Changelog

What's new

Decision Receipt release history.

August 25, 2026 — follow-up

Corrections completed on machine-readable surfaces

  • De-rated the repository badge SVG at /badge/repo: it now shows accepted and blocked counts, with no derived acceptance percentage.
  • Re-pointed the 14-day sparkline SVG at daily receipt counts. It no longer plots an acceptance-rate trend, and the landing-page caption beside it now reads "14-day receipt activity".
  • Replaced the embed widget's Accept Rate tile with an agent count. The widget publishes counts only.
  • Removed acceptance_rate and the rate-trend fields from /v1/digest/weekly, and the per-window rate from /v1/trend. Both endpoints return counts, including the refusals.
  • Scoped the landing page's enforcement description: on repositories where the admissibility check is required by branch protection (Summit-Cognitive/summit since 2026-08-24), a PR without an ACCEPTED receipt cannot merge; receipts issued before a repository's enforcement date are evidentiary records, not enforcement records.
  • Removed the withdrawn "NIST-aligned" wording from the landing page's Regulated Environments card.
  • Added an "Other" disposition row on /case-study and /deck, shown whenever the accepted, blocked and escalated buckets do not account for every record, so the published dispositions always sum to the ledger total.
  • Removed the footer link to the monitor on a Summit-operated host. A monitor Summit operates does not attest to anything beyond Summit's own statements; the link returns when the chain head is held by a party outside Summit's control.
  • Published the signing-key registry at /.well-known/summit-decrec-keys.json, and published the recovered historical signing key (sha256:776d85c1) as a retired key covering chain sequences 1-1463; it verifies the 1,397 signed receipts in that range, so anyone holding such a receipt can verify it against that key.
  • Linked the withdrawal notice on /nist to this changelog.
August 25, 2026

Public claim corrections, residual items

  • Withdrew the /nist control mapping. It attached a runtime-enforcement reading of Decision Receipt to named NIST SP 800-171 controls, AI RMF functions and EU AI Act articles. Our own records show the evaluator's verdicts have never controlled a merge in our pipeline.
  • Removed the derived acceptance percentage from four of the seven surfaces that published it: /case-study, /deck, /analytics and the landing page. The remaining three — the repository badge SVGs, the embed widget and the weekly digest — kept publishing a rate until the follow-up recorded in the entry above. Each surface rendered one summary rate above, or instead of, the counts that include the refusals. The ledger's own counts stay published; no summary rate replaces them.
  • Corrected the ALLOWED description on /policies. It said the action "is authorized to proceed". A verdict records an evaluation result; whether an action proceeds is decided by the integrating system.
  • Qualified the verification language on /nist and /spec. Checking a receipt depends on the signing key published at /v1/keys/server and the published specification, and those pages now say so instead of asserting bare verifiability.
  • Marked the withdrawn /nist page noindex, so a retracted document does not keep its search placement.
  • Relabelled the footer monitor link. The monitor runs on a host outside this service, but it is operated by Summit and is not an external or independent party.
  • Added a /spec index. The bare path returned 404 while the deep link worked.
May 19, 2026

v0.3.0 — New Pages & Production Stats

  • Added /policies page: all 9 deny-by-default rules with pass/fail examples
  • Added /admissibility page: category-defining explainer with 3 pillars and legal analogy
  • Added /comparison page: competitive landscape matrix vs 6 tool categories
  • Added /case-study page: production data from 17% to 96% acceptance in 8 days [figures retracted 2026-08-25; see the entry above]
  • Added /nist page: NIST 800-171, CMMC L2, AI RMF, EO 14110, EU AI Act control mapping (withdrawn 2026-08-25)
  • Added post-playground conversion CTA
  • Updated the deck with a May 2026 production snapshot; those numeric values are archived and are not current claims
  • Updated nav and footer with new page links
May 18, 2026

v0.2.0 — Integrations & Real-Time Feed

  • Added /deck page: 8-slide executive overview with live stats
  • Added /integrations page: GitHub, GitLab, Bitbucket, CI/CD, Slack integration guides
  • Added /contact page with intake form
  • Added /live page with Server-Sent Events real-time feed
  • Added /analytics page with receipt trend visualization
  • Added webhook simulator with 3 pre-built scenarios
  • Added compliance report generator with PDF export
  • Added SARIF 2.1.0 export for GitHub Code Scanning integration
  • Added embeddable widget and badge system
May 15, 2026

v0.1.0 — Initial Release

  • Core pipeline: Claim → Decision → Evidence → Replay → Policy → Receipt
  • 9 policy rules: source count, diversity, provenance, evidence admission, decision rights, confidence, replay, human approval, risk scope
  • Ed25519 signing: all receipts auto-signed with server key
  • GitHub webhook: automatic PR evaluation on opened/synchronize/reopened
  • PR comments: formatted receipt summary posted to PRs (with GITHUB_TOKEN)
  • Commit status: decrec/admissibility check on PR commits
  • API Playground: 4 interactive scenarios (allowed, blocked, escalated, minimal)
  • API reference: first-party lifecycle, evaluation, verification, and public-audit guidance
  • Receipt explorer: detail page with policy checks, evidence hashes, attestations
  • Receipt sharing: OG-optimized permalink, badge embed, JSON download, PDF export
  • Analytics dashboard: daily volume chart, agent performance, repo table
  • Compliance report: JSON + printable HTML for procurement/audit
  • Receipt search: filter by verdict, agent, repo, admissibility, PR
  • PR lifecycle chain: track admissibility across pushes
  • Agent analytics: per-agent acceptance rate tracking
  • Policy API: 4 built-in policies + custom policy creation
  • Repo management: register repos with policy assignment
  • TypeScript SDK: typed client with evaluate, verify, evaluatePR, search, and more
  • Verify CLI: offline receipt verification with --sign flag
  • GitHub Action: CI/CD admissibility verdicts on pull requests
  • Quickstart: curl https://decrec.summitcognitive.ai/quickstart.sh | bash
  • API key signup: instant key delivery, rate limiting by tier
  • Commercial terms: Team, Enterprise, and the fixed-scope Receipt Readiness Assessment are contracted and invoiced manually
  • Outbound webhooks: notify external systems on receipt events
  • Account API: check key status, tier, usage
  • Request metrics: traffic analysis endpoint
  • Badges: receipt, repo acceptance rate, 14-day sparkline SVGs
  • Embeddable widget: iframeable repo dashboard
  • Admin dashboard: signups, webhook feed, full ledger
  • Legal: privacy policy, terms of service, acceptable use policy
  • Setup wizard: step-by-step webhook configuration
  • Status page: uptime, memory, endpoint health
What's next
  • Persistent signing keys (vault-backed)
  • Receipt expiry with configurable TTL
  • Email notifications on new receipts
  • Multi-org workspace support
  • GitLab / Bitbucket webhook support
  • Receipt schema v1.1 with action lineage