{"what_this_is":"Every notation of a procedure change: the SOP, the version that went live, when, and the change-log line(s) for that version. Written automatically at deploy; the service refuses to start if an SOP text changed without a notation.","notations":[{"sop_id":"SOP-13","version":"2026-10-15","title":"Outreach and communications record","deployed_at":"2026-10-15T18:52:20.049479+00:00","changes":[{"date":"2026-10-15","change":"Owner: 'stay $1 under the threshold for fast approvals.' Every price except Roster 150 ($3,600, unchanged) now sits one dollar under its approval line: Roster 500 $9,600→$9,999 and enterprise 1,000 $9,600→$9,999 (federal micro-purchase threshold $10,000, 2 CFR 200.320); enterprise 5,000 $30,000→$29,999; Audit Desk $2,400/$4,800/$12,000→$4,999/$9,999/$14,999; bundles $150/$300→$249/$499; auditor-change weekly $600→$999; Audit Calendar + Forms Desk $600→$999 (still included with any roster); Handover licence $24→$36 per customer-month, minimum $480→$720. Letters re-render at send time from the current constants (re-render now keyed on text, not form label — two queued letters found still quoting $7,200 were corrected). Customer-facing wording: 'body' replaced by customer/organization/agency across pages and letters."}]},{"sop_id":"SOP-13","version":"2026-10-14","title":"Outreach and communications record","deployed_at":"2026-10-14T17:01:28.715480+00:00","changes":[{"date":"2026-10-14","change":"Owner: test the threshold on the larger bodies — 'they have the money'. Roster 500 $7,200→$9,600 (still under the $10,000 federal micro-purchase threshold, 2 CFR 200.320, and under Pennsylvania county/municipal quote thresholds). Roster 150 stays $3,600; enterprise, Audit Desk, Handover licence unchanged. Letters render the price at send time; queued letters inherit it."},{"date":"2026-10-14","change":"Owner: 'leave Roster 150 ($3,600), change everything else' at the top of the list. Enterprise roster 1,000 names $6,000→$9,600 and 5,000 names $21,000→$30,000 (health plans, health systems); Audit Desk firm-wide (200+ clients) $9,600→$12,000. Unchanged: Roster 150 $3,600, Audit Desk $2,400/$4,800 and bundles, Handover licence $24/body-month, Partner API tiers, the one free demo receipt. Letters and pages read these constants at render time."},{"date":"2026-10-14","change":"Owner: hand-holding for departments that lack the experience, 'based on stated documents and procedures, nothing more nothing less.' Audit Calendar (dated reminders by fiscal year end, two audiences, each quoting the controlling section as the eCFR serves it) and Forms Desk (an answer box that draws only from the Forms Register, procedure steps, eCFR text and the body's own filing; every sentence cited; forbidden determinations stripped in code; every exchange hashed and logged) shipped. Priced as one product: $600 a year per body, included with any roster, Audit Desk or enterprise roster; thirty desk questions a day free without an account. Owner's direction on price: included in the raised tiers unless a separate sale returns more — the desk is kept as the entry step and the reason to stay, not a separate knowledge product."}],"amended_at":"2026-10-14T18:34:31.797455+00:00"},{"sop_id":"SOP-13","version":"2026-10-13","title":"Outreach and communications record","deployed_at":"2026-10-13T03:04:32.689997+00:00","changes":[{"date":"2026-10-13","change":"Order path: every desk letter's offer line now ends 'on invoice, the quote is one step at /order' (forms auditor/health/insurer/short -2026-10-13). Queued letters are re-rendered from the current form when read for sending, so a price or offer change never ships stale without a manual rewrite; nothing else in the letter changes."},{"date":"2026-10-13","change":"Owner: 'We can send 20 emails per day. Please increase.' Daily cap of new organizations raised 5 → 20 (partnerdesk.DAILY_NEW_CAP; compliancedesk and the sealed outreach.py kept consistent). Every other rule unchanged: published office inboxes only, no personal-named addresses, 08:00–12:00 Eastern weekday window, holy-day rest, stop on reply/no/bounce, follow-ups do not count toward the cap."