VSO更新VAP正文引用与研究状态：签名验证修复仅在main
汇总11月8日网站核对之后已合并的更新，分别说明当前开发版、固定实验发行物与历史测试记录。
签名验证修复仅在main，固定ZIP未包含
VAP PR #68强化实验性Python／Node互操作演示对异常Ed25519输入的拒绝。修复已进入main（35e56ba，并包含于e00ee5a），但固定于cbd4502的vap-interop-demo-v0.2.0 ZIP不包含此修复。本公告不表示替换ZIP或发布新版。实验扩展仍未采纳，独立第三方复现尚未成立。
main snapshot · e00ee5a · Fixed prerelease ZIP · cbd4502 (not patched)
当前VAP正文引用 · 2026-11-12
正文仍为v1.2.0 Draft 3，包含编辑勘误E-2026-11-05及G-2撤回说明。SHA-256与主站11月11日引用相同；VAP子站之前显示11月3日旧摘要。本次引用核对不代表提案采纳。实验扩展未采纳，独立第三方复现尚未成立。
VAP v1.2.0 Draft 3 · e00ee5a · SHA-256 history
SHA-256: a35d5e082fd4b2f9921a78b1a71df263018320375e09fa18cf81533a18a19998
限定范围的签名修复 — VAP #68
两个实现均在调用密码库之前拒绝小阶公钥及签名R点、非规范点编码、达到或超过群阶的标量。已观察到的接受需要调用方同时替换角色信任密钥；保留原始可信密钥时，篡改包会被拒绝。后端行为存在运行环境差异。这不是完整素数阶子群验证，也不是新增VAP规范要求。记录的41个测试方法包括既有32项与新增9项；参数化输入不另行累加。原有11个向量／清单文件保持不变。
VAP文档与变更流程提案 — #66、#67、#69
文档区分会话／令牌有效性、权限时间区间和撤销证据，并区分政策来源、提案与已采纳规则。证据验证不能推导为预防控制，LAP仍是未注册的外部提案。变更流程及CHANGE-002候选清单尚未采纳，正式编号、决定、缺失的规范文字与向量仍待确定。IETF下一稿对应表是未提交的提案，不是新修订版发布，也不表示已启动公开审查或获得委员会批准。
VCP、SDK与历史引用
VCP #30／#31修复摘要元数据并澄清限定勘误及ERASURE表述，不替换已签名数据，也不确立完全符合VAP。SDK #16／#17区分开发文档与既有发行版，并引用未采纳的三值验证提案。CAP与参考实现区分历史评估和当前源码检查。导航、可选功能安装及CI维护各有独立范围。
Explorer与公开说明
GUI #28及API #30区分上报元数据与已验证的锚点、精度和认证状态；网站 #216已部署GUI修正。本公告不重新发行Explorer，也不将模拟API当作VCP v1.2原生验证器。保留产品、运营主体、LAP关系与事件来源的既有更正；PPC意见提交仍为单独记录。
自有CI与独立复现分开说明
截至11月12日23:44 JST，所检查更新仓库最新分支提交对应的36次工作流均已成功完成。vcp-sdk-spec、.github、cap-spec三个文档仓库没有当前提交的运行记录，不计入成功数。签名修复CI及其提交另行链接。这是已公开CI记录的核对，不是新的独立执行，也不表示最新文档提交重新运行了所有历史实验。
PR #68 · first-party signature-fix CI
测试和CI属于自有合成环境，不确立采纳、认证、完全符合性、生产适用性或独立复现。固定发行物保留原有32项测试、每个实现8个包（预期PASS 2／FAIL 6）的历史记录；后续41个方法的结果不归属于该ZIP。
已合并的来源记录
44 merged PRs · 8–11 November 2026
- vcp-site/pull/218 — docs(maintenance): record VAP site external-proposal deployment and corrections entry
- vcp-site/pull/219 — fix: replace "Regulator-Ready" preview image and identify the operating company on the homepage
- vcp-site/pull/217 — docs: announce public comment on Japan PPC draft security-measures guideline
- vcp-site/pull/216 — fix: refresh VAP disclosures and stage Explorer demo corrections
- vcp-explorer-api/pull/30 — fix: align event search vocabulary and bound Explorer API evidence claims
- vap-spec/pull/69 — docs: clarify evidence limits and prepare an unadopted VAP change process
- vcp-sdk-spec/pull/6 — docs: withdraw unavailable conformance-tool commands from archived guide
- .github/pull/13 — docs: separate the Legal AI Profile proposal from the VAP profile registry
- vcp-nasdaq-rta-reference/pull/5 — docs: bound Nasdaq sample integrity and regulatory claims
- vcp-supervision-node-poc/pull/5 — fix: install supervision API and dashboard extras from source
- vcp-sdk/pull/17 — docs: reference three-valued verification proposal revision 0.2
- cap-spec/pull/9 — docs: distinguish historical CAP mapping from the current VAP source check
- vcp-spec/pull/31 — docs: align Japanese and Chinese ERASURE wording and verify source digests
- vcp-explorer-gui/pull/28 — fix: distinguish Explorer demo metadata from verified anchors and certification
- vap-spec/pull/68 — fix: reject small-order Ed25519 trust and signature inputs in interop demo
- vcp-spec/pull/30 — docs(ci): repair digest metadata and record bounded v1.2 errata triage
- vcp-tradingview-rta-reference/pull/6 — ci: run existing Python test suites
- vcp-gdpr-poc/pull/4 — ci: run existing Python test suites
- vcp-explorer-gui/pull/27 — docs: link the published unified VCP SDK
- vcp-sdk/pull/16 — docs: distinguish SDK development revisions and UUID format checks
- vcp-site/pull/215 — docs(ci): repair repository navigation and restrict validation token
- vcp-nasdaq-rta-reference/pull/4 — docs: identify historical assessment and refresh current checksums
- vcp-ibkr-rta-reference/pull/5 — docs: identify historical assessment and refresh current checksums
