Changelog

What shipped, including what broke.

Dated and specific. Almost no early-stage product keeps one of these, which is exactly why it is worth reading — a changelog is the cheapest evidence that a thing is alive, and the hardest to fake.

August 2026

Detectors checked, not matched: EU VAT is now recognised per member state at that state's exact length, with the published check digit run for the twelve that have one — each algorithm confirmed against a real registration before it shipped. National identifiers became three checksummed schemes rather than any eleven digits, taking the false-positive rate on random strings from 100% to 2.1%. Found by our own red-team grid, which had two defects and now has none.
Readiness scoped to the regime: Scores now count only the instruments the resolved market profile names. Unselected instruments are still listed and scored, and marked — because deciding an instrument does not apply to you is not ours to make.
The coverage grid became evidence: The red-team result is now a registered evidence type cited by GDPR Art. 32(1)(d), computed live and carried whole into the audit bundle with the failing cells included.
A second list on readiness: Evidence that exists and still carries a fix now has somewhere to go. Previously a deployment could read 100% with nothing to do while a control had two known ways through it.
The demo runs daily: Agents act every morning under a systemd timer, seeded by the date so a Tuesday and a Wednesday differ. Nothing is backfilled: the history builds forward, and a missed day stays missing.
A refused decision declares too: The demo recorded fairness declarations only after a successful authorisation, so every declared decision was favourable and the screen could not have found a disparity however the data fell.

Each entry above is a real commit against a real issue, and several are bugs we found in our own controls by attacking them. A changelog that contains only features is a marketing page with dates on it.