreshes latest for installed remote packages when the working tree is clean; auto-push can commit and publish quiet local changes using your publish settings, while pausing on pending changes or divergence.
+
A tray-resident shell keeps Autosync running with the main window closed. The optional Close to tray setting hides the window instead of quitting, and the tray shows idle, syncing, paused, or error status with Open Quilt and Quit actions.
+
A per-mapping filesystem watcher refreshes local package status when files change on disk, so status badges and entry lists update within about 500 ms without a reload. The watcher is guarded against feedback loops and only repaints when computed status changes.
QuiltSync now enables you to specify per-bucket workflows, which is particularly useful with locally created packages.
+
+
+
Clearer Merge Actions
+
The merge page now labels actions by direction: Promote my commit pushes the local commit and tags it latest, while Overwrite local with remote resets local state and discards uncommitted edits.
+
+
+
quilt-cli on crates.io
+
The new QuiltSync-based quilt CLI is now published to crates.io with prebuilt binaries for macOS and Linux, installable via cargo binstall quilt-cli. It is tightly integrated with QuiltSync's data directory so you can use either the CLI or the GUI to manage your packages.
+
+
+
+
+
Robust Image Previewing
+
+
Multi-channel images render ~12–25% faster, and large floating-point multi-channel images near the memory limit now render reliably.
+
A channel containing NaN or infinite pixel values no longer blanks the entire thumbnail.
+
Color CZI images stored in BGR pixel formats (for example, Bgr24 or Bgr48) now preview with correct colors.
+
Signed and wider-than-16-bit integer images (uint32, uint64, int8, int64, and 32-bit-integer color) now preview contrast-stretched instead of failing or rendering dark.
+
.jpeg/.webp thumbnails, float and 16-bit-color images, and 16-bit greyscale now render correctly.
+
Previews are now 8-bit everywhere, producing smaller PNGs with no loss of meaningful detail.
+
The source image streams to disk during rendering instead of buffering fully in memory, lowering peak memory on large images.
+
+
+
+
+
Other Catalog Improvements
+
+
Landing page bucket cards now show configured bucket icons, matching the navbar selector.
+
An expired or rejected session now reliably redirects to sign-in instead of showing a generic error page.
+
The Admin > Theme logo preview no longer breaks the editor when the configured S3 URL is malformed.
+
Markdown file previews now use standard GitHub-Flavored Markdown (a superset of CommonMark). This means idiosyncratic Pandoc/PHP-Markdown-Extra shortcuts are no longer supported.
+
Syntax highlighting now loads language grammars on demand instead of all up front; code in an unsupported or unrecognized language is no longer highlighted.
+
The Athena Queries tab no longer errors for accounts with more than 50 Athena workgroups.
+
+
+
+
+
Stack Admin Improvements
+
Lake Formation Grants (Opt-In)
+
A new EnableLakeFormationGrants stack parameter emits PrincipalPermissions grants from stack service roles to the data lake. If your AWS account enforces Lake Formation on the data lake, you must enable this parameter; otherwise Lake Formation denies the stack's roles and per-bucket Iceberg access, among other things, breaks. It is opt-in and off by default; leave it off only on accounts that do not enforce Lake Formation.
+
+
+
+
Other Stack Improvements
+
+
The Quilt Platform MCP server now returns the full package revision hash, avoiding errors due to truncated hashes. Registry errors are also properly surfaced by the tool. The package_create tool avoids overwriting existing packages, steering clients to package_patch unless overridden, in which case it reports the diff.
+
The registry now uses the mimalloc allocator instead of pymalloc, lowering per-worker memory and eliminating intermittent out-of-memory worker kills that surfaced as a catalog “Unexpected Error.”
+
Obsolete global Iceberg package tables are now cleaned up via S3 lifecycle expiration instead of a synchronous Athena DROP TABLE that could time out on large stacks; the Iceberg Glue database name is now exposed as the IcebergDatabaseName stack output.
+
The CloudWatch Synthetics canary runtime is now Node 22 / Synthetics 15.1, replacing the previous v10 runtime that is on AWS's deprecation path.
+
Customers still on Network 1.0 can easily migrate to Network 2.0 for improved security and configurability.
+
+
These already shipped as part of the 1.69.4 security update, but are included here for completeness.
+
+
Postgres engine upgraded to 15.18 for CloudFormation deployments.
+
s3-proxy: nginx upgraded 1.24.0 → 1.30.2 with a refreshed Amazon Linux base image.
