Changelog

@passkeybridge/vc-wallet-sdk 0.6.0: forty-one findings from two independent review passes over the wallet SDK, every one reproduced by a test before it was fixed.

• SecurityHolder private keys are non-extractable CryptoKeys in the SDK's own storage backends, so script in the wallet's origin can sign with them but never read them out; keys written as exportable JWKs by earlier releases are locked on first read. The IndexedDB database is namespaced by tenant, two wallet instances can no longer orphan each other's records by racing on the wallet key, plaintext rows from before at-rest encryption are re-encrypted on first read, and the SDK never follows an HTTP redirect.
• ChangedA credential is only treated as holder-bound when its cnf names the key the wallet sent, on issue and on OID4VCI redemption; a different credential under an id already held is refused unless replaced explicitly; verified is true only for a literal true; apiKey is optional for the status, metadata and redemption calls that never needed one. The Presentation Exchange matcher reconstructs SD-JWT claims from disclosures, includes ancestor disclosures in a presentation, applies contains to one element, compares constants structurally, backtracks across descriptors, and refuses two more regular-expression shapes built to backtrack.
• Fixedpersist: false kept no holder keys; a failed key store on issue passed as success; redemption with autoStore: false discarded its key; an empty disclosure frame skipped binding; the request timeout stopped at the headers; multibyte claims decoded as mojibake; two credentials imported in one millisecond shared an id; remove and clearAll reported a wipe that had not happened.

The satellite catalog behind the marketing radar and the Provenance Guard kinematic channel is refreshed on a schedule from inside the database. Nothing in the request path fetches CelesTrak any more.

• FixedFrom 2026-09-09 to 2026-09-16 the radar showed no satellites and the kinematic channel had no authoritative Doppler expectation. CelesTrak had rate-limited the shared edge address, the durable catalog expired, and every visit to the radar became another refused 1.8 MB request that kept the address blocked. The catalog is now pulled every four hours by a database job that honours CelesTrak's once-per-two-hours rule and stops on any non-200; the radar only reads it.
• ChangedThe synthetic probe that watches the radar now reports red when a 200-but-degraded answer persists for three consecutive runs, instead of an endless run of yellows the digest does not list.
• FixedOn this page, every entry tagged Fixed rendered its text one word per line with the badge floating over it. The badge's class name was the raw change type, and "fixed" is also a utility class that positions an element fixed. Badges now carry a namespaced class, and a real-browser layout test asserts every badge stays in its column.

@passkeybridge/vc-wallet-sdk 0.5.0 is on npm, and the public SDK documentation now describes the package that ships rather than the one planned in May.

• Changed@passkeybridge/vc-wallet-sdk 0.5.0 published 2026-09-12. redeemOffer() now sends the access token it exchanges the pre-authorized code for; every earlier release dropped it and the credential request answered 401. The OID4VCI holder proof omits iss for the pre-authorized code flow, as OpenID4VCI section 7.2.1 requires, and createOid4vciProof() takes an options object. package.json, PBWallet.version and the User-Agent header now report one version.
• SecurityThe SDK's Presentation Exchange matcher bounds verifier-supplied regular expressions: patterns over 512 characters, patterns with nested quantifiers, and values over 4096 characters are refused rather than matched, so a hostile presentation definition can no longer pin a wallet at full CPU.
• ChangedThe /sdk page and the dashboard SDK tab document the shipped surface: local encrypted wallet, SD-JWT-VC holder binding, OID4VCI and batch verification have been on npm since 0.3.0 and are no longer labelled as a roadmap. Result shapes, the default base URL and the scope names now match the package and the edge functions (lifecycle writes need vc_revoke; there is no vc_status scope). The displayed version is pinned to the package by a test.
• DeprecatedhashPhone() in the SDK is documented as deprecated: it is an unkeyed SHA-256 that does not match the platform's keyed identifier hash and is reversible by enumeration over the phone keyspace. Send the raw E.164 number to ingest and let the server key it.

Everything that crosses a trust boundary now carries a post-quantum signature, and everything that stays inside is hash-chained under one. Webhooks and Security Event Tokens gain a detached ML-DSA proof beside their existing signature; the audit log and event log are chained and checkpointed with ML-DSA every five minutes, anchored to the NIST Randomness Beacon; and the hosted passkey relying party can mint a hybrid-signed session attestation on request. None of it touches the ingest decision path.

• SecurityOutbound webhooks carry a detached ML-DSA (FIPS 204) signature over the exact request body in x-pb-pqc-* headers, under your tenant's DID-published #mldsa-1 key, beside the existing HMAC. Present whether or not a callback secret is configured; the delivery log records the key id used.
• SecurityOutbound Security Event Tokens (SSF/CAEP push) carry the same detached ML-DSA proof over the JWS signing input, in the same headers, next to the tenant ES256 or ES384 signature. Receivers that verify the JWS alone are unaffected.
• AddedHash-chained audit and event logs: every row is linked at commit into an append-only ledger that has no foreign keys, so a purged tenant's rows show as a marked gap rather than vanishing. A checkpoint every five minutes signs the chain heads (HMAC-SHA-256 plus ML-DSA-65), anchors them to the latest NIST beacon pulse, and re-verifies the ledger since the previous checkpoint, writing a chain.integrity_violation audit row on any break. Latest checkpoint and public key: GET /v1/shield-chain-checkpoint.
• AddedHosted passkey relying party: new attest_session action returns a hybrid-signed attestation (ES256 or ES384 JWS plus detached ML-DSA over the same signing input) that a credential was verified here, with its counter and verification time, under the tenant's own keys. Requested after login, never on the login path.
• ChangedThe platform DID document publishes the checkpoint ML-DSA key as #chain-checkpoint-mldsa-1, so checkpoints verify against the document alone.

Billing hardening: failed payments now change entitlement in a predictable way, a stale Checkout can no longer create a second subscription, Starter is one organization per account, and the edge rate-limit ceiling is aligned with the plan limits. The dormant onboarding drip sender was removed.

