What shipped, newest first.
The gate, the verifier, the verified runs, the standard writer, and the site. Dates are the day a change reached a user; versions identify the released package where one is listed.
2026
Improvement Plans, payment and privacy, in writing.
The Terms now say how paid plans work: invoices go out monthly in advance in US dollars, are paid by bank transfer within 14 days, and prices exclude taxes. Team continues after its fourteen free days and is invoiced monthly unless you cancel by email before they end, and we send a reminder at least three days before. Cancelling takes effect at the end of the month already invoiced, which stays payable; cancelling during the free days means nothing is invoiced; there is no refund for part months, and your consumer-law rights are unchanged. If we end a paid plan ourselves, we refund the unused part of the month, and a significant change to the terms comes with 30 days' notice. Founding-team pricing is held for twelve months, and any later price change comes with 30 days' notice. The service is for work, for people aged 18 or over, and ScopeBlind does not train models on your content. The Privacy page now promises to acknowledge a data request within five business days and complete it within 30, and says how long each kind of operational data is kept. Both pages name the company by its ACN and ABN and give one address, support@scopeblind.com, which security.txt also lists.
Fix Enquiries arrive, and data that only runs the service is cleaned up.
Team and design partner enquiries were saved but never emailed to us, because the notification had no subject line and our mail provider refused it; nobody had sent one yet. Data that only runs the service is now removed by a scheduled cleanup every fifteen minutes: hourly counters for the model features after a day, the hashed network address kept for a button demo, a repository setup or a managed trial after 30 days, device link requests nobody approved, the record of which linked device acted in an invoice trial after 30 days, the reviewer name and note an agent suggested for a trial once the trial is over, and sign-in requests that never connected. Signed records people rely on are never removed this way. A published standard page now stays for 365 days from its latest write, as the Privacy page says, instead of lapsing a year after it was published. A new page lets you confirm a request about your data from the browser that holds your key. Retired code that called services the Privacy page does not list has been removed.
Fix The hosted connector works in Claude.
Three things stood between the hosted connector and Claude on the web and in the desktop app, which call it from Anthropic's servers. The connector now accepts requests that name claude.ai as their origin, and still refuses any other site. It lists its tools with an underscore in place of the dot, such as coordination_inspect_workspace, because Claude refuses a dot in a tool name; the dotted names still work for platforms that use them. And it answers ordinary requests that name a newer protocol version, while still refusing the newer handshake itself so the platform falls back to the one it shares. The sign-in metadata now also links the Terms and the Privacy page.
Fix Your agent can find every review it may read.
A hosted connector used to list only the reviews created from its own drafts, so it could not say where a review stood if the organizer had created it directly, such as the first review in a trial. It now also lists every other review in the project that its agreed limits cover: the same two people, repository, branch, files and checks the service already checks on every read. Nothing it can read changed. The connection page also starts over if a platform sends you to a different connection request in the same tab, so it never shows an earlier request than the one its address names.
Feature Your agent can start a trial with you.
Someone with no project and no repository can now get from inside their agent to a working two-person review. When the agent platform connects, choose a new trial on ScopeBlind's demo repository. Ask the agent to start one and it gives you a link, which carries no secret and opens only in the browser where you connected it. There you start the trial and invite your reviewer yourself; the agent never sees the invitation. When the trial's project exists, the agent's connector joins it, and it can prepare and read work once you propose limits naming it and your reviewer agrees them. A connector's key still never signs as a person, before or after it joins. The shared trial's capacity check also stops counting ScopeBlind's own test runs, which the trial limits already ignored.
Feature Connect an agent platform in one step.
An agent platform that supports signing in to an MCP server can now connect to a project without anyone copying a token. Add https://scopeblind.com/mcp and choose connect: the platform opens scopeblind.com in your browser, you pick one of the projects that browser organizes, check the address the platform will return to, and choose Connect. Your browser signs that approval with your own project key; the platform then exchanges a one-time code for its token, straight from ScopeBlind. It is OAuth 2.1 with PKCE for public clients, with client ID metadata documents and a registration that stores nothing. The connection is an ordinary hosted connector: it grants nothing until the organizer proposes limits naming its key and the reviewer agrees them, it appears on the project page, and the organizer can revoke it there. The approval works only in the browser that holds the project; there is no approval by link.
