Evidence kits verify CAIP-380 envelopes, and the changelog reaches SDK 0.1.10 and MCP 0.1.8

CHANGELOG.md

@@ -12,7 +12,7 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c
 ### Added
 
 - **Sell a service your server runs.** [Your server runs it](/gates/your-server) covers a listing whose orders go to your own URL with the buyer's inputs and repository, and whose result you post back onto the buyer's receipt.
-- **Changelog entries for `@proofable/mcp` 0.1.7 and `@proofable/sdk` 0.1.6.**
+- **Changelog entries for `@proofable/mcp` 0.1.7 and 0.1.8, and `@proofable/sdk` 0.1.6 through 0.1.10.**
 - **Eligibility clause in the Terms of Use.** Section 4 states the minimum age and the capacity to contract.
 - **One-time purchases in the Terms of Use.** Section 13 says one-time purchases, including the early partner pilot, are final like credit purchases, that pilot setup has no fixed delivery date, and that pilot credits stay on your account after the pilot closes.
 - **Background jobs keep proofs private and offchain.** [Proofs](/proofs) says that a background job's request for a blockchain record, a public or link-only proof, or a visibility change is refused with `JOB_ONCHAIN_PUBLISH_DENIED`, `JOB_PUBLIC_PROOF_DENIED` or `JOB_VISIBILITY_CHANGE_DENIED`.
@@ -25,6 +25,7 @@ Product release notes: [docs.proofable.me/changelog](https://docs.proofable.me/c
 - **Two checks you can run on the published records.** `public/evidence/checks/tamper-check.mjs` forges each signed record ten ways and confirms every copy is rejected offline; `reuse-check.mjs` times reading and verifying a finished result with no account.
 - **A fresh run of the eight authority cases on the live service.** All eight passed on the revision production was serving, with 17 signed records. Requests that should not have been allowed were refused before any job ran; the case that needs approval waited for it and then ran; and a valid request ran alongside the refusals to show the check can pass. The records need no account to read or verify, and the run lives at `public/evidence/aaif/authority-at-dispatch/2026-10-24-served/`.
 - **Jobs run on credits on every plan.** [Jobs](/jobs) says what a run costs and lists the job tools a connection carries, and the team-agents and reproduce guides no longer say jobs need Pro.
+- **The evidence kits install `@proofable/sdk` 0.1.10.** The reproduction kit, the forged-record checks and the October 8 packet verify CAIP-380 envelopes that omit `walletAddress`, and `aad.mjs verify --expect-signer` requires the receipt signer you read out of band. Each authority-at-dispatch packet says what it establishes and what it does not.
 - **Agent id format is in the schemas.** `agentId` in `agent-identity` and `agent-delegation` is 1 to 128 letters, digits, hyphens or underscores, the same id the agent page uses.
 
 ### Removed

changelog.mdx

@@ -16,6 +16,54 @@ Package records: [`proofable/sdk`](https://github.com/proofable/sdk/blob/main/CH
 Published APIs and verifier schemas may change between minor versions. Breaking changes are listed in each entry and in the repo changelogs.
 </Note>
 
