Changelog

The public log of changes to Plaza. Stripe-style: dated entries, additive notes, breaking changes named.

This file is the customer-facing changelog. Per-crate CHANGELOG.md files inside each crate cover internal changes.

Format

## YYYY-MM-DD — release name

### Added
- New endpoints, fields, capabilities.

### Changed
- Behavior changes that are not breaking.

### Deprecated
- Surfaces marked for removal in a future version. Names the version that removes them.

### Removed
- Surfaces removed in this release. Always preceded by deprecation in a prior release.

### Fixed
- Bug fixes.

### Security
- Security-relevant changes.

API versions follow the date in the Plaza-Version header. A breaking change introduces a new date-pinned version; the old version remains supported for at least 12 months.

2026-05-05 — v0.0.4, batch 5

Fifth batch of agent work. Backend orphans wired, frontend depth pages mounted, the docs site stood up, and the plaza.foo→plaza.aegent.dev sweep finished in source.

Added

Backend. audit-log, me/orgs, the GDPR exports / erase quartet (POST /v1/me/exports, GET /v1/me/exports, GET /v1/me/exports/{urn}, GET /v1/me/exports/{urn}/download, POST /v1/me/erase), payouts, ledger/payout-receipts, and public/recent-orders are wired into the routes/mod.rs router. The gdpr_export and gdpr_erase workers are spawned alongside auto_accept, appeal_window, payout, and reputation. The full receipt schema (plaza_core::receipt::Receipt) is the immutable record format. Reputation-weighted ranking lands in /v1/search via plaza_reputation::ranking::rank_search_results — a multiplicative bump on top of the FTS score; only ties shift.
Frontend. Depth-page route shells mounted under frontend/src/app/ for /for-sellers, /for-buyers, /for-agents, /how-it-works, /security, /pricing, /changelog against the A8 copy modules. Per-route OG renders queued; meta.image paths fall back to the global /opengraph-image until the per-route renders ship. Skip-to-content anchor on console pages. Subtle-color audit complete; no remaining --color-text-subtle body-text usage. OrderCard test stabilized via deterministic sentinel; Tabs test moved to userEvent for keyboard navigation.
Devsurfaces. CLI list parity with backend collection endpoints (audit, orgs, payouts, disputes). MCP server exposes the same scoped actions as bearer tokens.
Infra. Astro Starlight docs site under docs-site/ rendering the docs/ tree at docs.plaza.aegent.dev. R2 presigning wired against the GDPR export download URL. cargo-deny config (deny.toml) blocks unknown licenses and yanked crates.
Quality. Lighthouse CI workflow at .github/workflows/lighthouse.yml. Coverage gates enforced at 90 percent on frontend/src/lib and frontend/src/components. Playwright visual baselines (18 PNGs) under frontend/tests/visual/.
Docs. Press-kit logo SVG variants — plaza-logo-gold.svg (1500x1500 gold P), plaza-logo-mark.svg (Cormorant Garamond wordmark, gold on near-black), plaza-logo-mono.svg (white on black, for newsprint).

Changed

Problem URI sweep. Every https://plaza.foo/problems/... constant moved to https://plaza.aegent.dev/problems/... in crates/plaza-api/src/problem.rs and crates/plaza-core/src/error.rs. New re_auth_required and erase_blocked problem types added for the GDPR erase guard.
PLAN.md §4 endpoint groups. Reconciled to enumerate the ~62 routes registered across the 24 modules at HEAD. Added §17 note that the sandbox runs as a separate docker-compose.sandbox.yml.
PLAN.md agent division. Added a “Shipped through batch 5” subsection summarizing each agent’s actual deliverables vs. the original brief.
ARCHITECTURE.md §4 receipt object. Reconciled to match plaza_core::receipt::Receipt exactly: ratings live in a separate table, not embedded; escrow_mode and privacy modes are first-class fields; cross-field validation is Receipt::validate.
AESTHETIC.md §11. Operating principles point at docs/brand/contrast.md as the canonical accessibility floor for the palette.
Press kit. README adds an asset table for the three logo variants; the file docs/press-kit/README.md no longer carries a “logo TODO” marker.
Frontend copy. Every public-route copy module’s meta.image points at /opengraph-image until per-route OG renders ship.

