Changelog

A changelog is a claim about the past, and it rots the same way every other claim on a marketing site rots. Ours has gone stale before. This page states what the changelog is for and what has to be true of an entry, so that the failure is at least visible when it recurs.

What an entry has to carry

A date, a thing that changed, and, where the change is externally observable, the way to check it. A version number, a URL that returns something different than it did before, a command.

An entry describing something a reader cannot verify is a press release, and it belongs somewhere else.

What does not go in

• Roadmap. A changelog records what happened. Anything future belongs on the page that owns it, marked as a target rather than a plan.
• Rewording. Changing the adjectives on a page is not a change to the product, and logging it as one inflates the record.
• A status upgrade without the thing that caused it. "Now enterprise-ready" is not an event.

The rule that matters most, because breaking it is what actually caused the drift

When something ships, the changelog is not the only file that changes. The status of a product, a package version and a compliance claim each live in a canonical source, and every copy of a number goes stale the moment the source moves.

So: a status change updates the canonical source and every surface that renders from it, in the same commit. A half-updated set is worse than none, it produces two confident, contradictory answers, and whichever one a reader finds first becomes the one they quote back at us.

We have had exactly that failure. Certification and capability claims on our live pages contradicted our own internal record, and the corrections are published on the compliance page rather than quietly fixed.

How to check what is actually shipped, without trusting this page

Three things a stranger can verify in under a minute:

• The SDK version, from the public registry, @solidus-network/sdk, auth and bbs were all at 0.6.3 on 2026-07-31.
• The issuer's advertised credential format, GET https://capture-api.solidus.network/.well-known/openid-credential-issuer returns vc+sd-jwt.
• The trust registry's behaviour on an unknown issuer: it returns a 404 with issuer not enrolled in this registry.

Those are facts about the running system. This page is a story about it, and where the two disagree, the running system is right.