What changed, and when

Webapp

• New /blog, with an RSS feed at /blog/feed.xml. Posts are Markdown files in apps/web/content/blog/, prerendered at build time with article metadata and sitemap entries
• First post, "What an evidence envelope proves", at /blog/what-an-evidence-envelope-proves
• New post, "The bytes can stay where they are", at /blog/the-bytes-can-stay-where-they-are
• New post, "A settlement receipt names a transaction", at /blog/a-settlement-receipt-names-a-transaction
• Every page is server-rendered again: the wallet-pairing providers were loaded with ssr: false around the whole app, so crawlers and link unfurlers received an empty shell with no headings or copy (#251)
• Link previews carry a page-specific share card, the site name, and the Twitter handle on every route (pages that set their own Open Graph copy had lost the image), 404 and signed-in Cloud workspace pages no longer declare another URL as canonical, meta descriptions fit the search-snippet length, and robots.txt lets unfurlers fetch the verify card and the status badge (#251)
• Analytics events now cover the verify flow (runs, receipt exports, share controls), marketing calls to action, explorer CID search, BYOK keys, the add-credits funnel, onboarding, and Cloud management actions. Still gated by the GA id and the analytics-cookies preference; no envelope contents, URLs, or file names are sent (#250)
• Homepage gains a trust strip under the hero, a "who is this for" block with one scenario each for agent builders, release engineers, and archivists, and GitHub social proof in the footer (#245)
• New /changelog page fed by this file, with an RSS feed at /changelog/feed.xml (#245)

Verifier

• Verification reports carry an evidence summary: subject, signer counts (artifact and envelope separately), receipts per system, and key status, for the receipt view and the badge (#233)

Webapp

• /verify renders the report as a printable receipt headed by the verifier's exact status; the uploader shows the same receipt after a real anchor lands (#233)
• Share block under every report: link, status badge SVG at /api/badge, badge Markdown, and a social card at /api/og/verify (#229)
• /verify loads an envelope from ?url= or ?envelope= and ships sample envelopes drawn from the conformance fixtures (#228)
• Hero: one slogan for files and agent runs, and a developer quickstart with SDK, CLI, and MCP tabs highlighted on the server (#230, #231)
• Stale chain copy removed; every network is described no further than its integrationStatus (#232)

Action

• seal-release starter GitHub Action: hashes release artifacts into a manifest, seals it with @fileonchain/sdk/evidence, verifies, attaches the envelope to the GitHub Release, and appends the badge. Dogfooded on this repository's own releases (#229)

Webapp

• Anchor cost quotes come from live gas and price reads instead of the static table (#199)

Webapp

• Explorer reads the DB-backed indexer for real: recent anchors, per-CID pages, chunk content, and transaction lookups on Sepolia and Auto EVM Chronos (#187, #179)
• Hero ticker and stat tiles show indexed anchors only; nothing is padded with filler when the indexer is empty (#197, #198)
• Integrations page lists a network as active only when its contract is deployed (#190)
• Code samples are syntax-highlighted with Shiki on the server (#189)

Protocol

• Receipts are bound to the evidence they settle: offline settlement checks report unknown (structure only), and the online EVM check decodes the anchor payload from calldata and requires it to reference the envelope's subject or inclusion root
• Canonical JSON rejects __proto__ keys, -0, and unsafe-range integers; a wire scanner rejects duplicate JSON keys before parsing
• Merkle trees move to RFC 6962 style leaf and internal-node domain separation with lone-node promotion. This changes canonical bytes: every conformance fixture in packages/protocol/fixtures/ was regenerated, the spec was updated, and migrated legacy proofs get their own fileonchain-merkle-legacy/v1 adapter

Verifier

• The envelope digest only reports a strong pass when a valid envelope signature covers it; unsigned digests warn about exactly what they do not protect against, and reports carry an explicit attested flag
• ed25519 verification pinned to strict RFC 8032; key and signature hex must be lowercase as documented
• fileonchain migrate validates the legacy package before converting

Webapp

• Uploads resume after a partial anchor instead of starting over (#160)
• One wallet-connect flow across all twelve chain families (#157)
• Security hardening pass over the account backend and API routes (#153)
• Sepolia FileRegistry redeployed and recorded in the chain registry (#155)
• Single-chunk uploads no longer break on the IPLD blockstore (#162)

Cloud

• Hosted anchoring fails closed: a job on a chain without a funded signer fails with a readiness error and refunds credits (#57)
• Cache and donation reads go through real RPC; the mock layer remains only for unprovisioned chains (#59)
• Memo-anchoring mainnet flags for Cosmos, TRON, Cardano, and TON stay off until testnet QA (#58)

Cloud

• FileOnChain Cloud opens to real users: hosted evidence, agent runs, hosted verifier page, retention, search, webhooks, and exports behind fok_ API keys (#55, #37, #35)
• Wallet sign-in extended to TON and Hedera verifiers (#48, #50)

Webapp

• Vitest brought up for the webapp's pure helpers (#42, #43, #51 to #54)

Protocol

• First release of the FileOnChain Evidence Protocol as a standalone, zero-dependency package: envelope types, canonical JSON, SHA-256, Merkle inclusion, context-bound artifact and envelope signing payloads, envelope digest, tagged adapter receipts, profile and adapter registries, validation, and legacy-evidence-v1 migration. Protocol version 1. Conformance fixtures introduced in packages/protocol/fixtures/

Profile

• Agent Evidence Profile v1 (org.fileonchain.agent/v1): run, model, tool-call, approval, and policy claims with runId and agentId required

Verifier

• Isomorphic deterministic verifier with structured results (valid, valid-with-warnings, incomplete, invalid), grouped checks, artifact and envelope signatures reported separately, and unknown adapters or profiles reported as unknown, never failed
• fileonchain CLI with verify and migrate subcommands (fileonchain-verify stays as an alias)

SDK

• Anchor-only family clients: no propose step, no token, free beyond gas
• High-level evidence API on @fileonchain/sdk/evidence; the MCP server gains a fully local verify_evidence tool

Webapp

• Public browser verifier at /verify: no account, no wallet
• The whitepaper splits into the protocol spec, the profile, the product overview, the integration status ledger, and the ADRs

Contracts

• Anchor-only FileRegistry deployed on Ethereum Sepolia and Auto EVM Chronos; registry reads go through the real contract on provisioned chains (#31, #32, #33)

SDK

• The SDK splits into one package per chain family under @fileonchain/sdk-<family>, re-exported by the @fileonchain/sdk umbrella (#16)
• Chunked anchor clients with the same progress and receipt shape on every family (#11)

Webapp

• Account system: sign-in, wallets, credits, API keys, BYOK, and preferences (#10, #12)