}],"amended_at":"2026-10-13T22:50:52.203033+00:00"},{"sop_id":"SOP-13","version":"2026-10-12","title":"Outreach and communications record","deployed_at":"2026-10-12T23:43:29.686613+00:00","changes":[{"date":"2026-10-12","change":"Owner: 'prices are not too low… we have to eat; free things don't pay the bills.' Roster 150 $2,400→$3,600, Roster 500 $4,800→$7,200; enterprise roster $4,800→$6,000 (1k) and $18,000→$21,000 (5k); Audit Desk tiers and bundles unchanged. The 'first 25 names free' offer is withdrawn from every letter, follow-up, page and the dossier slide; the one free receipt at /screening stays as the demo; the first 25 names are now the first delivery under a signed roster, within 48 hours of the order. Auditor-change weekly list: one free issue (was four). Every unsent letter in every desk was regenerated so no body is quoted a number we then raise."},{"date":"2026-10-12","change":"Owner: 'we’re not gonna let people clone us without making some kind of money on any part of what we do.' Audit Handover licence added (pricing product handover_license; GET /api/partner/v1/handover/{UEI} under a partner key; $24 per body per month read, $480 minimum, or revenue share at 20% with the same floor; 'Read by Alpha Covenant Holdings' stays visible, brand as issued_via; spec §7b; Acceptable Use names unlicensed embedding). Roster product renamed 'Roster — counties, districts and authorities' (code county_roster unchanged). Queue audit this day: templates carry current prices; the only free item in any letter is the single demo receipt; Audit Desk tier prices ($2,400/$4,800) are unchanged by owner decision and are not stale."}]},{"sop_id":"SOP-14","version":"2026-10-11","title":"Monthly management review","deployed_at":"2026-10-11T03:17:17.817514+00:00","changes":[{"date":"2026-10-11","change":"Review inputs add: the two dollar products (/exclusion-settlements — OIG exclusion-employment settlements as titled, daily job oig_settlements_refresh; /cost-of-the-record — FAC procurement/S&D questioned-cost amounts as printed and EPA sector penalties, weekly job cost_record_refresh), the measurements register (owner stopwatch vs scripted path; minutes are never assumed), the AP contract uptake (ap_views count), and trade-key reads (EORI at the EC service, USCC at GLEIF; gsxt.gov.cn printed not read)."}]},{"sop_id":"SOP-13","version":"2026-10-11","title":"Outreach and communications record","deployed_at":"2026-10-11T03:17:17.807081+00:00","changes":[{"date":"2026-10-11","change":"DEVIATION RECORDED. The 00:05 UTC send queue fired on 2026-10-10 (8:05 pm ET Friday), inside the Sabbath (sunset 2026-10-09 22:38Z → 2026-10-10 22:37Z), and sent 5 letters (PA DGS COSTARS question, 3 press pitches, 1 government). The gate had no holy-day check. Correction: gate check 'holy_day_rest' added (fails while holyday.is_resting()); run_send_queue re-queues to the later of rest end + 10 min and the next cap reset; follow-ups hold; press skips with reason 'resting'. Rule as written: from sunset before a Sabbath or Torah feast day to sunset after, information and protection continue, commerce and outreach rest."},{"date":"2026-10-11","change":"Owner: 'make sure my name is off emails'; 'following up is what separates us'. Every send path signs 'Alpha Covenant Holdings — reference desk'; no personal name in any letter, follow-up, auto-reply prompt or operator draft; the reply mailbox stays until the LLC inbox exists. FOLLOWUP_NOTE reworded (no 'then stop'); second follow-up no longer says 'I will not write again'; deadline follow-ups 30/60/90 days before (by FAC expended) and 7 days after a missed date, re-read first, nothing sent when the file shows it handled."},{"date":"2026-10-11","change":"Law-firm desk (lawdesk.py): counsel named on Court of Federal Claims and FCA/S&D opinions via GovInfo (official; GOVINFO_API_KEY) → firm's own site → general office inbox only; DOJ counsel never targeted; GAO site refuses automation and is not read. Letter kind 'counsel': the opinion as printed, the dated receipt with FRE 902(13)/(14) certification, no characterization, no legal advice; first receipt free, Litigation Report at the published price."},{"date":"2026-10-11","change":"Audit Desk (auditdesk.py): single-audit CPA firms as the FAC prints them (auditor_firm_name; latest filing per body; state auditor offices excluded) → firm's own site via the auditor_email DOMAIN only (the FAC mailbox is a registrant contact and is never written to) → general office inbox. Letter kind 'auditor': the firm's FAC counts as printed, Part 3 §I / 2 CFR 180.300 workpaper receipts, client board, auditor-change list; first bundle of 25 free; published prices. Never an opinion on the audit or the client."