# Oversight CHANGELOG

## v0.4.12 - 2026-06-17 Security hardening, cross-language parity, JCS canonicalization, and the post-quantum KEM mirror

- **Minimum supported Rust version raised to 1.85.** The post-quantum KEM

  mirror depends on RustCrypto's `ml-kem` crate, which requires Rust 1.85

  (edition 2024). The workspace `rust-version` is bumped from 1.75 to 1.85

  to declare this accurately; the workspace itself stays on edition 2021.

  Consumers building from source need a 1.85+ toolchain.

- **Post-quantum KEM mirror (OSGT-HYBRID-v1), Phase A.** The Rust crypto

  crate now implements the ML-KEM-768 half of the hybrid DEK wrap,

  byte-identical to the Python reference. New functions

  `oversight_crypto::hybrid_wrap_dek`, `hybrid_unwrap_dek`, and

  `mlkem768_generate_keypair` reproduce the Python construction exactly:

  IKM is `ss_x || ss_pq || x25519_ephemeral_pub || mlkem_ciphertext`,

  HKDF-SHA256 with a zero salt and `info=b"oversight-hybrid-v1-dek-wrap"`,

  then XChaCha20-Poly1305 with `aad=b"oversight-hybrid-dek"`. The envelope

  JSON shape (`suite`, `x25519_ephemeral_pub`, `mlkem_ciphertext`, `nonce`,

  `wrapped_dek`, all hex) matches `oversight_core.crypto.hybrid_wrap_dek`,

  so a Python-wrapped envelope opens in Rust and vice versa. The primitive

  is RustCrypto's pure-Rust `ml-kem` crate (FIPS 203, no C build, chosen

  over liboqs because the build environment lacks cmake and the pure-Rust

  crate satisfies the same NIST-primitives-via-RustCrypto/liboqs rule). Rust keeps its

  decapsulation keys in the recommended 64-byte seed form; only the

  1184-byte public key ever crosses the language boundary, so no deprecated

  expanded-key import is needed. Six Rust unit tests mirror

  `tests/test_pq.py` (round trip, JSON shape, tamper-classical,

  tamper-PQ, wrong recipient, overhead bound), and a new cross-language

  conformance vector (`tests/conformance_hybrid_kem.py`) proves both

  directions (PY wrap to RS unwrap, RS wrap to PY unwrap) against a live

  liboqs, wired into `conformance_cross_lang.sh` as step 5. Scope: KEM

  only. The container HYBRID seal/open dispatch and ML-DSA manifest

  signing are deferred (Phase B and Phase C respectively); per the owner's

  decision, Phase C will use dual Ed25519 AND ML-DSA-65 signatures.

- **Suppress liboqs-python import-time stdout.** `liboqs-python` attaches a

  `StreamHandler(sys.stdout)` at INFO and logs a line when imported, which

  contaminated stdout for any caller importing `oversight_core.crypto` and

  broke byte-identity conformance capture. `oversight_core/crypto.py` now

  redirects stdout during the `import oqs` so the message is dropped.

  Behavior of the PQ primitives is unchanged.

- **Rust `open_sealed` now enforces the `jurisdiction` policy.** The

  `oversight-policy::check_policy` function already implemented

  jurisdiction matching (and had passing unit tests), but the container

  open path never called it: `open_sealed` and `open_sealed_with_provider`

  inlined only the `not_after` / `not_before` time checks and skipped

  jurisdiction entirely, so the policy crate's enforcement was dead code

  on the real open path. Python enforces at `container.py:226`

  (`check_policy` before decryption); Rust now mirrors that single

  chokepoint. Both Rust open functions now call

  `oversight_policy::check_policy(&manifest, policy_ctx)` after issuer

  trust and before DEK unwrap, which also retires the duplicated inline

  time checks onto the tested canonical path. Observable change: time

  violations now surface as `ContainerError::Policy` (typed, matching

  Python's `PolicyViolation`) rather than `ContainerError::Precondition`.

  Four new container-level tests pin the behavior (mismatch rejected,

  match allowed, GLOBAL allowed, no-context skip), and the existing

  `expired_file_rejected` assertion is updated to the typed error.

  Backward compatibility: GLOBAL manifests (the default) and opens with

  no `PolicyContext` (the raw-open path used by the cross-language

  conformance harness) are unaffected. Scope honesty: this closes the

  open-time gap the review flagged. It does NOT implement the

  registry-time MUST in SPEC.md §8.4 (`policy.jurisdiction` mismatch

  causing `/register` rejection), which is unimplemented in BOTH

  languages and tracked separately. A `--jurisdiction` CLI flag for an

  opener asserting a non-default region is a deferred follow-up, not

  required for the gap closure (the CLI's default `GLOBAL` context

  already rejects a manifest requiring a specific jurisdiction).