• ChangedDunning: a failed renewal keeps your plan active while Stripe retries (past_due) and shows an in-app banner with an update-card action. Once retries are exhausted (unpaid), paid features pause with a 402 payment_required response and ingest continues at the Starter allotment; access restores automatically when the open invoice is paid.
• SecurityCheckout re-entry: creating a new Checkout expires any earlier open session for the organization and every session lives 31 minutes. If a duplicate subscription is still completed, the webhook cancels it, refunds any charge, and alerts the operator.
• ChangedStarter is one organization per account. Existing organizations are unchanged; a second Starter organization needs a paid plan.
• ChangedRate limits: the per-source-IP edge ceiling is now 1,200 requests per minute with a 60 second block, raised from 300 so it no longer sits below the Pro and Enterprise per-minute limits. On every plan except Enterprise Dedicated, whose limit equals the ceiling, the per-organization limit is the one you reach first. Documentation figures were aligned with the code.
• ChangedThe account setup page names the plan and price on its billing action and states the trial conditionally, since trial eligibility is decided from Stripe history.
• RemovedOnboarding drip sender and enrollment trigger: the sequence had been unscheduled since July, had never enrolled a signup, and carried stale plan copy with no send cap or suppression check, so it was removed rather than revived.
• ChangedThe /unsubscribe page stops newsletter email only. Transactional product email (alerts, billing, security) is unaffected, as before.

Provenance Guard co-presence: the quorum channel gains new ways to confirm a trusted device is present, an NFC tap and Wi-Fi/cell co-observation. An additive evolution of the existing channel, behind the same per-tenant flag, with the three-channel logic unchanged.

• AddedQuorum Attestation adds an NFC proximity protocol: a tap between two enrolled devices, with the same post-quantum signature bound to the live challenge nonce plus a round-trip timing bound as relay defense.
• AddedNew Wi-Fi and cell co-observation protocols confirm that the subject device and a trusted senior device saw the same network landmarks within a short window. This establishes the same coarse area, not a measured distance, so it corroborates a verdict and does not stand alone unless a tenant opts in.
• SecurityEvery observed BSSID and cell identity is keyed-hashed (HMAC-SHA-256) server-side before any comparison; raw network landmarks are never stored or logged. Only a shared-landmark count is retained.
• ChangedPer-tenant controls for co-presence: whether Wi-Fi/cell may satisfy the quorum channel on its own, the minimum shared landmarks, and the co-observation window. All default to the safe, corroborating-only behavior.

Provenance Guard hardening: the kinematic channel now checks the observed Doppler against live orbital ephemeris, and quorum attestations now require a verified post-quantum signature. Both are Enterprise capabilities, enabled per tenant, with the prior behavior unchanged until opt-in.

• AddedKinematic Handshake (NTN) now compares the observed Doppler shift against an expected value derived server-side from a live CelesTrak TLE propagated with SGP4, for the satellite and observer bound at challenge time. The expected value is never accepted from the caller.
• SecurityQuorum Attestation now requires a valid ML-DSA-65 (FIPS 204) signature from the attesting senior device, verified against a public key captured at enrollment and bound to the live challenge nonce. Missing, tampered, wrong-key, and replayed attestations fail closed.
• ChangedDevice enrollment captures the device's ML-DSA-65 public key. Devices enrolled without one do not contribute a quorum vote until a key is rotated in.
• AddedPer-tenant control for the hardened verification path; the existing verdict behavior is unchanged until a tenant enables it.

Truthful SOC 2 wording, send-path idempotency, a working public unsubscribe page, and redaction of leftover identifier fields in Okta/SCIM/admin audit metadata.

• ChangedPublic programme copy now matches the Trust Center: readiness, evidence under review. Overclaim phrases on public surfaces fail the copy linter.
• SecurityPlaybook email_alert no longer treats a string recipients field as a send list, which previously skipped the tenant-member allowlist. Recipients must be an array; anything else is skipped.
• SecurityOutreach dispatcher fail-closes on send-count errors, claims intro rows with update-returning so a concurrent tick cannot send the same prospect, and treats a unique-constraint collision as a duplicate rather than a second send. Partial unique indexes on live (prospect, touch) and (prospect, template) rows ship as a manual migration.
• AddedPublic /unsubscribe confirm page (GET does not mutate) posting to newsletter-subscribe. Drip and marketing email now carry the physical postal address and a working unsubscribe link. Founder sign-off is Joel Bouckaert.
• SecurityOkta hook metadata no longer stores alternateId or displayName; session-start IP is hashed. SCIM provisioning logs store keyed HMAC-SHA-256 digests of userName, displayName, externalId, and member, never the raw request body. Admin audit metadata no longer records operator email.

Reliability and observability release: a unified operator alert bus, a new cost-budget alerter, an hourly self-check of the monitoring layer, and a synthetic end-to-end product-path canary.

• AddedUnified operator alert bus. Billing, security-testing, and cost alerts now flow through a single internal event stream consumed by the weekly operator digest, replacing scattered per-channel notifications with one triage surface.
• AddedCost-budget alerter. A new scheduled job reads per-function cost usage and raises an operator alert if any function crosses its budget, catching cost regressions before they show up on an invoice.
• AddedMeta-canary of the monitoring layer. An hourly self-check verifies that heartbeats, alert-bus writes, health snapshots, sweep reports, and canary runs are all fresh, so a silent failure of the monitoring system itself now pages operators instead of hiding.
• AddedSynthetic end-to-end canary. A 15-minute probe exercises the marketing site, app, docs, and edge CORS surface with per-probe latency and status budgets, alerting on live product-path regressions independent of user traffic.
• ChangedThe pre-flight suite operators run before shipping was expanded from four to eight automated checks (skipped-test drift, scheduled-job registry integrity, meta-canary classifier assertions, and the synthetic canary), tightening the release gate.

Agentic sweep-triage and claim-drift automation, sweep-smoke residue purge, Apollo usage ledger, and a scheduled-job heartbeat sync.

• AddedAgentic sweep-triage and claim-drift automation. Two new bounded agents propose fixes for common daily-sweep findings and marketing-claim drift, with every proposed action recorded to an append-only audit log and gated on explicit operator approval before apply.
• AddedAutomated purge of sweep-smoke test residue. A scheduled routine removes leftover synthetic-test tenants and users older than 24 hours, keeping the production dataset clean without manual intervention.
• AddedApollo lead-sourcing usage ledger with a hard 3,000-credit monthly cap enforced at the API call site, preventing overage regardless of caller.
• ChangedScheduled-job heartbeats are now synchronised from the database scheduler itself, closing the gap where a job could run successfully but appear stale to the monitoring layer.

VC Wallet SDK v0.4.0 published to npm, CAEP outbound transmitter live, cron-vault name guard and pre-rotation checklist added, outreach scheduling widened to all seven days.

