Changelog

What shipped, dated. Each entry corresponds to a public, verifiable artifact — that's the house style.

Pricing and payment details on this page are out of date. Current information: https://tanilo.io/pricing

  1. Gateway /v1/compose withdrawn; its signing key retired

    Our own audit found that the API gateway's /v1/compose signed verdicts supplied by the caller under ao-composed-2026-07-ed25519-3d44ba27 from 27 July to 24 September, without evaluating the claim. The route was withdrawn on 24 September 2026, when we deleted its private key and signing ended. It returns 410 since 28 September 2026, when we also removed its signing code. How many envelopes it signed cannot be established from the records. The key stays in the JWKS so existing signatures verify, but its signatures don't show we evaluated anything. This is a different route from the agentoracle.co /v1/compose stub closed on 28 August. tanilo.io's homepage and trust page now show a receipt issued by /evaluate instead of the one signed through this route. Full account: incident record, 2026-09-30 note.

  2. Incident record published — canned verdicts, 21-25 August 2026

    Four-day window in which /evaluate signed and returned receipts for evaluations it never performed. The signed layer halted every affected request; the presentation body did not disclose that. Fixes shipped 4a8b37177, 98b3b7e78, c28c5dd6f, 49261a37b, a8ce2a18d. External review by @giskard09 found and closed a same-class defect in the conformance sample and an unauthenticated signing path; kid separation remains open with no date. Full record: /incidents/2026-08-25-canned-verdicts ↗.

  3. Verifier v0.1.0 published to PyPI — three-outcome status semantics live on the released artifact

    pip install agentoracle-receipt-verify==0.1.0 · MIT · offline verification against the published JWKS. Public API exposes STATUS_VALID, STATUS_INVALID, STATUS_INDETERMINATE. Post-publish gate ran against the installed package in a fresh venv — the no-key path returns invalid rather than valid. pypi ↗

  4. Experiment A pre-registered — design frozen, three model families, results Sep 2

    Two deep-research agents, one gated through /evaluate (fail-closed, replans on failing verdict), 200 questions across four domains. Measured quantity: which citations survive independent verification. Ground-truth stack deterministic. The pre-registration document was public before any data was collected; the harness and the frozen question set land before the first run, on the schedule published in the repository README. pre-registration ↗

    Corrected 2026-08-17. This entry originally read “Pre-registration document, harness, and questions all public before any data was collected.” That overstated what was public: at the time of writing the harness was a disclosed stub and the question set was an empty array, both scheduled in the repository README for 2026-08-17, ahead of the 2026-08-19 run start. The pre-registration document itself was complete and public as described. No data had been collected at any point, and none has been collected as of this correction.

  5. Virtuals showcase merged — a live production receipt now sits in Virtual-Protocol/acp-cli-demos

    10 files, +670/-0, merge commit c08af80e7a12. Receipt blob d13a275e1c4d is byte-identical to the production receipt. Anyone can clone the showcase folder, install the verifier, and run python3 verify.py receipt.json against the live JWKS. showcase ↗

  6. Deterministic mode — POST /v1/verify-facts: six check types, no LLM in the trust chain, check_mode recorded inside the signed payload

    /docs/deterministic-mode ↗

  7. v0.4 draft rev-2 — per-layer provenance design (layer_trace, mode ∈ {recomputable, signed}, three-state absence semantics) folded in from public design collaboration

    commit ↗

  8. Routine credential rotation completed — all previously issued receipts verify unchanged against the published JWKS

    jwks ↗

  9. /pricing page + MCP homepage block live

    /pricing ↗

  10. Self-serve open — card → API key → signed receipts, live

    get a key ↗

  11. v0.4 conformance suite complete — 1 accept, 3 reject, 3 status vectors; two independent implementations; every envelope and wrapper hash recomputed byte-identical on both sides

    suite ↗

  12. First v0.4 conformance vector shipped — v04-accept-001, two-party signed (AgentOracle + AgentTrust legs), byte-identical across three independent canonicalizations

    vector ↗

  13. Sequence-integrity example merged into the community pre-action governance conformance suite — N artifacts over time, Merkle inclusion + tamper demos

    merge ↗

  14. Canonical verdict→gate mapping published, content-addressed — sha256-addressed immutable doc

    mapping ↗

  15. Third cross-citing draft filed in the receipt family — draft-msebenzi-evidence-action-00 cites draft-krausz-verification-state

    datatracker ↗

  16. Composed multi-issuer envelope example merged into the community conformance suite — N signers, one artifact

    PR #4 ↗

  17. Independent byte-identical second implementation merged — AgentTrust rebuilt the format from spec text alone

    PR #33 ↗

  18. First candidate profile entry in the receipt-format registry — verification.v0.3 entered as a candidate profile in the ERC-8210 Receipt Profile Registry

    registry ↗

  19. IETF Internet-Draft FILED — draft-krausz-verification-state-01

    datatracker ↗

  20. Open-source receipt verifier published — offline JWS verification, MIT licensed

    github ↗

  21. Cross-operator benchmark live — open methodology, open submissions

    github ↗

  22. Receipt spec v0.3 — binary-halt gate + canonical/derived/version-bound mapping

    spec ↗

  23. AVeriTeC 2024 dev published — 57.6% overall, held-out 57.7%, MIT licensed

    repo ↗

  24. Pinned in x402trace v0.3.3 — first operator-contributed fixture in the harness

    release ↗

  25. Live on SKALE Base — first paid settlement gasless on SKALE

    explorer ↗

  26. Tutorial #4 — claim verification in AI content approval workflows

    dev.to ↗

  27. Indexed in Coinbase Bazaar — 8 settlements verified

    discovery ↗