Changelog

What changed in composerID’s documentation, contracts and reference code, newest first. Every entry is shipped and checkable in the public docs; nothing lands here before it is real.

September 2026
Recent changes
DateChange
4 Sep 2026Authentication documented and implemented. OAuth 2.0 client credentials at POST /v1/oauth/token: an hour-long bearer token carrying only the scopes the client was granted (six scopes, one per capability), 403 insufficient_scope when a route needs more, RFC 6749 error bodies. Personal sandbox keys remain accepted with every scope. The OpenAPI document declares both schemes and the scope on every operation; the sandbox implements them and the conformance pack checks them.
4 Sep 2026Blog. Twelve posts on how composerID works and what building it against real vendor specifications taught us: the Intent ID, decide/publish/execute, preflight, idempotency, the never-sent boundary, chat intake surfaces, the Beeline mapping, reconciliation postures, docs-watch, the conformance pack, the auth model and the vocabulary of the landscape. Every post is tagged “Written with Claude” and says what that means. RSS at /blog/feed.xml.
4 Sep 2026Legal set published. Terms of Use, Privacy Policy, API Terms, End User Terms and a Data Processing Agreement with its Annexes (description of processing, technical and organisational measures, sub-processors, UK Addendum), all under the law of England and Wales and the UK GDPR. The footer links to every one.
4 Sep 2026Conformance pack. The documented /v1 contract as a runnable test pack: fifteen claims (bearer auth, client credentials, every operation routed, id format, version bumps, the preflight gate, deterministic idempotency and replay, the append-only timeline, signed webhooks, passthrough, discovery) run against any deployment URL. The sandbox passes it in CI, so the pack is the acceptance test for the production service.
2 Sep 2026Docs watch tells blocked from broken. Vendor portals that refuse automated fetches are reported as blocked, with the last verified date, instead of as broken links. Globality citations moved to the vendor’s new documentation locations.
August 2026
DateChange
13 Aug 2026Manuscript API documented. The full record behind every published score: assessments, documents, surveys, workflows and signed webhooks, served from the live backend. Access per programme.
13 Aug 2026Beeline verified against primary sources. Every claim on the Beeline page is now checked against Beeline’s 14 published OpenAPI specifications; the field-level mapping names the real create schema and its required fields, and coverage status is mapped. The page gains a flow diagram and two assurance sections: what crosses the boundary (including what is never sent), and the exact least-privilege scopes requested.
13 Aug 2026Beeline transport proven offline. The reference transport implements the documented behaviour (per-audience 24‑hour tokens, scope-error handling, rate-limit backoff, duplicate safety on the request’s own externalId, webhook validate and event-history recovery) against a scripted fake tenant over real HTTP.
12 Aug 2026The evidence pack is the Compliance File. Renamed from Defence File in all prose; the schema keeps the old name until a versioned rename.
11 Aug 2026Every diagram works on mobile. Each ships as a landscape and portrait pair; the portrait variant shows the same content, not a reduced one.
Early Aug 2026ServiceNow joins twice. As a destination and as a communication surface where the diagnostic runs. Provider pages gain connection scorecards; field-level detail moves behind free developer access.
Early Aug 2026Runnable sandbox. The documented /v1 surface runs as a sandbox with mock destination tenants and a narrated demo covering create, plan, preflight, enrich, publish, replay, drift and webhooks.
Jul 2026Coverage grows to 35 documented destination pages across VMS, sourcing, orchestration, contract management, ERP, service management, HRIS and ATS, driven from one registry with CI checking for drift.

Looking for what is planned rather than shipped? Coverage status per platform (mapped, documented, roadmap) lives on the platform overview.