Changelog and rating matrix history

Rating matrix

Every version of the prices

Every recorded entry carries the matrix_version that priced it, and that field is inside the entry’s hash, so it cannot be changed afterwards. The fingerprint is the SHA-256 of every price, one line per component (vertical|code|cents), sorted; recompute it from GET /api/v1/verticals or with node tools/matrix-fingerprint.mjs. A test fails if a price changes without a new version and a new row here.

The first 43 entries in the ledger, recorded on 12 September 2026 before the version field existed, carry no version. They were priced by the same rates: no price has changed since the engine was first deployed that day.

Changes

What changed, most recent first

28 October 2026

• Three new tools in the recorders (riskrouter-recorder 0.2.0), each keeping records on your side and sending only salted digests: dbseal seals the rows of a PostgreSQL table as they are written, through a trigger you apply yourself; folderseal seals each file that lands in a folder, with receipts that check at /check; and inspector puts everything sealed in a period into one folder a supervisor checks without us. Recorders
• Use it from your assistant: Claude, ChatGPT, Gemini CLI, Grok and the OpenAI and Claude APIs, and a page for telecom operators under NIS2.

26 October 2026

• Time stamps, checkpoints to witnesses and the outside probe behind /status now run every two hours instead of every hour, so that everything we run on GitHub Actions stays within the plan we pay nothing for. Each new head is still stamped and posted; time not probed is still shown as not measured.

24 October 2026

• Checkpoints now go to six witnesses: Geomys's Navigli witness and IPng's krabbel witness join the four of 23 October, each key copied from the operator's own page.
• MCP clients that cannot send a key, such as Claude's directory connectors, can now sign in to record: the user ticks that entries are permanent and the client receives a free sandbox key, under the same limits as any self-serve key (how it works). Reading still needs nothing.
• A GitHub Action that seals each file of a release and keeps a receipt anyone can verify offline; with an SBOM, each record is a Cyber Resilience Act cra.release. In the public recorder repository, under github-action.
• A terms of use page for the site, free sandbox keys, the API and the MCP endpoint during validation.

23 October 2026

• Two new record templates, for clinical trials (clinical-trials: the trial master file, its archive, adverse event reports and serious breaches, Regulation (EU) No 536/2014) and for medical devices (medical-devices: technical documentation and incident reports, the MDR and IVDR), with a page for the software that serves them, /for-life-sciences. Each article was read from its latest consolidated text first.
• The evidence log is on the public witness network's staging list (log-list-10qps-4klogs.1), and each new checkpoint is now posted to four of its witnesses: GDB Security, Markovian Protocol, Mullvad's staging witness and TrustFabric's staging witness. Each key was copied from that witness's own page; a cosignature is kept only when it verifies, and /witnesses counts them from the files.

20 October 2026

• The two hourly jobs, time stamps and checkpoints to witnesses, are now one, so /status is measured once an hour on paper instead of twice; in practice GitHub runs it every few hours, and time not probed is shown as not measured, as before.

19 October 2026

• Seal takes a whole folder as well as a file. Every file is fingerprinted in the browser and the folder is one entry in the log, whatever it holds: the receipt lists each file’s path and SHA-256 in the format sha256sum writes, and that list is what is sealed. Checking a folder fails on any file missing or changed and names a file added since; one file from a sealed folder can be checked on its own against the folder’s receipt. The receipt is the same record bundle as before, so both verifiers check it unchanged.

18 October 2026

• The evidence log’s newest signed head now goes into Bitcoin every day the log moves, through three OpenTimestamps calendars, over the same digest its RFC 3161 tokens carry. Until now only the quote ledger’s 13 September head was in a block. /age lists every head with its tokens and its block, read from the files when the site is built, and both verifiers check the proofs offline.

17 October 2026

• Privacy and the security questionnaire were not complete. They said nobody but the operator sees email sent to us, but the operator reads that mailbox with Claude, an AI assistant made by Anthropic, which drafts replies a person then reads and sends. Both pages now say so, including that Anthropic provides it under consumer terms rather than a data processing agreement.