},{"date":"2026-10-11","change":"Terms rewritten from the legacy agency text to the records service (service, what-you-decide, billing, acceptable use incl. FCRA non-CRA statement, no-advice, warranty); legal-entity disclosure kept in Terms, footer points to it. Owner: 'whatever protects the company … until I get the LLC set up'."},{"date":"2026-10-11","change":"Owner: 'we don't want to give people the answer' → A & B: letters no longer link the rule's how-to page or count the manual steps; the free offer is the first 25 names (same receipt the paid roster prints), with the county roster price stated in the letter ($2,400/yr to 150 vendors, $4,800 to 500). Deadline reminders go out 30 days ahead for bodies under $3M federal expended, 60 days for $3M–$25M, 90 days above $25M (FAC total expended, latest audit year); 7 days after a missed date, re-read first."},{"date":"2026-10-11","change":"Owner: 'we see the errors and needs based on their filings … approved.' Government discovery widened from Procurement/S&D (I) only to every finding kind the receipt answers: I (S&D), N with exclusion-screening text (42 CFR 455.436 / OIG LEIE monthly), M subrecipient monitoring (2 CFR 200.332 — letter says we cover only its exclusion and audit-results steps), and repeat findings of any type (letter says plainly the finding is not our file and points to the test next to it). Each kind has its own bridge, form line and ≤45-char subject; the auditor's severity line (material weakness / significant deficiency / repeat) is quoted as printed. Finding text now stored to 3,000 chars so the Condition paragraph is quoted. Same gate, cap, window."},{"date":"2026-10-11","change":"Owner: 'find deadlines … send reminders … selling ourselves.' Deadline Desk added (backend/deadlines.py, operator board /api/admin/deadlines): a daily scan of the government list reads two dates the public file prints — SAM.gov registration expiration (FAR 52.204-7) and the Single Audit due date computed from the FAC fiscal year end (2 CFR 200.512) — and queues a reminder letter (kind 'deadline') that states the date and the rule and offers the free receipts and the monthly roster. The letter never says late, lapsed or non-compliant. Same gate, same 5/day cap, same holy-day rest; never to a personal-named address, an address that said no or bounced, one promised no follow-up, or one written to within seven days; one letter per body per deadline."},{"date":"2026-10-11","change":"Owner: letters should land as offices open, not overnight. Send time moved from 00:05 UTC to 08:05 Eastern (America/New_York); run_send_queue holds and re-queues anything that fires outside 08:00–12:00 Eastern or on a weekend. Same gate, same 5/day cap, same holy-day rest."},{"date":"2026-10-11","change":"Owner: reach people by the dollars they are losing, facts only. Benefit-first letter templates drafted for review (memory/drafts/dollar_letters.md: time back → dollars at risk in the recipient's state/sector as printed → proof in hand); figures drawn at send time from /api/cost-record and /api/exclusion-settlements. Not wired until the owner approves."}],"amended_at":"2026-10-11T22:00:02.230187+00:00"},{"sop_id":"SOP-11","version":"2026-10-11","title":"Partner keys, customer data and roster handling","deployed_at":"2026-10-11T03:17:17.776434+00:00","changes":[{"date":"2026-10-11","change":"Second signing key key-pq-1 (ML-DSA-65, FIPS 204, dilithium-py reference implementation, not FIPS-validated) generated by the service and held in the database beside the Ed25519 key; published in the DID document; every receipt credential carries both proofs; Ed25519 remains the signature of record. No eIDAS claim."},{"date":"2026-10-11","change":"New collections and keys: oig_exclusion_settlements, cost_record_fac_qc, cost_record_facts, cost_record_measurements, ap_views (partner-scoped: a view is returned only to the key that made the read). Receipt keys extended with EORI and USCC; both print as exact-key rows from the official file that accepts them (EC EORI validation; GLEIF registration-authority id) and never as an identity conclusion. Partner API keys are shown once at creation and never stored in plain text — three internal research partners (p_7003310bbc, p_85b73880b4, p_fb8b1aed9c) lost their keys with an ephemeral pod and must be reissued by the operator if their CSVs are needed."