Changelog

What shipped, and when.

Protocol spec and reference runtime share the root version; SDKs and the MCP server version independently. Full history and signed releases live on GitHub.

vUnreleased

In progress

Experimental profiles

—EP-QUORUM-v1 — multi-party signoff (the two-person rule): M-of-N / ordered approval, each named human bound to the exact action, fail-closed. Three reference verifiers (JS / Python / Go) agree on it in cross-language conformance; live in-browser demo at /try/multi-party; server-side enforcement merged into the authorization path, pending production end-to-end validation.
—EP-AEC-v1 — Authorization Evidence Chain: composes heterogeneous agent-authorization receipts (delegation, policy/permit, and EP human-authorization) all bound to one canonical action into a single offline, fail-closed ALLOW/DENY. Filed as draft-schrock-ep-authorization-evidence-chain (IETF individual submission); tri-language reference verifier (JS / Python / Go) with portable conformance vectors.
—EP-PROVENANCE-CHAIN-v1 — chained provenance receipt. EXPERIMENTAL, additive over the frozen EP-RECEIPT-v1; governed by a Draft PIP (PIP-009).
—EP-DISPLAY-ATTESTATION-v1 — display attestation for WYSIWYS rendering. EXPERIMENTAL, additive over frozen EP-RECEIPT-v1; governed by a Draft PIP (PIP-010).
—EP-EXECUTION-INTEGRITY-v1 — execution binding between approved bytes and executed action. EXPERIMENTAL, additive over frozen EP-RECEIPT-v1; governed by a Draft PIP (PIP-010).
—EP-REVOCATION-v1 — portable, offline-verifiable revocation statement. EXPERIMENTAL, additive over frozen EP-RECEIPT-v1; governed by a Draft PIP (PIP-011).
—EP-EYE-SET-v1 — Eye continuous-eval advisory as a signed Security Event Token. EXPERIMENTAL, additive over frozen EP-RECEIPT-v1; governed by a Draft PIP (PIP-011).

v1.1.1

2026-07-07

Security hardening

—Closed a set of authorization-path hardening findings, each with a negative conformance vector, green across JS / Python / Go: a Class-A (WebAuthn) approver could be downgraded to a bare signature; offline quorum accepted self-approval (initiator now excluded) and one device key could fill two seats (key-uniqueness now unconditional); a gate decision could be replayed for unlimited high-stakes issuances (now one-time-consumed).
—RLS / grant drift on the revocation and replay tables journaled to prod (migrations 129–130).
—Published packages: @emilia-protocol/verify 3.6.2, @emilia-protocol/gate 0.9.3 (npm); emilia-verify 2.4.2 (PyPI); go packages/go-verify/v2.1.2.

v1.1.0

2026-04-04

Protocol hardening

—EP-IX Identity Continuity — full state machine (pending → under-challenge → frozen → terminal) with rate-limit and self-contest guards.
—Protocol Hardening v2 — 9 Supabase migrations (065–073) closing every L99/L90/L75 finding: binding FOR UPDATE, policy-version pin, DB-clock expiry, tenant isolation, issuer-authority TOCTOU.
—Formal verification extended to 26 TLA+ properties (20 verified by TLC 2.19, 6 EP-IX specified).
—4,220 tests across 173 files — passed full internal adversarial audit.
—New docs: audit methodology, 1.x API compatibility policy, migration runbook.

v1.0.0

2026-03-18

Standard v1.0

—Protocol Standard v1.0 — 17-section complete specification.
—29 MCP tools, 4 resources, 3 prompts; RFC 7807 errors on every surface.
—TypeScript SDK (25 methods) + Python SDK (21 methods) — published to npm / PyPI.
—EP Commit — signed pre-action authorization tokens proving policy evaluation before proceeding.
—OpenAPI 50/50 route coverage; 6-job CI pipeline (tests, build, lint, SDK builds, conformance, integration).

v0.9.0

2026-03-15

Pre-release

—Canonical evaluator — single read brain across all trust surfaces.
—Canonical writer — single write brain for all trust-changing operations.
—Four-factor receipt weighting (submitter × time × graph × provenance) with Sybil quality gate.
—Trust profile materialization — snapshot on write, freshness on read.

Full changelog on GitHub →Read the spec