• Added@passkeybridge/vc-wallet-sdk v0.4.0 published to the public npm registry. Breaking: engines bumped to Node >= 20.19. Test runner moved to vitest ^4.1.8 with a postcss shim and test type-narrowing; full dependency refresh. NPM provenance attestation is temporarily disabled pending OIDC Trusted Publisher onboarding.
• AddedCAEP outbound transmitter (shield-sse-deliver) is live. Queued events are drained on a scheduled cadence, signed as ES256 Security Event Tokens, and pushed to subscribed receivers per RFC 8935, completing the bidirectional CAEP path alongside the existing receiver.
• AddedCron-vs-vault name integrity guard. A new database audit function plus a sweep script (check-cron-vault-names) are wired into the daily codebase sweep and flag any pg_cron job whose Authorization header references a vault key that does not resolve, preventing the case-mismatch class of silent-failure incident.
• AddedPre-rotation checklist (npm run check:pre-rotation). Four hard gates (env vars present, sb_secret_ prefix shape, live PostgREST 200, shield-health database ok) block any API key rotation while the legacy credential is still authoritative.
• ChangedOutreach dispatcher cron schedule widened from weekdays only to all seven days, matching the outreach_config.send_days setting. Prior Saturday and Sunday coverage gaps eliminated; manual probe verified normal send behaviour.
• SecurityRecovered a 24-hour silent 401 window on the CAEP outbound transmitter (June 1 to 2) caused by a vault secret name case mismatch; remediated by rescheduling the job against the correct vault key and codified the class of failure in the new cron-vs-vault name guard above.

Knowledge Hub editorial pass continues, internal operations observability sharpened, and the VC Wallet SDK test matrix verified across all supported Node runtimes.

• ChangedKnowledge Hub editorial quality pass extended to the next batch of published articles: every internal and outbound link re-verified, factual claims audited against shipped code and primary sources, on-page SEO and GEO metadata refreshed, and mobile and desktop renders re-validated. Thirty-six articles have now been through the full pass.
• AddedInternal operations dashboards now refresh on a 60-second polling cadence with visibility-aware pause and an immediate re-fetch on tab refocus, giving on-call operators a near-live read on outbound campaign health without manual reloads.
• Changed@passkeybridge/vc-wallet-sdk continuous-integration matrix re-verified end-to-end across Node 18, 20, and 22 on Ubuntu, with the full storage, presentation, and wallet test suites passing under each runtime. Lockfile resolution tightened so the matrix build is reproducible from a clean checkout.

SOC 2 evidence intake hardened with vault-keyed encryption at rest, and the daily codebase sweep now enforces continuous SECURITY DEFINER grant integrity.

• SecurityContact details submitted through the public SOC 2 evidence-request form (requester name and work email) are now encrypted at rest using AES-256-GCM under a per-platform key held in the managed secrets vault. Decryption is gated through dedicated admin-only RPCs and the notification path; no other surface can read the plaintext.
• ChangedThe send-contact-form and SOC 2 notification edge functions were refactored onto the new encrypted-intake RPCs and redeployed without any change to the public submission API.
• SecurityThe daily codebase sweep now runs a SECURITY DEFINER grant-integrity check that asserts the curated allowlist of database functions retains only the EXECUTE grants required for row-level security chaining, admin UIs, and trigger plumbing. Any drift fails the sweep and is surfaced in the engineering inbox.

Knowledge Hub editorial pass on the first 15 published articles, daily-sweep reliability hardening, and a developer-playground CTA in outbound communications.

• ChangedEditorial quality pass completed on the first 15 published Knowledge Hub articles: every internal and outbound link verified, factual claims audited against shipped code and primary sources, on-page SEO and GEO metadata refreshed, and mobile and desktop renders re-validated.
• ChangedDaily codebase sweep workflow hardened against scheduler drops with a backup cron trigger 30 minutes after the primary run and an idempotency gate that prevents duplicate sends when both triggers fire.
• AddedOutbound prospect communications now include a 'Test the API' call-to-action linking to the public /developers/playground page so prospects can ping a live verification endpoint and model their own cost delta before any sales conversation.

Tenant dashboard upgrade: onboarding telemetry, in-app notifications, team and support surfaces, and tablet navigation.

• AddedOnboarding telemetry across all five guided wizards with a tenant-facing Onboarding tab and an admin-facing completion-rate widget so retention drop-off is now measurable.
• AddedPer-tenant in-app notification bell with realtime delivery, severity icons, unread badge, and mark-as-read controls.
• AddedWorkspace surfaces inside the dashboard: a Team tab for admins to manage members and roles, and a Support tab for opening and viewing tickets without leaving the product.
• AddedTenant-scoped Billing tab summarising current plan, usage limits, and upgrade paths, with empty-state guidance for new tenants.
• AddedReusable empty-state component on every previously-empty dashboard tab to nudge new tenants toward the next configuration step.
• ChangedMobile and tablet navigation: dashboard now uses the grouped bottom-sheet hamburger pattern below 1024px, eliminating the cramped two-tier strip on tablets in the 768–1023px range.
• SecurityNew tenant-scoped notification, wizard-event, and audit-log surfaces are protected by row-level security and limited to authenticated tenant members and admins.

Edge WAF and rate-limit policy fully codified, API-reconciled, and continuously drift-checked.

• AddedServer-side reconciler that enforces the codified WAF and rate-limit policy against the upstream edge provider, replacing manual dashboard edits as the deployment path.
• AddedCI integrity gate that fails the build if the canonical policy declaration, the bundled reconciler copy, and the nightly drift snapshot are not byte-identical, preventing partial or split-brain rollouts.
• SecurityContinuous drift detection in the daily codebase sweep compares live edge policy against the committed snapshot and surfaces any divergence as a finding, closing the 'someone changed it in the dashboard' gap.
• RemovedRetired the optional remote orchestration token surface that had been provisioned for an alternative reconciliation path; the live operational path uses a single scoped credential.

Knowledge Hub editorial polish: per-article social metadata, searchable index, reading progress, and prerendered share previews.

• AddedPer-article Open Graph and Twitter Card metadata so shared blog links render the correct title, description, and hero image across social platforms and chat clients.
• AddedBuild-time prerender for blog routes ensures crawlers and link unfurlers receive route-correct SEO tags on first byte, without waiting for client-side hydration.
• AddedSearchable Knowledge Hub index with keyword search and topic filters for faster article discovery.
• AddedReading progress indicator on article pages, anchored to the article body rather than full-page scroll for accurate progress feedback.
• ChangedSitemap generation continues to run on every build and now includes all published articles alongside marketing routes; robots.txt advertises the canonical sitemap location.
• ChangedWeb Vitals diagnostics (LCP, CLS) instrumented for non-production environments only, behind a strict host gate so the diagnostic surface is never exposed to public visitors.
• FixedBuilt-asset compliance and bundle-budget gates updated to accommodate new editorial assets without relaxing brand-exposure or size guarantees.

Frontend performance program: route-level prerender, lazy dashboard shell, per-article code-splitting, and Vite 6 toolchain.