}],"amended_at":"2026-10-11T22:00:02.122090+00:00"},{"sop_id":"SOP-14","version":"2026-10-09","title":"Monthly management review","deployed_at":"2026-10-09T07:04:59.383767+00:00","changes":[{"date":"2026-10-09","change":"Review inputs extended to the outreach register, Opportunity Watch, challenge comparisons, SAM quota trend and the new Sentinel kinds."}]},{"sop_id":"SOP-12","version":"2026-10-09","title":"Backups, disk and recovery","deployed_at":"2026-10-09T07:04:59.359889+00:00","changes":[{"date":"2026-10-09","change":"Provider-backup restore written as an owner step with a quarterly cadence; still OPEN — no provider-console restore has been recorded. The local restore drill remains the only rehearsed path."}]},{"sop_id":"SOP-09","version":"2026-10-09","title":"Release and deployment","deployed_at":"2026-10-09T07:04:59.337653+00:00","changes":[{"date":"2026-10-09","change":"Incident 2026-10-09 05:05 UTC: a unique index on a collection name already used by a legacy module (db.opportunities) raised in production bootstrap and left Road Watch, Opportunity Watch and other startup arming undone for 15 minutes while every page answered. Caught by readback of /api/health, fixed by renaming to db.opportunity_notices and guarding the index build; Sentinel now raises 'bootstrap_failed' (SOP-08). Readback step and collection-name check added above."}]},{"sop_id":"SOP-08","version":"2026-10-09","title":"Monitoring and availability measurement (Sentinel)","deployed_at":"2026-10-09T07:04:59.320305+00:00","changes":[{"date":"2026-10-09","change":"bootstrap_failed check added after the 2026-10-09 index incident (SOP-09)."},{"date":"2026-10-09","change":"Owner: produce other revenue streams. Government Data Status launched from Sentinel's own telemetry (backend/govdatastatus.py). Nothing new is read from any agency; the product is a view of checks we already make. Doctrine holds: counts and dates, vantage stated, no inference about the agency."}],"amended_at":"2026-10-11T22:00:01.978157+00:00"},{"sop_id":"SOP-04","version":"2026-10-09","title":"Source silence: did-not-answer and not-read","deployed_at":"2026-10-09T07:04:59.294181+00:00","changes":[{"date":"2026-10-09","change":"Refused-read rule written down: costars.state.pa.us, emarketplace.state.pa.us, pennbid.bonfirehub.com and ohiobuys.ohio.gov all publish robots.txt Disallow: / (read 2026-10-09) → not read, official link printed, owner e-alerts. The legacy FedConnect read under a browser user-agent was retired the same day as a breach of this rule."}]},{"sop_id":"SOP-13","version":"2026-10-09","title":"Outreach and communications record","deployed_at":"2026-10-09T04:15:57.276414+00:00","changes":[{"date":"2026-10-09","change":"DEVIATION RECORDED. Cranberry Township (FAC 2025-002, SAM.gov review documentation not retained; auditor Maher Duessel) was reached through its published Contact Us form as the sixth new organisation of the day — cap is five. Cause: the by-form path ran the pre-send gate against the preview database (cap read as open) and the production count was not checked first. Correction: /log-form now applies DAILY_NEW_CAP (was a stale 3) and refuses to record a cap-exceeding send unless a cap_exception note is supplied, so the register stays truthful; procedure step added — before any by-hand or by-form send, read the production register's count for the day. No further new organisations today; the queued COSTARS inquiry and government letters wait for the 00:05 UTC reset."