Improvement Your agent can say who is waiting.
Ask your agent where a review stands and it now answers in a few lines, through the hosted connector: who is waiting on whom and for what, what is left, how agents assessed each success criterion, the feedback on this version, and any open Resolve this options with the one decision each needs. It follows the same rules as the project page, so an expired snapshot or an expired approval is reported as waiting on the receiver, not on a person. The agent can read Resolve this options but never choose one; a choice counts only when the named person's own signed feedback records it. Separately, a hosted connector's key is now refused for anything a person does, such as joining a project, owning or reviewing a task, approving or starting a trial, both by the service and by the data itself.
Improvement The hosted connector finds its own project, and can check a record.
A cloud agent no longer needs anyone to paste IDs: the hosted connector belongs to one project, so it finds the limits its two people agreed for it by itself, and lists the reviews created from its drafts. When something is missing, it now says what, in a sentence the agent can pass on: no limits yet, the reviewer has not agreed them, they expired or were used up. A new read-only tool checks a ScopeBlind record someone was sent, exactly as received, with the same verifiers as the Verify page, pinned to scopeblind.com’s own service key; a record that is consistent only with a key it names itself, or that carries text outside its signatures, is never called genuine. The docs no longer say the agent can see open Resolve this options: only the two people can.
Feature A hosted connector for cloud agents.
A cloud agent that cannot run a local command can now reach a project through one address, https://scopeblind.com/mcp, with a token the project's organizer creates on the project page. The token is shown once. Of the token, ScopeBlind keeps only a hash, beside the connector's public key, and it derives the connector's signing key from the token on each request, so nothing stored here can sign as the connector. It offers six of the local agent profile's tools under the same limits and the same human steps: the organizer proposes preparation limits naming the connector's key, the reviewer agrees them, the agent prepares and reports, and people approve, accept and withdraw on their own devices. Revoking a connector stops its token at once, and the service and its database refuse the connector's key from then on. The site also has plain Privacy and Terms pages now, written from what the service actually stores.
Fix Receiver setup, said plainly.
Three things a first rehearsal of the personal-agent loop tripped over. The advanced connection import now says which file it takes (the connection.json that repository setup writes next to receiver-key.json) and names the wrong file when you pick the signed connection record, the receiver configuration or a private key. The connected-receiver button no longer waits for a poll that only ran while the tab was in front: its first check runs in a background tab too, and the page says why the button is waiting and when updates are paused. The receiver command on the task page no longer invents a key path; it says where repository setup and repository connect actually keep the private key, and the docs say the same.
Feature Bring your personal agent.
A personal agent such as Meta's Muse can now prepare shared work here and follow it through: two commands in the agent's own computer give it a ScopeBlind profile served as a local MCP address, which Muse takes as a custom connector. The agent prepares briefs and revisions and reads status, the next decision and the result; every approval, acceptance and withdrawal is still signed by a person on their own device, the receiver still holds the only credential that can change the destination, and the record still leaves with whoever wants it. The docs carry the setup and a public skill says it in the agent's terms.
0.30.0Feature The grant an agent is acting under travels with the call.
An agent platform can now send, with each tool call, the grant its agent is acting under: who the platform is, which agent, what the person allowed, and for how long. The gateway records it on the decision receipt exactly as presented, together with what it was able to check about the platform's signature: unsigned, unverifiable when it holds no key for that platform, valid, or invalid. Naming a platform key in the policy file is what turns a signature into a checked one, so an unchecked context is never reported as a checked one. The open verifier reads the same member and refuses a receipt whose recorded context is not what the platform signed. This follows a new Veritas Acta draft, with seven shared test vectors, three of which a conformant verifier must refuse.
Feature Resolve this.
When a review is stuck, either person can ask for a resolution. The model proposes a few options inside the agreed scope; the service refuses any that leave the allowed files, name a criterion the brief does not have, or need more than one further decision, and hands the refusals back for one more round at most. What comes back is two to four feasible options, each naming the one decision a person still has to make. Choosing one records ordinary signed feedback for the next revision. Three resolutions per task; nothing is approved or applied by any of it.