- **Constant-time token comparison via `subtle::ConstantTimeEq`.** The

  Oversight Rust registry's operator-token and DNS-secret comparison was

  a hand-rolled loop in `oversight-registry/src/auth.rs` with an early

  return on length mismatch, which trivially leaked whether an attacker's

  guessed length was correct in O(1). Replaced with

  `subtle::ConstantTimeEq` (audited RustCrypto crate, already a transitive

  dependency via `ed25519-dalek` and `chacha20poly1305`, now declared

  explicitly). Four new registry unit tests pin the correctness matrix

  (equal inputs across lengths, same-length different content,

  mismatched-length no-early-return, single-bit difference). The

  hand-rolled early-return leak is closed; the residual

  max(supplied, expected) timing observation from `subtle`'s slice impl

  is documented in the function-level rationale and is acceptable for

  Oversight's high-entropy operator tokens.

- **Canonicalization unified on RFC 8785 JCS.** The Python reference now

  canonicalizes via a vendored `oversight_core.jcs.jcs_dumps` that is

  byte-exact with the Rust reference's `serde_jcs::to_vec`. Previously

  Python used `json.dumps(sort_keys=True, separators=(",",":"))` with the

  default `ensure_ascii=True`, which diverged from Rust for any non-ASCII

  string value (Python escaped non-ASCII as `\uXXXX`; Rust emitted raw

  UTF-8). The divergence was latent because every committed test fixture

  and the conformance harness used ASCII-only content, but any production

  manifest with a non-ASCII recipient_id, issuer_id, or filename would

  have signed to different bytes across the two implementations and

  failed cross-language verification. The port covers manifest signing,

  manifest wire form, transparency-log leaf payloads, transparency-log

  signed heads, sealed-container wrapped_dek, DSSE statement payloads,

  DSSE envelope serialization, registry manifest verification, registry

  sidecar comparison, and registry evidence-bundle signing. Standalone

  tooling (sample generators, live demo, canary keeper) uses the

  `sort_keys=True, ensure_ascii=False` form, which is byte-identical to

  JCS for the no-floats subset these tools emit. `conformance_cross_lang.sh`

  gains a non-ASCII `recipient_id` round trip that exercises the

  divergence end-to-end and would fail under any non-JCS serialization.

  Backward compatibility: for ASCII-only content (every committed fixture

  and every existing test vector), the new JCS bytes are identical to the

  old sort_keys bytes, so existing signatures continue to verify.

### Earlier batches in v0.4.12 (pre-JCS, kept for review provenance)

- **Live registry deployment config.** `docker-compose.yml` now has a `live`

  Caddy profile with public TLS routing for the registry, beacon, OCSP-style,

  and license-style hostnames. `Caddyfile` covers the full registry v1

  read/evidence/tlog surface plus beacon routes, with all hostnames coming

  from environment variables. `.env.example` documents public-safe defaults

  and leaves secrets blank.

- **Registry operator token.** The Python reference registry can now require

  `OVERSIGHT_OPERATOR_TOKEN` for `POST /register` and `POST /attribute`.

  The token is optional so local development and unauthenticated conformance

  runs keep working, but production operators can protect write-side APIs

  without changing route shapes. The conformance harness sends the token as

  a bearer header when `OVERSIGHT_OPERATOR_TOKEN` is set.

- **Rust registry operator-token parity.** The Axum + SQLx registry now reads

  `OVERSIGHT_OPERATOR_TOKEN` too and enforces it on `POST /register` and

  `POST /attribute` with the same bearer/header contract as the Python

  registry. Its DNS event route also accepts either `Authorization: Bearer`

  or `X-Oversight-DNS-Secret`, matching the live deployment guide.

- **Rust registry migration tooling.** `oversight-registry` now supports

  `--migrate-from <python-registry.sqlite>` plus `--migrate-dry-run`. It

  copies the Python reference registry's manifests, beacons, watermarks,

  events, and corpus rows into the Rust SQLite schema while preserving event

  IDs, corpus metadata, and registry evidence relationships.

- **Rust registry integrity validation.** `oversight-registry --validate-db`

  now checks migrated Rust registry databases for orphaned attribution rows,

  identity mismatches, malformed manifest JSON, invalid manifest signatures,

  and manifest/file ID divergence before operators declare migration burn-in

  complete. It also validates event/corpus JSON sidecars and tlog index

  uniqueness so corrupted migrated evidence cannot look clean. Rust registry

  writes now fail closed if the local transparency log cannot append, and

  validation checks missing or out-of-range event tlog indexes against the

  on-disk tlog size. Validation also compares event rows to the corresponding

  tlog leaf payload so an index cannot point at unrelated evidence and still

  pass burn-in checks. Local tlog recovery now rejects malformed records,

  non-contiguous indexes, and leaf-hash mismatches instead of silently

  ignoring corrupted lines during startup or validation. `/tlog/range` now

  reads through the same validated tlog API, so malformed or hash-mismatched

  records fail the range request instead of being silently omitted from

  monitor responses. The Python reference tlog now matches that behavior:

  startup and `/tlog/range` fail closed on corrupt leaf records, and new

  leaves carry `leaf_data_hex` so exact leaf bytes survive recovery.

- **Registry v1 error envelope parity.** Python and Rust registry errors now

  return the spec envelope `{error: {code, message}}` for registry failures

  instead of the framework-native string-only shapes. The conformance harness

  now checks `/tlog/range` response shape plus representative

  `signature_invalid`, `sidecar_mismatch`, `missing_field`, and `not_found`

  error envelopes, raising the live/in-process harness to 38 checks.