12 October 2026

• Every tool of the hosted MCP endpoint now says what it does to the log: seven read only, and record_evidence appends without changing or removing anything. MCP clients and directories read these hints before letting an agent call a tool.
• The recorders' source is public at github.com/aniljangrabe-dev/riskrouter-recorder, an exact copy of what we publish to PyPI and npm, with setup steps an assistant can follow for the local MCP server. That server's three tools now carry the same hints: only record_decision writes, and nothing deletes. On npm from the next release.

11 October 2026

• Everything you need to check our evidence or build on it is now open source under the Apache License 2.0: the specification and its test vectors, both verifiers, the conformance suite, the regime packs, the integration and verification-page kits and the portable witness, joining the recorders. The public verifier repository carries the licence. The service that runs the log stays private; the design means nobody needs to trust it.
• A guide for engineers: what the AI Act asks of your logs. Articles 12, 14, 19, 26 and 86 read from the consolidated text that includes the amendment of July 2026, the dates Article 113 now sets for them, what the Act leaves to you, and how to keep logs that hold up, with or without us. The weekly watch now checks every article it cites.
• The recorders riskrouter-recorder 0.1.1 are on PyPI and npm. The code is unchanged; the README now says the verifiers, the conformance suite and the integration kit are Apache-2.0 too. From this release on, an npm version is staged by the release workflow and made public only when a person approves it with two-factor authentication.

10 October 2026

• A weekly watch, with no AI in it, of what the product relies on but does not control: the text of every EU article the regime packs cite, the standards the log implements, and every outside link on this site. Its first comparison found that the SCITT architecture and the COSE hash envelope are now RFC 9943 and RFC 9995, which the specification now cites, and that the MiFID II pack had no record for Article 54(10) of Delegated Regulation (EU) 2017/565 on sustainability preferences: it now has mifid.sustainability-reasons. The AI Act's amendment of July 2026 changed none of the articles the AI Act pack cites.
• Seal a file takes one click: tick the box that says a seal can never be deleted, press Seal this file, and the page takes a free sandbox key for you, seals the file and checks the receipt on the spot, before you download it. The key stays in the page’s memory for further seals and is shown once; anyone with a key of their own can still paste it.
• The Node recorder is published as riskrouter-recorder 0.1.0 on npm, Apache-2.0, after the full recorder suite passed: npm install riskrouter-recorder. Its command-line tools run with the package named, npx -p riskrouter-recorder riskrouter-logseal. Recorders

9 October 2026

• The Python recorder is published as riskrouter-recorder 0.1.0 on PyPI, Apache-2.0, by the release workflow after the full recorder suite passed: pip install riskrouter-recorder. The Node recorder follows on npm. Recorders

8 October 2026

• A roadmap that names what each next step waits on instead of promising dates, a page on what the pilot letter says, and a press page whose figures are computed from the repository when the site is built.
• The header fits one row on a wide screen, and folds behind a Menu button on a phone; without JavaScript the menu stays open.
• Every deploy now checks that what answers is what was deployed: the API names the commit, and every page in the sitemap answers with the title the build gave it.
• Every GitHub Action is pinned to a full commit SHA, every workflow declares the least permission it needs, and a test fails the build if either slips. The site also sends Cross-Origin-Opener-Policy. Security
• The privacy notice names its controller, Anil Jangra, who builds and runs RiskRouter; the press, continuity and security questionnaire pages say the same. Who is responsible
• An individual Internet-Draft on digest-only evidence logs is posted at the IETF: draft-jangra-scitt-digest-evidence-00. No working group has adopted it. Specification