+<Update
+  label="November 1, 2026"
+  description="v0.1.8"
+  tags={["MCP"]}
+  rss={{
+    title: "Proofable MCP v0.1.8",
+    description: "A dedicated ChatGPT endpoint, keys saved only on your profile, and a prompt injection test for your own agent."
+  }}
+>
+## A ChatGPT endpoint, and keys stay on your profile
+
+`@proofable/mcp@0.1.8` adds `https://mcp.proofable.me/mcp/openai`, which serves the eight read and guided-verification tools to the ChatGPT plugin with the same OAuth sign-in. Cursor, Claude Code, Codex and every other client keep the full tool list on `https://mcp.proofable.me/mcp`.
+
+**Breaking:** `/mcp` no longer accepts a key as a tool argument. The tool that saved one is gone from `tools/list`, and a call to it is rejected as an unknown tool. Save keys on your profile; listing, removing and calling a provider with a saved key still work, and never return the key.
+
+The release also adds `examples/injection-test`, which hides the five AgentDojo attack templates in a note your agent reads and grades every run from its signed receipt.
+
+```bash
+npm install @proofable/mcp@0.1.8
+```
+
+</Update>
+
+<Update
+  label="October 28, 2026"
+  description="v0.1.10"
+  tags={["SDK"]}
+  rss={{
+    title: "Proofable SDK v0.1.10",
+    description: "Verify any CAIP-380 envelope, import an agent in one step, and complete AI service orders."
+  }}
+>
+## Verify any CAIP-380 envelope, import an agent in one step
+
+`@proofable/sdk@0.1.10` covers 0.1.7 through 0.1.10.
+
+- **Any CAIP-380 envelope verifies (0.1.9).** `verifyPortableProofEnvelope` takes the signer from the envelope's `did:pkh` identifier, so an envelope without `walletAddress`, including the specification's test vectors, verifies instead of throwing. Use 0.1.9 or later to verify envelopes from other implementations.
+- **`proofable import` creates the agent (0.1.10).** A signed-in terminal creates the agent on your profile with its full instructions and mounts it into the current project. `--expires-at` sets an end to its permissions, `--no-mount` skips the mount, and `--dry-run` shows what would happen.
+- **`proofable auth --oauth` signs in the CLI only (0.1.10).** It no longer writes its short-lived token into your editors; pass `--client` to write it to one.
+- **`fulfillGate()` completes AI service orders (0.1.7).** It sends `serviceParameters` for the listing's `serviceInputs`, and the run's answer appears on the buyer's receipt at `meta.marketplace.serviceJob.result`.
+- **The CLI exits with code 1 after an error on Windows (0.1.8),** and a dry-run mount lists files as "would write".
+
+```bash
+npm install @proofable/sdk@0.1.10
+```
+
+</Update>
+
 <Update
   label="October 12, 2026"
   description="v0.1.6"

evidence.mdx

@@ -88,7 +88,7 @@ Live web pages change between requests and cause unpredictable token spikes when
 
 **8 of 8 permission tests passed on the live service.** Every action outside the agent's permission was stopped before it ran, and the actions it was allowed to take ran.
 
-We ran each test on the live service on October 8, 2026, with a dedicated agent under its own fixed permission, and again on October 24 on the revision production serves ([records](https://github.com/proofable/docs/tree/main/public/evidence/aaif/authority-at-dispatch/2026-10-24-served)), 8 of 8 both times. Each link opens that test's signed record.
+We ran each test on the live service on October 8, 2026, with a dedicated agent under its own fixed permission, and again on October 24 on the revision production was serving then ([records](https://github.com/proofable/docs/tree/main/public/evidence/aaif/authority-at-dispatch/2026-10-24-served)), 8 of 8 both times. Each link opens that test's signed record.
 
 | Test | What happened |
 |---|---|
@@ -202,7 +202,7 @@ Unlike the live LLM and governance runs above, portable identity reuse is a **pr
     git clone --depth 1 https://github.com/proofable/docs
     cd docs/public/evidence/aaif/authority-at-dispatch/2026-10-08-eight-case
     sha256sum -c SHA256SUMS
-    npm install @proofable/sdk@0.1.6
+    npm install @proofable/sdk@0.1.10
     node verify-portable-proofs.mjs
     ```
   </Accordion>

public/evidence/aaif/authority-at-dispatch/2026-10-08-eight-case/README.md

@@ -66,9 +66,13 @@ your own Proofable account, so the records it writes are yours, not Proofable's.
 `SHA256SUMS` covers every payload file in this directory except itself. Verify with
 `sha256sum -c SHA256SUMS`.
 
