What changed, and when.
Three tracks, dated and honest: the format (which only changes by versioning), the reference implementations, and this site. Security advisories land here too.
Protocol site: the backbone ships site
- The normative GOVP-1 specification published — the citable text, frozen.
- Conformance center with the 8 GOVP-CORE-CONFORMANCE-1 golden vectors downloadable.
- Playground: issue and verify entirely in the browser.
- Network, HTTP surface, badges, full docs set (quickstart, examples, integration, governance), comparisons, glossary and this changelog.
- The site now serves its own identity record at /.well-known/govp.txt.
GOVP CLI 0.1.4 release
The reference verifier is packaged from one immutable tag as standalone binaries, a Python wheel and a reproducible source distribution. Portable CA certificates make HTTPS verification independent of the host installation, and every platform binary verifies a live GOVP record before release. All artifacts share one checksum manifest. Publication to PyPI is prepared through GitHub OIDC without a long-lived upload token; it remains disabled until the public launch.
Format status: GOVP-1 frozen format
The GOVP-1 wire format is stable and frozen: canonicalization, signature scheme, GOVP-ID derivation and the verification algorithm change only through the governance process, and any canonical-bytes change mints a new format tag. Records issued today verify forever under this format.
WordPress reference plugin 2.38.2 release
Current stable of the reference server implementation. Highlights of the 2.x line:
- No sidecar: pure PHP (libsodium) engine, runs on shared hosting; browser verification with server fallback.
- Sources Verification Layer with type-specific verifiers and verifiable source states.
- Mesh: discovery, witnessing, consortium mode, independence-weighted trust.
- Reproducible three-node HTTP scenario: honest agreement, attributed split-view alarm and continuity with one node down.
- Production key custody: issuing blocks if the key sits under the web root; external KMS/HSM signing supported.
- Bundled conformance vectors + in-install self-test.
GOVP Studio 1.0.1 — macOS arm64 release
Signed and notarized desktop build for Apple Silicon; published SHA-256 27fcde21…54785b so anyone can verify the installer. Intel macOS, Linux and Windows builds in preparation — no fabricated checksums, ever. Download.
Real records everywhere site
Every example on this site became a genuinely signed GOVP-1 record — the reference library and the site's own proof all pass the in-browser verifier, which performs the full Ed25519 check client-side.
Security advisories security
None published to date. When one exists it will appear here, after coordinated disclosure per the security policy.