7 October 2026

• Completeness chains: records can be numbered in chains, the log refuses a position out of turn with nothing written, and GET /api/v2/evidence/chain signs every position it holds, so a record sealed and later held back shows as a gap. Spot checks draw a sample from a Bitcoin block hash; selective disclosure shows one field of a sealed record; co-sealing checks that two parties signed the same record. New frozen forms, with vectors, checked by both verifiers and the conformance suite. Is this all of it?
• Regime packs for eleven laws, adding GDPR consent and erasure, consumer credit, anti-money laundering, the Cyber Resilience Act, VAT invoices and public procurement, and new kinds for AI model provenance, screening criteria and content credentials, IDD pre-contract disclosures and product versions, and MiFID II call recordings. Regime packs · Invoices
• The recorders chain records themselves when given a chain secret, fingerprint files kept elsewhere, and seal at the OpenTelemetry Collector through otlp-sealer; logseal exports a sealed forensic copy. Recorders
• Deadline proofs compare a sealed report with the NIS2, GDPR and Cyber Resilience Act clocks, and a software vendor can publish a verification page in its own brand that cannot send anything anywhere. Deadline proofs · The kit

6 October 2026

• Qualified time stamps can now be switched on by contract: the hourly job can use a qualified authority’s credentials and be limited to one token an hour, and it never calls a paid authority without them. Nothing is called qualified until such an authority is listed with its EU Trusted List entry; today none is. FAQ
• The FAQ and the short map for AI assistants now describe the log as it is: any record a firm may have to defend, built first for software vendors serving regulated finance and for AI platforms.

5 October 2026

• The home page now says who we build for first: software for regulated finance and AI-governance platforms, where one integration serves every firm on them, and compares the log with the alternatives, including where they do better. For AI platforms
• The site is in English only for now. The French, Dutch and German pages are withdrawn, and their old addresses redirect permanently to the English page of the same name. Each article on what the law asks you to record still links to its EUR-Lex text, where every official language is one click away.

4 October 2026

• Seal a file, for anyone with no software to integrate: the browser fingerprints the file (it is never uploaded), the salted digest is recorded, and you keep a receipt that the published verifiers check offline. Its check half is at /check.
• Industries: one page for each kind of record people are later asked to prove, from insurers, lenders and AML teams to hiring, laboratories, sustainability reports, research and public procurement. Each ends with a two-minute test on a real file of your own; no page offers a made-up sample.

30 September 2026

• AI agents can connect to the evidence log over the Model Context Protocol at https://api.riskrouter.eu/mcp: read the signed head, proofs, the checkpoint and usage without a key, and record a digest with one. Each tool is an existing route, answered by the same code. There is no pricing tool. How to connect
• Opening https://api.riskrouter.eu/mcp in a browser now shows a page saying what the address is and how to connect, with its tools; MCP clients get exactly what they did before. And the endpoint is ready to be listed in the official MCP Registry as eu.riskrouter/evidence-log.
• AI agents and assistants: one page to connect Claude Code, Cursor or any MCP client to the evidence log, with the tools and which need a key, the agent framework adapters and AI Act logging. And /llms-full.txt: every English page as text, for AI assistants, rebuilt with the site.
• Sealed security logs: logseal, in the recorder kit, seals any log stream segment by segment, so after a breach you can show which logs existed before it and that none was rewritten or removed, while the logs stay on your own storage. A sixth pack, NIS2 and data breaches, records each segment, each incident stage and each report sent, mapped to NIS2 Articles 21 and 23 and GDPR Articles 33 and 34. It detects nothing and names no attacker; it keeps the evidence trustworthy.
• Load tested on every change to the engine, against the self-hosted stack: the log ceiling (600 entries a minute) and the per-caller limit (60 requests a minute) both held exactly and answered a clean 429, batches of 50 were recorded in about 22 ms, no request failed with a server error, and every accepted entry was in the tree. These are test-machine figures, not production ones.
• In French, Dutch and German (withdrawn on 5 October 2026): the home page and what the law asks you to record, with each article linked to the EUR-Lex text in that language and a language switch on every page that has a translation. The API, the specification and most pages remain in English, and the translated pages say so.
• The drop-in recorders are now tested through an outage: the log refusing everything, then writing a batch whose answer is lost, then back, with the process killed in between. Nothing is lost and nothing is marked recorded before the log answered; a lost answer costs a duplicate leaf, never a gap. Recorders
• Uptime, measured from outside: GitHub Actions, which runs on none of our infrastructure, probes the website and the API on a schedule of twice an hour that GitHub often runs late or skips, in practice every two hours or so, and keeps every answer, and /status shows the last 30 days. Time GitHub did not probe is shown as not measured, never as up; a degraded API is counted apart. The figures as JSON: /uptime.json.
• Backups are now daily and kept for 90 days, each restored into a fresh database and checked the same day; they were weekly, kept 30 days. At most a day of entries now separates the database from its last backup. Restore drill
• DORA Article 30, clause by clause: every provision a contract with an ICT provider must contain, the clause we offer for it, and what is in place today, including what is not. Proposed terms until RiskRouter’s legal entity exists.
• What the law asks you to record: for IDD, MiFID II, the AI Act, GDPR Article 22 and DORA, what each article asks, when the record gets tested, and what a sealed record adds, built from the same files as the regime packs. It says plainly that no law requires RiskRouter or any product.
• Questions and answers: nineteen short answers to what people ask before they write to us, each linking to the page that holds the detail.
• Search: a search box in every page’s header, and /search, over every page of the site down to its sections, with exact phrases in quotes and -word to exclude. The index is a file on this site, so what you type never leaves your browser. Press / to jump to it.
• The mark is now the icon everywhere: browser tabs, phone home screens, search results and any API address opened in a browser. The icon was redrawn so its three squares stay apart at every size, as they do in the header.
• The API’s own page at api.riskrouter.eu now looks like the rest of the site, with the same mark and icon, and lists every current route. The admin console uses the same icon.

