v0.1.0

Changelog

• 4fcbb75631138b97dcb66101aaa0ce169e5edd43 Accessibility: run axe-core 4.14.0 on rendered pages, static rules as fallback
• db7afdb585e17d71ec8fc1849e4f50322a1eab7b After-purchase: cancellation and address-change paths, checks and suite tests
• c52cab70a2e2e32ffafa387228a38a6e9e433a83 Edge worker: Cloudflare Worker script for traffic ingest and evidence capture
• 65b45d1287b37086521fd6516b6f48d3290a3ca0 Merge integrate/release-v0.1.0 into fix/launch-blockers
• 5e79d8d71d6ff9cd19f2945d2254790f71bf4290 Merge origin/fix/launch-blockers
• b1c120fc95e70c48bedc8fef9df4f437b8a200cd Merge phase1/01-domain-verification into fix/launch-blockers
• c229145efb5f58e6fd04391192a8438316d8ecb8 Merge phase1/02-billing into fix/launch-blockers
• f1519b9f27cf9afc0a1738fecacd7bec11d5442d Merge phase1/03-accounts into fix/launch-blockers
• d5da3438aac9d38411c94e3c77a800bcec5dd17b Merge phase1/04-vps-deploy into fix/launch-blockers
• cb19fd051c6a5f59b4b55ab1cac3883a631826f8 Merge phase1/05-invite-lookup into fix/launch-blockers
• fbafd4dab3ff43c87fd286aaff20638d2829ff04 Merge phase1/06-shared-rate-limits into fix/launch-blockers
• 58ddfe7ffffe6d387df2c9cbad758cdad2c2b438 Merge phase1/ops-01-s3-blobs into fix/launch-blockers
• f26a89ebf3e361c4b3d2660ac88ce057f078aec6 Merge phase1/ops-02-deploy into fix/launch-blockers
• c8d1c7c1a76dfa320c9095319d52b27c5c11a732 Merge phase1/ops-03-releases into fix/launch-blockers
• 1be76797dfd4b9911642e84e784f5b75b5f25fff Merge pull request #1 from tragent-io/tragent-rebrand
• 0e087e3a37d36a62d092c5bfd3860df0f438ee64 Merge pull request #2 from tragent-io/tragent-folders
• d70870c11687e001fd1097fead91857e12419158 Merge pull request #2: launch work with release/v0.1.0
• 4909a3955f1fd84bc8dcb1fe609f759ecfab927f Merge pull request #3 from sagoresarker/phase-2-3
• f633e897b789a90bad043e121c4350c547852e83 Merge pull request #3 from tragent-io/palette-and-release
• 1714d9be1fde6212a2890b9095299c6a03c8df7c Merge pull request #4 from sagoresarker/oss-upgrades
• 1430126a8caae85e5d6ad14419105ea948c09a55 Merge pull request #4 from tragent-io/public-release
• c5c3950fc22387f765c6d8f6dca4ee0b840d98d6 Merge pull request #5 from sagoresarker/signature-agent-dictionary
• 942f5dbdbea03638978f25eeed60f1af0c1011dc Merge pull request #6 from sagoresarker/vocab-ux-overhaul
• 642a5df2ea4dfe0c3fa43820a70d645e75b11df7 Merge pull request #7 from sagoresarker/fix/webhook-domain-verification
• 57bba8ef239dc4148be0b07cc9c76a5a247ea5ec Merge pull request #8 from sagoresarker/chore/remove-fly-config
• 0537bd8559c25c47e08817afa88e02bc7579465b Merge release/v0.1.0 into the launch work
• ec26589795ea7fb9899c71f5c5e26cace6cb318a Price parity: compare person and agents within each locale
• 4852e347071ae8df9d9d81a976b22e29d23c0af5 Security: verified email for copy preview and SSO; guarded OIDC; SSO handoff to the app
• 090f9ec2a3ed840d0a442b201d0088579c295388 WebMCP: exercise update/complete_checkout in a sandbox; current WooCommerce MCP paths
• b0c50f5156824fb49c1e7969f537dfc1b09b61c6 browser: rrweb journey recordings, credentials masked; stored per journey
• c16c344a48e86341db176c873439de03e2372f31 checks: Google's merchant-listing rules for product data (advisory)
