{
  "schema": "fairseal.transparency.v1",
  "updated": "2026-09-13",
  "principle": "FairSeal sells verifiable integrity. A verification service that hides its own errors has no product. This is a public, dated record of our mistakes, fixes, and material changes.",
  "contact": "hello@fairseal.io",
  "human_readable": "https://fairseal.io/transparency.html",
  "entries": [
    {
      "id": "pii-docs-overclaim-20260913",
      "date": "2026-09-13",
      "type": "correction",
      "title": "docs page overclaimed PII results carried cryptographic evidence",
      "summary": "Our API docs described /v1/pii/detect as returning a receipt with cryptographic evidence, and listed the wrong HTTP method (GET; it is POST). PII detection responses contain no cryptographic artifacts -- they are regex findings with sanitized text. Found by our own claims-verification gate (L4: NOT VERIFIED) on 2026-09-13; wording corrected the same day to state coverage limits and the absence of cryptographic proof explicitly.",
      "status": "fixed"
    },
    {
      "id": "anchor-nonce-degraded-20260913",
      "date": "2026-09-13",
      "type": "correction",
      "title": "Anchor service failed closed after a nonce collision; retry whitelist gap fixed",
      "summary": "During our own end-to-end testing on 2026-09-13, the anchor batch transaction collided with another service sharing the same deployer wallet (REPLACEMENT_UNDERPRICED). That error class was missing from the transient-retry whitelist, so the anchor engine entered its fail-closed degraded state and /v2/anchor returned 503 until an operator restart. No receipts were lost (queue state is persisted) and no incorrect receipts were issued -- fail-closed behaved as designed. Fixed same day: replacement-underpriced errors are now retried with a re-fetched nonce, like other nonce races.",
      "status": "fixed"
    },
    {
      "id": "csp-verify-ui-outage-202609",
      "date": "2026-09-12",
      "type": "correction",
      "title": "Verifier UI broken for 3 days after CSP hardening",
      "summary": "A 2026-09-09 Content-Security-Policy tightening on verify.fairseal.io blocked inline handlers and silently broke browser-side verification until 2026-09-12. HTTP-status monitoring did not cover the interaction layer. Fixed; interaction-level tests now required for CSP changes. Offline verification via @fairseal/verify was unaffected.",
      "status": "fixed"
    },
    {
      "id": "veo-malformed-body-settlement",
      "date": "2026-09-10",
      "type": "correction",
      "title": "VEO endpoint could charge buyers for malformed requests",
      "summary": "Found in our own 2026-09-09 payment-path audit: a structurally invalid body could return 200 and settle the x402 payment. Fixed 2026-09-10: validation now runs before settlement; malformed bodies return 400 payment_canceled and the buyer is not charged.",
      "status": "fixed"
    },
    {
      "id": "anchor-batch-amortization-disclosure",
      "date": "2026-09-10",
      "type": "disclosure",
      "title": "/v2/anchor batch-amortized cost disclosure",
      "summary": "Endpoint listed at $0.01/request while on-chain anchoring cost is batch-amortized across receipts sharing one Base transaction. Explicit disclosure added to .well-known/x402.",
      "status": "disclosed"
    },
    {
      "id": "commit-fail-open-verifier",
      "date": "2026-09-09",
      "type": "correction",
      "title": "@fairseal/commit <=0.1.3 verifier was not fail-closed",
      "summary": "verifyReceipt() never invoked beacon signature verification; a forged beacon signature could report beaconVerified: true. Fixed in v0.1.4 (2026-09-09): verification wired in, offline beacons explicitly rejected, self-reported flags ignored. Users of <=0.1.3 should upgrade and re-verify.",
      "status": "fixed",
      "affected_component": "@fairseal/commit <=0.1.3"
    },
    {
      "id": "vdf-correction-202609",
      "date": "2026-09-09",
      "type": "correction",
      "title": "VDF algorithm mislabeled as wesolowski-2048 before 2026-09-01",
      "summary": "Before 2026-09-01 04:02 UTC, /v1/rng/latest labeled the VDF as wesolowski-2048 while the production engine was an iterated SHA-256 chain (also sequential, not Wesolowski). Corrected 2026-09-01: genuine Wesolowski RSA-2048 with verifiable proofs is live. Full notice published 2026-09-09; affected buyers invited to contact us.",
      "status": "fixed",
      "details": "https://fairseal.io/notices/vdf-correction-202609.html"
    },
    {
      "id": "bls-copy-correction",
      "date": "2026-09-05",
      "type": "correction",
      "title": "Site copy claimed BLS12-381; live receipts use EIP-191 / Ed25519",
      "summary": "Descriptive copy referenced BLS12-381 aggregate signatures. No live receipt was ever BLS-signed; production uses EIP-191 (secp256k1) for VEO-1 and Ed25519 for VEO-2. Copy corrected across landing, verifier, and llms.txt.",
      "status": "fixed"
    },
    {
      "id": "overclaim-cleanup-202609",
      "date": "2026-09-05",
      "type": "correction",
      "title": "Claims-precision pass on homepage copy",
      "summary": "Loose claims replaced with exact statements: 'cannot be backdated' rewritten as a precise entropy-ordering description; code examples corrected to require anchored === true; CSR wording narrowed to what the evidence proves.",
      "status": "fixed"
    },
    {
      "id": "path-template-404",
      "date": "2026-08-30",
      "type": "correction",
      "title": "Paying customer hit 404 after payment due to path-template ambiguity",
      "summary": "Our first external x402 buyer paid, then followed a literal path template and got an unrecoverable 404. Fixed: template-brace requests now return machine-readable 400 with self-correction hints; discovery descriptions rewritten. Verified end-to-end.",
      "status": "fixed"
    },
    {
      "id": "notarize-routing-verify-032",
      "date": "2026-09-10",
      "type": "change",
      "title": "Notarize routing gap fixed; @fairseal/verify 0.3.2",
      "summary": "Payment host was missing the /v1/notarize route; fixed with regression checks across all paid endpoints. @fairseal/verify 0.3.2: fail-closed semantics, on-chain anchor checking, EIP-191/Ed25519, CJS fix.",
      "status": "shipped"
    },
    {
      "id": "payment-path-audit-202609",
      "date": "2026-09-09",
      "type": "disclosure",
      "title": "Full payment-path integrity audit",
      "summary": "All 7 paid endpoints audited against replayed, expired, missing payments and malformed bodies. Replay/expiry/no-payment correctly rejected everywhere. Surfaced the VEO malformed-body issue (fixed 09-10). Recurring audit class; material findings published here.",
      "status": "disclosed"
    },
    {
      "id": "wesolowski-production",
      "date": "2026-09-01",
      "type": "change",
      "title": "Genuine Wesolowski RSA-2048 VDF live in production",
      "summary": "Real Wesolowski VDF (T=568,300, ~5s epochs, ~30,000x verification asymmetry). 24h burn-in: 113/113 proof verifications passed. Algorithm labels re-audited across API, pricing manifest, and discovery metadata.",
      "status": "shipped"
    },
    {
      "id": "rng-latest-unpurchasable",
      "date": "2026-08-30",
      "type": "correction",
      "title": "rng/latest silently unpurchasable due to non-ASCII metadata",
      "summary": "Payment facilitator rejected the endpoint description over a non-ASCII em-dash, making the endpoint unpurchasable. Fixed with a source-level guard note; all paid endpoints now have recurring purchase tests.",
      "status": "fixed"
    }
  ]
}