• AddedBuild-time per-route prerender of marketing pages with route-specific SEO and Open Graph tags, improving first contentful paint and crawler fidelity for the landing, pricing, and related routes.
• ChangedDashboard shell now lazy-loads onboarding wizards and the command palette gated on user intent, reducing the initial shell payload by 87% (139KB to 18KB gzipped).
• ChangedKnowledge Hub articles split into per-slug modules with import.meta.glob so each article ships as its own chunk, reducing initial article-route weight.
• AddedOnboarding wizards persist non-sensitive draft fields to localStorage so users can resume in-progress configuration; secrets and credentials are excluded by design.
• ChangedBuild toolchain advanced to Vite 6 with PostCSS 8.5 for faster dev startup and modern plugin compatibility.

Operational observability: cross-tenant anomaly detection, CAEP cascade automation, and tenant quotas with egress controls.

• AddedPlatform-wide infrastructure anomaly scanner monitoring traffic surges, error-rate spikes, latency regressions, egress volume, cascade depth, and tenant-concentration anomalies, with Slack alerting on threshold breach.
• AddedCAEP (Continuous Access Evaluation Profile) receiver now dispatches in-process revocation cascades for hard signals via the shared signal mapper, closing the loop between inbound CAEP events and downstream session termination.
• AddedPer-tenant request quotas enforced at the edge, replacing reliance on global infrastructure limits and providing per-tier predictability for Starter through Dedicated plans.
• AddedEdge egress allowlist via safeFetch helper, restricting outbound HTTP from edge functions to approved destinations and blocking SSRF and data-exfiltration vectors at the network boundary.
• AddedDPoP (RFC 9449) shadow telemetry channel through the api-key-auth chokepoint with 15-minute re-attestation cadence and a shadow_degraded tier surfaced in tenant posture views.
• Addedshield-ingest dead-letter audit trail records usage-RPC retry failures to shield_audit_log so under-billing and ingest-side regressions surface in the admin dashboard rather than failing silently.

Trust, billing, and supply-chain safety net: canary mesh, billing health alerter, and the daily codebase sweep.

• AddedHoneypot canary endpoints distributed across the edge surface, recording probe attempts to shield_canary_hits and dispatching SSRF-guarded Slack alerts when scanners or unauthorized clients touch them.
• AddedBilling health alerter (shield-billing-alerter) emitting Slack and email alerts on tenant provisioning failures and unbilled-usage backlog, including top-offender drill-down with the oldest unbilled timestamp per tenant for fast triage.
• Changedshield-usage-billing now auto-skips unbilled rows for exempt, internal, or unsubscribed tenants, marking them as reported so the queue cannot accumulate phantom backlog.
• AddedDaily codebase sweep (5pm ET) aggregating compliance, bundle-size, edge-function health, audit, and memory-index checks with consolidated HTML report and email delivery to the engineering inbox.
• ChangedStripe usage-reporting pipeline made fully idempotent across the billing window with atomic row-claiming, eliminating double-count risk under retry pressure.

Infrastructure hardening: P-256 ECDSA signing keys, per-tenant rate limits, async webhook delivery, key rotation grace period, and health check endpoint.

• SecurityTenant signing keys migrated from symmetric HMAC-SHA-256 to asymmetric P-256 ECDSA (ES256)—enables proper public key exposure in DID documents and W3C VC interoperability without exposing private key material.
• Added24-hour key rotation grace period—rotated signing keys remain valid for verification via grace_expires_at until the window expires, preventing in-flight VC verification failures during key transitions.
• AddedPer-tenant rate limits—configurable rate_limit_per_minute per tenant (Starter: 60, Pro: 300, Enterprise: 600, Dedicated: 1,200 req/min) replacing the previous global default.
• AddedAsynchronous webhook delivery via shield_webhook_queue table and shield-webhook-worker edge function—fire-and-forget enqueuing with SSRF validation, exponential backoff retries, and full delivery logging.
• AddedGlobal health check endpoint (shield-health)—validates database connectivity, SHIELD_ENCRYPTION_KEY availability, and Stripe integration. Returns 503 if any check fails.
• SecurityJWT authentication standardized on auth.getUser() across all edge functions—eliminates inconsistent getClaims() usage that had different validation semantics.
• SecurityCORS headers now include Access-Control-Allow-Methods (GET, POST, PUT, PATCH, DELETE, OPTIONS)—previously relied on Supabase gateway injection.
• ChangedUsage billing pagination: shield-usage-billing now processes all unbilled records via batch pagination loop, eliminating the previous 500-row cap.
• ChangedA2A handshake refactored from 953-line monolith into 7 focused action handler modules in _shared/a2a-handlers/ for improved testability.
• ChangedAgent delegate refactored from 277-line monolith into 4 focused action handler modules in _shared/agent-delegate-handlers/ for improved testability.
• ChangedFAQ, Terms, Privacy, Changelog, Sitemap, and Knowledge Hub updated to reflect P-256 key migration, per-tenant rate limits, key rotation grace period, and webhook queue architecture.

Cross-tenant threat sharing and insider threat behavioral analytics with A2A agent anomaly detection.

• AddedCross-Tenant Threat Sharing—privacy-preserving collaborative threat intelligence via anonymized IOC exchange with k-anonymity thresholds (k ≥ 3), five indicator types, atomic contributor counting, and opt-in subscription model.
• AddedThreat Sharing dashboard tab (Enterprise)—network health cards, privacy controls, searchable threat feed with 'You' badges, and manual indicator submission.
• AddedInsider Threat Behavioral Analytics—27-category anomaly detection engine: 18 human categories (off-hours access, privilege escalation, shadow admin creation, bulk export, PII access spikes, audit log tampering, velocity spikes, dormant reactivation, scope widening, credential hoarding, and more) and 9 agent/A2A categories.
• AddedAgent/A2A insider threat detectors: scope creep, velocity spike, lateral movement, trust score gaming, credential harvesting, delegation chain abuse, A2A exfiltration tunneling, dormant reactivation, and off-schedule execution.
• AddedInsider Threat dashboard tab (Enterprise)—summary cards, anomaly feed table with severity/status filters, detail dialogs, and investigation workflow (open → investigating → resolved/dismissed).
• SecurityInsider threat engine: pure-function zero-I/O architecture ensures all 27 detectors are independently testable with no database side effects.
• SecurityThreat sharing k-anonymity enforced at both RLS and application layers. SECURITY DEFINER function for atomic contributor count increments prevents TOCTOU race conditions.
• AddedKnowledge Hub articles: Cross-Tenant Threat Sharing and Insider Threat Behavioral Analytics.
• ChangedFAQ updated with Cross-Tenant Threat Sharing and Insider Threat Analytics categories.
• ChangedTerms of Service §2 updated with cross-tenant threat sharing and insider threat analytics disclosures.
• ChangedPrivacy Policy §11 updated with threat sharing data flow and insider threat analytics data handling.
• ChangedHomepage Protocol Strip updated: Threat Sharing and Insider Threat Analytics added as proprietary protocol primitives.

