Changelog

1. 2026-10-22

   The edition specifies the authorisation contract. Every access token is DPoP-bound, for every client, and no client class uses Bearer tokens (A2, A6.3, B4.1). A6 defines client registration, the meaning of each scope and the access token's claims, with five new generated schemas and an authorisation example, and A9 defines the content of the log events that grant issuance, revocation, expiry, conditional reads and operators write. A4.1 adds a per-partition entry limit, and A3.2 says a handle's authority is the provider's DNS hostname, never an IP address. The error registry has 29 codes, adding the entry limit and the first-party sign-in and session refusals. The conformance manifest records a third kind of evidence, the reference implementation's own integration tests against real storage, which signing keys now have. The vocabulary's medical alert examples read "Synthetic medical alert". The test vectors are unchanged.

2. 2026-10-15

   The edition now publishes test vectors for canonical JSON, disclosure, the receipt chain, purge and 43 negative cases, signed with synthetic keys that must never be trusted. They are verified by the reference repository's own verifier and independently by a separate implementation built on Python's jwcrypto and rfc8785; that independent verifier is not published here. The normative statement audit maps every MUST and SHOULD to a conformance check or to the reason no suite can test it. The signed-object contract is settled in A5.4, A9 and A10, the error registry has 23 codes with their MCP forms in B3.4, and B1.10 tabulates the PDPP Core requirements. The conformance page now lists every check with its evidence.

3. 2026-10-05

   Edition 1.0-draft-1 of Open Personal Context is published, replacing document 0.2-draft. It has the core, the three bindings for PDPP, MCP and REST with an informative Linked Web Storage binding, the vocabulary registry, the conformance manifest, an adoption record for every standard it uses and a worked example for media. Every page of document 0.2-draft redirects to where its text now lives, and the 0.2-draft downloads stay published unchanged. The reference implementation is not released.

4. 2026-09-22

   The international privacy guide maps Autonym's design to privacy laws across Europe, Asia-Pacific, the Americas, the Middle East and Africa, with local notes and sources. Chapter A16 now specifies six deployment checks covering lawful processing, sensitive data, international flows, rights and retention, opt-outs and accountable operation. The reference implementation and operational evidence for these requirements remain pending. Conformance is not a legal compliance certificate.

5. 2026-09-21

   The scope additions clarify separate advertising consent, temporary situational preferences and two-way context contribution. They extend the draft's existing grants, provenance and validity dates. Advertising purpose parsing is implemented; the consent, temporal, contribution and migration services remain in development. No recipient conformance is certified.

6. 2026-09-18

   Specification v0.1 draft. @autonym/schema 0.0.1 and autonym-sdk 0.0.1 published as placeholders. Domains and organisation registered.

References to other standards and projects describe intended technical alignment only and do not imply endorsement or partnership.