- vcp-cloudflare-rta-reference/pull/4 — docs: identify the historical WorldFirst PDF
- vcp-payout-dispute-poc/pull/5 — docs: scope the historical WorldFirst report
- vcp-tradingview-rta-reference/pull/5 — docs: repair TradingView integration repository links
- vcp-supervision-node-poc/pull/4 — docs: correct repository links and AI Act application dates
- .github/pull/12 — docs: align VSO profile release and repository status
- vap-spec/pull/67 — docs: record 10 November Japan regulatory monitoring and source follow-up
- vap-spec/pull/66 — docs: clarify provider session validity and revocation evidence gaps
- evidect-site/pull/42 — docs: update Chainalysis impact assessment with dated follow-up
- vcp-site/pull/214 — docs: add Chainalysis disclosure update and separate Storm-3358 review
- vcp-site/pull/213 — Link VeraSnap page to its product site (EN/JA/ZH)
- vcp-site/pull/212 — Correct VeraSnap page technical details (EN/JA/ZH)
- vcp-sdk/pull/15 — ci: move pinned actions to Node 24 releases
- vcp-site/pull/211 — ci: move pinned actions to Node 24 releases
- vcp-supervision-node-poc/pull/3 — ci: move pinned actions to Node 24 releases
- vcp-cloudflare-rta-reference/pull/3 — ci: move pinned actions to Node 24 releases
- vcp-transparency-backend/pull/3 — ci: move pinned actions to Node 24 releases
- vcp-payout-dispute-poc/pull/4 — ci: move pinned actions to Node 24 releases
- cap-srp/pull/4 — ci: move pinned actions to Node 24 releases
- evidect-site/pull/41 — ci: move pinned actions to Node 24 releases
- vap-spec/pull/64 — ci: move pinned actions to Node 24 releases
- vcp-explorer-api/pull/29 — ci: move pinned actions to Node 24 releases
36 first-party workflow records · checked 12 November 23:44 JST
- vcp-spec · VCP v1.2 contract · 749b145
- vcp-spec · pages build and deployment · 749b145
- vcp-site · pages build and deployment · b416009
- vcp-site · Site CSP and script integrity · b416009
- vcp-site · CI · b416009
- vcp-site · Local agent settings guard · b416009
- vcp-site · Compiled site CSS · b416009
- vcp-explorer-api · SDK evidence integration · 30fe0ad
- vcp-explorer-api · Local agent settings guard · 30fe0ad
- vcp-explorer-api · pages build and deployment · 30fe0ad
- vcp-explorer-api · CI · 30fe0ad
- vcp-explorer-gui · Hash Chain inspection regression · e143684
- vcp-explorer-gui · Explorer accessibility regression · e143684
- vcp-explorer-gui · SDK API GUI evidence integration · e143684
- vcp-explorer-gui · CI · e143684
- vcp-explorer-gui · Local agent settings guard · e143684
- vcp-transparency-backend · Local proof regression · 26a8b3b
- vcp-ibkr-rta-reference · Legacy evidence verification regression · 463709a
- vcp-nasdaq-rta-reference · Verifier status and distribution inventory · 41983b9
- vcp-cloudflare-rta-reference · Worker authentication regression · f713f11
- vcp-payout-dispute-poc · PoC result semantics · 58b61ee
- vap-spec · Wallet authorization evidence experiment · e00ee5a
- vap-spec · Cloud credential evidence experiment · e00ee5a
- vap-spec · Cloud credential collector pilot · e00ee5a
- vap-spec · Local agent settings guard · e00ee5a
- vcp-tradingview-rta-reference · Existing Python tests · a2b0c70
- vcp-gdpr-poc · Existing Python tests · 23fe49c
- vcp-supervision-node-poc · Supervision node verification regression · 47c1a49
- cap-srp · CAP-SRP verification regression · c340b7f
- evidect-site · Deployed reproduction entrypoint · 35ebf2f
- evidect-site · Local agent settings guard · 35ebf2f
- evidect-site · pages build and deployment · 35ebf2f
- vcp-sdk · Evidence adapter parity · 5f2f6d2
- vcp-sdk · ci · 5f2f6d2
- vcp-sdk · Local agent settings guard · 5f2f6d2
- vcp-sdk · Wallet authorization demo · 5f2f6d2
保留历史证据与发行物
保留Explorer在159项测试时的公告及历史试验记录。本次仅更新网站引用，不修改规范要求、既有实现、已签名数据、固定发行物或K3。未合并的Draft PR不计作已合并成果。