# CertaRail OpenAPI changelog

This file records repository contract releases. It describes the canonical
OpenAPI snapshot and is not evidence of production deployment or external
provider execution.

## 0.29.0

- Compatibility: `breaking`
- Adds deterministic current-key, invalid-signature, and bounded rotated-key fixtures to the sandbox Webhook Inbox test-event generator.
- Publishes the generated signature scenario and receiver verification expectation while retaining append-only evidence and `external_calls=0`.

## 0.28.0

- Compatibility: `backward-compatible`
- Adds an explicit manual replay operation and append-only replay history for terminal sandbox Webhook Inbox deliveries, distinct from bounded retry processing.
- Exposes event/attempt/status/retry/HTTP/latency/timestamp evidence and keeps replay in-process: it preserves the exact signed envelope, does not consume retry budget, and makes no external HTTPS call.

## 0.27.0

- Compatibility: `backward-compatible`
- Adds the explicit TEST-bound Webhook Inbox lifecycle: create, challenge verify, activate, pause/reactivate, secret rotation with re-verification, revoke, and durable tombstone delete.
- Keeps signing secrets one-time and response-only, stores only their digests, requires explicit confirmation for irreversible transitions, and does not expose a LIVE authority from sandbox routes.

## 0.26.0

- Compatibility: `backward-compatible`
- Adds a documented, closed ALLOW/REVIEW/DENY hosted-sandbox fixture catalog and the concrete active decision request.
- Adds an idempotent logical reset operation with a ten-reset quota, append-only reset history, zero record deletion/external calls, and preserved decision/audit/outbox evidence.
- Adds durable `READY_FOR_FIRST_REQUEST` → `FIRST_API_SUCCESS` onboarding progress for the exact active fixture request.

## 0.25.0

- Compatibility: `backward-compatible`
- Extends self-service sandbox creation with a one-time 30-minute credential, five fixed scopes, a 100-request budget, digest-only persistence, and explicit `production_access=false`.
- Adds server-managed current, rotate, and revoke operations protected by a separate 24-hour management grant; exact replay never reveals plaintext material again.
- Documents hosted-sandbox bearer enforcement on the scoped Decision, Evidence, Movement, and Platform routes.

## 0.24.0

- Compatibility: `backward-compatible`
- Adds the role-gated self-service sandbox creation operation and its typed synthetic tenant, account, limited-role, onboarding-state, and audit-event receipt.
- The operation is sandbox-only, idempotent, PostgreSQL-backed, and explicitly does not issue caller credentials or production access.

## 0.23.0

- Compatibility: `backward-compatible`
- Adds tenant-bound public-submission, corporate-onboarding-draft, and secure-document sandbox operations without removing baseline operations.
- Documents generated operation pages, synthetic request and response examples, explicit sandbox boundaries, and related event metadata.
- Publishes deterministic reference, Try manifest, and client collections from the canonical OpenAPI source.