- **Registry v1 candidate stability note.** Added

  `docs/REGISTRY_V1_STABILITY.md`, which names the candidate-frozen route

  surface, JSON field families, error envelope, conformance gate, breaking

  change rules, and remaining v1.0 burn-in gates for independent registry

  operators.

- **GitHub Actions runtime hygiene.** Main CI workflows opt into the GitHub

  Actions Node 24 runtime before the hosted runner default changes.

- **Rust policy test parity.** Fixed the `oversight-policy` crate's manifest

  fixture after the v0.4.11 `Recipient.p256_pub` schema addition so the full

  Rust workspace test suite compiles again.

- **Deployment docs.** Added `docs/REGISTRY_DEPLOYMENT.md` covering the live

  Compose/Caddy flow, route map, token headers, DNS bridge secret, and local

  versus live conformance commands.

- **Public description refresh.** Updated README/roadmap/embedding copy to

  describe v0.4.11 as the current stable line and the post-tag Rust registry

  deployment and migration work on `main`.

- **Code comment style.** Added `CONTRIBUTING.md` guidance to prefer

  self-explanatory code and tests over prose-style inline comments, then

  removed noisy implementation comments from the Rust registry path.

- **Source comment guard.** Added `scripts/check_source_comments.py`, a pytest

  wrapper, and a `source-style` GitHub Actions workflow so strict comment-light

  paths fail CI if prose comments are reintroduced.

- **Rust PDF extraction parity.** `oversight-formats` now uses lopdf page text

  extraction plus parsed content-stream operations for PDF fingerprint text

  instead of raw literal scanning. The fallback handles `Tj`, `TJ`, quote

  operators, and array spacing, with new Rust tests covering page-level PDF

  text extraction.

- **Rust image DCT parity.** `oversight-formats` now ports the Python image

  adapter's DCT mid-band spread-spectrum watermarking path using `rustdct`.

  Image watermarking writes the DCT mark and then preserves blind LSB recovery,

  with tests for the Python-compatible mark sequence, DCT verification, and

  adapter round trip.

- **Outlook add-in hosted pilot page.** `integrations/outlook/index.html`

  documents the hosted manifest URL, task pane URL, requested `ReadItem`

  permission, same-origin viewer reuse, sideload steps, and remaining tenant

  load-test gates for the Outlook read-mode inspector.

## v0.4.11 - 2026-05-08 Hardware-keys completion: Python parity, browser support, end-to-end seal

The `OSGT-HW-P256-v1` suite is now implemented end-to-end across all

three reference implementations: Rust core, Python core, and the

public browser inspector. Every layer of the protocol ships every

suite. The only piece deferred to a follow-up is the `PivKeyProvider`

(PKCS#11 binding to actual hardware tokens) and the matching

`--recipient-hw` CLI flag.

- **`oversight_core.crypto`: Python parity for `OSGT-HW-P256-v1`

  (2026-05-08).** New `wrap_dek_for_recipient_p256` and `unwrap_dek_p256`

  mirror the Rust reference byte-for-byte: same HKDF info string

  (`"oversight-hw-p256-v1-dek-wrap"`), same AEAD AAD

  (`"oversight-hw-p256-dek"`), same SEC1 uncompressed (65 byte) wire

  format for the ephemeral public key, same wrapped envelope JSON shape

  including the explicit `"suite"` field. `unwrap_dek_p256` accepts

  either an `EllipticCurvePrivateKey`, a PKCS#8-encoded private key, or

  a raw integer scalar so a future PIV / PKCS#11 binding has a portable

  on-ramp. `oversight_core.container` now recognizes `suite_id = 3` and

  maps it to `OSGT-HW-P256-v1` in `SUITE_ID_TO_NAME`. New

  `tests/test_hw_p256.py` (10 tests) covers the round trip across all

  three private-key input forms, the on-wire envelope shape against

  `SPEC.md` § 5.2, and the negative paths (wrong recipient, wrong

  ephemeral key length, missing fields, AAD binding so a classic

  envelope's bytes do not silently decrypt through the hardware path).

- **`oversight-container`: end-to-end seal/open for `OSGT-HW-P256-v1`

  (2026-05-07).** New `seal_hw_p256` mirrors `seal` but consumes a P-256

  SEC1 uncompressed recipient public key and writes a container with

  `suite_id = 3`. New `open_sealed_with_provider` is the polymorphic

  open path: dispatches on the container's `suite_id` and delegates the

  recipient-side ECDH to a `KeyProvider`. Today it supports classic (with

  `FileKeyProvider`) and HW P-256 (with `SoftwareP256KeyProvider` or any

  future `PivKeyProvider`); a hybrid-aware provider extension lands later.

  Cross-suite mismatches (e.g. an X25519 provider on a HW P-256 container)

  are refused explicitly. `oversight-manifest::Recipient` gains an

  optional `p256_pub: Option<String>` field, gated by `serde(default,

  skip_serializing_if = "Option::is_none")` so existing JSON manifests

  parse unchanged. Five new round-trip / negative tests; `oversight-

  container` now 17/17, workspace builds clean.