}]},{"sop_id":"SOP-15","version":"2026-10-09","title":"Government Forms Register, Procedures and Record History","deployed_at":"2026-10-09T02:56:49.763538+00:00","changes":[{"date":"2026-10-09","change":"Owner: 'have we addressed all the government forms we can document?' → register grew 25→33 served, 8→12 not-served. Added where an official public record stands behind the line: 2 CFR 200.332 subrecipient monitoring (FAC+SAM), CMS-855 ownership/managing-employee screen (LEIE+SAM+state), OSHA 300A (ITA data + inspection record, Record History only), FAR 52.209-5/-11 offeror certifications (SAM+FAPIIS), FAR 52.222-50 / 2 CFR 175 trafficking clause (SAM+CSL), DOT DBE UCP directory (public state directories; PA), IRS 990 / TEOS (Record History), PA COSTARS contract in force (62 Pa.C.S. 1902; directory read pending and said so). Declined and listed: I-9/E-Verify, WH-347 payroll accuracy, non-PA licenses, FOCI self-representations. New procedure families: osha_recordkeeping, trafficking, dbe, irs_teos, coop_purchasing."},{"date":"2026-10-09","change":"Owner: 'press' the Pennsylvania path. COSTARS public supplier search publishes robots.txt 'Disallow: /' → the automated directory read is NOT built (SOP-04: a refused read is printed as 'not read' with the official link, never as 'no row'); register and procedure text corrected from 'being wired' to 'refuses automated reads'. DGS Guide to COSTARS Contracts (12-24) read: COSTARS-6 Software excludes hosted solutions → hosted services sit on the IT Services ITQ (ITQ-26/-27/-28) with a COSTARS election; that reading is printed as DGS's text, and a supplier-category question was sent to the published COSTARS mailbox under SOP-13 (one message, no follow-up)."},{"date":"2026-10-09","change":"Operating template GOV-01 (suspension-and-debarment purchase file for local governments, authorities and school districts; PA cooperative purchases) issued 2026-10-09 at /protocols, cross-filed to two-cfr-180-300 and costars-contract; it carries a pilot kit (CSV columns incl. forms, where to send, what comes back). Written from FAC findings Cranberry Township 2025-002 and City of Lancaster 2024-001."}],"amended_at":"2026-10-11T22:00:02.341673+00:00"},{"sop_id":"SOP-11","version":"2026-10-09","title":"Partner keys, customer data and roster handling","deployed_at":"2026-10-09T02:34:38.045731+00:00","changes":[{"date":"2026-10-09","change":"Owner: build what benefits our position. Added the per-receipt Certification of process and digest (FRE 902(13)/(14) shape; RFC 3161 TSA timestamp; Ed25519 signature; custodian declaration template; hash re-computed on view), linked from every /r/{id} page and /for-counsel, with an AU-C 500 evidence-hierarchy paragraph. Audit log and self-audit entries are now Ed25519-signed (SOP-06/07)."}]},{"sop_id":"SOP-07","version":"2026-10-08","title":"Daily self-audit and timestamp anchoring","deployed_at":"2026-10-08T10:17:07.533079+00:00","changes":[{"date":"2026-10-08","change":"Each daily self-audit entry now carries a detached Ed25519 signature over its entry_hash under the platform key (DID document, SOP-11); /api/audit/verify checks chain and signatures and counts earlier unsigned entries as predating the key."}]},{"sop_id":"SOP-06","version":"2026-10-08","title":"Corrections, withdrawal and CAPA","deployed_at":"2026-10-08T10:17:07.494685+00:00","changes":[{"date":"2026-10-08","change":"Owner adopted Ed25519 signatures on the audit log (entity-resolution / provenance memo). Every new corrections-log entry carries a detached signature over its hash under the platform key published in the DID document (SOP-11); GET /api/corrections/verify recomputes the chain and checks every signature. Entries older than the key are reported as unsigned, never back-signed."}]},{"sop_id":"SOP-05","version":"2026-10-08","title":"Matching method and person-level rows","deployed_at":"2026-10-08T10:17:07.462530+00:00","changes":[{"date":"2026-10-08","change":"Owner reviewed an entity-resolution memo (Fellegi–Sunter, Splink). Probabilistic linkage declined: a match probability printed beside a name is a score. Adopted the deterministic alternative: 'rows under a similar printed name — shown, not counted' (backend/namewiden.py; /api/public-record/similar-names, /method publishes the full normalisation). A row is similar only when its name equals the queried name after a fixed normalisation (upper-case, &→AND, punctuation dropped, standard abbreviations expanded, trailing corporate suffixes removed, leading THE dropped). Entities only; individuals never indexed. Nothing is counted, matched or merged on its account; the block sits in the receipt's identity section and on the print page."