• 5042be1a037d4d27b6e534ece95c1bc6dcd848be chore(ci): bring the CLI to zero lint findings
• 88ddc997c313f0fa37c4157e4b536a153e006c3b chore(ci): lint, test, build pipeline and Dockerfiles
• 881ee084cb3a037259a54d4290b625457c5a0ac6 chore(make): add run-create-org target
• c1d0868ca7bda8d500839e351313c888bccb2342 chore(store): renumber launch migrations to 0018-0023
• e1f1c2bb7a1b6c85fa6667f3f996bfd65035c6bd ci(release): GoReleaser CLI builds and GHCR images on v* tags
• 07a48f117c8225c42cd52e95f11707ddc2f570ba ci: lint with golangci-lint v2, run DB tests one package at a time
• ce3c113f3a9b59ab70c1b4018dd73f137d21f5a4 deploy: remove the Fly.io configs
• e0f7933c13f9c5bb9155413abae2728dce93b815 docs(api): document the nine endpoints the spec had fallen behind on
• 9db695f326d77d8fc66847202b6657cb2fcbce2b docs(deploy): Fly.io configs for api and worker, and a production guide
• c584c6bb9d013eb857b7d5431c607986080dba7f docs(open-source): state the package boundary as it is
• 5f7d86068e36c7ec348a29d524920ef2da7ba8bf docs(openapi): every Phase 2/3 and evidence endpoint, plus the older gaps; coverage test
• 837507e317156052fcbad751b4a0b903ee0f6f96 docs(public): OpenAPI, README and env for the public scanner
• 22cc3939bd935bbcc9633343136797b47f165e57 feat(agency): the agency and system-integrator program
• 92a41db433ce24ffcae08c219e6ef5f2a0c61d27 feat(api): expose run diff against the accepted baseline
• 1887b92965642bbf572fb2ff44772ea535a71e04 feat(api): list, create and revoke API keys
• c8782426e7c3f407399eecfe9b97a131eb01496b feat(api): monitoring endpoints
• 665d74391b3dfab79f28891968503f4d1c3331ed feat(api): projects and targets CRUD
• 3311e0c244db7f0698a7e10e10f177043d3416b7 feat(api): run endpoints and SSE progress
• f7c36421203e593d253f5a05fcd1e490daa9d8d7 feat(api): store and resolve economics per project and target
• 272bbc7dae685e7bad49ad6c906c2b99ceec2425 feat(api): suite CRUD
• 369573c97efeea4c902687397f4a227e331aa299 feat(audit): an audit log of every change, with export
• 8f5108269bb37f7eaa477b83c56491789d3fefca feat(auth): API key issuance and bearer auth middleware
• 4fa8d4cce38ab5dc8836845f034c2f5d977960e6 feat(auth): argon2id password hashing and a length-first policy
• 55e6131ca048de774de33570462d9f63ff4adbcd feat(auth): look up an invite before accepting it
• b8a90b8a3be926af3cb4806be7ed3f8c56c690b7 feat(auth): self-serve signup, login and the read-only demo org
• 5f1924345b867c045ee46e74d71c3307c2fee36c feat(auth): session cookies and a single principal for both credentials
• 3fd13421575ab82a8635b2543ebb76fb340159c6 feat(auth): share signup and login rate limits across replicas
• a84cf9b3a992aad12bcf734c186c29cc6a71e448 feat(auth): users, org membership, sessions and verification tokens
• 7c5582b9817a08c01a3022c0809f3ff9f5e2bd63 feat(blob): S3-compatible artifact store selected by VERION_BLOB_BACKEND
• ec37b399919933768e3231704fed95c5405dc9cd feat(botauth): name the bot manager, its likely rule and its fix; signed vs unsigned per stage
• b0a24d0c3015caf7e90f693b59564b76e0cebc47 feat(browser): chromedp session manager, snapshots and screenshots
• 9164312dc4430a371ead343d67313662ffffac21 feat(checks): UCP profile, robots/agent policy, bot-block probe
• 5ef7634753285da79f77bb7f5ac5e62334e07785 feat(checks): check framework, registry and result model