0.29.0Feature The result you saw is the result delivered.
A published preview is now rendered from bytes your browser fetched and checked, file by file, against the digest in the worker's signed plan; nothing else can load inside it. Every review can be kept as one file: the review package carries the signed evidence, the verified preview bytes and an offline viewer that re-checks all of it on open with no network. A coding result now names the workflow run and attempt that produced it, signed by the worker from inside that run. And once the recipient accepts a result, its preview is served at one address that will not change, resolving to the same verified bytes.
0.28.0Improvement One standard, two enforcers, one answer.
A standard is enforced twice: by the gateway on the agent's machine and by this site, which compiles it, rehearses call logs against it, and reads the receipts. A shared file of decision vectors, six standards and fifty calls with the answer each standard's own words require, now runs in both release gates, so the two cannot drift apart unnoticed. Three readings were aligned on the gateway side: a standard that states neither tools nor a limit admits nothing; a payment standard admits only the tool it names; amounts are read as integer minor units in the standard's currency, spelled exactly. The demo's inspection now asks for itself as soon as both people are present, from the page both of them are actually polling.
0.27.0Feature Start a revision with what changed.
Each success criterion can now say what it relies on: particular files, named checks, or the preview. When a revision arrives, the review opens with the criteria whose wording was revised, then the criteria whose linked files or preview changed in this version, and folds away the criteria whose wording and evidence are both unchanged. A criterion with no links is treated as relying on the whole change, so nothing is quietly carried over. The new version still needs both people’s fresh decision. Also: once both people have joined a shared demo, the inspection is requested for them instead of waiting for a click.
0.26.0Feature Approve on Friday. Deliver on Monday.
An approval now holds until the task’s deadline, up to seven days, instead of fifteen minutes. It stays bound to one exact version and the brief it was made against. Either person can withdraw their own approval until delivery begins, and the withdrawal stays in the record. At delivery the receiver asks for a short-lived permission that is issued only after rechecking both decisions, membership, the destination branch, and the recorded evidence, then applies within two minutes or not at all. A revised version needs its own two decisions and nothing else. Receivers on protect-mcp 0.26.0 or later apply durable approvals; the demo repository is updated with this release.
Improvement The queue keeps moving when both tabs are in the background.
Review, demo, and trial pages now keep checking for the other person about once a minute while their tab is hidden, so a requested inspection or apply is woken even if both people switched away; in front, they still update every five seconds. A busy model provider no longer ends a negotiation: the step is retried with a growing pause. Internal release checks now run in their own allowance, so a deploy never spends a visitor’s demo or trial budget.
Improvement Five strangers walked the site. Ten things got fixed.
A simulated stranger test of the live site, two of them running a real review in separate browsers, turned up ten things worth fixing. The home page now leads with the friend trial and says what a client review needs. The AI trial tells you the real reason when it cannot start and no longer calls a rejected request saved. Review pages say when they last checked for the other person, refresh the moment you return to the tab, and say so when an inspection has not arrived. The person opening an invitation is greeted as the invited reviewer. Buttons that wait for a tick tell you so. How it works tells the same client-review story as every other page. The shared button demo and the receiver are defined where they are first mentioned, and the docs open the receiver section with what it installs and the one command that installs it.
Improvement One story, front to back: a change, a client, an accepted result.
Home, Demo, Plans, and Docs now tell one journey: describe the change, involve the person who gets the final say, let an agent prepare it, decide on the exact version, deliver and accept. A real completed run, recorded on 17 September, can be inspected on Verify before starting your own. The invoice examples, the rules rehearsal, and the two-agent discussion stay one disclosure away on Demo; Docs opens with four paths.
0.22.0Feature See the change. Share the decision. Keep the feedback.
Try a visible contact-button change in an isolated ScopeBlind-owned repository. Compare checked file versions, invite someone to review, approve the exact change and accept the receiver-observed result. Requested revisions carry the original signed feedback into a fresh task. Connect your own repository through guided local discovery and a pinned receiver workflow. Scoped agents can inspect and suggest revisions; approval stays with each person. Preview and revision evidence verifies locally in the browser or with verifier 0.10.16.
