Changelog
What shipped, when.
Every entry corresponds to merged work, and the dates are merge dates. Earlier history, including the orchestration engine, multi-tenant isolation, the simulation, and the NetSuite reference workflow, predates this log.
Identifiers such as HDR-01 refer to the claims register, which gives each claim’s status in each environment and is described on the trust page.
- New
One brand system for the site and the product
The public site now follows a single sample decision from its first evidence to what it taught the organization, and the demo is a seventeen-step story run on the engine’s own simulation and hashing code. Marketing and product share one visual system, one vocabulary, and one set of epistemic marks.
- New
Public ledger verification and a live status page
Anyone can paste an execution-ledger export at /ledger-verify and recompute the SHA-256 hash chain in their own browser. A public status page reports the live system.
- New
Salesforce self-serve OAuth install
Organization admins connect Salesforce from Settings with a standard OAuth web-server flow. Tokens are AES-256-GCM encrypted at rest.
- New
DCAA-format audit export
The organization-scoped execution ledger exports as CSV or JSON for defense-contract audit workflows. Parameters are exported as SHA-256 hashes; access is owner and admin only, and rate-limited.
- New
Slack approvals
The Nervos app installs into a workspace by OAuth. Approvers see a proposal with approve and reject inline; every decision is signature-verified, role-checked, and logged.
- Security
Compliance document set
A GDPR-aligned Data Processing Agreement template, a sub-processor register, and a security and engineering code of conduct joined the security documentation, with the SOC 2 criteria mapping updated to match.
- Improved
Billing quotas and seat enforcement
Decision runs and write actions meter against the billing tier, with clear upgrade paths, usage meters on the billing page, and seat limits enforced on team invites.
- Security
Rate limiting on every remaining route
Team, notifications, connectors, logout, demo seeding, and proposal approve and reject now carry distributed rate limiting, closing gaps found in an internal audit.
- New
Salesforce writes join the governed execution path
Task, opportunity, account, and case creation run through the same approve, execute, and ledger pipeline as NetSuite, with delete-compensation rollback on created records.
- Security
Per-request nonce CSP (off by default) and Supabase Vault
Content Security Policy gained an opt-in per-request nonce mode; production still serves the static policy, which allows inline scripts, until the cutover (HDR-01). Connector credentials gained a Supabase Vault store, also opt-in.
- Security
Internal hardening review
Privilege-escalation and cross-tenant findings from an internal review were fixed in the repository, including a permissive policy on the organizations table and a lockdown on profile role updates. No behavioral test has run against production (PROD-VERIFIED). No third-party penetration test has been performed.
- New
Independent technical diligence guide
A replay script lets an auditor or acquirer verify thirteen platform claims, from tenant isolation to ledger integrity, with nothing but curl.
- New
Hash-chained execution ledger
Each recorded stage of a governed write appends to a SHA-256 hash-chained ledger, verifiable per proposal. If the step recording a sent write cannot be written, the result is flagged and that write is missing from the chain.
- New
Rollback and replay for governed writes
Reversible actions gained compensating writes (a vendor bill is voided) and replay: re-driving a failed execution re-sends under its original idempotency key. RESTlet 2.2.0 is not yet uploaded to NetSuite, and against an older RESTlet a retried attempt may still write twice (IDEMP-01).
- Improved
One canonical orchestration engine
The legacy agent system was deleted in favor of one engine, grounded in live signals and synthesized with a deterministic simulation.
Experience it
See what shipped, running.
The demo runs the engine’s own simulation and hashing code on a sample decision.