Every unit of work that landed, newest first, each one naming the commit that closed it and the limitation it left behind. You can check any of it against the repository instead of taking my word for it.
The verification endpoint gained four verdict states, a signature report and an anchor; the screen still renders the old two. Wiring it up also means handing the head back as the anchor for the next check.
Verification now answers VALID, BROKEN, TRUNCATED or UNVERIFIABLE, carries a signature report, and writes itself into the chain it verified. Truncation is only claimed against an anchor the caller supplies — a chain cannot detect its own missing tail.
The playground screen doesn't consume the new fields yet. A verification lands in the chain one drain tick later, not in the response that produced it.
Ed25519 over the v2 entry hash. The private key lives in process configuration and never touches the database, so a database alone is not enough to forge an entry. The key-id to public-key registry is a file read from outside the database.
The JDK can't derive the public key from the private one, so both are configured and the pair self-checks at startup. The signature coverage report stayed internal until unit 42.
The id enters the preimage, timestamps serialise at fixed microsecond precision and strings normalise to NFC, so the same entry hashes the same everywhere. Older entries aren’t recomputed; the verifier branches on the scheme each row declares.
An unknown scheme was reported as a malformed entry, which is misleading. Fixed in unit 42. The preimage spec lives in Javadoc, not in docs.
ADR 0003 fixes Ed25519, one key per instance held outside the database, four verdict states, and a publicly published key registry. A second commit corrects a false claim the ADR made about the vocabulary guards.
Marked "accepted, not yet implemented". Export artefact, independent verifier, external time anchoring and per-tenant keys all deferred.
The invocation endpoint returns the token facts the ledger recorded for that call, as an additive nullable field.
Still no per-tenant aggregation and no cost materialisation.
Session, conversation, tenants, agents, API keys, invocations and the audit chain, all built against the mockups and reading from the running API. A build guard fails if the audit screen drifts into verdict language.
No test harness on the frontend; its gate is a build plus manual verification. The vocabulary guard covered the audit view and its stylesheet, not the wire types — widened in unit 40.
Static HTML mockups, one file per viewport, each declaring its own contract down to focus, autofill and reduced-motion states. Specification, not code.
The playground reads its own identity instead of asking you to paste it, and renders the full tool trace from the structured content.
The number of rounds still isn't derivable from the wire.
Key introspection, structured tool content on the message DTO, and malformed UUIDs in a body answered with 400 instead of 500.
The three tiers rendered as a tree, with agents created in the context you’re standing in.
The workspace tenant id had to be pasted by hand, because no identity endpoint existed yet.
Send to a real agent, poll invocation state every two seconds, and see the tool loop as a foldable trace. No fake streaming — the engine is asynchronous and the interface says so.
No message-to-invocation link on the wire, so invocation meta is per view.
Shell, health probe and session screen. The API key lives in memory only and is never written anywhere.
The dev proxy stands in for CORS, which the backend still doesn't configure.
One authenticated endpoint recomputes a tenant’s chain and returns the verdict, the sequence where it first breaks with a public classification, the count of pre-chain rows, and a scope block naming what recomputation does not detect.
Two verdict states only at this point, and the scope said signing was reserved — true then, superseded by unit 41.
Creating a tenant, an agent or a key, revoking one, configuring a channel — each audited inside the transaction of the operation itself, in the subject’s chain, with the acting tenant as actor.
Actor attribution by key id deferred. Two hooks reserved without emission. The operator bootstrap is the un-audited genesis exception.
Message received, agent responded, invocation failed — each emitted inside the transaction of the fact it audits, so an audited event and an unrecorded one cannot come apart.
Four event types reserved without emission: external action, data access, human escalation, reply delivered.
A hash chain per tenant, with a head row as the single source of sequence. Alter an old entry and every link after it stops matching; the verifier reports the exact sequence where it first breaks.
Signing still reserved, and with it the documented residual: a privileged attacker who recomputes the whole chain and rewrites the head is not detectable by recomputation alone.
An outbox written inside the caller’s own business transaction, and an append-only ledger where update and delete are revoked from the application’s database role. If the business fact commits, its audit record commits with it.
Chain columns created reserved and null. No real emitters yet.
One immutable row per LLM call, written synchronously before the response event is published. If the ledger insert fails, the invocation fails.
Cost deliberately not materialised — pricing will be a versioned table and a view. No query endpoint, no aggregations.
A compose profile that brings up the app and a local Ollama, pulls the model, creates a demo agent and sends the first tool-using message. The default model called the clock tool five times out of five.