0.21.0Feature Keep the original intent. Review the exact change.
Start with a short practice, then continue into shared work or a real repository review. Original instructions stay with a signed standard; unresolved meaning needs an explicit decision. Browser author keys use secure non-extractable storage with verified migration. Repository tasks bind both approvals to exact commits, paths and checks; the owner’s receiver keeps the write credential and checks the result at GitHub. Evidence separates integrity, authority, observed effect and recipient acceptance. The gateway and coordination client now share a pinned npm release, while verifier 0.10.15 checks complete nested inputs and distinguishes verified properties from declarations.
0.20.0Feature Start with your agent. Take the next decision on your phone.
A reusable agent profile can prepare an unsigned task and return a private review link. Each person reviews and signs their own limits; negotiation and later execution require separate explicit grants. The original organizer can authorize the same agent for the exact jointly adopted task without replacing its negotiation connection. Authorize a phone key for one task, with limited decision permissions, expiry and revocation. An authenticated inbox shows current work, and optional generic reminders carry no task details or approval rights. Evidence preserves actual device signatures and their original human authorization.
Start through your agentYour decisionsSetup and device scope
0.19.0Feature Bring your agent, resolve a disagreement, compare real plans
Choose Claude Code, Codex CLI or a generic MCP client, with scoped setup and resume instructions. Readiness is confirmed only after the adapter verifies the current signed instructions. Two people can now set hard ranges and private preferences for both budget and review threshold, compare actual gate outcomes, and select one exact tested plan for joint approval. Recovery explains conflicts, offers changes only to your own draft, and links fresh discussions to preserved history or an exact eligible blocked request. No earlier approval or agent authority carries into the new discussion.
0.18.0Improvement Try it alone, return to your work, and share an exact result
Practice with an explicitly scripted partner using real isolated gate comparisons. The shared job now explains each next action and shows the consequences of proposed rules. This browser can restore unsigned drafts and invitations, and a recent-work shelf returns to the last view. People can explicitly share an immutable 30-day negotiation or result snapshot; recipients verify its signed record without an account or approval rights. Private agent instructions and raw invitation secrets stay outside those public copies.
0.17.0Feature Your agent and their agent, with both people in control
Two people can now sign separate mandates, give their assistants private background, and negotiate an invoice review threshold. Hosted assistants or individually paired MCP agents recommend at most three proposals. Every comparison retains both people’s required checks and exercises the actual gate in isolated ledgers. Both humans approve the exact proposal, report, and new agreement before creating a separate trial; the partner is enrolled as its reviewer. The shared negotiation history travels with the final evidence, while private briefs stay outside the shared record. Model work starts explicitly, is bounded, and can recover saved progress.
Improvement One clear path from shared work to a checked result
The public pages now use the shared trial’s visual language and a consistent Try together entry. Demo separates guided work, live-agent jobs, and rules rehearsal. Verify leads with authentic signed sandbox examples. Docs organizes setup by task; Write distinguishes draft, test, sign, and deploy. Plans separates the immediate free sandbox from manual team setup. Data-path explanations now distinguish hosted collaboration, model assistance, local gateways, and local verification. Existing tools, records, and deep links remain available.
0.16.0Feature Test and improve the rules together
Invite a collaborator to test an invoice task without payment authority. Rehearse concrete cases through the database-backed gate in isolated sample ledgers, compare an approval-threshold change, and preserve successful work alongside required safety checks. The owner alone can use a passing comparison to create a separate trial with the proposed rules; the original job remains intact. Dedicated test-agent connections expose the same bounded collaboration through MCP. Optional model readback proposes a case for review and marks unsupported requests. Signed reports bind the source inputs, cases, proposed change, and gate runtime, and verify locally in the browser.
Feature A live agent, your limits, and a shared result
The invoice trial now offers a live model that inspects invoices and purchase orders, proposes payments through the gate, and continues independent work while exceptions wait for a reviewer. Describe the job, review the model’s proposed limits and assumptions, and customize the sample amounts. Requested revisions retain the earlier result, payments, and shared budget. Connect your own MCP agent with a short-lived pairing code, wait for decisions, and revoke its access from the room. All payments remain fictional. The guided walkthrough is still available.
