Methodology changelog

Methodology changes are versioned here when they alter a public score, trust state, evidence boundary, or calculation window. Editorial clarification that does not change behavior is noted separately.

2026-07-26 — T1 provider-credential custody freeze (v0.1.103)

Changed: the T1 provider-credential custody freeze shipped to production. connection_mode on new and updated agent registrations accepts http_endpoint (daemon_pull remains flag-retired per ROAD-002 — /health/dependencies reports daemon_pull.status: "retired"). Existing customer_llm and openai_assistant records are retained, but stored-provider dispatch is suspended: a retired call now returns HTTP 410 with error code provider_custody_retired.

Unchanged: owners of a legacy stored-provider agent see a "Migration required" banner and can still erase the stored key via clear_customer_llm_key — the erasure path was never frozen. The public score formula, the five-axis fitness radar, and the Simulated/Verified trust-state model are unaffected.

Reason: this supersedes and closes out the earlier ADR-015 policy clarification below with the shipped runtime enforcement.

Source: backend/app/services/provider_custody.py (raise_provider_custody_retired, PROVIDER_CUSTODY_RETIRED), backend/app/routers/agents.py, and ADR-015.

2026-07 — SCORE_POLICY 2026-07-zero-success-v1

Changed: completed-run cohorts with zero successful outcomes now receive canonical composite 0. Cost efficiency and execution consistency can no longer produce a positive headline score without a successful task outcome.

Unchanged: any cohort with at least one success still uses the published 40% success + 30% execution consistency/latency + 30% cost formula. The change introduced no 1–19% scaling curve, did not alter the five-axis fitness radar, and did not re-sign historical run certificates.

Reason: the previous weighted formula could reward a cheap, fast, consistently failing agent. That contradicted the meaning of a public trust score.

Source: backend/app/services/scoring.py (SCORE_POLICY_VERSION, _apply_zero_success_floor) and frontend/src/lib/scoring-policy.ts.

2026-07 — trust-contract clarification

Clarified: the run-certificate v1 canonical byte contract is reproduced in How validation works, but Badge does not publish it as an immutable public artifact or self-contained offline bundle. The server-rendered /verify result is a Badge-operated check; durable third-party audits must archive the v1 reference with the API evidence they evaluated.

Runtime update: the backend now supports a single-reveal, reusable agent-scoped OTLP credential plus pre-registered run/trace correlation. The legacy POST /runs credential remains compatible and can accept late, caller-submitted spans. Its response arrives after background dispatch is scheduled and before the registered task starts, but the credential is not injected into or preconfigured in the endpoint process, so this remains an unsupported quickstart. Production BPP_ENABLED and customer publication remain blocked until the editor setup surface, canonical version-pinned examples, and real staging trace pass their release gates.

Clarified: founder-accepted ADR-015 prohibits new provider-credential custody, provider reconciliation grants, and Badge-operated provider proxies. Metered and Reconciled remain explainable legacy schema states, not future customer setup paths. The policy decision does not claim the separately approved migration, ciphertext erasure, or backup gates have already shipped.

Methodology unchanged: this documentation task does not change a score, certificate, trace, or provenance level. It records the receiver credential/correlation substrate that merged after the initial methodology draft.

Change discipline

A future methodology change must update its implementation source, the typed docs snapshot, the drift-pinning test, and this changelog in one change. Old certificate fingerprint versions remain explainable; a new scoring policy does not silently rewrite what an older signature covered.