## v0.4.10 - 2026-05-07 Hardware-keys foundation: KeyProvider trait + OSGT-HW-P256-v1

This release lands the abstraction and pure-Rust reference path that the

upcoming `PivKeyProvider` (PKCS#11 against YubiKey / Nitrokey / OnlyKey)

plugs into. Public API is purely additive; all existing v0.4.9 callers

keep working unchanged.

- **`oversight-container`: `OSGT-HW-P256-v1` recognized by the binary

  container (2026-05-07).** Added `SUITE_HW_P256_V1_ID = 3` and extended

  `suite_id_for_manifest` to map the new manifest suite. This is the bridge

  that lets a future `seal_hw_p256` ride the existing container layout

  without reinventing it. New unit test covers the full mapping and asserts

  unknown suites still return `None`. 12/12 container tests; workspace

  build clean.

- **`oversight-crypto`: `OSGT-HW-P256-v1` suite implementation (2026-05-07).**

  P-256 ECDH wrap/unwrap landed alongside the X25519 path so hardware-backed

  recipients (YubiKey / Nitrokey / OnlyKey via PIV) have a complete pure-Rust

  reference to plug into. `wrap_dek_for_recipient_p256` accepts SEC1

  uncompressed (65 byte) recipient public keys and produces `WrappedDekP256`.

  `SoftwareP256KeyProvider` is the in-memory `KeyProvider` impl that

  `PivKeyProvider` will mirror against PKCS#11 next. Cross-suite envelopes

  are rejected explicitly: an X25519 provider passed to a P-256 envelope

  errors out instead of producing garbage. Eight new unit tests covering

  round trips, wrong-recipient rejection, cross-suite rejection, JSON

  envelope round-trip, and a regression check that the classic path still

  works. `SUITE_HW_P256_V1` constant exported. Adds `p256` (RustCrypto) to

  workspace deps with `ecdh` + `arithmetic` features. `oversight-crypto`

  passes 21/21; workspace build clean.

- **`oversight-crypto`: `KeyProvider` trait + `FileKeyProvider` (2026-05-07).**

  The recipient-side ECDH path is now abstracted behind `pub trait KeyProvider`,

  with `FileKeyProvider` shipping as the X25519 file-backed default. New

  `unwrap_dek_with_provider` is byte-identical to `unwrap_dek` for file-backed

  keys (asserted by tests) and is the entry point hardware-backed providers

  (PIV / PKCS#11) will plug into next, per `docs/HARDWARE_KEYS.md`. Public API

  is purely additive: existing `unwrap_dek(wrapped, priv_bytes)` callers are

  unchanged. `KeyAlgorithm::P256` reserved for the upcoming `OSGT-HW-P256-v1`

  suite. Six new unit tests; workspace build clean; `oversight-crypto` passes

  13/13.

## v0.4.9 - 2026-05-07 Hybrid browser decrypt, Rust registry v1, Outlook scaffold

The browser inspector now decrypts post-quantum sealed files end-to-end,

the Rust registry passes the v1 conformance harness 33/33, and a thin

Outlook task-pane scaffold lets us start a tenant pilot. Format watermark

regressions in `oversight-rust/oversight-formats` are also resolved.

- **Outlook add-in scaffold landed (2026-05-07).** New `integrations/outlook/`

  with the Office add-in 1.1 manifest (`MailApp`, read-mode task pane,

  `ReadItem` only), task-pane HTML, and JS that imports the public viewer's

  `parseSealed`, `verifyManifestSignature`, and `decryptSealed` directly

  from `oversightprotocol.dev/viewer/...` rather than reimplementing crypto.

  Decrypts both classic and hybrid suites. Architecture decision recorded in

  `docs/OUTLOOK.md`. Status: scaffold; not yet load-tested in an Outlook

  tenant. Icons (64/128 px) still pending.

- **Browser inspector: hybrid (post-quantum) decrypt shipped (2026-05-03).**

  The viewer at `oversight-protocol.github.io/oversight/viewer/` now decrypts

  `OSGT-HYBRID-v1` sealed files end-to-end, in addition to the

  `OSGT-CLASSIC-v1` path that shipped earlier. Implementation reuses

  WebCrypto X25519 + HKDF-SHA256 and the existing vendored `@noble/ciphers`

  XChaCha20-Poly1305, plus a newly vendored `@noble/post-quantum` ML-KEM-768

  for the post-quantum half of the KEM. KEK is bound X-wing-style over both

  shared secrets and both ephemeral inputs (`ss_x || ss_pq || eph_pub ||

  mlkem_ct`), matching `oversight_core.crypto.hybrid_wrap_dek`. New files

  on the site: `viewer/vendor/noble-post-quantum-ml-kem-0.6.1.js` (+ three

  vendored transitive deps from `@noble/hashes` and `@noble/curves`),

  `viewer/samples/tutorial-hybrid.sealed`, and

  `viewer/samples/tutorial-hybrid-identity.json`. New "Load hybrid tutorial

  identity" button surfaces the test fixture. New tooling:

  `tools/gen_hybrid_sample.py` (self-contained sample generator that mirrors

  the production hybrid wrap construction, runs anywhere `oqs` and

  `cryptography` are available), and `tools/test_hybrid_decrypt_node.mjs`

  (Node-based end-to-end smoke test against Node's WebCrypto).

