Developers · changelog
Versions, honestly dated
Platform v0.89 – v0.96
October 2026- Self-service billing: plan choice in the app (monthly/yearly, CHF/EUR/USD), Stripe checkout, customer portal for plan changes, cancellation and invoices; owners/admins only, no double subscriptions.
- Plan limits enforced: agents and connector instances per plan; at 100 % of the monthly quota new issuance pauses — verifications, revocation and the kill switch keep working.
- The webhook reads the subscription period and invoice reference in Stripe API versions from 2025-03 (basil/dahlia) as well; payment failures are no longer swallowed.
- Security: open redirect after login closed, CSP without unsafe-eval in production, dependencies updated (including Next.js 16.3.8); pentest and crawl gates run in CI.
- Action atlas: one page per action type from the engine's catalogue — form requirement per country, legal basis, agent capability; /mandat redirects there permanently.
- English site complete: knowledge hub, product modules, pricing, comparisons including the feature matrix, legal profiles CH/DE/AT.
- Clarification: the OAuth/RAR bridge from OMP v0.5.2 is withdrawn — /v1/oauth/token and /v1/oauth/introspect answer 410 Gone; the website and API reference now say so consistently.
- Correction: statements about qualified timestamps now read only «once a trust service is connected».
OMP v0.5.2 · platform sprints 12–14
June 2026- All 19 denial codes implemented — new: MD-103 (unsupported_vct), MD-305 (frequency_limit), MD-306 (geo + time_window), MD-503 (minVerificationLevel).
- API keys (mk_test_/mk_live_) mandatory on every verifier endpoint; the sandbox stays keyless.
- Rate limits per key with X-RateLimit headers; 429 with a reset time.
- Evidence export: integrity root, signed receipt, 24 h download, timestamp path.
- OAuth/RAR bridge: mandate-bound access tokens (RFC 9396) + live introspection (RFC 7662) — revocation voids tokens immediately.
- Correction: escalation is checked BEFORE the limit reservation; step-up approvals are single-use.
Platform sprints 7–11
June 2026- Supabase schema (006) with the evidence chain guard: append-only by trigger, 16 database validations.
- Auth: magic link, Google OAuth, enterprise SSO, TOTP 2FA with an AAL2 gate.
- Account lifecycle: GDPR export (Art. 20), deletion with anonymisation (the evidence chain remains).
- Automation: daily expiry sweep, mandate.expiring, limit.threshold at 80%.
- MCP server with 5 tools — the full lifecycle verified over stdio.
OMP v0.5 · platform sprints 1–6
June 2026- Verify engine with a deterministic check order, atomic limit reservation, timing-safe signatures.
- Issuance wizard (6 steps), kill switch, escalation flow end to end (600 s), four-eyes signing by database trigger.
- Evidence log (hash chain), webhooks (HMAC, retries, DLQ), verifier workspace with a rule editor.
- SEO foundation: action, glossary, and comparison clusters, llms.txt.