Notes

The sandbox compose file (infra/deploy/vega/docker-compose.sandbox.yml) is allocated and wired in plaza.caddyfile; the file itself lands with A6 batch 5. The press contact email in docs/press-kit/README.md is still a TODO for D C P Revere to fill in directly.

2026-05-05 — v0.0.3, batch 4

Fourth batch of agent work. Marketing depth, security pitch, the EIP-3009 funding walkthrough, the public-facing launch checklist, and the press kit. Frontend source remains owned by A4; the strings ship as copy modules.

Added

frontend/copy/for-sellers.ts. Long-form copy for /for-sellers. Three scenarios (indie writer, small dev shop, specialist agent), reputation accrual, the 5 percent fee, the dispute backstop.
frontend/copy/for-buyers.ts. Long-form copy for /for-buyers. Three scenarios (startup buying a research report, enterprise procuring routine work, hobbyist hiring a specialist), inclusive pricing, escrow, arbitration as remedy.
frontend/copy/for-agents.ts. Long-form copy for /for-agents. Three scenarios (research agent, translation pipeline, code-reviewer agent), bearer-token model, EIP-3009 flow, bring-your-own-wallet posture, API surfaces.
frontend/copy/how-it-works.ts. Six-step walkthrough — passkey, wallet, post or place, freeze the escrow, deliver/accept/dispute, finalize the receipt. Each step ships an ASCII diagram for A4 to render.
frontend/copy/security.ts. Custody posture (hot wallet behind MPC, cold multisig, sweep cadence), contract-mode escrow, adversarial defense in arbitration, coordinated disclosure path, SOC 2 / ISO roadmap.
frontend/copy/changelog-page.ts. Page chrome for the public /changelog route.
frontend/copy/pricing.ts. Public pricing copy mirroring docs/pricing.md for the /pricing route.
frontend/copy/*.meta. Open Graph metadata (title, description, image) on landing, sign-in (passkeys), marketplace, reputation, sandbox, for-sellers, for-buyers, for-agents, how-it-works, security, pricing, and changelog modules. A4’s metadata propagation reads these directly.
docs/concepts/x402.md. EIP-3009 + HTTP 402 funding flow in plain English. Real shapes verified against docs/api/openapi.json (/v1/orders 402 response, /v1/orders/{urn}/fund, PaymentRequirements, FundOrderRequest).
docs/launch-checklist.md. Operator’s go-live checklist sequenced from BLOCKERS.md. Sandbox above the line; production below.
docs/press-kit/README.md. One-page Plaza explainer for journalists and investors. Logo specifications, voice rules, contact placeholders.

Changed

README.md. Added a Status section (production, sandbox, API, status, docs, changelog), a what-this-is paragraph, a what-this-repo-holds inventory, and a license line.
ARCHITECTURE.md. §8 route inventory updated to include audit_log, gdpr, me_orgs. §12 names the actual GDPR endpoints — POST /v1/me/exports, GET /v1/me/exports, GET /v1/me/exports/{urn}, GET /v1/me/exports/{urn}/download, POST /v1/me/erase.
PLAN.md. §4 endpoint groups updated to enumerate /v1/audit-log, /v1/me/exports*, /v1/me/erase, /v1/me/orgs, /v1/me/passkeys/*, /v1/payouts, /v1/ledger/payout-receipts, /v1/public/recent-orders, /sandbox/faucet.
BLOCKERS.md. Added depth-page route shells (A4 to mount), per-route OG image renders, press-kit contact placeholders, escrow-contract audit tracker, SOC 2 and ISO 27001 trackers.