- `oversight-rust/oversight-registry`: added the missing registry v1

  read-only and beacon surface (`/.well-known/oversight-registry`,

  `/evidence/{file_id}`, `/tlog/head|proof|range`, `/p/{token_id}.png`,

  `/r/{token_id}`, `/v/{token_id}`, `/candidates/semantic`) and tightened

  CORS to the public browser-inspector origins with GET/OPTIONS only. The

  Axum server now passes the existing 33-check

  `tests/test_registry_conformance.py` harness in live-URL mode.

- `oversight-rust/oversight-manifest`: added `canonical_content_hash` and

  `l3_policy` to the signed manifest model so Rust verifies Python-signed

  v0.4.5+ manifests without dropping signed fields before canonicalization,

  while retaining a fallback verification path for older manifests that lack

  those default fields.

- `oversight-rust/oversight-formats`: fixed Rust text/image watermark

  regressions that were failing the workspace test suite. Text embedding now

  keeps L2 trailing-whitespace marks at physical line endings after L1

  zero-width insertion, and image LSB embedding avoids duplicate pixel slots

  that could overwrite earlier payload bits.

## v0.4.8 - 2026-04-29 Mobile-build portability and rustls-webpki security bump

Patch release covering two upstream-driven fixes that landed on `main`

since v0.4.7. No new features and no breaking changes.

- `oversight-rust/oversight-container`: gate the 4 GiB

  `MAX_CIPHERTEXT_BYTES` literal to 64-bit targets and fall back to

  `usize::MAX` on 32-bit. Required to cross-compile the Rust core for

  Android `armv7-linux-androideabi` and `i686-linux-android`, which the

  mobile companion (`oversight-protocol/oversight-mobile`, Flutter +

  Rust via `flutter_rust_bridge`) embeds unchanged. Behavior is preserved

  for any realistic bundle on 32-bit; `usize::MAX` is just under 4 GiB

  on those targets. (PR #4, merged 2026-04-26.)

- `oversight-rust` Cargo.lock: bumped `rustls-webpki` from 0.103.12 to

  0.103.13. Patches a reachable panic in CRL parsing

  (GHSA-82j2-j2ch-gfr8) and an inverted-meaning URI excluded-subtree

  check (rustls/webpki#471). In scope because the Rust registry and

  Rekor clients use rustls for TLS. (Dependabot PR #3, merged 2026-04-29.)

## v0.4.7 - 2026-04-22 Registry federation hardening and conformance harness

Federation stops being aspirational when a second operator can prove

compatibility. v0.4.7 hardens the registry v1 interop spec against the

reference implementation and ships a conformance harness that any

operator can point at their deployment.

- `docs/spec/registry-v1.md`: expanded with the canonicalization algorithm

  (`json.dumps(sort_keys=True, separators=(",", ":"))` over UTF-8), the

  uniform error envelope and `code` vocabulary, a full endpoint table

  including the normative beacon paths (`/p/{token_id}.png`, `/r/{token_id}`,

  `/v/{token_id}`), the `/.well-known/oversight-registry` shape, the

  `/evidence/{file_id}` bundle fields, and the `/tlog/head|proof|range`

  endpoints federated verifiers rely on. Removed a phantom

  `/query/{file_id}` endpoint that was in the draft but never shipped.

- `tests/test_registry_conformance.py`: 32-check harness with two modes.

  In-process against a FastAPI `TestClient` for CI, or against a live URL

  when `OVERSIGHT_REGISTRY_URL` is set. Covers identity, liveness, a full

  signed-manifest registration round trip, attribution by token id,

  evidence bundle shape, transparency-log head, every beacon endpoint,

  and DNS event authentication.

- `docs/ROADMAP.md`: the registry federation item references the harness

  as the acceptance gate for federation.

- Version bumped to `0.4.7`. No breaking changes.

## v0.4.6 - 2026-04-22 SIEM export: Splunk, Sentinel, and Elastic

Registry beacon events can now be emitted in three SIEM-native formats so

security teams get Oversight data into the incident pipeline they already

run. Formatters are pure; transport is a thin sink layer.

- `oversight_core/siem.py`: new module. Normalized `OversightEvent` model

  built from the registry `events` table, pure formatters for Splunk HEC,

  Elastic Common Schema 8.x, and Microsoft Sentinel (Log Analytics custom

  logs), plus `sentinel_authorization()` helper that signs the Data

  Collector API `Authorization` header per Microsoft's recipe.

- `cli/oversight.py`: new `oversight siem export` subcommand. Streams

  events as JSON lines to stdout, a file, or an HTTPS collector. Supports

  `--since`, `--limit`, repeatable `--header`, and Splunk source/sourcetype/

  index overrides. Opens the registry database read-only so it is safe

  to run against a live service.

- `docs/SIEM.md`: operator integration guide covering each of the three

  SIEMs, the event field dictionary, the Sentinel HMAC signing window,

  and the honest beacon-absence caveat. Also surfaced from the website

  docs index.

- `tests/test_siem_unit.py`: 11 focused unit tests covering envelope

  shape per format, empty-field suppression, SQLite row mapping,

  read-only iteration, Sentinel HMAC stability, and action-name

  coverage for every beacon kind.