Feature Try a shared job with someone else
The shared invoice trial gives two browsers their own signing keys and a private reviewer invitation. Routine payments run within a shared budget; a larger payment waits for an exact approval, changed details require a new decision, and a duplicate invoice is refused. The recipient can accept the finalized result and export independently verifiable evidence. Requests are guided and scripted; decisions and payments run through a persistent sandbox gate and ledger. No live model or bank is connected. The installed coordination adapter is available as a source-build preview.
0.14.0Feature The record lands on the standard's page; held actions wait there for a named person
A signed standard can be published to a page of its own from the Write page. A gate started with the standard and the page refuses anything over the standard's limit before it runs, holds anything above the approval threshold, and posts every receipt to the page after it is chained locally. The named person approves or denies each held action on the page with the key the standard accepts, signed in the browser; the gate finds the decision when the agent retries the same action and carries it in the receipt. Each run opens on the verify page from the standard's page. The author's key now stays in the browser that made it. protect-mcp 0.14.0 adds --standard, --report, --report-token, and --run to the MCP gateway and the hook server, and passes the call's input to Cedar so a compiled amount limit is evaluated at the gate.
Launch One site at scopeblind.com; the standard as a plain-English document; the writer talks to a model
scopeblind.com and legate.scopeblind.com become one site under one name. The standard is rendered as a document a person would sign, from its structure and the compiled clauses, with a mark on every line saying where it is checked; the same document opens above the receipts on a shared record. The plain-English writer now proposes changes through a model (OpenAI or Anthropic, chosen by which key is set) and falls back to fixed sentence shapes offline. Docs, status, and the changelog moved over from the retired console.
Feature Write a standard in plain English, run under it, share the record
A conversation on the left and the standard on the right. Each sentence becomes operations on a structured standard, the compiler turns it into the policy the gate enforces, and the refusals are computed from that policy, never from the words. Sign it in the browser with a key generated there. A checked record can be kept under an unguessable link for 180 days so the other side can check it again without an account.
Launch Stage two: six agents, one bounded allocation, three configurations
Five attested swarm runs published in ScopeBlind/verified-runs. With logs and allowlists alone, nine unauthorized effects reached the services; with a conserved allocation, receivers, and rules over history, zero, at the same cost. Every file behind the numbers is public and checks offline.
v0.10.12Fix @veritasacta/verify 0.10.12 and protect-mcp 0.13.1
One chain-hash rule across every implementation (three conformant: protect-mcp, nobulex, APS), the policy under test is the on-disk bytes, and protect-mcp loads its Cedar engine correctly on Node 18 and 20 after a release that had denied everything there. verify-cli checks a standard against receipts and calls with --standard and --receipts.
Feature Verified runs: a benchmark run every tool call of which is on the record
Run clauses in the compiler, a run manifest, a harness with Codex and Claude hook adapters, and a public repository of runs made in GitHub Actions under the maintainer's published key, with the model answering inside a confidential machine that signs every call.
Feature The standard compiles to the gate's policy
A signed standard compiles to protect-mcp's Cedar policy with a digest every receipt cites; real gateway receipts verify in the browser on the verify page and with one CLI.
Feature Proof Requests and admission decisions
A recipient states the decision, the boundary, the evidence that would change it, and what happens if it is met, signed in the browser. An operator's payment is evaluated against it before dispatch and after, and the admission decision is recomputed from the evidence by anyone.
Launch Two demo films: the gate and the record, and the risks that hide between firms
Two 2-minute films, both live on the record page and both real end to end. Act one: the gate governs a live agent, every decision signs into a record the operator owns, an edited record is caught in the browser, and a payment cap is proven without revealing a single payment. The film was assembled by an AI agent working behind that same gate; one of its own tool calls was refused on camera. Act two: five parties run a standing covenant where health, silence, and breach are public states while every number stays sealed (the Archegos shape), three desks find their one shared exposure without opening a single book, and clean books earn a co-signed certificate. Every artifact in both films verifies offline with the new standalone CLI: npx legate-verify (MIT, on npm). Replay everything from your own terminal.