AWS IAM Identity Center, PingOne, CyberArk Identity, and OneLogin ISPM modules—seven-provider posture management.

• AddedAWS IAM Identity Center ISPM module: 25 weighted security checks across MFA enforcement, permission set least-privilege analysis, account assignment hygiene, lifecycle provisioning, and session controls with 0-100 Posture Score generation via AWS SigV4 authentication.
• AddedPingOne ISPM module: 25 weighted security checks across MFA policy enforcement, population and role management, application and sign-on policy hygiene, lifecycle provisioning, and protocol controls with 0-100 Posture Score generation via PingOne Management API.
• AddedCyberArk Identity ISPM module: 25 weighted security checks across MFA profile enforcement, administrative privilege management, application SSO hygiene, lifecycle provisioning, and PAM-adjacent posture checks (session recording, PSM policies, credential rotation) with 0-100 Posture Score generation via CyberArk Identity Platform API.
• AddedOneLogin ISPM module: 25 weighted security checks across MFA policy enforcement, role and privilege management (case-tolerant super-admin detection), application policy hygiene, directory sync lifecycle, and session controls with 0-100 Posture Score generation via OneLogin Admin API v2.
• AddedKnowledge Hub articles: AWS IAM Identity Center ISPM, PingOne ISPM, CyberArk Identity ISPM, OneLogin ISPM, and ISPM Cross-Provider Comparison (seven-provider matrix).
• AddedDashboard Posture tab seven-provider toggle: switch between Okta, Entra ID, Google Workspace, AWS IAM, PingOne, CyberArk, and OneLogin with side-by-side scan results.
• AddedFAQ entries for AWS IAM Identity Center, PingOne, CyberArk Identity, and OneLogin ISPM, plus updated multi-provider auditing entry.
• ChangedTerms of Service updated: Section 2 (Service Description) now includes AWS IAM Identity Center, PingOne, CyberArk Identity, and OneLogin ISPM automated configuration auditing.
• ChangedPrivacy Policy updated: Section 11 (Security) now includes AWS IAM, PingOne, CyberArk, and OneLogin ISPM data handling disclosures—all credentials AES-256-GCM encrypted, zero PII persistence.
• ChangedHomepage Enterprise section updated to reflect seven-provider ISPM (175 combined security checks).

Supply chain provenance, SDK integrity attestation, and breakglass emergency access protocol.

• AddedSupply Chain Provenance Guard (SLSA/Sigstore)—build artifact attestation with SLSA Level 1-3 verification, Sigstore Rekor transparency log integration, SBOM signing (CycloneDX/SPDX), and optional hybrid PQC provenance signatures (ML-DSA-65).
• AddedSupply Chain dashboard tab (Enterprise)—provenance overview cards, artifact history table with expandable details, and attestation submission form.
• AddedClient-Side SDK Integrity Attestation (RASP-lite)—six-check runtime self-verification pipeline detecting code tampering, DOM injection, AiTM/EvilGinx2 proxy signatures, and debugger attachment.
• AddedIntegrity dashboard tab (Enterprise)—attestation health cards, threat class breakdown, and expandable attestation history with session fingerprint deduplication.
• AddedBreakglass Emergency Access Protocol—multi-party approval workflow for emergency access bypass with severity-based approval thresholds (P1: 3 approvers/4h TTL, P2: 2/2h, P3: 1/1h), five access scopes (read, write, admin, decrypt, rotate_keys), and self-approval prevention.
• AddedBreakglass dashboard tab (Enterprise)—request form, active session alerts with live TTL countdown, approval pipeline visualization, and 7-day session history.
• SecurityBreakglass audit trail: every action (request, approve, activate, revoke) immutably logged with actor IP and user agent via shared audit logger. No DELETE operations permitted on breakglass session records.
• SecuritySDK Integrity origin matching hardened: exact domain match replaces startsWith() to prevent domain shadowing attacks.
• AddedKnowledge Hub articles: Supply Chain Provenance, SDK Integrity Attestation, and Breakglass Emergency Access.
• ChangedFAQ updated with Supply Chain Provenance, SDK Integrity, and Breakglass Protocol categories.
• ChangedTerms of Service §2 and Privacy Policy §11 updated with supply chain, SDK integrity, and breakglass data handling disclosures.
• ChangedHomepage Protocol Strip updated: Provenance Guard and SDK Integrity added as proprietary protocol primitives.

SSE/CAEP and DPoP: real-time cross-IdP session revocation and sender-constrained token binding.

• AddedShared Signals & Events (SSE 1.0) and Continuous Access Evaluation Protocol (CAEP 1.0) via shield-sse-caep edge function—ingest, validate, and process Security Event Tokens from external identity providers with zero-PII subject hashing.
• AddedSSE stream management: configure, list, update, delete, and verify (§7.2) SSE transmitter and receiver streams with per-tenant scoping and admin authorization gates.
• AddedFive CAEP event types: session-revoked, token-claims-change, credential-change, assurance-level-change, and device-compliance-change with automated action dispatch and encrypted SET forensic retention.
• AddedSSE Transmitter Metadata (§6.1) well-known endpoint for auto-discovery of PasskeyBridge SSE capabilities by external receivers.
• AddedDPoP (RFC 9449) token binding via shield-dpop edge function—bind OAuth access tokens to client-held asymmetric key pairs with JWK Thumbprint (RFC 7638) identification.
• AddedDPoP server nonce issuance (§8) with DPoP-Nonce HTTP header delivery for enhanced replay protection.
• AddedDPoP verification pipeline: seven-step validation (header, payload, temporal window, signature via Web Crypto, binding lookup, nonce check, one-time consumption).
• AddedDPoP introspection and tenant-scoped cleanup with stale binding garbage collection.
• SecuritySeven supported asymmetric algorithms (ES256, ES384, ES512, PS256, PS384, PS512, EdDSA) with explicit symmetric algorithm rejection and private key material detection.
• AddedKnowledge Hub articles: SSE/CAEP Shared Signals and DPoP Proof of Possession.
• ChangedFAQ updated with SSE/CAEP and DPoP category covering four new entries.
• ChangedTerms of Service §2 and Privacy Policy §11 updated with SSE/CAEP and DPoP data handling disclosures.
• ChangedHomepage Protocol Strip updated: SSE/CAEP and DPoP added as proprietary protocol primitives.

NF-08 Sensor Capture SDK v2.0: real magnetometer and accelerometer entropy channels.