• c9ce5b2f3ab71abbfb9c66c4f892448d18c25535 feat(checks): schema.org Product/Offer extraction and validation
• 27f49ecdf12d6ac6d1495dae8ddb0fdedd02ff56 feat(checks): six advisory checks that report without moving readiness
• e9aef058f18159a266bcb71904c7a5e3cab4b040 feat(ci): GitHub check-run webhook
• 9f148445dc40c5bf6fa0a8d27c6bcf37fcc97c3d feat(ci): GitHub composite Action, PR comment, GitLab template
• f8d3574eb7a3f7e63a4966467aa157b47fa8b8b0 feat(cli): carry revenue at risk into the terminal report and PR comment
• 53f7d3b71a566defd6643de66b02950b1eb9ebe3 feat(cli): follow runs over SSE, falling back to polling
• 07acdf923512d018706c3c640361879dacb86853 feat(cli): verion CLI with test/runs/report commands
• a2b9184fdaad8ca234d788c4c1b7d4f007308448 feat(compat): the merchant compatibility API
• 7526b7e3fc0656be93beec35c32d455daad4568f feat(config): typed env configuration and slog logger
• 957ee6b4e3178e0594fd669d0c3c0213073d0147 feat(conformance): Shopify WebMCP checkout, Merchant Center feed, WooCommerce MCP
• 35605ce83db4dd95f8d5983b195090598ee54f22 feat(copy-preview): see how agents will read a product before publishing
• f3e6441ab037be005b8a25d0df44ea1195c0b83c feat(db): pgx pool, embedded goose migrations, local Postgres
• 223b9c5c9e545beeaff3282d3401a002b2277b39 feat(deploy): single-VPS stack; fix bot URL and model prices
• 821110dcac530e6a3687ceb06fc17751da09e2e1 feat(domain): orgs, api keys, projects, targets + first migration
• af2af92fedd6fe486433b31c4889c3818c0e2195 feat(economics): measure agent revenue from Shopify's own orders
• 6bb379f86c70aaccceee84f838f6d725cfb6c59e feat(evidence): capture API, dispute filing, checkpoints and public verification
• 69f8bede4fc7e163974713747baf2bfabbd80934 feat(evidence): capture points, order record, CE 3.0, evidence pack and PDF
• 447a8a1b8a45b8891eb837ed19d700ae935552b0 feat(evidence): hash chain, RFC 6962 Merkle log, signed checkpoints, RFC 3161
• da446863d78bb522a194d80ab012b61e1edf1233 feat(evidence): the ledger store
• f829312c3031a4cbf8fec19e80b8312c2b6ee24d feat(github): GitHub App with verified installations and dashboard bindings
• b0560adbe45a2e261a4608ee9789eb18301feeb9 feat(http): server lifecycle, health endpoints, core middleware
• e3334a37f8261bb1dfb7c9c50a17db4b91e075ee feat(incident): shareable incident reports for platform support
• 6a7374338f784d7e773001a2545198ab2a465eff feat(ingest): CDN log connectors for Cloudflare, Vercel and Fastly
• 1a66e099c2ef186c75eeb0c209ae903898f6a64f feat(judge): checkpoint scoring, LLM-as-judge rubric, readiness score
• 1f530624b86d1b093f87687865a2cc0175e5c2cc feat(llm): OpenRouter provider behind a configuration flag
• 5786066a24cd3b2024cadad5400aede6f8cf637a feat(llm): provider interface, Anthropic and OpenAI clients, budgets
• 2fa290d6ba68d99441df5d859758d3239bd775aa feat(loadtest): peak-season agent load rehearsal
• 456d2d35afef4d2cfb1b53f44627d53e55b06730 feat(market): the State of Agent Checkout batch scan and report
• 1bacd355ad5fe817ad350178c5aa58058be4842e feat(monitor): bot cost meter
• c754afa106d3cfb2ba1ab9bff857fdeebda4da2a feat(monitor): funnel aggregation, alert rules and Slack notifications
• b2c9bc86781d99d5282a68cdabcaede8993ddb83 feat(monitor): scheduled synthetic probes