v0.9.6Feature protect-mcp 0.9.6: policy you can see and change
The gate's policy is now inspectable and editable from the CLI: policy list shows permit/forbid/default-deny per tool with allow/deny counts from your own log, policy allow/deny edit it, and commented-out rules are never read as active. Denials teach the fix: a deny names the policy file and gives the exact command to change it. The running gate hot-reloads Cedar edits, fail-closed on a bad edit. Also 0.9.5: npx protect-mcp sample seeds a labeled sample record (8 real signed receipts including a blocked network call, plus a tampered copy) so the demo film replays in an empty folder in 60 seconds. 267 tests.
v0.9.4Feature protect-mcp 0.9.4: x402 payment receipts, record checkpoints, pinned-identity anchors
The agentic-payments layer, shipped the week Cloudflare launched its x402 Monetization Gateway. The gate tags agent payments across the real x402 wire shapes (paymentRequirements, X-PAYMENT, EIP-3009) into signed receipts carrying the amount, the asset, and a hashed recipient. claim --payment-under <cap> proves every agent payment stayed under a cap, position-blind, and an amount the gate could not read counts as over the cap, so the claim cannot lie. anchor-record checkpoints the record's Merkle root into the public log on a heartbeat, so a later claim is provably over the complete record, not a curated subset.
v0.7.1Fix protect-mcp 0.7.0/0.7.1: the fail-closed release
A security release we are candid about. Verification of a community report showed the Cedar gate could fail open on evaluation errors and was not evaluating Cedar correctly against cedar-wasm 4.x. 0.7.0 makes the gate fail closed on any policy error, missing engine, or evaluation failure, and adds a startup self-test: serve --enforce and doctor refuse to arm the gate unless they can prove a known-forbidden action is actually denied. A gate that cannot prove it denies does not start. GitHub security advisory published; per-host hook adapters (Claude, Codex, Gemini, Cursor, Hermes) followed in 0.7.2.
Launch Cold-chain hardware programme: ETCF #197 submitted, CSIRO Kick-Start EOI in process
Submitted NSW Office of the Chief Scientist & Engineer Emerging Technology Commercialisation Fund application #197 (A$500,000 over 18 months) for the cryptographic cold-chain evidence tag. Three phases: PCB design + embedded Rust firmware (Phase 1), 100 prototype units + NATA-accredited calibration + IP67 enclosure (Phase 2), 50-device NSW field pilot with cold-chain operators (Phase 3). Parallel CSIRO Kick-Start EOI prepared for the engineering de-risking research (A$50K, 6 months): battery-life model with Merkle batch signing, environmental qualification −25 °C to +65 °C, optimal signing cadence. Same receipt format that powers protect-mcp, now embedded in physical sensor hardware. Project page live at scopeblind.com/cold-chain with full spec, two-SKU strategy (disposable evidence tag v1 + reusable+ logger v2), three inspectable demo receipts, comparison vs Sensitech/Emerson/ELPRO/LogTag, FAQ, and one-page PDF brief.
v0.6.0Launch protect-mcp 0.6.0 + @veritasacta/verify 0.6.0: commitment-mode receipts shipped
protect-mcp 0.6.0 wraps any MCP server with opt-in commitment-mode signing: each receipt field is independently committed via SHA-256(salt || JCS({name, salt, value})) and arranged into an RFC 6962-style Merkle tree. The receipt payload carries a single committed_fields_root. Selective disclosure works by revealing specific (name, salt, value, proof) tuples to specific auditors; other fields stay cryptographically hidden. @veritasacta/verify 0.6.0 adds the matching --disclosure-file flag for offline verification. Cross-implementation interop verified: TypeScript signing, JavaScript verification, byte-exact across the same Merkle root. draft-farley-acta-signed-receipts-01 submitted to IETF datatracker. ScopeBlind Founding Plan production support tier launched at scopeblind.com/support: $499/month for first 25 customers, locked for life.