The CI job only builds the image.
Keyset pagination over the time-ordered id, one uniform envelope across the list endpoints. A contract break from the bare arrays that came before.
The API-key listing stayed outside the contract and still returns a bare array.
The accepted response hands back an invocation id, and an endpoint reports its state in public vocabulary decoupled from the internal lifecycle.
Reaper-abandoned invocations and non-LLM setup failures leave no message in the conversation; their only visible signal is the invocation state.
Outbound delivery through a dispatch port in the domain, called once the agent’s last message is committed.
Explicitly best-effort: no outbox, no retries, no deduplication on delivery.
A channel SPI, a binding from a channel instance to an agent, and a Telegram inbound adapter whose ingestion is idempotent on the platform’s own update id.
The bot credential is stored in clear at rest — encryption deferred alongside per-tenant LLM credentials. Supported channels are still a hardcoded set.
The eight orchestration events become metrics on an authenticated actuator endpoint. The hooks laid two units earlier now have a consumer.
No exporter — no OpenTelemetry, no Prometheus, in any module.
An optional idempotency header: a repeat with the same key for the same agent returns the original ids and ingests nothing, held by an insert-first lock on a unique constraint.
No request-body fingerprinting and no retention purge.
A leaf module with a sealed contract of eight events, emitted at every step of the loop. Nothing consumes them yet — they exist so that auditing can attach later without reopening the orchestrator.
One event publishes inside the ingest transaction, so a persisting consumer will need an after-commit hook or an outbox.
The orchestrator offers tools, runs the ones the model asks for, feeds results back and invokes again, up to ten rounds. The model calls run without holding a database connection.
The reaper timeout became a flat twelve minutes instead of a heartbeat. Tool schemas don't count against the context window.
The same neutral tool model maps onto Anthropic’s content blocks and onto the OpenAI-compatible shape. The core never learned either format.
Tool definitions, calls and results as sealed types in the domain, an executable contract in a new module, and tool messages persisted with their payload. A clock tool ships built in, mostly to prove the contract end to end.
The tool registry is global — no per-agent scoping.
A durable register of consciously deferred work, kept in the file the tooling reads. Known gaps stop being folklore and start being a list.
One endpoint resolves or opens the conversation, appends the message and queues the work in a single transaction, race-safe under a partial unique index. The reply arrives asynchronously.
The accepted response dropped the invocation id, so a client couldn't ask what happened. Fixed in unit 22.
A single OpenAI-compatible adapter registered as three conditional providers, with a keyless local model as the development default. The second adapter dropped in without touching the interface — the only real test an abstraction gets.
Real key authentication on every route: which tenant you are comes from the validated key, never from a header. Keys are hashed with a pepper. ADR 0002 fixes that authority is the visibility relation the database already enforces.
No roles and no scopes. Still true today.
It now connects as a least-privilege role with row-level security live at runtime. The background worker’s cross-tenant claim goes through narrowly scoped functions, and ADR 0001 fixes those three as the only sanctioned ways out.
Not a pending item but a standing constraint: every new cross-tenant need requires a new function and a documented reason.
Tenants and agents over HTTP, with a global error contract and a request id carried through the logs and back in a header.
A development header stood in for the tenant, paired with an open route. Both were explicitly marked to go away, and did, in unit 10.
The key entity and the authentication filter land in the security pipeline with no endpoints behind them yet.
A queue on the database, context assembly bounded by the model’s window, a worker that claims rows without blocking its neighbours, backoff on retry, and a reaper for claims whose worker died. Everything since stands on this.
The claim and reap cross tenants and didn't yet work under a least-privilege role. Resolved in unit 9.
A neutral provider contract with a registry and a neutral invocation model, plus the first adapter behind it.
Streaming left outside the contract on purpose. One provider. No per-tenant credentials.
Conversations and messages under the same hierarchical isolation, time-ordered ids from one place in the domain, and explicit lifecycle transitions.
Escalation was written with no caller. It still has none — it is a reserved hook, and the log says so rather than implying the feature exists.
Operator, partner, client — with visibility enforced by row-level security where each entity’s rule calls its parent’s. Forgetting a filter cannot leak another tenant’s rows, because the database will not return them.
The provider field was a free string validated against a hardcoded set, waiting for the contract that arrived in unit 5.
The build, the local stack and continuous integration, with the shape already drawn and nothing inside it. Naming the empty modules early is what keeps the full ones from growing into each other later.
Readme, licence and project context. Source-available now, Apache 2.0 four years after each release. No code yet, and the file said so.
First commit: 18 May 2026.