+
+
+
+
+
Your CloudFormation Template
+
Find the CloudFormation YAML file available via the link below:
{% text "preview_text" label="Preview Text This will be used as the preview text that displays in some email clients", value="Security and reliability improvements, safer Catalog file deletion, clearer search errors, steadier registry memory use, and QuiltSync v0.20.0.", no_wrapper=True %}
This release combines a broad batch of security and reliability improvements across the stack with QuiltSync v0.20.0, which adds role switching, safer pulls, and clearer revision details. It also brings safer file deletion in the Catalog, clearer errors for malformed searches, steadier registry memory use under sustained load, and a new date-based numbering scheme for Quilt Platform releases.
+
+
+
+
A Note on Version Numbering
+
+
Date-Based Releases
+
Starting with this release, Quilt Platform version numbers are date-based: 26.7 is the release for July 2026. The previous release was 1.71.
+
Existing minimum-version constraints such as “1.70.0 or higher,” along with tooling that compares release versions, continue to work because 26.7 sorts after every 1.x release.
+
This changes what the numbers mean, not the platform. It is not a jump of twenty-five major versions, and compatibility and the upgrade path are unchanged. Version tags retain the same three-part form (26.7.0), with the third number identifying patch releases such as 26.7.1 and 26.7.2.
+
+
+
+
+
Quilt Platform Changes
+
+
Deleting a File Now Preserves Earlier Versions
+
Deleting a file from the Catalog on a versioning-enabled bucket now adds an S3 delete marker instead of erasing that version of the object. The file leaves the bucket listing as before, while earlier versions remain browsable and packages pinning them continue to resolve. On buckets without versioning, deletion still removes the object permanently.
+
Deleting a specific object version requires s3:DeleteObjectVersion, which Quilt read-write roles do not grant by default. Ask a Quilt admin to attach a custom policy granting this action to your role; otherwise delete_object calls, including through quilt3, fail with AccessDenied. No action is required if nothing in your workflows deletes specific object versions.
+
+
+
Clear Errors for Malformed Searches
+
A search query that cannot be parsed—such as an unparseable numeric term, invalid regular expression, or malformed Lucene syntax—now returns a validation error instead of a server error.
+
+
+
Steadier Registry Memory Use
+
The registry now recycles request-handling workers gracefully, using staggered worker lifetimes and a per-worker memory cap. Gradual memory growth no longer ends in abrupt out-of-memory kills that can interrupt requests and surface as gateway or full-page Catalog errors.
+
+
+
+
+
QuiltSync v0.20.0
+
+
Role Switching
+
+
Switch Roles in QuiltSync: Settings > Auth now shows the active role for each Quilt Catalog login and lets users with multiple roles switch directly in the app. The selected role takes effect on the next read or write.
+
Clearer Permission Guidance: When the active role cannot access a bucket, QuiltSync identifies the role and offers an opportunity to switch. Commit is disabled before the operation begins, and Autosync pauses until the role changes.
+
+
+
+
Safer Pulls and Clearer Revisions
+
+
Preserve Non-Conflicting Local Work: Pull now keeps local edits that do not conflict with incoming remote changes. QuiltSync identifies conflicts before pulling and asks users to resolve only files changed both locally and remotely. Autosync uses the same behavior.
+
Readable Revision Details: Version-mismatch banners now show the revision's commit message instead of its top hash, with the full hash available on hover.
+
+
+
+
+
+
Stack Admin Improvements
+
+
Encryption and Transport
+
+
All HTTPS listeners now use AWS's current recommended TLS policy, retaining TLS 1.3 and 1.2 with forward-secret ciphers and adding post-quantum key exchange.
+
Both load balancers now drop incoming HTTP headers containing characters that are invalid under the HTTP specification.
+
Every SQS queue now explicitly requires TLS for sending and receiving messages.
+
+
+
+
Storage and Key Configuration
+
+
Internal service buckets now explicitly declare S3 Block Public Access and enforced bucket-owner object ownership.
+
The SNS notification encryption key now has automatic key rotation enabled.
+
The unused analytics bucket CORS configuration has been removed.
+
+
+
+
Least-Privilege Roles
+
+
The package-events Lambda role now grants only its required EventBridge action on the account's default event bus.
+
The access-counts Lambda role now scopes Athena and Glue permissions to stack-owned resources.
+
Roles trusted by ECS or EventBridge now require the calling service to act for the current account.