29 September 2026

• Agent adapters: each run of an AI agent becomes one evidence record, with its tool calls, model calls, handoffs, guardrails and graph nodes as steps, from a callback handler for LangChain and LangGraph and a tracing processor for the OpenAI Agents SDK, in Python and JavaScript. Steps keep a SHA-256 of the text they handled, not the text. An MCP server gives any MCP client a record_decision tool, whose records say they are the agent’s own statement. Tested against the real frameworks on every change.
• The recorders and adapters are licensed Apache-2.0 (those packages only; the rest of the source is not licensed), ready for PyPI and npm as riskrouter-recorder.
• The evidence log’s checkpoint key is published (anchors/checkpoint/log.vkey), so /tlog/evidence-v2/checkpoint now serves a signed C2SP checkpoint. Its private half was generated straight into the API’s secret store and exists nowhere else. No witness of the public network cosigns it yet.
• SCITT: the log registers IETF SCITT Signed Statements that are hash envelopes, signed with a key the distributor registered, and returns RFC 9942 COSE Receipts that any COSE library can check (POST /api/v2/evidence/statement, GET /api/v2/evidence/receipt). Only the statement’s digest is kept; the artifact never comes here. Verified in our tests by pycose, an independent implementation, and by both of our verifiers. Nothing frozen changed.
• Drop-in recorders for Python and Node: a logging handler, a decorator or function wrapper, and OpenTelemetry span processors that turn the decision logs a team already writes into evidence. Each record and its salt stay in a journal on the customer’s side, only the digest is sent, and nothing is marked recorded until the log says so. No dependencies; tested against the real engine and the real OpenTelemetry SDKs on every change.
• The FSMA replied to our question of 19 September about the boundary of insurance distribution. It restated the legal definitions and left the analysis of whether registration is needed to us, with a specialised legal adviser if need be; it did not rule on our model. Summarised on /evidence, which no longer waits for an answer.