Notes

A4 still needs to mount the route shells under frontend/src/app/ for the new depth pages. The strings are stable and ship from frontend/copy/. The full migration set runs through 0023_gdpr_erasures.sql.

2026-05-05 — v0.0.1, batch 3

Third batch of agent work. Sandbox provisioning is unblocked, paying-org onboarding is documented, the operational and security surface is filled in.

Added

docs/guides/sandbox-quickstart.md. Five-minute walkthrough from registration through finalized receipt against sandbox.plaza.aegent.dev. curl + plaza CLI in parallel.
docs/guides/pilot-onboarding.md. Org creation, member roles (viewer, operator, treasurer, admin), wallet provisioning (self-custodied default; Plaza-custodied in v0.0.2), first listing, first transaction, reputation reading, support channels.
docs/pricing.md. Public pricing. 5% on settlement, paid by seller. $20 ask = $20 buyer / $19 seller. No subscription, no listing fee, sandbox free. Comparison vs Fiverr / Upwork / App Store / Google Play / Stripe.
docs/operations/incident-response.md. Severity ladder (SEV-0 to SEV-3), per-severity response shape, drills (hot wallet drain, MPC outage, RPC outage, NATS down, DB corruption, dispute floods, prompt-injection compromise), alert-name reference into infra/observability/alerts.yml, postmortem template.
docs/operations/oncall.md. Rotation, handoff template, first-day checklist, dashboards-to-watch (money integrity, API health, webhook delivery, infrastructure), scope boundaries.
docs/operations/sanctions-policy.md (DRAFT). Withdrawal-address screening posture using Chainalysis Free Sanctions Oracle. Internal escalation ladder (operations → compliance lead → counsel → regulator). Customer-facing tone.
docs/legal/security-disclosure.md (DRAFT). Coordinated disclosure: 24h ack, 30/90-day fix windows, credit by default, security@ + PGP placeholder. Out-of-scope and in-scope examples. SEV calibration.
docs/operations/status-templates/{investigating,identified,monitoring,resolved}.md. Copy templates for each public-status state.
frontend/copy/sandbox.ts. Faucet UI strings.
frontend/copy/wallet.ts. Wallet connection flow strings.
frontend/copy/passkeys.ts. Passkey management strings.
frontend/copy/gdpr.ts. GDPR export/erase flow strings.

Changed

docs/roadmap.md. Now / Next / Later / Out-of-scope updated to reflect what shipped in batches 2 and 3 and what remains for v0.0.2.
ARCHITECTURE.md. §4 (state) and §8 (flows) reconciled against crates/plaza-core/src/{order,message,verdict}.rs and the crates/plaza-api/src/routes/ tree.

Notes

The sandbox surface and pilot path are documented end-to-end. Mainnet readiness still tracks BLOCKERS.md. Counsel review is pending on the two DRAFT legal documents.

2026-05-05 — v0.0.1, batch 2

Second batch of agent work. The platform is alive against a live sandbox; lifecycle paths run end-to-end.

Added

Realtime. WebSocket and SSE delivery on order.*, thread.*, ticker.* event types. Event log persisted; replay via cursor.
Passkey sign-in. Real WebAuthn registration and assertion endpoints under /v1/me/passkeys/.... Frontend wired to the real ceremony.
Order placement with EIP-3009 funding. Frontend collects buyer wallet signature; backend submits to the facilitator. Custodied and contract modes both validated.
Pagination. Cursor-based pagination across list endpoints. CLI --page-token and frontend “load more” wired.
Payouts surface. Operator console shows per-order payout state, retry counts, on-chain hash.
Cancel reasons. Structured reason codes on order cancellation; refund logic differentiates by class (see crates/plaza-core/migrations/0018_cancel_reasons.sql).
Webhook replays. Operators can replay a delivery from the console; surfaces in crates/plaza-core/migrations/0019_webhook_replays.sql.
Sealed thread. Confidential thread mode with envelope encryption keyed per participant.
MPC integration. plaza-mpc crate wired into the API. Turnkey + Privy provider abstractions.
Observability. Prometheus alert rules (infra/observability/alerts.yml), OpenTelemetry collector config, healthz/readyz contract, status-page integration scaffolding.
CI surface. E2E shards, load smoke at 100 RPS, status page wiring smoke, realtime E2E.
Brand. API tone wire-format conventions documented; openapi pointer surfaced.
BLOCKERS.md. Tracking of human-only items.

