VSO · 2026-11-13
VSO adds ten source reviews and a fixed-demo known-issue notice
Two updates merged on 13 November are reflected here: website source reviews and documentation of the VAP interoperability demo release and its known issue. A dated warning has also been added to the GitHub release description.
1. Ten incident and development source reviews added
Website PR #224 adds ten reviews, bringing the registry to 64 entries: 19 registered and 45 source-verified, pending registration. The ten additions belong to the latter category. They are not ten newly confirmed incidents, and the total does not mean 64 registered cases.
The reviews include industry developments as well as incidents. Primary sources and secondary reporting, allegations and responses, and unresolved questions remain distinct. Correction records and examples of VAP limitations were updated. Unread original sources and uncertain causes or impacts are not presented as established facts. This is not an independent third-party review.
AI Incident & Development Registry · VAP Limits · VSO Corrections · vcp-site PR #224
2. Clarifying demo 0.2.0 publication and the known issue
VAP PR #70 updates three documentation files. The experimental prerelease was published on 8 November at 03:09 UTC (12:09 JST). The 7 November preparation text is retained as a historical record. The fixed tag and source ZIP remain at cbd4502.
The tagged verifiers do not explicitly screen Ed25519 inputs before backend verification. If a caller accepts a substituted trust file containing small-order role keys, the recorded altered pack passes all seven checks under Python cryptography 50.0.2 and Node 22.23.4. Node 24.22.1, the release toolchain, rejects it; the original demo-trust.json also rejects that pack. This is a conditional, backend-dependent first-party observation using synthetic inputs.
A party able to substitute trust can also sign with ordinary keys, so the trust file needs separate authentication in every case. This is not a claim that the original trust file or every environment accepts the altered pack.
PR #68 merged the explicit input policy into main. It is absent from the fixed tag, fixed ZIP and original 32-test record. This update changes the public explanation only: the tag, all five assets, checksums and historical execution evidence are retained. No replacement ZIP or new release is announced. Reports must pin the implementation commit.
GitHub · vap-interop-demo-v0.2.0 · RELEASE.md · b929556 · vap-spec PR #70 · PR #68 · main
Latest main CI and historical test records stay separate
The update sources are vcp-site 32dc736 and vap-spec b929556. All five workflows and 11 jobs for the website and both applicable jobs for VAP completed successfully. Website image comparison passed all 110 cases with zero failures and zero raster-noise allowances; the incorrect-CSS rejection control also passed. These are first-party CI results for these revisions.
vcp-site · 32dc736 · 11 checks · 110 image comparisons · vap-spec · b929556 · 2 checks
Sources and verification records
The earlier 13 November CI follow-up for website fix 720852c, the fixed demo’s original 32 tests, the Explorer 159-test milestone and other historical records remain intact. New results do not replace earlier runs or combine counts from separate scopes. Normative requirements, existing implementations, signed data, fixed distributions and K3 are unchanged.