- `oversight_core/__init__.py` and `pyproject.toml`: version bumped to

  `0.4.6`. No breaking changes; SIEM is additive.

## v0.4.5 - 2026-04-20 L3 safety, GUI, and registry federation docs

Review-driven hardening from the local security review report.

- `oversight_core/l3_policy.py`: new L3 safety policy engine. L3 defaults off

  for legal, regulatory, technical/spec, source-code, SQL, log, and structured

  data classes; explicit `full`, `boilerplate`, and `off` modes are supported.

- `cli/oversight.py` and `cli/oversight_rich.py`: seal-time L3 disclosure now

  requires acknowledgement when L3 is enabled, and seal manifests record the

  applied L3 policy.

- `oversight_core/manifest.py`: manifests now carry `canonical_content_hash`

  so auditors can diff recipient copies against the original source bytes.

- `oversight_core/watermark.py` and `oversight_core/formats/text.py`: high-level

  L3 application is opt-in; L1/L2 remain available by default.

- `cli/gui.py`: added a Tkinter desktop GUI for key generation, sealing, and

  opening files (`oversight gui`) so non-technical users have a starter path.

- GUI and CLI output writes now fail closed against private-key overwrites,

  same-path writes, reserved Windows device names, malformed key files, and

  non-UTF-8 watermark attempts. Private-key writes use atomic replacement and

  restrictive permissions/ACL hardening where supported.

- `.sealed` parsing now rejects tampered suite IDs, malformed manifest/wrapped-DEK

  JSON, unknown manifest fields, and trailing bytes after ciphertext.

- `oversight-rust/oversight-container`: Rust now mirrors the Python parser's

  strictness by rejecting suite-byte tamper and trailing bytes after the

  authenticated ciphertext region.

- `docs/security.md`: documented L3 collusion/canonicalization limits, layer

  survival properties, passive beacon limits, jurisdiction-by-IP limits, and

  RFC 3161 timestamp semantics.

- `docs/spec/registry-v1.md`: added a registry federation/interoperability

  draft for independent compatible registry operators.

- `docs/ROADMAP.md`: corrected launch sequencing, dropped near-term FedRAMP,

  scoped ecosystem plugins to Outlook-first, and prioritized SIEM integration

  before SOC 2 / ISO 27001 work.

- Raised vulnerable dependency floors flagged by Dependabot/PyPI advisory

  checks: setuptools, cryptography, PyNaCl, pydantic, python-multipart,

  Pillow, and pypdf now require patched minimums; Rust manifest floors

  now pin patched minima for sqlx, tokio, rand_core, zip, chrono, regex,

  once_cell, and tracing-subscriber.

- Added focused regression coverage in `tests/test_l3_policy_unit.py`.

## v0.4.4 - 2026-04-20 security hardening

Security patch line started from the `v0.4.3` Python package baseline

(`0b1a4ab`) and incorporates the Codex review fixes made on 2026-04-20.

This is the current `main` download line. Historical `v0.5.0` Rekor/Rust

work remains in git history and the Rust workspace, but the Python package

metadata now intentionally advances from `0.4.3` to `0.4.4` so users do not

confuse the hardened tree with the vulnerable `v0.4.3` baseline.

- `oversight_core/container.py`: `max_opens` now increments only after a

  successful decrypt, and unsafe `seal_multi()` is disabled until the

  manifest format can honestly represent multiple recipients.

- `oversight_core/policy.py`: `LOCAL_ONLY` counter locking now works on

  Windows, and `REGISTRY` / `HYBRID` fail closed instead of silently using

  local state.

- `oversight_core/rekor.py`: offline verification now rejects DSSE envelopes

  whose subject digest does not match the expected content hash.

- `registry/server.py`: Rekor attestations now use real watermark mark IDs

  and the manifest's actual `content_hash`, and `/register` now rejects

  unsigned beacon / watermark sidecars that do not match the signed manifest.

- `oversight_core/formats/text.py`: text adapter now applies L3 before L2/L1,

  matching the core watermark pipeline.

- `oversight_core/tlog.py`: empty-tree roots now use the RFC 6962 Merkle

  hash (`SHA-256("")`) instead of an all-zero placeholder.

- `oversight_core/__init__.py`, `pyproject.toml`, and the Rich CLI banner:

  version metadata is now `0.4.4`, marking this post-`0.4.3` hardening train.

- `oversight_dns/server.py` and `registry/server.py`: DNS beacon callbacks now

  support a shared `OVERSIGHT_DNS_EVENT_SECRET`, and non-loopback callbacks

  fail closed when no secret is configured.

- `registry/server.py`: evidence bundles now include local transparency-log

  inclusion proofs for recorded events, not just the signed tree head.

- `oversight-rust`: removed the direct `rand` dependency in favor of

  `rand_core::OsRng`, clearing the low-severity `rand` advisory path.

- `oversight-rust/oversight-registry`: `/dns_event` now requires

  `OVERSIGHT_DNS_EVENT_SECRET` for non-loopback callbacks, signed

  beacon/watermark artifacts fail registration when malformed instead of being

  silently dropped, and Rekor attestation skips watermarkless registrations

  rather than logging `mark:<file_id>`.

