VSO updates verification-status disclosures and the public Explorer
VSO is publishing a consolidated record of 23 pull requests merged across 23 repositories on 3 November 2026 (JST). This website update aligns the current VAP source reference, the public Explorer GUI and the announcement archives with those merged revisions.
Scope and verification status
These are disclosure corrections, bounded implementation repairs and first-party checks. They do not establish full VCP/VAP conformance, certification, production readiness or independent third-party reproduction. Experimental extensions remain unadopted; independent reproduction is not established. A local test reported in a PR, first-party CI, this website deployment check and an independent new execution are different records.
Current VAP text and digest
VAP PR #45 adds the previously published commercial-claim withdrawal directly beside historical G-2 and records the disposition. The original historical text is retained. The withdrawn contract figure is not a verified commercial result and is not replaced with zero. The document remains v1.2.0 Draft 3; no normative requirement changed. The source correction is dated 2 November; this website notice is dated 3 November, after the merge.
VAP v1.2.0 Draft 3 · 5ed1084 · Digest history
SHA-256: 4eef5270fbd08bc1ffbae8f08d8bcb41a7f961a70b4a8e4edb75d6f2af280583
Public Explorer: inspect supplied links without overstating verification
GUI PR #22 stops unknown Trace IDs and event IDs from falling back to unrelated demo records. Search and detail requests are bound to the selected Trace ID and data mode; prior results are cleared during a new request, cancellation or failure. The Hash Chain page distinguishes LINKS_MATCH, LINK_MISMATCH, INSUFFICIENT_DATA and INVALID_DATA. Equality of supplied hash strings does not recompute event hashes or establish signatures, a trusted external anchor, completeness or a verified genesis boundary. NOT_CHECKED and NOT_ESTABLISHED remain visible.
Authentication, proof boundaries and conservative outcomes
FIX, IBKR and Nasdaq reference checks, and the transparency backend, stop treating unauthenticated local consistency as complete verification. Known contradictions and indeterminate trust remain distinct. CAP-SRP tightens proof binding and serialized verification; the Cloudflare and TradingView examples check configured credentials before ingestion or writing. TradingView retains failed in-memory anchor batches but does not establish persistence across restarts. The supervision-node example rejects unverified proof results and requires API authorization. These repository fixes do not imply that every reference service has been deployed or independently assessed.
Historical documents, assurance language and reporting routes
VCP specification, SDK/conformance guides, CAP documents and reference materials clarify historical status, license scope and unsupported assurance statements. The payout demo no longer presents a public prefix as a verified signature; the GDPR demo uses a reserved example address. vso-docs withdraws a confidential report from the current tree and replaces editable certificate forms with clearly historical forms; this is not a claim that repository history or caches have been erased. Explorer API #27 updates the security-reporting policy link, not API verification behavior. The three broker landing pages require analytics consent.
What the checks mean
The merged GUI PR links successful first-party CI for its final reviewed head, including browser, subpath, accessibility and container checks. For this static publication, we separately ran the GUI lint, production build and 52 Node tests, then checked the deployed bytes and desktop/mobile display. Container checks do not make GitHub Pages run the container or inherit its nginx headers. The existing Evidence Demo API and its fixed inputs are retained: local checks and full evidence status remain separate. Other PRs include a mixture of first-party CI and reported local tests; the source records below retain those distinctions. No combined cross-project test count is claimed.
Merged source records (23)
- vcp-nasdaq-rta-reference #2 — fix: reject unauthenticated success and clarify historical evidence provenance
- vap-spec #45 — docs: mark the withdrawn commercial claim directly in G-2
- vcp-spec #22 — docs: correct VCP v1.2 status and assurance wording in all three languages
- cap-srp #3 — fix: bind proofs, reject unverifiable logs and repair serialized verification
- cap-safe-refusal-provenance #3 — docs: identify historical AI-assisted research and license scope
- vcp-conformance-guide #5 — docs: clarify historical status and preserve license grants
- vcp-sdk-spec #5 — docs: identify the retained SDK release candidate as historical
- vcp-payout-dispute-poc #3 — fix: label public demo prefixes without claiming signature verification
- vcp-gdpr-poc #3 — fix: use a reserved example email in the crypto-shredding demo
- vcp-ctrader-rta-reference #2 — docs: disclose historical Merkle limits and clarify code licensing
- vcp-tradingview-rta-reference #4 — fix: authenticate webhook writes and retain failed anchor batches
- vcp-sidecar-guide #2 — docs: remove unsupported GDPR assurances from sidecar examples
- cap-spec #8 — docs: distinguish governance objectives from established independence
- vcp-transparency-backend #2 — fix: validate local proof boundaries and report unauthenticated matches
- vcp-explorer-api #27 — docs: link the organization private security reporting policy
- vcp-rta-reference #22 — docs: clarify code license scope and consolidate historical report
- vcp-explorer-gui #22 — fix(explorer): bind trace results and scope hash-chain inspection
- vcp-cloudflare-rta-reference #2 — fix: reject unconfigured Worker credentials before ingestion
- vcp-fix-rta-reference #3 — fix: stop reporting authenticated success from legacy consistency checks
- vcp-ibkr-rta-reference #3 — fix: stop reporting authenticated success from legacy consistency checks
- vcp-supervision-node-poc #2 — security: enforce API authorization and reject unverified proof results
- vso-docs #2 — docs: withdraw confidential legal-review report from the current tree
- vcp-site #180 — fix: require analytics consent on all broker landing pages
Earlier records and fixed artifacts remain available
The 159-test Explorer notice and subsequent historical test records are retained in the archive. Counts apply to their recorded versions and environments and are not added across revisions or operating systems. Current website references do not rewrite earlier pinned hashes, signed evidence, fixed distributions or K3. This publication does not adopt a proposal or merge pending drafts.