Changelog

What has shipped, phase by phase, from the repository history.

The service is built in the phases of the specification's implementation sequence. Dates are commit dates. The whole service is still a preview.

Documentation site — 2026-10-05

This documentation site at /docs: guides for organizations and relying parties, and an API reference generated from the OpenAPI description.

OpenAPI 3.1 descriptions of the public and organization API (served at /v1/openapi.yaml) and of the internal reviewer and operator API, with a test that fails when routes and documentation drift apart.
CI: typecheck and tests, Go vet and tests, a scanner image build and an OpenAPI lint. A deploy script that applies and verifies database migrations before deploying, then runs smoke tests.
Certificate scanning switched on in production.

Issuer rotation with an explicit overlap inside the bundle: add, remove, renewal and emergency steps, a sticky overlap and a 24-hour production minimum for add steps; the remove step needs a different reviewer.
Withdrawal of published bindings with a committed result and the 330-second race bound.
The public change feed GET /v1/changes with cursors, 90-day retention and the 410 resync.
Binding expiry and renewal by rotation, a cap on unactivated versions, suspension and a 30-day resume window when a backing claim stops being verified.
Endpoint drift detection on active bindings.

A local demonstration with three SPIRE servers (1.15.3), a Go relying party and bank agent authenticating each other over mTLS through the directory, and the specification's acceptance cases, including the withdrawal bound.
A DEMO_MODE hook that can run only in local development and tests.

Issuer registration (POST /v1/issuer-bindings) with strict SPIFFE bundle validation: single-certificate x5c per authority, public members only.
The issuer-control ceremony: federation endpoint proof, challenge SVIDs for CA proof of possession, and signed statements for JWT keys; endpoint quarantine.
Two-person activation of production issuers.
Delegation of subdomains to other organizations, with acceptance, review, cascade and delegated resolution.
Console: issuer registration wizard, binding and ceremony page, and delegations.

Sign-in with GitHub and Google, passkeys, sessions, CSRF protection, step-up and service tokens.
Organizations, memberships, invitations and idempotency keys.
Domain claims with the DNS TXT challenge checked through two DNS-over-HTTPS resolvers, the 90-day recheck, appeals and withdrawal.
Evidence submission with one-time streamed uploads to private storage.
The internal reviewer Worker behind Cloudflare Access, with decisions, independent contacts and audited downloads.
The organization console.

An isolated Go DNS and TLS observation service running as a Cloudflare Container, with egress controls.
Versioned DV, OV and EV classification of observed certificates against a pinned trust store.
Observation storage, deduplication and retention, and the public display of the latest TLS observation.

The directory assertion model, a prototype ES256 signer Worker, GET /v1/resolve and /.well-known/jwks.json.
The immutable approved-bundle endpoint.
The reference verifier and the art-verify command-line tool.

The monorepo, hostname canonicalization with a pinned Public Suffix List, scope matching and the claim and binding state machines.
The database schema with an atomic commit helper.
Public domain search and domain records, and an idempotent import of the Tranco seed list with provenance and exact counts.
The public site: search, domain records and How it works. The svid.io domain.