• AddedMagnetometer capture via Generic Sensor API—ambient magnetic field readings hashed as EMI spectral proxy. Supported on Chrome, Edge, Opera, and Android WebView.
• AddedAccelerometer entropy capture upgraded with unified Generic Sensor abstraction, parallel sampling with magnetometer within ≤100ms temporal window.
• AddedThermal state heuristic channel: memory pressure, heap utilization, scheduler jitter, and color depth signals combined into environmental thermal hash.
• ChangedSensor Capture SDK bumped to v2.0.0. Placeholder hashes replaced with real sensor data on supported platforms; deterministic fallback preserved for unsupported browsers (iOS Safari).
• ChangedSpatialTab dashboard updated: five-channel sensor legend (EMI Proxy, Thermal Signal, Accelerometer, Network Jitter, Device ID) replacing four-channel display.
• ChangedKnowledge Hub Provenance Guard article updated: Channel 1 (Atomic Fingerprint) now references magnetometer and accelerometer as production sensor sources.
• ChangedQuantum security roadmap: NF-08 sensor capture status upgraded from 'In progress' to 'Shipped'.

Google Workspace ISPM module, three-provider posture management, and edge function auth hardening.

• AddedGoogle Workspace ISPM module: 25 weighted security checks across 2-Step Verification enforcement, super admin sprawl, OAuth app grant activity, mobile device management, stale account detection, and domain verification with 0-100 Posture Score generation via Google Admin SDK.
• AddedKnowledge Hub article: Google Workspace Identity Security Posture Management (ISPM)—covers service account setup, domain-wide delegation scopes, check domains, scoring methodology, and three-provider comparison.
• AddedDashboard Posture tab three-provider toggle: switch between Okta, Entra ID, and Google Workspace with side-by-side scan results.
• AddedFAQ entries for Google Workspace ISPM and three-provider posture auditing.
• ChangedTerms of Service updated: Section 2 (Service Description) now includes Google Workspace ISPM automated configuration auditing via Google Admin SDK.
• ChangedPrivacy Policy updated: Section 11 (Security) now includes Google Workspace ISPM data handling disclosure—service account private keys encrypted at rest with AES-256-GCM, domain-wide delegation with read-only Admin SDK scopes.
• SecurityEdge function JWT authentication standardized on getUser() for consistent validation semantics across all functions.
• ChangedHomepage Enterprise section updated to reflect tri-provider ISPM (Okta + Entra ID + Google Workspace) with 75 combined security checks.

Microsoft Entra ID ISPM module, multi-provider posture management, and cross-provider comparison.

• AddedMicrosoft Entra ID ISPM module: 25 weighted security checks across Conditional Access & MFA, Privileged Identity Management, Lifecycle & Credential Hygiene, and Protocol & Session Controls with 0-100 Posture Score generation.
• AddedKnowledge Hub article: Microsoft Entra ID Identity Security Posture Management (ISPM)—covers Graph API permissions, check domains, scoring methodology, and Okta vs. Entra ID comparison.
• AddedDashboard Posture tab provider toggle: switch between Okta and Entra ID with side-by-side scan results and cross-provider posture comparison.
• AddedFAQ entries for Entra ID ISPM and multi-provider posture auditing.
• ChangedTerms of Service updated: Section 2 (Service Description) now includes Entra ID ISPM automated tenant configuration auditing via Microsoft Graph API.
• ChangedPrivacy Policy updated: Section 11 (Security) now includes Entra ID ISPM data handling disclosure—client secrets encrypted at rest with AES-256-GCM, OAuth 2.0 client credentials flow, read-only Graph API permissions.
• ChangedHomepage Enterprise section updated to reflect dual-provider ISPM (Okta + Entra ID) with 50 combined security checks.

Okta ISPM documentation, asset pipeline optimization, and CSP hardening.

• AddedKnowledge Hub article: Okta Identity Security Posture Management (ISPM)—covers 25 weighted security checks, phishing-resistant MFA enforcement, admin sprawl detection, lifecycle hygiene auditing, and 0-100 Posture Score generation.
• AddedFAQ entry for Okta ISPM under Enterprise SSO & SCIM category.
• AddedPer-article Open Graph images: each blog article now uses its hero image as the og:image and JSON-LD image via the assets.passkeybridge.io CDN, improving social preview richness.
• ChangedAll blog hero images converted to WebP format—final two .jpg holdouts (selective-disclosure, edge-first) compressed from 2.3 MB combined to 234 KB (90% reduction).
• SecurityContent Security Policy img-src directive updated to include assets.passkeybridge.io subdomain, ensuring CDN-served images are not blocked by CSP in production browsers.
• ChangedTerms of Service updated: Section 2 (Service Description) now includes Okta ISPM automated IdP configuration auditing.
• ChangedPrivacy Policy updated: Section 11 (Security) now includes ISPM data handling disclosure—Okta API tokens encrypted at rest with AES-256-GCM, zero plaintext credential storage.
• ChangedSDS updated to v2.10.0 with ISPM documentation and asset pipeline changes.

Documentation expansion, veracity audit, and reference corrections.

• AddedTwo new documentation articles: Edge-First Signal Verification (signals category) and Identity Settlement Tokens (security category).
• FixedML-DSA-65 signature size corrected to 3,309 bytes per NIST FIPS 204 Table 1 across whitepaper, settlement tokens paper, and all documentation.
• FixedSP 800-227 publication date corrected from 'early 2025' to November 2024 (Initial Public Draft) across whitepaper and settlement tokens references.
• FixedWebAuthn Level 3 reference updated from 'FIDO Alliance (2024)' to 'FIDO Alliance & W3C (2025)'—W3C Recommendation finalized April 2, 2025.
• ChangedBlog veracity audit completed: Cloudflare Workers CPU limits, Deno Deploy region count, and ECDSA nonce-reuse historical reference corrected against authoritative sources.

Whitepaper updated to reflect 16-patent portfolio. Terms, Privacy, SDS, and changelog aligned.

• ChangedWhitepaper updated to v3.1.0—added PBPBV (Purpose-Bound PII Vault) and PBANCHOR (Topological Virtual Authenticator) to patent portfolio, competitive position, and roadmap. Patent count updated from 14 to 16; novel feature count updated from 18 to 20.
• ChangedTerms of Service updated: Section 2 (Service Description) now includes PBPBV and PBANCHOR capabilities; Section 9 (IP) references 16-patent portfolio.
• ChangedPrivacy Policy updated: Section 11 (Security) now includes Purpose-Bound PII Vault with dual-path cryptographic storage and auditable purpose-coded decryption.
• ChangedSDS updated to v2.8.0 with PBPBV and PBANCHOR documentation alignment.