}]},{"sop_id":"SOP-09","version":"2026-10-08","title":"Release and deployment","deployed_at":"2026-10-08T02:47:13.563229+00:00","changes":[{"date":"2026-10-08","change":"Owner: 'Update homepage.' Front door re-pointed to the forms layer: descriptor keeps the approved phrase and adds 'the government's own record, cross-filed to the form you file'; hero names the form lines and the FAC type-I count (6,952 in 2024, linked); a Three Doors block (which forms apply to me → /maps; my own record → /your-record; a dated receipt now → /screening) with a Government Desk line; the chooser gains an RFP/contract door to /clause. Measured before/after at 1920px: height 1,724 → 1,968 px, words 624 → 714, links 72 → 78. Still one screen for the record statement and doors."}]},{"sop_id":"SOP-15","version":"2026-10-08","title":"Government Forms Register, Procedures and Record History","deployed_at":"2026-10-08T01:24:01.599205+00:00","changes":[{"date":"2026-10-08","change":"First issue. Owner: 'make it so easy for people to deal with the government when they deal with us … remain neutral.' Written after the register (25 forms), procedures (11 families), finder, Coverage Ledger, Record History, rule-as-printed (eCFR), Federal Register form-number index, FAC finding counts and Government Desk went live."}]},{"sop_id":"SOP-13","version":"2026-10-08","title":"Outreach and communications record","deployed_at":"2026-10-08T01:24:01.585129+00:00","changes":[{"date":"2026-10-08","change":"Letters link the recipient's form procedure page (/forms/{id}, steps as written with the auditor's test) rather than describing the process in our words. Downstream target lists may be drawn from FAC findings by compliance type (public, by report id) but every recipient is still reached only through a published procurement, grants or general route under the existing checks and the 5-per-day cap."}]},{"sop_id":"SOP-11","version":"2026-10-08","title":"Partner keys, customer data and roster handling","deployed_at":"2026-10-08T01:24:01.571532+00:00","changes":[{"date":"2026-10-08","change":"Coverage Ledger (GET /api/batch/{id}/coverage) is partner-key data: computed per request from the partner's own rows, never stored or shown publicly, never attributed to a named roster on any public page. Governed with SOP-15."}]},{"sop_id":"SOP-03","version":"2026-10-08","title":"Source onboarding and held-file refresh","deployed_at":"2026-10-08T01:24:01.480219+00:00","changes":[{"date":"2026-10-08","change":"Reference reads added that are not party lookups and so sit outside the source freeze: eCFR versioner API (regulation text as served, amendment dates, hash) and Federal Register API (documents naming a form number), cached 7 days / 24 h; FAC finding counts by type and year from the existing FAC source. Governed by SOP-15."}]},{"sop_id":"SOP-03","version":"2026-10-07","title":"Source onboarding and held-file refresh","deployed_at":"2026-10-07T15:12:03.747720+00:00","changes":[{"date":"2026-10-07","change":"Source freeze adopted (reviewer, owner): no new held file or lookup without a named buyer. Exception made the same day with the buyer named — federal construction / prevailing wage column set (DOL Wage & Hour enforcement cases by printed name, official API) for PennDOT and federal-aid primes; the DOL debarment list and OSHA Severe Violator log refuse automated reads (HTTP 403) and are printed not read with the official link, never as no record. The free DOL API key returned HTTP 429 during the first production-style test; that state prints as did not answer — owner action: DOL Open Data key with higher quota."}]},{"sop_id":"SOP-13","version":"2026-10-07","title":"Outreach and communications record","deployed_at":"2026-10-07T12:40:27.016116+00:00","changes":[{"date":"2026-10-07","change":"Stacked-systems audit found a legacy autonomous job ('Record Outreach', outreach.py, built 2026-09) still armed in production: it drew carrier contact emails from the FMCSA Motor Carrier Census — a registrant-record route this SOP forbids — and its log shows 2 sends on 2026-09-24. Sealed (jobs cancelled at startup, handlers dropped); those addresses are never contacted again. Reported here because the rule is that nothing stale stays quiet."}]},{"sop_id":"SOP-05","version":"2026-10-07","title":"Matching method and person-level rows","deployed_at":"2026-10-07T05:59:19.853132+00:00","changes":[{"date":"2026-10-07","change":"Evidence link corrected: /api/receipts/spec (404) → /api/spec/receipt/v1."