• 4f85e5797af4858b7152bb77a3012c7eca5b4984 feat(monitor): traffic ingest endpoint and agent classifier
• 03ff78a766704c7c71e5fb0382fdd72bb0284601 feat(observability): Prometheus metrics and tracing hooks
• a573c9ca539c3c8e7e537b06893c799a411ea855 feat(public): project revenue at risk without an account
• 21148e64a3549512dcaf17a209836a4a33979ca5 feat(public): scan model, storage and system-org migration
• d71b7b262f96d3c7ee21fe69aaa6e0a6d5d0cd97 feat(public): unauthenticated scan endpoints with abuse and egress guards
• 32fdab6948931fd300a1172d2f46b707689ef98d feat(queue): Postgres job queue and verion-worker
• 81ac8f99ae1f1505ac225c83c1c3b6e89694aa11 feat(regression): baselines and regression diff gate
• e15dbae289d4b7402d9c1c8759f9a5e42f6131e1 feat(report): attribute revenue at risk to failing checkpoints
• cf09c26636af483a7e39d5d57adf59a3134557e3 feat(report): run report JSON/Markdown and findings taxonomy
• d386f7d8007d409a9a62a7a65921114073a38f12 feat(runs): runs, checkpoints, findings schema and run state machine
• fb524f408d1b95570003a597eba74b492bd9fdaf feat(scoring): readiness-v2 published as an open benchmark
• 09a1d803ee2b4f00ab1315bb36a443e4cdf06936 feat(simulator): a protocol-client persona that shops through UCP and MCP
• 56aeff5c1b78e926cc0f7c11e35997af5cde9e8c feat(simulator): agent loop, tool set, step limits, circuit breaker
• 57098a82b82c0c92414a9e90c9429d618c07e94b feat(simulator): checkpoint detection and trace/artifact recording
• 5bf737b09947ed910888a66103ed0a459b8379f8 feat(simulator): personas and YAML test-spec parser
• 5a79fa4974da12754ad9e6a274a8aeb9ec057d7b feat(sso): OIDC and SAML single sign-on
• 22dfbc66bc1e6c6bed4e88239d9f05cb041f2466 feat(suites): after-purchase, promotions and injection-resistance test packs
• 235dbf2bb150e4002e8b9400c59456445895a17d feat(trust): verify agents in production traffic and detect impostors
• ddfe58540784ccb107481f8c93ddb644ced2b49c feat(vocab): one vocabulary, in words a merchant can read
• a96b92709b849a42a1a8b33462366a385b57617c feat(vocab): vendor the vocabulary to the dashboard, and carry fix advice
• 133086f023b19790429c53f1bc36270d10cdd703 feat(workers): org-scoped private workers, and the SOC 2 controls map
• d02dc863078bfda021936449d458f4f2294cf68c feat: connect platforms, be findable by agents, benchmark, measure, and fix
• d3cf24301e108f9b5781f2541ee9e777b2918342 feat: connect the generators, the category axis, and the self-check
• bda8072700230012a8b870bbf103360ccc45261f feat: password reset, verification resend, team invites and owner roles
• f0c9668174af93122725fe2b98efe54cee7ee46d feat: plans, Stripe billing, quotas and a monthly model-spend cap
• 5935fc6f4cf433ee48e7f0b6da913744d7a62270 feat: protocol conformance, authenticated journeys, sandbox checkout
• f19924e3653944f5ec69340669576d19eafc6938 feat: require a verified domain for simulations and probes
• 03d6ed88a28d928dccbb7dc083477a0847385ba9 fix(api): file webhook runs under the bound project's org
• b8f5382b262a958544d65281e369b763dcdcb16d fix(api): require a verified email before runs, probes and API keys
• df164cf3c5023228d5d76010a30c5ce1e2f396ca fix(api): require a verified email to connect a platform