Purpose-Bound PII Vault and Topological Virtual Authenticator shipped.

• AddedPurpose-Bound PII Vault (PBPBV)—dual-path cryptographic architecture with AES-256-GCM ciphertext and independent SHA-256 hashes. Every decryption requires a declared purpose code logged in an immutable audit trail. Tenant-isolated BYOK model enables cryptographic erasure via key deletion.
• AddedTopological Virtual Authenticator (PBANCHOR)—Manifest V3 browser extension implementing a virtual FIDO2 authenticator via topological braiding operations (#P-hard computational barrier). Kinematic-Temporal Gate validates 4D coordinates against predicted LEO Doppler telemetry.
• SecurityPBPBV enforces zero plaintext persistence—PII never stored or retained in application memory beyond the encryption/decryption operation.
• AddedImmutable decryption audit log tracking field name, function name, purpose code, and tenant ID for every PII access event.
• ChangedPatent portfolio expanded to 16 filings with PBPBV (64/014,323) and PBANCHOR (19/576,127).

Bulk PII Migration Tooling—tenant-facing encryption pipeline for legacy plaintext columns during customer onboarding.

• AddedBulk PII Migration panel in Settings—enables enterprise customers migrating from legacy systems to encrypt pre-existing plaintext columns into the zero-PII model. Per-table coverage heatmap and progress bars.
• AddedOne-click 'Encrypt Unprotected Rows' action processes up to 500 rows per batch across profiles and newsletter subscribers.
• AddedManual 'Shred Plaintext' action permanently NULLs legacy columns after verifying 100% encryption coverage.
• AddedMigration run history table tracking every encrypt and shred batch with row counts and error details.
• SecurityShred action enforces pre-flight coverage check—blocks execution if any rows lack encrypted counterparts.
• ChangedPII migration edge function supports three actions: status, encrypt, and shred.

ML-DSA-87 (Security Level 5) Enterprise add-on, Stripe billing integration, and full documentation sweep.

• SecurityML-DSA-87 (NIST FIPS 204, Security Level 5) shipped as an Enterprise add-on at $149/mo. Per-tenant pqc_level configuration with runtime algorithm branching in pqc-signatures, shield-vc-issue, and shield-cached-proof.
• AddedStripe product and price created for ML-DSA-87 add-on. Webhook handler maps checkout to pqc_level upgrade; cancellation reverts to ML-DSA-65.
• AddedEnterprise-gated PQC Level toggle in Settings → Security—switch between Level 3 (ML-DSA-65) and Level 5 (ML-DSA-87) with one click.
• AddedML-DSA-87 add-on card on the Pricing page with feature comparison and checkout flow.
• ChangedSDS updated to v2.6.0. Knowledge Hub PQC articles, cryptographic roadmap, VC capabilities table, and compliance references updated to reflect ML-DSA-87 as shipped.
• ChangedFAQ updated with 'ML-DSA-65 vs ML-DSA-87' question covering parameter differences, pricing, and enablement.
• ChangedLanding page Enterprise section updated: 'ML-DSA-65 / ML-DSA-87' with CNSA 2.0 compliance badge.

SCIM 2.0 provisioning hardening, Stripe billing migration, and quarterly E2E audit.

• AddedSCIM v2 provisioning log table (shield_scim_provisioning_log) with operation tracking, latency metrics, raw payload capture, and tenant-admin RLS policy.
• AddedSCIM Provisioning Log viewer in dashboard Settings tab—filterable by operation type, with inline payload inspection and success-rate statistics. Gated to Enterprise plan.
• AddedexternalId and scim_active columns on shield_tenant_members for Okta directory mapping and soft-deprovisioning support.
• Changedshield-scim edge function hardened for full RFC 7644 compliance: PatchOp validation, externalId mapping, RFC-compliant error schemas (urn:ietf:params:scim:api:messages:2.0:Error), and soft-delete deprovisioning.
• SecurityQuarterly E2E production audit completed: 208/208 tests passing, all 43 shield_ tables verified with RLS enabled, zero type errors, all edge functions responding with correct auth gates.

Interactive API Playground, OpenAPI v2.0, mobile dashboard UX, drip campaign, and expanded test coverage.

• AddedInteractive API Playground embedded in SDK page (/sdk#playground)—execute live API calls with pre-configured endpoint templates, editable JSON request bodies, response timing display, and one-click cURL export.
• AddedOpenAPI specification updated to v2.0.0 with full request/response schemas for all 40 edge functions across 24 tag groups. Live at /functions/v1/openapi-spec.
• AddedMobile bottom-tab navigation for the dashboard—replaces sidebar on viewports below 768px for improved mobile CX.
• AddedPost-auth drip email campaign wired to signup flow via enroll_drip_campaign database trigger on profiles table.
• AddedVC Wallet SDK unit test suite—35 tests covering credential lifecycle, JWT handling, OpenID4VP presentation exchange, and phone hashing.
• ChangedEdge function inventory updated to 39 functions (added shield-blast, shield-cascade, shield-provenance-guard, verify-sds-passcode; removed verify-patent-passcode).
• ChangedSDS updated to v2.5.0. Total verified checkpoints: 263 (208 frontend + 55 edge function).
• FixedSettlement tokens page (/settlement-tokens) margins aligned with whitepaper layout for visual consistency.

Production ML-DSA-65 lattice signatures promoted from reference validation to full signing path.

• SecurityML-DSA-65 (NIST FIPS 204) promoted to production signing—PQClean reference implementation compiled to WebAssembly (mldsa-wasm). 3,309-byte signatures; sub-millisecond sign/verify on a warm isolate, cold-path end-to-end dominated by WASM instantiation and quantum-entropy acquisition. Prior HMAC-based reference validation layer retired.
• ChangedHybrid PQC signatures now produce native ML-DSA-65 output in shield-cross-reference, shield-cached-proof, shield-vc-verify, and shield-a2a-handshake edge functions.
• AddedDeterministic key derivation: SHIELD_ENCRYPTION_KEY → domain-separated HMAC-SHA-256 → 32-byte seed → ML-DSA-65 key expansion per FIPS 204. Per-tenant cryptographic isolation without schema changes.
• AddedML-DSA-87 (CNSA 2.0 Level 5) added to SDS migration roadmap as Phase 6 for defense and intelligence verticals.
• ChangedUpdated landing page, whitepaper, FAQ, SDS (v2.4.0), pitch, and partner collateral to reflect production PQC status.
• ChangedPatent audit updated: NF-06 (Hybrid PQC) limitation resolved—native lattice signatures replace reference validation layer. Two disclosed limitations remain (NF-08 EMI/thermal placeholders, PBIP aspirational).