28 September 2026

• The evidence log now also speaks the C2SP transparency-log formats that the public witness network uses: a signed checkpoint at /tlog/evidence-v2/checkpoint for the same tree as the v2 head, and hash tiles beside it, so anyone can mirror the tree and compute any proof without our API. Entry bundles are not published. Checked against litewitness, the reference witness, in CI, and by both verifiers. The checkpoint key is not published yet, so no checkpoint is served until it is, and no witness of that network cosigns our log yet. Specification
• Witnesses: anyone can now run a witness of an evidence log on their own account, as a Cloudflare Worker, in a fork of the verifier repository on GitHub, or on a small server, with a key only they hold. It co-signs a head only after checking the log never rewrote history, pins each log’s keys on first sight, and keeps the evidence for good if a log contradicts itself. Its web side only serves what it has stored. A public registry at /registry.json lists every log and every witness, from files in the repository; a self-hosted instance can witness every listed log, and its own, by switching on one service. Today the registry lists one log, ours, and no witnesses.
• The engine can run in a customer’s own account: the same code on their own Cloudflare and Supabase, or anywhere containers run (PostgreSQL, PostgREST and the API). A self-hosted instance signs with its own key, holds its own data and calls nothing of ours, and it hands out no sandbox keys unless its operator switches that on. Built and checked end to end from nothing every week in CI. Running it needs the source and a licence, agreed in writing. Continuity

27 September 2026

• RFC 3161 time on every signed head: each hour, every new evidence head and ledger attestation is sent to two independent time-stamping authorities (DigiCert and Sectigo), and their signed tokens are kept in anchors/tsa/ beside the Bitcoin anchors. The token binds the exact payload we signed; both verifiers check it offline, and /verify counts only tokens that verify. These are not qualified eIDAS time stamps, and every page and verifier says so. Specification
• Regime packs: what to record, rule by rule, so the log’s proof answers the question a supervisor will ask. Five packs, for insurance distribution (IDD), MiFID II suitability, the AI Act’s logging and human oversight, GDPR Article 22 and DORA incidents, each field mapped to its article with a link to the text. Published as data at /packs/<id>.json. A record has one canonical form (RFC 8785, specification), so a supervisor holding the record and its salt can recompute the digest in any language, and a bundle (record, salt, proof) checks offline with either verifier. The conformance suite gains the record cases. Nothing changed in the API: the log still accepts any kind.
• Signed leaves: a distributor can sign each claim with its own P-256 key, registered once at POST /api/v2/evidence/keys and served to anyone at GET /api/v2/evidence/keys. The signature goes inside the leaf (a new leaf version, v3, beside v2 in the same tree), so a proof now shows that the distributor asserted the decision, not only that we sealed it. Verified before anything is written; a claim that does not verify records nothing. Optional per entry. Both verifiers and the conformance suite check the client signature; the Python kit gains a standard-library signer.
• A conformance suite for anyone implementing the evidence formats in their own product: it grades an implementation in any language against the specification’s test vectors and against proofs that have been deliberately broken, checks the exports and proofs the product writes, and gives a result file that is the implementer’s own to publish. Ships in the kit at /kit/conformance/; the reference code passes all 46 cases.
• The evidence log’s Merkle tree is now kept in the database and maintained on every append, so a head or a proof reads a handful of stored subtree roots instead of every leaf, and the size ceiling on those routes is gone. Signed heads are stored once per tree size and the database refuses a head whose root is not the tree’s own. Nothing frozen changed: the specification, its vectors and both verifiers are untouched, and the stored-node fold is held equal to the leaf fold by tests in JavaScript and in SQL.
• POST /api/v2/evidence/batch: up to 500 digests in one transaction, in order, all or nothing, under the same ceilings per entry. API reference.
• Usage: how much is recorded and by whom, counted live from the ledger by a new public endpoint, GET /api/v1/usage, which returns nothing but numbers and week dates. The figure it leads with is entries recorded by keys that are not ours. Below it, how many independent witnesses and conformance results published by others exist, from the repository at build time; today both say none yet.
• Every claim, and where to check it: one page for a security review, a regulator or an investor, each claim with its artefact and who other than us can check it, and a plain no where the answer is no.
• How old the record is: the first anchored head, the earliest Bitcoin block it is in, how many heads are anchored and how many independent witnesses co-sign, computed from the published anchors every time the site is built and never typed into a page. Also on the home page and as proof-of-age.json. Where a figure is zero it says none yet.

