Changelog

Versioned record of changes to the Akaeon Registry specification and API.

The registry's specification and API surface are versioned. This page records every change.

2026-07-20 — Free public lookup, publisher deploy kit, Signal Watch, discovery precedence

  • Free unauthenticated lookup. GET /v1/public/lookup?domain=<domain> returns a domain's current anchored opt-outs as full offline-verifiable bundles (canonical record, registry signature, Merkle inclusion proof, Arweave anchor), or optouts: []. Rate-limited per IP (50 req/s token bucket + 10,000/hour, 100,000/day); point queries only — no listing, prefix, or wildcard form. Signed attestations, as_of reproduction, include_withdrawn, and bulk lookup remain on the credentialed lab API: the reservation is free to read; the audit trail costs money.
  • Publisher deploy kit. From dns_verified onward, GET /v1/optouts/:submission_id/deploy-kit (also embedded in the status poll as deploy_kit) returns copy-paste in-band signals, each pointing back at the anchored record: a robots.txt block (Content-Signal line + # ADP-Declaration: pointer comment), /.well-known/tdmrep.json, a pointer-only /.well-known/adp.json, and a permanent _adp.<domain> TXT record — plus a per_host_checklist (robots.txt and well-known files are host-scoped; the TXT record is the domain-wide carrier). Withdrawals generate a removal kit. See publisher runbook §6.
  • Signal Watch. The registry now monitors each verified domain's deployed signals and emails the publisher on drift (a stripped robots line, a deleted well-known file, a removed TXT record); the anchored record proves the reservation predated the stripping. Detection and email alerts are free; a registry-signed drift attestation is planned as a paid tier (not yet available).
  • ADP-1 discovery updates (declaration format). New normative precedence rule (§6.3): the most recently anchored declaration wins; in-band signals are advisory pointers, the anchored declaration is authoritative; a withdrawal is itself an anchored record, so revocation needs no special case. §6.1's _adp TXT record format is reconciled to the deployed pointer-only grammar — adp1=1; lookup=<evergreen lookup URL>, with ABNF — replacing the earlier adp1; id=…; uri=… form, ahead of the planned IANA _adp registration. A signal-stripping consideration was added to §8.6. No wire-format change to the declaration itself: adp_version stays 1.0, schema_version stays 1.
  • API base URL. All documentation and reference-verifier defaults now use the deployed https://api.akaeon.com (previously written as api.akaeon-registry.com in several places).

2026-07-14 — ADP-1: Stelais watermark discovery channel; governance transfer conditions

  • Added the embedded Stelais watermark to ADP-1's work-level discovery list (declaration format §6.2): for image assets, an imperceptible DCT/LSB watermark carries a cid the registry resolves — a pixel-domain channel that survives the metadata stripping that removes C2PA manifests. Discovery ordering is otherwise unchanged, and discovery remains best-effort, never the trust root.
  • Conditioned the governance transfer and scoped what it governs (declaration format §11). The move of change control to a multi-stakeholder body is now explicitly gated on ADP-1 having multiple independent implementations and at least one registry operator besides Akaeon — a single-implementer format gives a standards body nothing to arbitrate. A new scope-of-governance clause states that ADP-1 governance covers the format (schema, canonicalization and signing, verification, interop mapping, conformance vectors) and does not reach any operator's deployment policy — publication and disclosure rules, credentialing, tiering, and retention remain the operator's own.
  • No wire-format change in either edit; adp_version stays 1.0, schema_version stays 1.

2026-07-10 — Daily anchored state commitment; snapshot manifest withdrawn

  • Published the state commitment addendum: a daily anchored sparse Merkle tree over the registry's entire per-domain opt-out state, keyed by SHA-256(domain), root signed (akaeon-registry:state-root:v1) and Arweave-anchored every midnight UTC, chained day-to-day. Serves publicly verifiable per-domain membership and non-membership proofs against the anchored root.
  • Withdrew the planned daily snapshot manifest. The registry publishes commitments, never an enumerable artifact of its contents — the new publication policy (spec §6.4) makes the boundary explicit: commitments public forever, contents private, evidence disclosed selectively against anchored hashes (spec §5.8).
  • Upgraded the negative attestation. Lookup responses for opt-out-free domains can now carry an anchored_non_inclusion proof (paid-tier entitlement) alongside the ephemeral no_optouts_attestation (runbook §3.3) — closing the runbook's long-acknowledged "colluding registry could re-sign" gap for everything up to the last epoch boundary.
  • Watermarked all per-lab attestations. Credentials now carry a public lab_key_id, embedded inside the signed canonical messages of no-optouts, bulk-attestation, and state-proof responses — unstrippable without destroying the signature, making redistributed response corpora attributable to the leaking credential.
  • Shipped in the registry service (same day): the depth-256 SMT primitive, the daily commitment job (piggybacked on the hourly anchoring scheduler, chained day-to-day on Arweave), per-epoch leaf persistence for historical proofs, and the new endpoints — GET /v1/public/state-roots/latest and GET /v1/public/state-roots/:epoch (public, free), GET /v1/state/proof (credentialed, paid-tier entitlement). Entitled credentials also receive the anchored_non_inclusion block inline on empty lookups. Covered by 44 new tests including full lab-side proof verification round-trips.

2026-06-16 — ADP-1 declaration format published

  • Published ADP-1, the Akaeon Declaration Protocol (adp_version 1.0, schema_version 1): the open, vendor-independent declaration format underlying the registry. Three layers (declaration, anchor, discovery), a normative seven-step verification procedure, and four cross-cutting sections (interop mapping to aipref/TDMRep/robots.txt/C2PA, opt-in licensing + RSL superset, privacy/GDPR, IETF-style security considerations).
  • Shipped two reference artifacts with the spec: reference verifiers in Python and Node.js (/spec/adp-1/verify.py, verify.mjs) and deterministic conformance test vectors (/spec/adp-1/test-vectors.json) — real Ed25519 keys, JCS canonical bytes, RFC 6962 Merkle tree, and inclusion proofs that both verifiers pass.
  • Reframed the registry technical specification as one operator's deployment of ADP-1, cross-linked to the format spec.