v1.2.1 — Bundle rebuild + R047 fix + doc corrections

Fixed

• Admin panel bundle was distributed unminified (869 KB / 25,064 lines instead of the 490 KB / 41 lines the documented build command produces). Rebuilt from source.
• Rule R047 (minimum contribution amount) had no form field in the admin panel; params were API-only. Merchant-category rendering leaked anti-injection delimiters into the display.
• USER_GUIDE.md / USER_GUIDE_ES.md described 5 of 6 rule-table rows with the wrong rule (R007↔R005 semantics swapped), plus two false claims (locally-evaluated rules, a non-existent catalog-visibility attribute). Corrected against the real rule definitions.

Full history: README.md#changelog

Trusteed Agentic Commerce for Magento v1.2.0

Security and correctness release.

• Security fix — the agent token verifier treated exp, iat and nonce as optional. Both time checks hung off > 0, so a token that simply omitted the claim skipped expiry and max-age entirely: it was valid forever. All three claims are now mandatory (nonce 16–64 chars).
• Security fix — the enforcement snapshot's signed freshness window (validUntil) was ignored, so an expired snapshot was applied as if current. Magento was the only connector that did not check it. Expired now means absent, and the merchant's fallback policy applies.
• Fix — trust scores with a decimal rendered as "no score" (the Health tab used is_int() on a value the engine rounds to one decimal). Measured across production stores on 2026-07-27: 44.7, 52.7, 55.7, 61.5 and 81.4 all showed as "no score".
• Fix — rule R036 read its cap from maxCents; the canonical parameter is maxCentsPerLine, so the rule could never fire.
• Added — capability reporting, so the merchant panel can warn when a rule is switched on whose signal this installation cannot provide.

Full changelog in the README (also available in Español, Français, Deutsch).

Trusteed Agentic Commerce for Magento v1.1.1

Fix: Mis Ventas SPA mount

The "My Sales" page mounted a static placeholder (Dashboard block +
ventas.phtml) that never reached the actual TrustReceipt list. It now
mounts the real admin SPA in the "Mis Ventas" section, same as Rules
and Agents. Admin SPA bundle rebuilt.

Trusteed Agentic Commerce for Magento v1.1.0

Fix: checkout enforcement was skipped for organic (non-agent) checkouts

Merchant enforcement rules — maximum order amount, blocked countries, business-hours restrictions — were being skipped entirely whenever a checkout had no agent DID attached. These rules now run unconditionally regardless of agent presence.

This closes the same class of bug flagged in a Shopify App Store review of an unrelated checkout extension: a cross-platform audit confirmed the Magento module had a structurally similar gap.

Added: offline safety-valve evaluator

When the remote rules-evaluation API is unreachable, the module now enforces the same universal merchant rules locally (OfflineSafetyValveEvaluator) instead of falling back to a blanket allow/block policy.

Also included (previously unreleased security fixes)

• The enforcement snapshot fetched from the Trusteed backend is now cryptographically verified (Ed25519 signature check against the published JWKS) before being trusted.
• EnforcementClient no longer fabricates a placeholder dev-bypass signature when the HMAC secret is not yet configured — requests now fail safely open with a distinct log line.
• Fixed the support "Send diagnostics" endpoint calling the wrong backend path.

Testing

41/41 unit tests pass, including a cross-language conformance suite validated against the canonical rule definitions.

---

🤖 Generated with Claude Code

Trusteed Agentic Commerce v1.0.0 (Magento 2)

Módulo instalable para Magento 2.

Instalación manual:

1. Descomprime el zip en app/code/Trusteed/AgenticCommerce/
2. bin/magento module:enable Trusteed_AgenticCommerce
3. bin/magento setup:upgrade && bin/magento cache:flush

El zip contiene los archivos del módulo (sin vendor/ ni dependencias de desarrollo).