-Install the pinned `@proofable/sdk@0.1.6` package once. Then verify every signature and qHash offline:
+Install `@proofable/sdk@0.1.10` (or later) once, then verify every signature and qHash offline:
 
 `node verify-portable-proofs.mjs`
 
+Use 0.1.9 or later. Earlier versions require a non-canonical `walletAddress` field and cannot verify a
+CAIP-380 envelope that omits it; 0.1.9 and later read the signer from the envelope's `did`. This packet's
+envelopes verify under 0.1.10, checked offline.
+
 Disclosure controls which fields of the Proofable record are shared; non-public fields are not
 required to evaluate these results.

public/evidence/aaif/authority-at-dispatch/2026-10-08-eight-case/SHA256SUMS

@@ -1,4 +1,4 @@
-2a45eb148b07bec8c0acd422bd6532022aaa2ab94ea142aa2d91519bc562b869  README.md
+614212892a210668c46691fc13e1c50d7f688f53b5b024da514ee8609bd5f9af  README.md
 4ac0e5d10b11751d8c871c482731477b1b3603abee4b81279608a34bde37978a  manifest.json
 79eba6766b460b5e907cc83d1db5ca61a84326806f4cb6d93b1ceb4b9ce3112f  authority-effect-results.md
 7f6fff7d37f14dc563914a242f0b70f8a950d6356b8f17671786d8c0a4b521c8  authority-effect-results.json

public/evidence/aaif/authority-at-dispatch/2026-10-24-fetch-route/README.md

@@ -10,6 +10,27 @@ This answers the request in
 [agentrust-io/integrations#333](https://github.com/agentrust-io/integrations/issues/333) for a
 copyable example of the dispatch-only, correlation-only route.
 
+## What this establishes, and what it does not
+
+Classified against AAIF Identity & Trust [#21](https://github.com/aaif/wg-identity-and-trust/issues/21)
+and [agentrust-io/integrations#333](https://github.com/agentrust-io/integrations/issues/333), the
+defensible statement for this packet is **a service-attested job decision with correlation links**.
+Prior authorisation is not established by it. Three links are missing:
+
+1. **The grant is named by commitment only.** `delegationQHash` cannot be resolved to the mandate
+   being evaluated, so its bounds cannot be checked from this packet.
+2. **Nothing binds the mandate digest and version to what the counterparty received.** The
+   decision-to-job tie is an unsigned create response, and the target kept no log. The full marker
+   first appears in the signed terminal receipt, after the call.
+3. **The ordering rests on the deciding service's signed timestamp.** A token taken later dates the
+   record; it does not witness the dispatch.
+
+What it does establish: the decision is signed before the job exists, it commits to the grant's
+`delegationQHash` and to an `argsDigest` over a declared field projection of the request, and the
+terminal receipt is signed by the same service account. That account is published outside this
+packet, in the pinned registration document whose bytes and registry read are at
+[`public/evidence/registry`](https://github.com/proofable/docs/blob/f81b8416a4f6fc1f1439ef43216078261fb206d2/public/evidence/registry/README.md).
+
 ## Files
 
 | File | What it is | Signed |

public/evidence/aaif/authority-at-dispatch/2026-10-24-fetch-route/SHA256SUMS

@@ -6,4 +6,4 @@
 34688c283148a0524b550666fa74839b38410c26fd63425734a2753ba89f040c  6-terminal-receipt.json
 b6849d19f65356cb3da0a1d0d4e840c1e1244830c9c2a637641f0cf7cf468616  health-at-run.json
 d1919890e1d5ff3c5da0f552c90e09ef672e514c7f2dc3e35c91276358c926a6  verify.mjs
-52c153a1a05e7e6b915e531a8b4ef81fa0322226e3df51b3d231e918195b61f5  README.md
+1ec9b2d5c050eaf75ec9cf18b8d15e828d3c0efcfd07693880f3073e8b3d11f9  README.md

public/evidence/aaif/authority-at-dispatch/2026-10-24-served/README.md

@@ -8,8 +8,9 @@ The code that graded it is `reproduce/aad.mjs` at
 SHA-256 `afbb0cf8541c3916967707143b5be56556051b32797b2a6b52aae6f423234f79`. Check that version out to
 grade the run with the exact code that graded it.
 
-This is the current run. It replaces [`../2026-10-08-eight-case/`](../2026-10-08-eight-case/), which
-stays at its own commit.
+This run replaces [`../2026-10-08-eight-case/`](../2026-10-08-eight-case/), which stays at its own
+commit. Both are dated runs on the revision each was taken against; the service moved on afterwards, so
+read the revision here as what production served on 24 October, not as what it serves now.
 