- `oversight-rust/oversight-container` and `oversight-rust/oversight-policy`:

  Rust opens can now enforce `max_opens` after successful recipient decrypt,

  `REGISTRY` / `HYBRID` modes fail closed instead of falling back to local

  counters, and Rust `seal_multi()` fails closed until recipient-honest

  manifests exist.

- `oversight-rust/oversight-rekor`: offline verification now mirrors Python by

  rejecting DSSE envelopes whose subject digest does not match the expected

  content hash.

- `oversight-rust/oversight-formats`: DOCX metadata insertion no longer reports

  success when `<cp:keywords>` is missing, and PDF processing rejects indirect

  Launch / JavaScript / unsafe URI actions before rewriting files.

- Added focused regression coverage in `tests/test_policy_unit.py`,

  `tests/test_registry_unit.py`, `tests/test_rekor_unit.py`,

  `tests/test_text_format_unit.py`, and `tests/test_tlog_unit.py`.

Patch sequence on top of `v0.4.3`:

1. `0.4.3` / `0b1a4ab`: Rich CLI, anti-stripping defenses, and L3

   integration baseline.

2. `0.4.4` / `dab6157`: policy and Rekor verification hardening.

3. `0.4.4` / `4d60e3b`: registry Rekor mark indexing fix.

4. `0.4.4` / `20a566b`: multi-recipient sealing fails closed until the

   manifest can represent multiple recipients honestly.

5. `0.4.4` / `482f294`: default beacon/registry domain updated from

   `oversight.example` to `oversightprotocol.dev`.

6. `0.4.4` / `7712f98`: signed registry sidecars enforced and RFC 6962

   empty tlog roots fixed.

7. `0.4.4` / `0a7a2da`: package, core, and CLI version metadata

   aligned to the hardened `0.4.4` line.

8. `0.4.4` / `69e50aa`: public changelog patch chronology documented.

9. `0.4.4` / `26db8d3`: DNS evidence hardening, Rust RNG dependency

   cleanup, and evidence-bundle inclusion proofs.

10. `0.5.0+` / `b9bee41`: Claude-added Rust format adapters, Axum registry,

    and USENIX benchmark scaffolding.

11. `0.5.0+` / current hardening commit: Codex audit fixes for the new Rust

    registry/container/policy/Rekor/format-adapter security regressions.

## v0.5.0 - 2026-04-19

First release with public-Rekor attestations. Now hosted at

https://github.com/oversight-protocol/oversight (so the v0.5 predicate URI

resolves for any third-party verifier).

### Session B (registry wiring + e2e + backcompat)

- `registry/server.py`: `/register` now opt-in attests each registration into

  a public Rekor v2 log. Off by default; opt in with

  `OVERSIGHT_REKOR_ENABLED=1`. Failures non-fatal - local SQLite tlog stays

  authoritative for "list marks for issuer X" queries.

- `oversight_core/rekor.py upload_dsse`: fixed three wire-shape bugs against

  current rekor-tiles proto (`verifier`→`verifiers` array, `keyDetails` as

  sibling of `publicKey`, `raw_bytes` carries DER not PEM). Verified live

  against `log2025-1.rekor.sigstore.dev` - got real `log_index` returned.

- `tests/test_rekor_e2e.py`: 2 live tests, gated behind

  `OVERSIGHT_REKOR_E2E=1` so default runs do not append entries to the

  public log.

- `tests/test_rekor_backcompat.py`: 5 offline checks of v0.4 contract

  preservation.

### Session C (Rust crate + cross-language conformance + version bump)

- New crate `oversight-rust/oversight-rekor`: bit-identical port of

  `oversight_core.rekor`. 9 inline tests cover PAE byte-exactness,

  sign/verify round trip, tamper + wrong-key rejection, statement shape,

  canonical envelope JSON, and offline TLE inclusion check.

- New conformance suite `oversight-rust/tests/conformance_rekor.sh`: proves

  Python ↔ Rust bit-identity in 4 ways - PAE bytes, Python-signs/Rust-verifies,

  Rust-signs/Python-verifies, canonical payload bytes for the same statement.

- Version bumped to 0.5.0 across `oversight-rust/Cargo.toml`, `README.md`,

  `docs/SPEC.md`.

Hard constraints respected: no new crypto primitives (RustCrypto +

`cryptography`'s Ed25519 only), test count additions-only, Python ↔ Rust

bit-identity proven by conformance script.

## Unreleased - v0.5 Session A (2026-04-19)

- Added `docs/V05_REKOR_PLAN.md`: full Rekor v2 migration plan, verified

  against current upstream API (Rekor v2 GA 2025-10-10, DSSE + hashedrekord

  only, tile-backed reads, no online proof API, public log shard rotates

  ~6 months).

- Added `oversight_core/rekor.py` (~280 LOC): DSSE statement construction,

  PAE-exact signing/verification against the spec, Rekor v2 `/api/v2/log/entries`

  upload helper, offline inclusion-check helper, and `build_bundle()` shaper.

- Added `docs/predicates/registration-v1.md`: the URI the predicate type

  resolves to, with privacy contract and field schema.