Launch Integrations hub + cedar-agent-schemas community repo
Launched /integrations, the canonical map of every framework, runtime, and marketplace where ScopeBlind and Veritas Acta plug in. Shipped VeritasActa/cedar-agent-schemas v0.1.0: canonical Cedar schema library for agent action verbs (exec, open, connect, request_tool), with TypeScript bindings, three reference policies, and OWASP Agentic Top 10 mapping. Created in response to cedar-for-agents#76 per Cedar RFC #58/#69 community-venue pattern.
Launch AWS Cedar-for-agents PR #73 merged
Second PR merged into AWS cedar-policy/cedar-for-agents. RequestGenerator WASM bindings complete the JS/TS Cedar toolchain: any agent host can now adopt Cedar policy-as-code with three function calls, no Rust toolchain required. Paired with the already-merged #64 (schema generation), the full build-time + runtime Cedar pipeline is available in any JS environment.
Launch 3 AGT PRs merged: Tutorial 33, sb-runtime integration, governance skill
Three PRs merged into Microsoft Agent Governance Toolkit: #1201 (Signet added to cross-implementation table), #1202 (sb-runtime integration guide), #1203 (sb-runtime governance skill provider shim with nono-composable sandbox backend). Positions Veritas Acta receipts as the composition layer for governance frameworks, with nono recommended as the Linux/macOS sandbox primitive.
v0.5.0Feature @veritasacta/verify v0.5.0 (Bold Arrow) shipped
Unified reference verifier: Ed25519 signed receipts, full Schnorr DLEQ verification for VOPRF anonymous credentials, Knowledge Unit bundles, and selective-disclosure receipts all in one CLI. BRASS wire-compatible with api.scopeblind.com. 12 new round-trip tests against production issuer + client logic. Sigil fingerprint over 25 source files.
Feature VS Code Extension Published + Trace Walkthrough
ScopeBlind Trace extension published to VS Code Marketplace. Animated walkthrough GIF of the Trace demo. Compare page (ScopeBlind vs Vectimus vs logs). Dark/light mode toggle. Improved 404 page. Dashboard: Trace integration + Underwriter Export button.
Feature "Break My Agent" CTF + MCP Server Directory
Launched the Break My Agent CTF challenge. MCP Server Directory (/hub) with verification badges. Trace V2 with hover tooltips, Verify All button, Insights tab, and shareable URLs. Trust Center with DPA, SLA, SLSA, and CSA CAIQ. Enterprise Self-Hosted pricing tier.
Feature 6 new packages + GitHub Action + webhooks
Published @scopeblind/otel-exporter, create-scopeblind-agent (npm), acta-sql (PyPI), VS Code extension scaffold, autoresearch and HyperAgents integrations. GitHub Action for SLSA provenance. Slack/PagerDuty webhook integration.
Launch IETF Internet-Draft published
Published draft-farley-acta-signed-receipts-00. Referenced as informative reference in draft-serra-mcp-discovery-uri-04.
Feature Blog launched across all properties
Blog launched on scopeblind.com, blindllm.com, and veritasacta.com. First post: "How BlindLLM Uses Signed Receipts to Prove AI Comparisons."
Feature Cedar policies + CVE packs + compliance pages
Cedar policy engine support via --cedar flag. 5 CVE-anchored policy packs shipped. OWASP Agentic Top 10 mapping. SOC 2 and EU AI Act compliance pages.
v0.3.3Feature protect-mcp v0.3.3, HTTP/SSE + notifications
protect-mcp v0.3.3 published with HTTP/SSE transport, notification system (SMS/webhook/email), and HuggingFace export pipeline.
Improvement Homepage redesigned with interactive demos
New homepage with interactive demos: DAG visualization, Selective Disclosure, and Human Approval flow. MIT license adopted across all packages.
v1.0.0Feature MCP Plugin for AI IDEs
New scopeblind-mcp package (npx scopeblind-mcp) lets AI coding assistants in Cursor, Claude Desktop, and Windsurf scan endpoints, provision tenants, get abuse reports, and generate integration code, 4 tools, zero config.
Feature Agent discovery header + /verify-agent page
Agent SDK now sends X-Device-Identity header linking to /verify-agent, a dual-content landing page with human-friendly copy and hidden machine-readable section for LLMs/crawlers. Every protected agent request leaves a breadcrumb.
v1.0.2Feature Agent SDK v1.0.2 with DPoP
scopeblind-agent now includes X-Device-Identity header and DPoP proof-of-possession (RFC 9449) for AI agents, CLIs, and MCP tool servers. Zero dependencies, uses node:crypto.