 ## What happened
 

public/evidence/aaif/authority-at-dispatch/README.md

@@ -6,13 +6,13 @@ link to every record, is at
 
 | Folder | What it is |
 | --- | --- |
-| [`2026-10-24-served/`](./2026-10-24-served/) | **Current run.** Eight cases on revision `61724c9f4`, 17 signed records, checksums, and a result for each case |
+| [`2026-10-24-served/`](./2026-10-24-served/) | **Latest published run, 24 October.** Eight cases on revision `61724c9f4`, 17 signed records, checksums, and a result for each case |
 | [`2026-10-24-fetch-route/`](./2026-10-24-fetch-route/) | One job on the fetch route: the call, the raw response, the signed decision and receipt, and an offline checker |
 | [`reproduce/`](./reproduce/) | Run the same cases under your own account |
 | [`action/`](./action/) | The same run as a GitHub Action, which writes a `trustharness.report/v1` report |
 | [`2026-10-08-eight-case/`](./2026-10-08-eight-case/) | Earlier run at revision `e1217327a`: 15 signed records and an offline checker |
 
-To check the current run:
+To check the latest published run:
 
 ```sh
 cd 2026-10-24-served
@@ -21,7 +21,7 @@ cd ../reproduce
 node aad.mjs verify ../2026-10-24-served
 ```
 
-The October 8 packet has its own pin. Run `npm install @proofable/sdk@0.1.6` inside
+To check the October 8 packet, run `npm install @proofable/sdk@0.1.10` inside
 `2026-10-08-eight-case/`, then `node verify-portable-proofs.mjs`.
 
 Earlier packets stay where they were:

public/evidence/aaif/authority-at-dispatch/reproduce/README.md

@@ -22,11 +22,16 @@ export AAD_OPERATOR="Your Organization"
 node aad.mjs setup        # creates a local agent wallet and registers your review agent
 node aad.mjs run          # all eight cases, about 6 to 8 minutes
 node aad.mjs verify runs/<run-id>
+node aad.mjs report runs/<run-id>
 ```
 
 `verify` needs no network and no account. Run one case with `node aad.mjs run <case>`; list them
 with `node aad.mjs cases`.
 
+Verify with `@proofable/sdk` 0.1.9 or later, which this kit pins. Earlier versions require a
+non-canonical `walletAddress` field on the envelope, so they cannot verify a CAIP-380 envelope that
+omits it, including the CAIP's own test vectors.
+
 ## The cases
 
 | Case | What it does | Expected |
@@ -45,6 +50,33 @@ with `node aad.mjs cases`.
 How long a revocation takes to reach the check, and the effect at the target: effects are recorded
 as the service observed them.
 
+## Typed outcomes, typed cost and the grading scope
+
+`report` reads a run offline and prints one row per case: the separate outcome fields (what was
+attempted, what was observed, what the service accepted, whether effects were verified) each with a
+typed reason where the case refused or skipped, the benign cost of the check and the legitimate work
+it must not forbid, and a statement of what the run does not grade. It writes nothing.
+
+- `elapsed_ms` is measured on the kit's clock, over the whole case including setup and waits.
+- `job_ms` is measured by the service inside the signed job record, over the executed part of the job,
+  and is `not_applicable` where no job ran.
+- Model tokens are `not_measured`: the kit does not count them.
+- `effects_verified` is `not_measured` for every case. Effects are observed by the service, with no
+  target-side witness, and `MANIFEST.json` carries the same entry.
+
+## Pin the signer
+
+`verify` recovers each signature against the address declared inside that same envelope. To also
+require the address you read out of band:
+
+```sh
+node aad.mjs verify runs/<run-id> --expect-signer 0xa41494e1e5f9e5eaf786961e6ef84cd1a3071eec
+```
+
+That address is the receipt signer named in the registration document published at
+[`docs/public/evidence/registry`](https://github.com/proofable/docs/tree/main/public/evidence/registry),
+together with the registry read that binds the document to Proofable's on-chain agent identity.
+
 ## Settings
 
 | Variable | Default | Purpose |