Release notes · updated continuously

What we've shipped. What's coming.

Every shipped item links to its commit. Every in-progress item has a target month. Every planned item has a target quarter and is honest about not being committed-to yet.

Strategic phase-level view: /roadmap · substrate version history: /changelog · suggestions: roadmap@promethean.software

Shipped6 items

  • Email-verified signup

    security

    Magic-link verification on signup. SDK ingest refused until verified — closes the identity-squatting gap (anyone-as-anyone-on-signup).

    shipped 2026-05-18 · 024adcc

  • /api/facts/* verifiable claims layer

    verifiability

    Every quantitative claim on the public site backed by a JSON endpoint. Trust anchor + sha256 fingerprint, live OTS calendar reachability, verifier line count, tier allowances, regulatory coverage.

    shipped 2026-05-18 · 7789e21

  • Runnable chain examples (/examples)

    verifiability

    Three pre-signed L12 chains (paysafe, cliniclens, civicgate) downloadable; copy-pasteable verify command; HowTo schema for LLM citation.

    shipped 2026-05-18 · 7789e21

  • Per-workspace ingest lock

    security

    Atomic Redis lock with exponential backoff + Lua-EVAL release. Closes the round-2 data-loss race where 10 concurrent ingests lost 4 entries.

    shipped 2026-05-18 · 3a56653

  • Stripe webhook event-id dedup

    billing

    SET NX on each event.id with 30-day TTL. Replayed webhooks ack as duplicate and skip handler — no double billing events.

    shipped 2026-05-18 · 024adcc

  • Verifier closed-field schema enforcement

    verifiability

    verify.mjs now rejects entries with unknown top-level fields. An attacker can't add a JSON field that gets silently stripped from the canonical form.

    shipped 2026-05-18 · 3a56653

In progress4 items

  • Stripe live mode (paid-tier checkout)

    billing

    STRIPE_SECRET_KEY + STRIPE_PRICE_<tier> env vars provisioned. Customer signup → /pricing → checkout → tier flips on webhook.

    targeting 2026-06

  • Resend + DNS-verified domain

    operations

    SPF/DKIM/DMARC records on promethean.software. Welcome, verify, tier-change, key-rotation emails deliver to real inboxes instead of console-logging.

    targeting 2026-06

  • npm publish of @promethean/runtime-ai

    developer-experience

    `npm install @promethean/runtime-ai` works from the official registry. Trusted-publisher OIDC token-less flow via GitHub Actions.

    targeting 2026-06

  • Three design partners, three verticals

    growth

    Fintech / healthtech / govtech operator each running a real production workspace, in exchange for case study + monthly product feedback session.

    targeting 2026-Q3

Planned6 items

  • HSM key custody hooks (Scale, Enterprise)

    security

    Operator signing key generated + held in a YubiHSM or AWS CloudHSM. Replaces env-var custody for tiers above Production.

    planned 2026-Q4

  • Federation: cross-workspace chain commit

    verifiability

    Production tier validates federation read primitives; Scale+ unlocks cross-workspace commit so a parent operator can vouch for a downstream's chain.

    planned 2026-Q4

  • On-prem deployment package (Enterprise)

    compliance-coverage

    Self-host the substrate + dashboard inside an operator's VPC. Targeting healthtech + govtech procurement that refuses external SaaS.

    planned 2027-Q1

  • Python runtime-AI SDK

    developer-experience

    Parity port of @promethean/runtime-ai in Python. Pinned canonical form so chains produced by either SDK are byte-identical.

    planned 2026-Q4

  • Pen test + public summary

    security

    External pen-test (Cobalt or Hacken). Full report private; one-page public summary on /security with sha256 of the full report.

    planned 2026-Q3

  • SOC 2 Type 1

    compliance-coverage

    Tooling: Vanta or Drata. Auditor: TBD. Targeting closure by end of 2026 so mid-2027 we can run Type 2 alongside.

    planned 2026-Q4

Why we publish this

A prospect evaluating Promethean against a regulatory deadline (PSD3 SCA, EU AI Act Annex III, DORA Art. 28, NIS 2) needs to know whether the capability they're depending on will ship before their deadline. Hiding the roadmap behind a sales call is a credibility tax. Publishing it is the trust we ask customers to extend back.