Improvement License consolidation to MIT
All packages now MIT licensed, gateway, verifier, SDKs, and protocol libraries. No restrictions on self-hosting, modification, or commercial use.
Fix Pre-launch consistency fixes
Unified pricing across homepage ($79/mo Pro, $199/mo Growth), docs, and llms.txt. Updated agent auditing instructions and proactive scanning prompts in llms.txt. Added MCP plugin to docs overview and links.
Improvement Homepage copy overhaul + launch polish
New pain-led headline, inline cost calculator in hero, comparison table replacing card grid, streamlined 3-step How It Works, verifiable credibility strip replacing placeholder testimonials. Privacy policy updated with VOPRF/JWT/edge-processing specifics. Plausible analytics, PWA manifest, and apple-touch-icon added.
Improvement Teal brand rebrand
Complete rebrand from purple/orange to teal/cyan across the full design system. 50+ color references updated. Favicon tinted. New color identity: unclaimed territory in the security × dev-tools space with strong semantic fit for 'cryptographic.'
Improvement Micro-interactions + delight pass
20 new animations: nav link underlines, copy button success, pricing card hover lift, input focus glow, code block language badges, accordion auto-scroll, mobile nav backdrop, button loading states, testimonial card hover, and full prefers-reduced-motion accessibility.
Feature Stripe checkout + billing management
Added checkout success/cancel pages, billing portal link for Pro users on the dashboard, and Growth tier contact form replacing mailto links.
Feature Agent API keys + fast-lane
AI agents can now authenticate with dedicated API keys and skip VOPRF challenges entirely. Manage keys from your dashboard with create, list, and revoke. JWT tokens include an agent: true claim.
Fix Security hardening pass
Stripe webhook signature verification is now mandatory. Admin API key comparisons use constant-time checks. Webhook test endpoint blocks internal/private IPs (SSRF protection). OG image endpoint escapes user input to prevent SVG injection.
Improvement Dashboard UX improvements
Refresh button no longer gets stuck spinning on error. Quick Start section auto-collapses once you have traffic. Auth state badge shows whether you're authenticated or read-only. Toast notifications on all write failures.
Fix Docs code examples fixed
Fixed Express import syntax (import * as jose), Python key selection (filters for OKP key type), and Django/FastAPI line continuation bugs. Added CDN cache propagation note for JWKS verification.
Feature Guided deploy wizard + live dashboard demo
After scanning your API, a 3-step wizard walks you through deployment and verification. Plus /t/demo now shows a live demo dashboard with sample data so you can see the product before deploying.
Feature Custom cost-per-abuser input
Set your actual API/compute cost per user in the dashboard ROI card. See real dollar impact instead of a generic estimate.
Improvement 62% smaller initial page load
Code splitting with React.lazy, the homepage now loads 62% less JavaScript. Dashboard, docs, and other pages load on-demand.
Feature Enforce pre-flight checklist
Switching to enforce mode now shows a data-driven checklist with your abuse rate, estimated blocked count, and safety assurances before you confirm.
Feature Report page social cards
Sharing a /report/:slug link on Twitter, LinkedIn, or Slack now shows a rich preview card with your abuse rate and grade.
Feature Smart email lifecycle
New automated emails: welcome on provision, no-deployment troubleshooter at 48h, first-data milestone at 100 pings, and quota warnings at 75% and 100%.
Feature 7-day traffic chart + empty-state preview
Dashboard now shows a 7-day area chart of visitors vs. unique devices. New tenants see a preview of what their dashboard will look like once data flows in.
Improvement Synthetic test ping on provision
New endpoints get a synthetic ping immediately on creation, so the dashboard shows data right away instead of a blank state.
v1.0.0Launch v1.0.0, Public launch
ScopeBlind gateway released as open source (MIT). Edge-native progressive enforcement for APIs with VOPRF proofs, EdDSA JWT pass tokens, and a real-time dashboard.