• 5175c567fd04a66cc9c7a590bc824e7317b8289c fix(checks): report a policy refusal as its own cause, not an unreachable site
• 8d3f7ba28d03e0ea1991a331eb70a8e95c7e70f7 fix(classify): treat an unverified signature header as a claim
• 859ae74d5165c2684236b61adf42090ffdf1d40a fix(llm): observe real call latency in the metered provider
• 8b095f1744e447861f811ce234ff58198480262f fix(logging): label worker logs as verion-worker
• 1b52c9f2396433713a9e6008ddf822822679be48 fix(monitor): aggregate every project with events, not only those with alerts
• d28e6a26b99c245a092cfc921cd1e9dbcbe7ece1 fix(monitor): deliver alerts to each project's own channels
• 1728b7721e64155e13786f61d591522bce4c29b6 fix(monitor): keep per-rule webhook and PagerDuty inside the project
• 8bc76283cd0c133cea3230dd81ee920f3159be9d fix(queue): stamp run_after with the database clock
• 9a42140fed702ceae8f8cb0133b6580b82ee6b96 fix(report): list every checkpoint, marking unattempted ones as skip
• b3a9ed74cafe21a1cef4de7299679a9fb352db20 fix(store): apply migrations that merge below the current version
• 132e81bcbe9f56c750ac4d7595d635eac9c3455f fix(store): impostor_spike alert rules can be saved (migration 0039)
• 6e2d4e8d2c2b64a882c11d9ec39fedf3eed35cf2 fix(worker): prune raw events past a retention window
• 8db86623dc702c3326f5cd54db0aa4e1aff97615 fix: axe-core reaches the readiness checks; fixes from a live end-to-end pass
• 10226a6ff3a6259a64dcd40baf5a6273f6ba8583 fix: seal target credentials, ignore spoofed X-Forwarded-For
• 6ccb268c70047372086d44293deecb4abb3bc28a goreleaser: 'checksum', not 'checksums'
• c51a2ec8397937ef00fbc46513f4c934a7a25e91 identity: Signature-Agent as a structured dictionary (sig1="…"), the current Web Bot Auth form
• 1b3543e7934ebc2406f66fdf98ce23a639a578c5 identity: keyids are JWK thumbprints, checked against Cloudflare's reference verifier
• 72315e6a17f632045f8f1d00384129a3f8d6d047 migration 0040: move the demo user to the new domain
• f7ac648827dabae0996e13d04f01df43e619ebff rebrand: Verion -> tragent (tragent.io), a clean cutover
• 0bdbbfbbb86bc67f28e83af8e2789e1642d25efe refactor(worker): score runs with the judge and persist reports
• 57bf1c9dd319ebef65af4250ca3069d838f30298 release: publish CLI binaries to the public tragent-io/cli repo
• 65246407bec3719c40d90225460e9a7d1774379b release: the Action and GitLab template ship from the public tragent-io/cli
• bd315471793bf6288bb0f23eac1c8a6ae546b6df telemetry: OpenTelemetry traces of journeys and model calls (Langfuse-compatible)
• 100a02d64a45ecdb82dec6c4667d0dcf874d56f0 test(api): cover the economics writes in the demo read-only sweep
• 96e1f71a806a4bdc452ce8a68576c988d9a766da test(api): drop an unused binding in the report fixture
• 6d6add543c760c1d0a83f616502cac47b5fa2b08 test(api): the scoring spec names its advisory checks, now including merchant_listing
• a8afc90dcd65df21cc2089ac1956e59483f6f4f6 test(cli): do not read the CI's own pull request in the no-PR test
• 39c76346d65b91501009a4f690720656a10f0bfa test(store): claim a leaf migration in the out-of-order test
• 57e5c0500bfed59ec3c99ecf67960e6b62b1c836 vocab: merchant-first concept names for the dashboard overhaul
• 206bc29a5968e1e6564e242ef48e0d320472d8ee webhooks: a CI-triggered simulation needs a verified domain