Releases

The oldest debt of the dashboard: no endpoint checked the caller.

Three levels, from narrowest to widest: analyst, supervisor and administrator. Authorization is by floor, every session route declares the minimum level that opens it, and a suite reads the router to prove none was left without a floor. Whoever signs the contract became a separate mark, not an access level.

Whoever was a viewer became an analyst and gained write access, and that is written in the migration itself: migrating access silently would be deciding for whoever operates. The minimum of two administrators is a lock on the way out and a warning on the way in.

Alongside, the operational metrics in the dashboard: acts about to expire, distribution by type and by policy version. The screen declares, next to the column, that latency per source does not exist, because the act recorded only creation and conclusion.

The chain does not expose a cut at the end. The checkpoint does.

An isolated chain exposes a gap in the middle, insertion, reordering and forking, and does not expose the removal of the last receipts, because what is left stays continuous from the genesis. Numbering does not solve it: a sequence from 1 to N does not reveal that N+1 existed.

The checkpoint is a signed object, with the same key as the receipts, stating how many existed and what the last hash was. Whoever audits keeps it outside Hummand and compares later. With no table of ours listing issued checkpoints: the only copy that counts is the auditor own.

Creating the same act twice stops creating two acts.

Act creation accepts an idempotency key: the same key with the same body returns the same act, and a different body is refused. Retrying after a network drop duplicates nothing.

A cheap lookup for the state of a mandate, and bulk revocation by mandate holder or by client, with one receipt per mandate brought down. Act events now carry the domain vocabulary.

The context hash recipe now uses the format own canonicalisation, and it is published: whoever holds the original context recomputes the hash alone, with nothing from Hummand.

The ceiling started applying to the whole client, not per process.

Shared counting in the database, with ceilings per API key, per client and per address on public routes. Before, each process counted its own, and the real ceiling was the number of processes.

The API now answers behind an edge that terminates the encrypted connection, with a limit at the edge too and the interactive documentation closed behind access control.

Three things nobody using it can see, and that change what we can promise.

Tracing and structured logs in the service and the workers, with alerts configured and notification delivery proven rather than assumed.

Production secrets left the file on disk and are now read from a managed vault, in memory. No secret persists on the server.

Automatic backups with an encrypted external copy, off the server, and the first restore rehearsal done in production. A backup never restored is a promise, not a guarantee.

Four defects found in adversarial review, fixed before going up.

Retention did not reach the context of acts created by the new API; irreversible erasure now requires a scope of its own that no integration receives by default; the public proof no longer exposes the act position in the chain; mandate revocation inherits sandbox mode.

Documented the erasure limit: in that version, standalone document validations were not reached on request, only by the period. Closed later, in 0.13.0.

Three phases of the plan in one release, replaced by 0.5.1 before going live.

Dual operator with composite receipt; agent mandate with scope and revocation; delegated act; exception proof triggered by the client or a source; alerts computed on read, with the expiry event; deciding the review queue requires the reviewer's fresh presence.

Two test tenants and four scenarios as the acceptance suite, every act with its receipt verified outside the gateway. Read-only policy, data subject privacy, receipt by link token and revocation from the dashboard.

Dashboard, journey and console speak of acts, receipts, mandates and policy.

Dashboard: screens for acts, receipts with batch export, mandates with revocation, alerts, read-only policy and privacy on the real routes. Journey: mandate scope step, proof at the end, accessibility for elderly users, initial bundle from 1.39 MB to 209 kB. Console: queue decision only with the reviewer's fresh presence.

Types generated from the OpenAPI contract in all three; ninety hand-written types removed.

Product decision: API and receipt now say the same thing.

Live presence with a failed match is a negative act, no longer positive with a separate match verdict. A match requested and not computed is a technical failure, with the reason in the receipt.

Fix after the 0.3.0 deploy.

The app did not start because the key policy denied the receipt service the right to read the public key. Now the error goes to the log, the JWKS comes out empty without cache and is retried on every request; the key policy was fixed and documented.