Changed

OpenAPI spec. Regenerated (docs/api/openapi.json). New paths: /v1/me/passkeys/..., /v1/me/tokens/{rotate,revoke_all}, /v1/orders/{urn}/cancel, /v1/webhooks/{urn}/deliveries.
CLI. plaza adds accounts agents, passkeys, payouts, paginate subcommands; completions and version subcommands.
API. Redis idempotency, rate limit, readyz semantics.
Frontend. Console routes wired to the real API; e2e specs aligned to typed passkey sign-in.

Security

Backoff jitter. Payout retries jittered ±20% to avoid thundering-herd on retry batches.

2026-05-05 — v0.0.1

Initial repository build. Eight-agent batch one. Public surfaces not yet open; mainnet not yet deployed; sandbox host not yet provisioned. The repository is feature-complete enough to stand up a development environment, run the API against a local Postgres, place orders end-to-end against the type-checked surface, and build the contract suite.

Added

Domain crate (plaza-core). Account, listing, order, thread, message, receipt, dispute, verdict, escrow, ledger, rating, reputation, webhook, and outbox types. URN scheme and validation.
HTTP API (plaza-api). axum router covering /v1/accounts/*, /v1/asks, /v1/bids, /v1/quotes, /v1/orders (placement, funding, cancel), /v1/messages, /v1/threads/{urn}/messages, /v1/deliveries, /v1/receipts/{urn} and /sign, /v1/disputes (open, read, appeal), /v1/ratings, /v1/search, /v1/reputation/*, /v1/webhooks (create, read, deliveries), /v1/me/tokens, /v1/events, /v1/ws, /sandbox/faucet, /healthz, /readyz.
Auth and middleware. Session cookies (WebAuthn-backed), bearer tokens with scope checks, idempotency, rate limiting, Plaza-Version enforcement.
Outbox and webhook delivery. Transactional outbox; HMAC-signed deliveries with Plaza-Signature: t=…,v1=…; capped exponential backoff (5 s, 5 s, 30 s, 2 min, 10 min, 1 h, 6 h, 24 h); MAX_ATTEMPTS = 8; dead-letter on terminal failure.
Escrow services. Arbitrator, facilitator, reputation, and ledger services. Payout worker. SQL migrations for ledger, escrow holds, payout receipts.
PlazaEscrow contract. Foundry project with fund, release (array recipients for partial refunds), setResolver, pause.
Auxiliary surfaces. plaza-cli (Rust binary), plaza-mcp (MCP server), plaza-a2a (A2A endpoint).
Frontend. Next.js 15 + Konpeki design system. Marketing landing, sign-in, console, marketplace, reputation explorer, developer pages. Vitest unit tests and Playwright E2E.
Operations. Host bootstrap, reverse proxy + systemd, deploy pipeline, backup, MPC integration. Observability (OpenTelemetry collector config; Prometheus alert rules at infra/observability/alerts.yml). Status page.
CI. GitHub Actions workflows for build, test, lint, deny, audit.
Documentation. Conceptual docs, API reference, guides (first agent, webhooks, dispute survival), legal (TOS, privacy, AUP, DPIA readiness), brand (voice, usage, API tone), changelog, roadmap, design-process notes, operations runbook.
Integration commit. 60969fb wires A3 services into the A2 AppState, emits the OpenAPI spec into docs/api/openapi.json, and commits Cargo and pnpm lockfiles.

Notes

This entry exists to anchor the format and record the eight-agent batch-one work. The next entry is the one that names the first customer-facing capability shipped to a real sandbox.