}]},{"sop_id":"SOP-02","version":"2026-10-07","title":"Receipt production","deployed_at":"2026-10-07T05:59:19.826716+00:00","changes":[{"date":"2026-10-07","change":"Evidence link corrected: /api/receipts/spec (404) → /api/spec/receipt/v1."},{"date":"2026-10-07","change":"Owner: 'build what is needed' to tie receipts to the Government Forms Register. supports_forms block added (optional, requester-named, hashed with the body) on public, partner and roster receipts; HTML receipt prints it after Identity; re-run line carries forms=. Register grew 13 → 25 federal forms with a 'not served' list."},{"date":"2026-10-07","change":"Owner: use the forms to show companies what is supposed to be conducted and their own record against it. Added per-form Procedures (steps as the regulation writes them, actor, when, record, citation, auditor's test — /api/public-record/forms/{id}/procedure and printable /html), Form Finder (/forms/finder), roster Coverage Ledger (GET /api/batch/{id}/coverage: rows with dated record / none held / source silent, by receipt step; counts and dates only), Record History (/api/public-record/history: what each source printed by year; no trend or score), and a forms_named field on every registry row so /forms shows 'named on N receipts' and Road Watch reports it."}],"amended_at":"2026-10-11T22:00:01.723099+00:00"},{"sop_id":"SOP-14","version":"2026-10-06","title":"Monthly management review","deployed_at":"2026-10-06T05:11:59.058961+00:00","changes":[{"date":"2026-10-06","change":"First issue."}]},{"sop_id":"SOP-13","version":"2026-10-06","title":"Outreach and communications record","deployed_at":"2026-10-06T05:11:58.960341+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP."}]},{"sop_id":"SOP-12","version":"2026-10-06","title":"Backups, disk and recovery","deployed_at":"2026-10-06T05:11:58.861100+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP."}]},{"sop_id":"SOP-11","version":"2026-10-06","title":"Partner keys, customer data and roster handling","deployed_at":"2026-10-06T05:11:58.762929+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP; challenge handling added."}]},{"sop_id":"SOP-10","version":"2026-10-06","title":"Dependency, vulnerability and SBOM maintenance","deployed_at":"2026-10-06T05:11:58.665064+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP."}]},{"sop_id":"SOP-09","version":"2026-10-06","title":"Release and deployment","deployed_at":"2026-10-06T05:11:58.565607+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP."}]},{"sop_id":"SOP-08","version":"2026-10-06","title":"Monitoring and availability measurement (Sentinel)","deployed_at":"2026-10-06T05:11:58.467814+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP; sop_review_overdue finding added."}]},{"sop_id":"SOP-07","version":"2026-10-06","title":"Daily self-audit and timestamp anchoring","deployed_at":"2026-10-06T05:11:58.368140+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP."}]},{"sop_id":"SOP-06","version":"2026-10-06","title":"Corrections, withdrawal and CAPA","deployed_at":"2026-10-06T05:11:58.269688+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP."}]},{"sop_id":"SOP-05","version":"2026-10-06","title":"Matching method and person-level rows","deployed_at":"2026-10-06T05:11:58.171660+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP."}]},{"sop_id":"SOP-04","version":"2026-10-06","title":"Source silence: did-not-answer and not-read","deployed_at":"2026-10-06T05:11:58.073199+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP."}]},{"sop_id":"SOP-03","version":"2026-10-06","title":"Source onboarding and held-file refresh","deployed_at":"2026-10-06T05:11:57.976175+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP."}]},{"sop_id":"SOP-02","version":"2026-10-06","title":"Receipt production","deployed_at":"2026-10-06T05:11:57.878271+00:00","changes":[{"date":"2026-10-06","change":"Written as SOP."}]},{"sop_id":"SOP-01","version":"2026-10-06","title":"Document and records control","deployed_at":"2026-10-06T05:11:57.553066+00:00","changes":[{"date":"2026-10-06","change":"First issue of the quality system: manual, 14 SOPs, records register, review log, Sentinel overdue finding."}]}],"count":41}