+
+
+
+
Athena Workgroups
+
+
The Iceberg and audit-trail workgroups now enforce their workgroup configuration, preventing client-side query settings from overriding it.
+
The access-counts Lambda now runs hourly queries in a dedicated, stack-owned Athena workgroup instead of the shared primary workgroup.
+
+
+
+
Logging and Service Configuration
+
+
Registry, nginx, and platform Lambda CloudWatch log groups now retain logs for 365 days instead of 90 days.
+
All security-group rules now include a description naming the traffic they permit.
+
Fargate services now state their platform version explicitly.
+
+
+
+
+
+
Other Improvements
+
+
S3 Notification Reliability
+
+
The S3-notification forwarding Lambda no longer writes the full event payload to CloudWatch on every invocation. It now logs only failures, including the record that failed.
+
The Lambda now ignores the test event S3 sends when a bucket notification configuration is created, preventing unnecessary retries and dead-letter queue entries.
+
+
+
+
+
diff --git a/release-notes/26-7-0-release-notes.md b/release-notes/26-7-0-release-notes.md
new file mode 100644
index 0000000..6e66b5f
--- /dev/null
+++ b/release-notes/26-7-0-release-notes.md
@@ -0,0 +1,81 @@
+# Platform Update 26.7
+
+This release combines a broad batch of security and reliability improvements across the stack with QuiltSync v0.20.0, which adds role switching, safer pulls, and clearer revision details. It also brings safer file deletion in the Catalog, clearer errors for malformed searches, steadier registry memory use under sustained load, and a new date-based numbering scheme for Quilt Platform releases.
+
+## A Note on Version Numbering
+
+Starting with this release, Quilt Platform version numbers are date-based: **26.7** is the release for July 2026. The previous release was 1.71.
+
+Existing minimum-version constraints such as "1.70.0 or higher," along with tooling that compares release versions, continue to work because 26.7 sorts after every 1.x release.
+
+This changes what the numbers mean, not the platform — it is not a jump of twenty-five major versions, and nothing about compatibility or the upgrade path changes with it. Version tags keep the same three-part form (`26.7.0`), and the third number still marks patch releases off a given month's release (`26.7.1`, `26.7.2`, and so on).
+
+## Quilt Platform Changes
+
+### Deleting a File Now Preserves Earlier Versions
+
+Deleting a file from the Catalog on a versioning-enabled bucket now adds an S3 delete marker instead of erasing that version of the object. The file leaves the bucket listing as before, but earlier versions stay browsable and any package pinning them keeps resolving. On buckets without versioning enabled, deletion still removes the object permanently.
+
+Deleting a specific object version requires `s3:DeleteObjectVersion`, which Quilt read-write roles do not grant by default. Ask a Quilt admin to attach a custom policy granting this action to your role; otherwise `delete_object` calls, including through `quilt3`, fail with `AccessDenied`. No action is required if nothing in your workflows deletes specific object versions.
+
+### Clear Errors for Malformed Searches
+
+A search query that cannot be parsed — an unparseable numeric term, an invalid regular expression, or malformed Lucene syntax — now returns a validation error instead of failing with a server error.
+
+### Steadier Registry Memory Use
+
+The registry now recycles its request-handling workers gracefully, using staggered worker lifetimes together with a per-worker memory cap, so gradual memory growth no longer ends in abrupt out-of-memory kills. Those kills could land mid-request and surface as an intermittent gateway error or a full-page Catalog error.
+
+## QuiltSync v0.20.0
+
+[QuiltSync](https://www.quilt.bio/quiltsync), the desktop sync client for Quilt packages, now handles multi-role access and local changes more gracefully.
+
+### Role Switching
+
+- **Switch Roles in QuiltSync:** Settings > Auth now shows the active role for each Quilt catalog login and lets users with multiple roles switch directly in the app. The selected role takes effect on the next read or write.
+- **Clearer Permission Guidance:** When the active role cannot access a bucket, QuiltSync identifies the role and offers an opportunity to switch instead of showing a raw storage error or asking the user to sign in again. Commit is disabled before the operation starts, and Autosync pauses until the role changes.
+
+### Safer Pulls and Clearer Revisions
+
+- **Preserve Non-Conflicting Local Work:** Pull now keeps local edits that do not conflict with incoming remote changes. QuiltSync identifies conflicts before pulling and directs users to commit and resolve only when the same files changed locally and remotely. Autosync uses the same behavior.
+- **Readable Revision Details:** Version-mismatch banners now show the revision's commit message instead of its top hash, with the full hash available on hover.
