> ## Documentation Index > Fetch the complete documentation index at: https://docs.parmanasystems.com/llms.txt > Use this file to discover all available pages before exploring further. # Changelog > What actually shipped, by commit, newest first. Not a marketing summary, generated from git log. Pulled directly from `git log` on `main` in `pavancharak/parmana-exp`, commit hashes are real and checkable. This page covers the commits that changed what a reader of this site can actually do or rely on, not every commit in the repository's history, run `git log` yourself for the complete record, 192 commits as of this page's last update. ## 2026-08-11 * **`6a1c3ae`** docs: latency/voice-AI readiness investigation — four findings on whether Parmana can meet a sub-500ms latency budget (cold Postgres connections, since fixed; synchronous caller-auth audit writes, confirmed deliberate; a region mismatch; anycast relay overhead), explicit that a full, real `POST /execute` round trip remains unmeasured. Also added [Verification Log](/trust-and-claims/verification-log)'s first entry (live HubSpot verification against the deployed instance) and repositioned the README tagline. * **`09eb2d4`** feat(sdk): dogfood the SDKs end to end — the HubSpot live integration suite rewritten to run through the real `@parmana/sdk` package (`ParmanaClient`/`HttpTransport`) instead of `supertest` against an in-process Express object, and both documented "quickstart" example scripts (`python/examples/quickstart/run.py`, `typescript/examples/02-execute.ts`) proven to actually run for the first time, by a real test each. Found and fixed real bugs along the way, including all 7 `typescript/examples/*.ts` files importing `@parmana/typescript-sdk`, a package name that has never existed. See `docs/CLAIMS.md` §3.15. * **`bf6a413`** docs: document per-caller rate limiting on `/execute` (`docs/CLAIMS.md` §3.14, `.env.example`), see [Authentication](/api-reference/authentication#rate-limiting). * **`6f39ef1`** feat(api): add rate limiting — `POST /execute` per authenticated caller identity, `GET /health`/`GET /ready` separately by IP with a far more permissive limit, see [Authentication](/api-reference/authentication#rate-limiting). * **`85dc62d`** feat(sdk): add refusal-record and audit-verify route coverage to both SDKs. * **`328be90`** fix(python-sdk): fix stale repository URLs, add missing Apache-2.0 license text. * **`6f6c76f`** fix: resolve additional pre-existing test failures found while verifying SDK fixes, plus 2 lint errors. * **`6597939`** fix(typescript-sdk): fix an env-path test bug, implement retry logic (backoff on idempotent GETs against 502/503/504), and rename the package `@parmana/legacy-reference` → `@parmana/sdk`, see [TypeScript SDK](/sdks/typescript). ## 2026-08-10 * **`5b5cf2c`** / **`b4a2e9c`** / **`3cb4249`** Python SDK and API error-handling fixes: a `shell=True` plus list-argument bug that broke key generation in CI, and `ruff` lint failures in `client.py` and its tests. ## 2026-08-09 * **`2e94a0a`** complete hybrid signature migration — see [Security](/security/overview) §3.13 for the current scope (built and tested, not yet running in any deployed environment). * **`1d8ebf0`** refactor: strengthen execution authorization architecture. ## 2026-08-07 * **`1e3bd90`** Update documentation and project artifacts. ## 2026-08-05 * **`0e3e465`** feat(hubspot): implement Signed Approval Artifact, closing the HubSpot half of TD-23, see [HubSpot](/integrations/hubspot). * **`d6b3143`** fix(razorpay): derive the daily cumulative refund cap from the repository rather than a hardcoded value, closing the Razorpay half of TD-23, see [Razorpay](/integrations/razorpay). * **`e55c646`**, **`470121b`**, **`56cef07`**, **`17c5554`**, **`d38e775`**, **`a30f24a`**, **`ae7c930`**, **`58a3f39`**, **`e44bffc`**, **`5bd4ea6`**, **`4e5f78d`**, **`5470847`** — a technical-debt hardening series (TD-1 through TD-23) from an internal architecture review: canonical capability-to-policy binding, a dead composition-root removal, replay endpoint semantics certified by test, stale vendor-payment/caller-auth documentation corrected, and residual debug instrumentation removed. ## 2026-07-28 * **`0e69ed4`** chore: npm audit fix, resolving 4 known transitive vulnerabilities (`brace-expansion`, `js-yaml`, `postcss`, `body-parser`, plus `nanoid` pulled in transitively) — `npm audit fix` alone, no `--force`, no `package.json` changes. Full suite (597 tests) unchanged, `npm