- Added `tests/test_rekor_unit.py` with 10 offline unit tests covering DSSE

  PAE, sign/verify, tamper rejection, wrong-key rejection, statement shape,

  canonical envelope JSON, offline bundle verification, the recipient-pubkey

  privacy guarantee, predicate-version int, and 5-year-replay bundle fields.

- Six desktop-review fixes baked into Session A before commit:

  - Recipient X25519 pubkey now SHA-256 hashed before going on-log

    (deanonymization fix).

  - Predicate URI pinned to git-tagged GitHub path, not `oversight.dev`.

  - Bundle gained `bundle_schema: 2` integer + `log_pubkey_pem` +

    `checkpoint` + `log_entry_schema` + optional `rfc3161_chain`.

- Conformance script `oversight-rust/tests/conformance_cross_lang.sh` now

  derives REPO_ROOT from its own location instead of `/home/claude` hardcode.

- `HANDOFF.md` gained explicit "what NOT to accept from a future Claude

  session" section per the v0.4.1 retro.

Test count: 76 → 86 (additions only, baseline conformance still green).

## v0.4.1 - 2026-04-18

Cosmetic polish only, no functionality changes.

### Fixed

- Removed unused `std::path::Path` import from `oversight-policy` - clean

  `cargo build --workspace --release` with zero warnings.

- Rust workspace version bumped to 0.4.1 across all crates via

  `version.workspace = true`.

### No behavioral changes

All 76 tests (31 Python + 42 Rust + 3 conformance) still green.

---

## v0.4.0 - 2026-04-17

**Rust port expands from core to core+enforcement+semantics.** Three new Rust

crates; Python reference unchanged in functionality but with RFC 6962 fix.

### Added

- **`oversight-tlog`** Rust crate (367 LOC). RFC 6962-compliant Merkle tree

  from day one - left-heavy largest-power-of-2 split, not the promote-odd

  shortcut from the Python v0.2 tlog. Signed tree heads, inclusion proofs,

  durable append (fsync), automatic recovery on reopen. 7 tests.

- **`oversight-policy`** Rust crate (284 LOC). TOCTOU-safe `max_opens`

  enforcement via `fs2::FileExt::lock_exclusive` + atomic temp-file rename.

  File-ID sanitization against path traversal. Jurisdiction / not_after /

  not_before checks. 6 tests.

- **`oversight-semantic`** Rust crate (345 LOC + 156-line dictionary file).

  Full port of the 151-class synonym dictionary and L3 watermarking.

  Airgap-strip-survivor verified (tests embed, then strip zero-width and

  trailing whitespace, then verify - still attributes). URL / email / code

  / path / hex / base64 skip regions. 8 tests.

- **Fuzz harness** (`oversight-rust/fuzz/`) - two `cargo-fuzz` targets

  hammering the container parser and manifest parser. Excluded from main

  workspace so normal builds don't need nightly. README with 24-hour

  pre-audit run recommendation.

- **`docs/HARDWARE_KEYS.md`** - vendor-neutral setup guide for YubiKey /

  Nitrokey / OnlyKey. Covers PIN/PUK setup, PIV slot 9d provisioning,

  Oversight identity-file format for hardware-backed recipients, curve

  choice rationale (P-256 for PIV compat vs X25519 file-backed), revocation

  procedure, threat model, deployment checklist.

### Fixed

- **`oversight_core/tlog.py`** now RFC 6962 compliant. Replaced the

  promote-odd-trailing shortcut with the canonical largest-power-of-2

  left-heavy split. Added `_rfc6962_mth`, `_rfc6962_path`,

  `verify_inclusion_proof` helpers. Tested with asymmetric sizes

  (n ∈ {1,2,3,4,5,7,8,16,17,100}) - every leaf's proof verifies;

  tampered proofs rejected. Old custom Merkle logic removed.

- **Mutex self-deadlock** in `oversight-tlog::inclusion_proof` - was

  holding the leaves lock while calling `root()` which also locks.

  Fixed by dropping the lock before invoking `root()`.

- **`oversight-semantic` round-trip bug** - `embed_synonyms` could pick

  hyphenated variants like `"write-up"` that `WORD_RE` tokenizes as two

  separate words, desyncing the verify sequence. Both embed and verify

  now explicitly skip non-round-trippable variants (whitespace or hyphen).

### Changed

- **Workspace version** bumped to `0.4.0`. Python reference remains `v0.3`

  (unchanged feature set, one correctness fix).

- **SealedFile** gained `#[derive(Debug)]` to support test assertions with

  `{:?}` formatting.

### Known limitations (unchanged from v0.3)

- Paraphrasing attack defeats all three watermark levels.

- Airgapped readers leave no network beacon.

- Hardware-backed recipients require v0.5+ `KeyProvider` abstraction (not

  yet implemented - currently file-backed only).

- Format adapters (image DCT, PDF, DOCX) remain Python-only until v0.6.

- Registry server (FastAPI) remains Python-only until v1.0.

## v0.3.0 - 2026-04-17

See earlier commits. Initial Rust core + FreeTSA RFC 3161 + cross-language

conformance + SENTINEL→Oversight rename + Nitro→YubiKey pivot.

## v0.2.1 and earlier

Python-only; see git history.