+
+Download [QuiltSync v0.20.0](https://www.quilt.bio/quiltsync).
+
+## Stack Admin Improvements
+
+This release closes a large batch of security-scanner findings across the CloudFormation template. Nearly all of them are configuration changes with no effect on how the stack behaves; the exceptions are called out below.
+
+### Encryption and Transport
+
+- All HTTPS listeners — the main, private, and Quilt Connect load balancers — now use AWS's current recommended TLS policy, which keeps TLS 1.3 and 1.2 with forward-secret ciphers, adds post-quantum key exchange, and drops only legacy CBC ciphers. Client impact is negligible.
+- Both load balancers now drop incoming HTTP headers containing characters that are invalid per the HTTP specification, rather than forwarding them upstream. Well-formed traffic is unaffected.
+- Every SQS queue now explicitly requires TLS for sending and receiving messages. The queues were already encrypted, so this is a belt-and-braces change with no effect on delivery.
+
+### Storage and Key Configuration
+
+- The internal service buckets (DuckDB-select, ES-ingest, Iceberg, Tabulator, and user Athena results) now declare S3 Block Public Access and enforced bucket-owner object ownership explicitly. These buckets were already private; stating the settings in the template makes the configuration visible to scanners and detectable if it ever drifts.
+- The SNS notification encryption key now has automatic key rotation enabled. Existing key material is retained, so data encrypted before the change stays readable.
+- The analytics bucket no longer declares a CORS configuration. The rule was unused — the Catalog reads access counts through the registry API rather than from the bucket directly — so removing it changes no access.
+
+### Least-Privilege Roles
+
+- The package-events Lambda's role no longer carries a broad managed EventBridge policy. It now grants only the single action the Lambda uses, on the account's default event bus, which also removes the account-wide role-passing permission that managed policy included.
+- The access-counts Lambda's role no longer grants its Athena and Glue actions on all resources; they are now scoped to its own workgroup and to the stack's own Glue catalog, database, and tables.
+- Every role trusted by ECS or EventBridge now requires the calling service to be acting for this account, the cross-service guard both services' documentation prescribes. Trust-policy updates apply without interruption.
+
+### Athena Workgroups
+
+- The Iceberg and audit-trail workgroups now enforce their workgroup configuration, so client-side query settings can no longer override it. For the audit-trail workgroup this guarantees what the documentation already describes: audit query results are written to the audit-trail bucket.
+- The access-counts Lambda now runs its hourly queries in a dedicated, stack-owned Athena workgroup instead of the account-shared `primary` workgroup. Administrators will see one additional workgroup in the stack.
+
+### Logging and Service Configuration
+
+- CloudWatch log groups — the registry and nginx group, and all platform Lambda groups — now retain logs for 365 days, up from 90. Logs are kept roughly four times longer; the only cost change is CloudWatch Logs archival storage, as log ingestion is unchanged.
+- All security-group rules now carry a description naming the traffic they permit.
+- Fargate services now state their platform version explicitly, matching the value Fargate already used by default.
+
+## Other Improvements
+
+- The S3-notification forwarding Lambda no longer writes the full event payload to CloudWatch on every invocation. This was a debugging leftover that dominated log volume on busy stacks; it now logs only on failure, including the record that failed.
+- That same Lambda now ignores the test event S3 sends when a bucket's notification configuration is created, instead of failing on it. Previously each test event cycled through retries into the dead-letter queue and could take genuine events batched alongside it.
diff --git a/release-notes/README.md b/release-notes/README.md
new file mode 100644
index 0000000..892161c
--- /dev/null
+++ b/release-notes/README.md
@@ -0,0 +1,263 @@
+# Quilt Platform Release Notes
+
+This directory contains the source Markdown and HubSpot coded-email templates for Quilt Platform release announcements.
+
+## File naming
+
+Use the full three-part release version in both source filenames:
+
+```text
+-release-notes.md
+-release-notes.html
+```
+
+For example, Quilt Platform 26.7.0 uses:
+
+```text
+26-7-0-release-notes.md
+26-7-0-release-notes.html
+```
+
+Platform versions are date-based beginning with 26.7: `26.7` is July 2026, and the third number identifies patch releases such as `26.7.1`.
+
+## Authoring workflow
+
+1. Write and review the release in Markdown using [TEMPLATE.md](TEMPLATE.md).
+2. Create the matching HTML file from [TEMPLATE.html](TEMPLATE.html).
