Standard · changelog

Every version,
in order.

Each entry below is a published version of the standard. Once a version has sealed a production pack it never changes in place; pre-production revisions are logged here until the first seal, and a successor supersedes it with a documented rationale.

  1. v1 · rev. 2026-08-11
    Corrected the addresses of the three verification surfaces.

    The spec named verify.importable.io for the website and the HTTP API. That host does not resolve, and never has — the verifier, its documentation and the /api/v1/* endpoints have been served from importable.io since Phase 9.3. A reader following the spec to check a pack reached nothing, which is the one failure this document cannot afford. §04 and §05 now name the live paths, and /standard/v1.json resolves them from the site origin rather than hard-coding a host. No normative change: the construction, the artefact ordinals, the signature scheme and the verification method are untouched. The addresses were wrong; the standard was not.

  2. v1 · rev. 2026-06-05
    Pre-production hardening — Merkle domain separation.

    Added RFC 6962-style domain separation: a leaf hashes as sha256(0x00 || digest) and an internal node as sha256(0x01 || left || right), closing a second-preimage / proof-forgery gap. Applied before the first production seal — no production packs were sealed under the prior construction, so v1 remains a single coherent spec.

  3. v1
    Initial publication.

    Establishes the 24-artefact ordinal set, SHA-256 + Merkle assembly, Ed25519 signing, and the three verification surfaces (web, HTTP API, npm client).