NF-08 Sensor Capture SDK, carrier-signal variance detection, and documentation updates.

• AddedNF-08 Sensor Capture SDK (sensor-capture.ts)—client-side network jitter (RTT variance, navigator.connection, OS scheduler delta) and accelerometer (60Hz via Generic Sensor API) capture within the 100ms Atomic Fingerprint temporal window.
• AddedJitter replay detection in shield-spatial-bind—identical network jitter hashes across distinct captures trigger +0.4 anomaly score for replay/relay attack flagging.
• AddedNew columns on shield_atomic_fingerprints: network_jitter_hash (text) and channels (text[]) for multi-channel sensor provenance.
• AddedBlog: 'The Invisible SIM-Swap: How Carrier-Signal Variance Detects What Software Can't'—on carrier-signal entropy and NF-08 jitter analysis.
• ChangedQRNG provider hierarchy corrected to four tiers: Outshift (Cisco) → QCi uQRNG (Photonic) → ANU QRNG → CSPRNG fallback.
• ChangedUpdated SDS (v2.3.0), FAQ, patent review, hardware brief, and pitch documents with sensor capture SDK details.
• SecurityAll raw sensor data SHA-256 hashed on-device before transmission—zero-PII architecture extended to physical-layer attestation.

VC Wallet SDK, RLS policy optimization, and consistency fixes.

• AddedVC Wallet SDK (PBWallet)—tenant-facing TypeScript SDK for credential storage, OpenID4VP presentation exchange, and lifecycle management. Available at /sdk with copy-paste code snippets.
• AddedSDK integration tab in dashboard Credentials panel with pre-filled initialization snippets scoped to the active tenant.
• ChangedMigrated all 75 Row-Level Security policies from RESTRICTIVE to PERMISSIVE mode for improved query composability, preserving all tenant-isolation expressions. This aligns with Supabase best practices for multi-policy tables.
• FixedHardware brief and other sub-page nav anchor links now scroll to on-page sections instead of navigating to the landing page.
• FixedContact form submit button now uses the amber CTA style, consistent with all other CTAs across the platform.
• ChangedUpdated FAQ, terms, privacy, SDS, and changelog documentation to reflect current v1.4.3 build including SDK delivery.

Landing page redesign, stability fixes, and zero-PII hardening.

• ChangedLanding page redesigned with amber accent system, updated hero typography, and refined CTA styling across all viewports.
• ChangedArchitecture diagram SVG connectors migrated from hardcoded HSL to theme-aware tokens for dark/light mode consistency.
• FixedResolved memory leak in terminal typing animation—clearTimeout now fires correctly on unmount.
• FixedEliminated SEO component infinite re-render caused by unstable JSON-LD array dependency.
• SecurityWhitepaper gate now stores only SHA-256 email hashes—no plaintext email ever persisted, enforcing zero-PII architecture.

BLAST Protocol, DRBG refactor, and documentation updates.

• AddedBLAST Protocol—end-to-end encrypted signal resolution tunnels using X25519 ECDH + AES-256-GCM with QRNG-seeded session keys.
• AddedBLAST API documentation with blast_init, blast_resolve, and blast_teardown endpoint references and Node.js quick-start snippet.
• ChangedRefactored BLAST module into blast-types, blast-crypto, and blast-sessions for improved maintainability.
• ChangedDRBG entropy hierarchy simplified to Outshift QRNG → ANU QRNG → CSPRNG (removed unused Qrypt provider).
• ChangedUpdated SDS, whitepaper, FAQ, terms, and privacy documentation to reflect current architecture.
• SecurityDRBG nonce generation now XOR-mixes local CSPRNG entropy per invocation to prevent deterministic session IDs.

Agentic Identity & Shadow Proxy enhancements.

• AddedAgent Delegate provisioning—grant scoped, time-limited API access to autonomous agents acting on behalf of verified users.
• AddedShadow Proxy identities—generate disposable email and phone proxies that forward through encrypted relays without exposing real PII.
• ChangedDashboard sidebar reorganized for clearer navigation across Pillar I, II, and III features.
• FixedResolved edge case where cached proofs near expiry could return stale trust-level badges.
• SecurityPost-quantum signature verification updated to latest NIST ML-DSA-65 parameter set.

Intelligence layer, playbook improvements, and expanded webhook verification.

• AddedAI-powered Intelligence Worker—automated threat-actor clustering and risk scoring on ingested events.
• AddedPlaybook builder wizard with industry-specific templates (fintech, healthcare, crypto).
• ChangedEvent timeline now displays response latency (p50/p99) per playbook execution.
• FixedWebhook delivery retry logic now respects exponential back-off ceiling correctly.
• SecurityExtended HMAC-SHA-256 signature verification to custom webhook sources, completing coverage across all inbound carrier payload paths.

Verifiable Credentials and cross-reference matching.

• AddedPillar II—Verifiable Credential verification with support for W3C VC Data Model 2.0 and SD-JWT.
• AddedCross-reference engine linking carrier signals, passkey attestations, and VC subject hashes.
• AddedSSO configuration panel supporting SAML 2.0 and OIDC providers.
• ChangedAPI key management now shows last-used timestamps and per-key scope badges.
• FixedDashboard analytics widgets no longer flash empty state on slow connections.

Cached proofs, audit logging, and compliance tooling.

• AddedCached identity proofs with configurable TTL—reduce redundant carrier lookups.
• AddedSOC 2 Type 2-ready audit log with immutable, append-only event recording.
• AddedCSV and JSON export for events, audit logs, and usage data.
• ChangedUsage billing now reports hourly signal counts to Stripe metered subscriptions.
• SecurityAll PII fields encrypted at rest using AES-256-GCM with tenant-scoped keys.

General availability—PasskeyBridge ITRaaS platform launch.

• AddedPillar I—real-time SIM-swap, number-port, and fraud-signal ingestion via carrier webhooks with HMAC-SHA-256 signature verification.
• AddedConfigurable response playbooks with conditional logic and multi-action chains.
• AddedPasskey (WebAuthn) registration and authentication with FIDO2 compliance.
• AddedMulti-tenant architecture with role-based access control (admin / member / viewer).
• AddedAPI key provisioning with scoped permissions and prefix-based identification.
• AddedReal-time status page with automated health checks.
• SecurityZero-PII architecture—all identifiers stored as irreversible cryptographic hashes. Row-Level Security enforced on all tenant-scoped tables.
• SecurityAutomated penetration testing suite (6 validators: RLS auditor, auth fuzzer, column exposure scanner, tenant isolation prober, scope escalation tester, dependency scanner) integrated into CI pipeline.