24 September 2026

• A new look: paper, ink and typefaces served from this site, set like a document rather than a product launch. The home page shows the last three ledger entries exactly as they were anchored.
• A page for broker-software vendors: what one integration gives every broker on a package.
• Check your setup: paste a key and see whether it is recording, whether your chain links up and whether we signed its head.
• Verifiers now choose the signing key by its id, so attestations saved before a future key rotation keep verifying.
• Every page is checked against WCAG 2.1 AA on every change; code blocks can now be scrolled with the keyboard.
• A security questionnaire, answered: the questions a vendor-risk team sends, each answer linked to its evidence, with a plain no where the answer is no.
• A status page that checks the API, the ledger and the evidence log live from your browser, and shows no uptime history until one has been measured.
• The API names the commit it is running (build.commit on /api/v1/health), and a bill of materials shows that no third-party package runs in production.
• First restore drill: a backup of the ledger was restored and matched the head anchored in Bitcoin. Continuity
• Backups are now weekly and automatic: each one is restored into a fresh database and checked against the anchored head, then kept encrypted on GitHub for 30 days, which is outside the EU. Sub-processors
• Fixed: a refused contact-form write logged the database’s whole error body, which can contain the sender’s name and email. Error logs now keep only the error code and message.
• Fixed: checking an export against a head recorded earlier said “history has been altered” whenever entries had been added since, which is always. A recorded head now matches when it is any earlier head of the chain, and the check says up to which entry history is unchanged. Same fix on /verify, in tools/verify-ledger.mjs and in the Python verifier.
• Fixed: when the ledger could not be read, /verify showed “0 entries” and its copy button put the error message on the clipboard as if it were a hash. It now shows no count and offers nothing to copy until a real head has arrived.

23 September 2026

• Evidence log v2: record a fingerprint of any regulated decision, not only a quote. The record stays with you; only its salted SHA-256 is sent. Entries sit in an RFC 9162 Merkle tree with signed heads, inclusion and consistency proofs. v1 is unchanged. API reference
• An open specification of every byte the evidence commits to, with test vectors and a second, independent verifier in Python.
• A witness tool anyone can run to check our heads and co-sign them. There are no independent witnesses yet. How it works
• An integration kit for broker-software vendors: Python, PHP, C#/.NET and Java, standard library only, plus a reference broker app, all tested against the real Worker on every change.
• The 13 September head is timestamped in Bitcoin (block 967830 and later), via three OpenTimestamps calendars. Heads are now anchored weekly by an automated workflow. Verify
• Single-entry proofs: show one quote to a regulator or a customer without revealing any other. Verify
• Every API error links to the row of the API reference that explains it; ten codes that had no row now do.
• A Postman collection generated from the OpenAPI spec, and a “try it” panel on the API reference.
• Fixed: a browser on riskrouter.eu could not send an API key to the API, so the live console could price but never record.
• Security headers on the site and the API, a hash-based Content-Security-Policy, security.txt and a disclosure policy.
• A continuity and exit plan, with the facts a DORA register of information needs.
• Three guides for distributors, a share image per page, and the ledger’s live head on the home page.
• Campaign links are counted without cookies, storage or third parties. What is counted

22 September 2026

• Self-serve sandbox keys: take one on screen with nobody in the loop. Get a key
• Idempotency-Key on recorded quotes: a retried request can never create a second ledger entry.
• An OpenAPI 3.1 description of the API, kept identical to the running routes by a test.
• Check your own export in the browser on /verify, with nothing uploaded.
• Fixed: a keyed quote whose ledger write failed still reported attribution.recorded: true.

20 September 2026

• Distributors can export their own entries, the chain they sit in and the signed head, and verify it without us.
• The public verifier repository went live.
• Heads first submitted to OpenTimestamps calendars.
• A “break it yourself” demonstration of the chain on /verify.
• Rate limit on the export, the one route that had none.

19 September 2026

• The platform moved to riskrouter.eu, with a published contact address.

13 September 2026

• Attestations of the ledger head are signed (ECDSA P-256), so a head someone saved cannot be disowned.
• Ledger writes are attributed to a distributor, and the attribution is inside the entry’s hash.

12 September 2026

• The ledger becomes tamper-evident: every entry is SHA-256 hash-chained to the one before it.
• First version of the engine, the audit ledger and the demo console. Rating matrix 2026.09.1.