+3. Keep the title, introductory summary, feature descriptions, version numbers, and links synchronized between the Markdown and HTML files.
+4. Replace every `[[PLACEHOLDER]]` in the generated HTML. The square-bracket form is intentional: `{{ ... }}` is reserved for HubL.
+5. Run the local checks before uploading:
+
+ ```bash
+ hs cms lint release-notes/-release-notes.html
+ git diff --check -- \
+ release-notes/-release-notes.md \
+ release-notes/-release-notes.html
+ ```
+
+The introductory summary should mention the most important Platform and QuiltSync changes. Do not let a major companion-product release appear only in a later section.
+
+## HubSpot template requirements
+
+`TEMPLATE.html` is an HTML + HubL coded email template. Preserve these elements in every generated release template:
+
+- `templateType: email`
+- `isAvailableForNewContent: true`
+- A dynamic HubSpot email title
+- The `hs-inline-css` style block
+- The editable `preview_text` module
+- The editable `@hubspot/email_body` module
+- The optional browser-view link
+- Company address fields from `site_settings`
+- Subscription-preference and global-unsubscribe links
+
+### Deployment personalization fields
+
+The **Your CloudFormation Template** section must retain these account-specific HubSpot personalization tokens:
+
+| Display field | HubSpot property | Fallback |
+| --- | --- | --- |
+| Catalog URL | `p24310949_deployments.quilt_stack_url` | `No URL Found` |
+| Template URL | `p24310949_deployments.template_variant_url` | `No Template Variant Found` |
+| Deployment Style | `p24310949_deployments.cf_tf` | `CF` |
+| Network Version | `p24310949_deployments.network_version` | `2` |
+
+Use the full HubL expression, not the fallback as static text. For example:
+
+```html
+{{ personalization_token('p24310949_deployments.quilt_stack_url', 'No URL Found') }}
+```
+
+These tokens were recovered from the live 1.71 marketing email. They are not ordinary contact properties and must not be replaced with generic `[[PLACEHOLDER]]` values or sanitized fallbacks.
+
+Keep these expressions at template scope. Do not place them inside the `@hubspot/email_body` rich-text module or a `module_attribute "html"` block: nested HubL is treated as rich-text content and recipients will see the literal `{{ personalization_token(...) }}` expression instead of the resolved value.
+
+Passing `hs cms lint` only proves that the file is valid HubL. It does **not** create a marketing email or prove that all campaign metadata is present.
+
+## Upload the coded template
+
+The HubSpot CLI is configured with the `quilt-data` account alias for account `24310949`.
+
+Upload to draft first, then publish after HubSpot accepts it:
+
+```bash
+hs cms upload \
+ --account=quilt-data \
+ --cms-publish-mode=draft \
+ release-notes/-release-notes.html \
+ release-notes/-release-notes.html
+
+hs cms upload \
+ --account=quilt-data \
+ --cms-publish-mode=publish \
+ release-notes/-release-notes.html \
+ release-notes/-release-notes.html
+```
+
+Confirm the remote asset exists:
+
+```bash
+hs cms ls --account=quilt-data release-notes
+```
+
+The uploaded file is a Design Manager asset. It appears under:
+
+```text
+https://app.hubspot.com/design-manager/24310949
+```
+
+It will **not** appear in the Marketing Email list until a marketing-email record is created from it.
+
+## Create the marketing email
+
+### Recommended: clone the previous release
+
+Clone the previous release email when the new email should inherit detailed metadata such as sender settings, subscription type, campaign, access, graymail behavior, and email mode. HubSpot provides a dedicated clone endpoint:
+
+```bash
+POST /marketing/emails/2026-03/clone
+```
+
+Request body:
+
+```json
+{
+ "id": "",
+ "cloneName": "Variant Release Email - , ",
+ "language": "en"
+}
+```
+
+After cloning, patch the clone with the new subject, preview text, coded-template path, web-version details, and any metadata that intentionally differs from the previous release.
+
+Cloning does not attach a draft to the previous email's workflow. For a workflow email, configure the clone's sending method as **Through an automation**, complete HubSpot's review, and publish the automated email. Only then can it be selected in a workflow's **Send email** action. Adding or replacing that workflow action is a separate, potentially live change and requires explicit approval.