audit` now reports 0 vulnerabilities. * **`f89029e`** fix: bind policy signals to executed intent, closing an execution-authorization bypass — the most severe finding in this project's history, see [Security](/security/overview) for the incident and `docs/VERIFICATION-GAPS.md` G-24 for full detail. `Policy.boundSignals` + `SignalIntentBinder` ([Policies and the decision](/concepts/policies-and-the-decision)), `isPrincipalAllowed`, and `isOwnedByCaller` (a compounding IDOR fix) landed together. Found via an external adversarial security exercise, not this project's own audit process. ## 2026-07-20 * **`f453713`** docs: fix CLAIMS.md escaping corruption, lead README/CLAIMS with execution-trust framing, scope key-compromise notice to what's verifiable * **`03aed1a`** / **`48320b3`** docs: add founder case study and update E2E documentation * **`8a72f1a`** chore: production hardening and live deployment improvements ## 2026-07-19 * **`e13dd2a`** feat: production deployment, execution hardening, and live Razorpay validation, the live-mode refund validated against a second, live-mode Fly.io deployment, see [Razorpay](/integrations/razorpay) and `docs/CLAIMS.md` §3.9. * **`731465c`** feat(razorpay): add webhook processing, settlement confirmations, and live integration support, `POST /webhooks/razorpay`, `RazorpaySettlementProcessor`, see [Verify Razorpay webhooks](/guides/verify-razorpay-webhooks) and [Settlement](/concepts/settlement). ## 2026-07-18 * **`5fddced`** feat(api): add Razorpay connector and credential provider, refund creation against real Razorpay, see [Razorpay](/integrations/razorpay). * **`4df5cf6`** Add end-to-end documentation, Swagger UI, authentication improvements, and OpenAPI tooling. * **`ce02554`** refactor(storage): improve repository initialization and availability handling. * **`5c688b4`** feat(platform): Execution Integrity Platform v0.3, this commit added caller bearer-key authentication, `createCallerAuthenticator.ts`, gating every route except `/health`, `/ready`, `/openapi.yaml`, and `/documentation`, see [Authentication](/api-reference/authentication). If you're reading an older capture of this site's Quickstart or FAQ that describes an unauthenticated API, that description predates this commit and is stale. ## 2026-07-17 * **`de503e6`** docs(architecture): add implementation-backed execution flow audit. ## 2026-07-14 * **`ec3735e`** feat(api): publish OpenAPI specification and add execution connector framework. ## 2026-07-11 to 2026-07-13 * **`c282b8d`**, **`850e7ab`**, **`7c0f186`** Test and naming alignment: gateway session hardening, `BusinessTrustRecordBuilder` rename, separating the business trust pipeline from the execution trust builder. * **`651497a`** feat: implement credential isolation and secure enterprise connectors, the commit most of this site's `[AVAILABLE]` credential-isolation and content-binding claims are pinned to, see [Credential isolation](/concepts/credential-isolation) and [Content binding & TOCTOU](/concepts/content-binding-toctou). * **`5cc0c2e`** feat: add deterministic trust record ordering and verification hardening. * **`7c529c4`** / **`82ebd31`** feat: add Execution Trust pipeline, hybrid signatures, and tutorials 47-56. ## Earlier milestones * **2026-07-07 to 2026-07-10**: connector SDK and business transaction model (`4740aee`), runtime stabilization (`ddf4bc5`), execution system bootstrap composition root (`6484349`), tutorial series expansion through tutorial 56. * **2026-07-01**: Python SDK `v1.0.0` tagged and released, see [Python SDK](/sdks/python). This is a package version, not the overall product version, the running server's `/version` route reports its own version independently. * **2026-06-25**: first commit, `ba7bc45`, "initialize Parmana architecture v1." ## A note on terminology in older commits Commit messages and some earlier internal documents use "Execution Governance" as an architecture name. The product's current, public-facing language avoids that framing, see [Trust and claims](/trust-and-claims/claims-discipline) for the discipline this site follows today. Commit messages are historical record and are quoted here as written, not edited to match current terminology. ## Full history ```bash theme={null} git log --oneline ``` For the evidentiary detail behind what each milestone actually proves, not just what it claims, see `docs/CLAIMS.md` in the repository, cited throughout this site wherever a specific claim needs it.