# Methodology changelog

> Versioned changes to badgeIA scoring, validation, and integrity policy.

Methodology changes are versioned here when they alter a public score, trust state, evidence boundary, or calculation window. Editorial clarification that does not change behavior is noted separately.

2026-07-26 — T1 provider-credential custody freeze (v0.1.103) [#2026-07-26--t1-provider-credential-custody-freeze-v01103]

**Changed:** the T1 provider-credential custody freeze shipped to production. `connection_mode` on new and updated agent registrations accepts `http_endpoint` (`daemon_pull` remains flag-retired per ROAD-002 — `/health/dependencies` reports `daemon_pull.status: "retired"`). Existing `customer_llm` and `openai_assistant` records are retained, but stored-provider dispatch is suspended: a retired call now returns HTTP 410 with error code `provider_custody_retired`.

**Unchanged:** owners of a legacy stored-provider agent see a "Migration required" banner and can still erase the stored key via `clear_customer_llm_key` — the erasure path was never frozen. The public score formula, the five-axis fitness radar, and the Simulated/Verified trust-state model are unaffected.

**Reason:** this supersedes and closes out the earlier ADR-015 policy clarification below with the shipped runtime enforcement.

**Source:** `backend/app/services/provider_custody.py` (`raise_provider_custody_retired`, `PROVIDER_CUSTODY_RETIRED`), `backend/app/routers/agents.py`, and ADR-015.

2026-07 — SCORE_POLICY `2026-07-zero-success-v1` [#2026-07--score_policy-2026-07-zero-success-v1]

**Changed:** completed-run cohorts with zero successful outcomes now receive canonical composite 0. Cost efficiency and execution consistency can no longer produce a positive headline score without a successful task outcome.

**Unchanged:** any cohort with at least one success still uses the published 40% success + 30% execution consistency/latency + 30% cost formula. The change introduced no 1–19% scaling curve, did not alter the five-axis fitness radar, and did not re-sign historical run certificates.

**Reason:** the previous weighted formula could reward a cheap, fast, consistently failing agent. That contradicted the meaning of a public trust score.

**Source:** `backend/app/services/scoring.py` (`SCORE_POLICY_VERSION`, `_apply_zero_success_floor`) and `frontend/src/lib/scoring-policy.ts`.

2026-07 — trust-contract clarification [#2026-07--trust-contract-clarification]

**Clarified:** the run-certificate v1 canonical byte contract is reproduced in [How validation works](/docs/methodology/validation), but Badge does not publish it as an immutable public artifact or self-contained offline bundle. The server-rendered `/verify` result is a Badge-operated check; durable third-party audits must archive the v1 reference with the API evidence they evaluated.

**Runtime update:** the backend now supports a single-reveal, reusable agent-scoped OTLP credential plus pre-registered run/trace correlation. The legacy `POST /runs` credential remains compatible and can accept late, caller-submitted spans. Its response arrives after background dispatch is scheduled and before the registered task starts, but the credential is not injected into or preconfigured in the endpoint process, so this remains an unsupported quickstart. Production `BPP_ENABLED` and customer publication remain blocked until the editor setup surface, canonical version-pinned examples, and real staging trace pass their release gates.

**Clarified:** founder-accepted ADR-015 prohibits new provider-credential custody, provider reconciliation grants, and Badge-operated provider proxies. Metered and Reconciled remain explainable legacy schema states, not future customer setup paths. The policy decision does not claim the separately approved migration, ciphertext erasure, or backup gates have already shipped.

**Methodology unchanged:** this documentation task does not change a score, certificate, trace, or provenance level. It records the receiver credential/correlation substrate that merged after the initial methodology draft.

Change discipline [#change-discipline]

A future methodology change must update its implementation source, the typed docs snapshot, the drift-pinning test, and this changelog in one change. Old certificate fingerprint versions remain explainable; a new scoring policy does not silently rewrite what an older signature covered.