+
+### Minimal creation
+
+The Marketing Email API can also create a new draft, but the result contains only minimal defaults:
+
+```bash
+POST /marketing/emails/2026-03
+```
+
+```json
+{
+ "name": "Quilt Platform Release ",
+ "subject": "Quilt Platform Release "
+}
+```
+
+When using this path, set the coded template using the nested update field:
+
+```json
+{
+ "content": {
+ "templatePath": "release-notes/-release-notes.html"
+ }
+}
+```
+
+Do not rely on `templatePath` at the top level of the create request. HubSpot may silently create the draft with `@hubspot/email/dnd/plain_text.html` instead. Always fetch the resulting record and verify `content.templatePath`.
+
+## Required marketing-email metadata
+
+Use the previous release as the source of truth, then confirm every value. Current Quilt defaults include:
+
+| Field | Expected value |
+| --- | --- |
+| From name | `Quilt Support` |
+| From/reply-to address | `support@quilt.bio` |
+| Subscription | `Quilt Stack Updates` |
+| Subscription ID | `220905832` |
+| Office location ID | `108352087860` |
+| Web-version domain | `www.quilt.bio` |
+| Language | `en` |
+
+Also set and verify:
+
+- Internal email name
+- Personalized subject line, when required
+- Persisted preview text, not only the template's default preview text
+- Campaign ID for the current release
+- Low-engagement/graymail suppression behavior
+- Browser-version slug and meta description
+- Email type: regular/batch or automated
+- Recipient lists for regular emails, or the **Through an automation** sending method for automated-email drafts
+- User and team access restrictions
+
+Campaigns change over time. Do not blindly reuse the previous campaign ID simply because it exists on the prior email.
+
+### Preview text
+
+For coded templates, persist preview text in the email record as well as supplying a template default:
+
+```json
+{
+ "content": {
+ "widgets": {
+ "preview_text": {
+ "body": {
+ "value": ""
+ }
+ }
+ }
+ }
+}
+```
+
+### Lifecycle fields
+
+The following details cannot be prefilled as ordinary metadata:
+
+- Published status
+- Publishing user and publication date
+- Workflow history
+- Delivery, open, click, and reply statistics
+
+These fields appear only after the corresponding HubSpot lifecycle action. Do not publish, attach a workflow, select recipients, or send merely to make the details panel look complete.
+
+## Verify before handoff
+
+Fetch the created email and confirm at least:
+
+- `state` is still a draft
+- `content.templatePath` is the intended release template
+- Subject and preview text are correct
+- Sender and reply-to are populated
+- Subscription and office location are populated
+- Campaign is appropriate for this release
+- Web version is configured as intended
+- Graymail behavior matches the release-email policy
+- Regular-email recipient lists are intentionally configured, or an automated-email draft is ready to be reviewed and published before workflow selection
+
+Marketing emails are listed at:
+
+```text
+https://app.hubspot.com/email/24310949/manage/state/all
+```
+
+An email editor URL has the form:
+
+```text
+https://app.hubspot.com/email/24310949/edit/
+```
+
+## Credentials and safety
+
+The repository `.env` may define `HUBSPOT_ACCESS_TOKEN`. The token needs the following scopes for the workflow above:
+
+- `content`
+- `marketing.email.read`
+- `marketing.email.write`
+
+Important rules:
+
+- Never print, log, paste, or commit access-token values.
+- Never run `set -x` while a token is loaded.
+- Do not inspect `.env` by printing entire lines. Extract variable names with a parser that understands optional `export` prefixes.
+- Load the token only for the command that needs it.
+- Filter API responses to the non-sensitive fields required for verification.
+- Rotate a credential immediately if it appears in terminal or tool output.
+- Creating or updating a draft is not authorization to publish, attach live automation, choose recipients, or send.
+
+The CLI credential in `~/.hscli/config.yml` and the token in `.env` may have different scopes. A successful Design Manager upload does not prove that the same credential can create or update marketing emails.
diff --git a/release-notes/TEMPLATE.html b/release-notes/TEMPLATE.html
new file mode 100644
index 0000000..e9e48b9
--- /dev/null
+++ b/release-notes/TEMPLATE.html
@@ -0,0 +1,127 @@
+
+
+
+
+ {% if content.html_title and content.html_title != '' %}{{ content.html_title }}{% else %}{{ content.body.subject }}{% endif %}
+ {% if content.meta_description %}{% endif %}
+
+
+
+
{% text "preview_text" label="Preview Text This will be used as the preview text that displays in some email clients", value="[[PAGE_DESCRIPTION]]", no_wrapper=True %}
+ 
+
+ 
+ 
+
+ 
+
+ 
+ 
+
+