Changelog

Release claims, with receipts.

We sell cryptographic receipts for agent work, so our own release claims come with them. Every entry below is committed to the log.traceseal.io transparency log, whose checkpoints are cosigned by an independent witness. Don't take our word for any of it.

Verify this page

One script checks the full chain: entry hashes, the RFC 6962 Merkle root, the log's Ed25519 checkpoint signature, and the witness cosignature — then any single receipt against its log entry. Download it, read it (it's ~230 lines), then run it:

curl -sO https://traceseal.io/changelog/verify.py
$ python3 verify.py        # the whole log, checkpoint and witness
$ python3 verify.py 24     # plus the receipt for entry 24

Or use the pinned verifier in the open-source Alibi repo: python3 -m lib.tlog_witness

17 August 2026

Independent verifier for the witnessed log

lib/tlog_witness.py shipped in the open-source Alibi repository: a standalone verifier for the log's signed checkpoint and the witness cosignature/v1, pinned to both public keys. Commit 9aee9fb.

receipt log entry #24 · manifest · signature · verify: python3 verify.py 24
entry_hash sha256:f942d41a657e265cfef2e82c3b02941a0aba8cdf7800af00af93864631ec802b
manifest_hash sha256:123272c8d846a7c295866d4cd44998a5a9b0d66cc2172257233c95989d9de3eb
17 August 2026

The log gains an independent witness

witness.markovianprotocol.com (Markovian Protocol) pinned our log key and now cosigns log.traceseal.io checkpoints after verifying each new tree is an append-only extension of everything it previously cosigned. First cosignature: 2026-08-17T14:17:40Z. From this point the log cannot show different readers different histories without the split view becoming provable.

receipt log entry #23 · manifest · signature · verify: python3 verify.py 23
entry_hash sha256:f94d187db730e3131ca290938e3cf4b3b11d8b4ec9b79847d507f0a96f53efa2
manifest_hash sha256:7cf5aabc847cfc9e3341e59c8e58526171257a2af9af0b0a8b8bca1fc6da1b52
17 August 2026

Signed checkpoint endpoint

The transparency log publishes a signed c2sp.org/tlog-checkpoint note at log.traceseal.io/checkpoint. Leaves are the raw lines of the published entries.jsonl (RFC 6962), so anyone can recompute the tree root from public data alone.

receipt log entry #22 · manifest · signature · verify: python3 verify.py 22
entry_hash sha256:299812f3f084313f105d047784a14404558aeabaee6bfa94f70fe75d7e3e9876
manifest_hash sha256:3d6012afedf59d204cdd7543cc1fd3cc4f3162bf781de0eaf3748bcc62e259a4
12 June 2026

Security-hardening releases: traceseal-verify 1.0.2, traceseal-observe 1.3.2

Both packages republished to PyPI resolving the four HIGH findings of the 2026-06-07 security audit: manifest omission not detected and unbounded signature input (verify); unbundle returning an unverified payload and error messages that could leak credentials (observe). Wheel and sdist digests are pinned in the receipts. These releases predate the log, so their receipts were logged retrospectively on 18 August 2026 — the receipt states both dates.

receipt log entry #20 · manifest · signature · verify: python3 verify.py 20
entry_hash sha256:bcd4339909912109392f9a2210e6560bfc6ca2446e1c1a801e93874226a7fec4
manifest_hash sha256:1228ed67d157edba1ece96cf45f83b6d182b64832aee6fdc120293cfecf4e661
receipt log entry #21 · manifest · signature · verify: python3 verify.py 21
entry_hash sha256:24df8c8d5eeffcb00fe06767b519dd25aff663428b6c5ff28599f42cb0c6b6ab
manifest_hash sha256:e8543ebb7d40e82a90453a1ecb31d32b774ed59fe60c3cad0c30dff6d7ea2bca
13–16 April 2026

Transparency log genesis

The first 19 entries of the log: signed publication receipts for agent skills, hash-chained back to genesis. These entries are their own receipt — they are the leaves the signed checkpoint commits to.

receipt entries 1–19 in the log itself · entries.jsonl · verify: python3 verify.py