Skip to main content

v0.99.8.2: public passport accuracy, import validation, and security hardening

A broad quality release: the public passport stops making claims it should not, data imports validate what they accept, and a set of security hardenings lands across uploads, resets and public routes.

Public passport​

  • Long unbreakable values such as URNs and GTINs no longer overflow the passport layout on mobile.
  • The passport no longer claims optional certificates are outstanding; only genuinely required documents are shown as missing.
  • Regulation article citations on public surfaces were audited and corrected.
  • Links to child components on a passport are now access-gated, and the machine-readable JSON-LD gains schema.org hasPart links to child-component passports where those are publicly resolvable. See DPP endpoints.
  • The demo platform's persona cards became real buttons.

Data entry and import​

  • Enum, type and range validation is now enforced consistently across CSV import, the AI-assisted write paths, and the web editor, so a value that the wizard would reject can no longer arrive through a side door.
  • The import preview now shows what the import will actually do before you commit it.

AI transparency and cost​

  • The EU AI Act Article 50(1) notice ("You are interacting with an AI system…") was added to six AI-verdict surfaces that were missing it.
  • AI usage cost is now attributed to the tenant rather than only the account owner, so usage reporting reflects who actually consumed the quota.

Security​

  • Password-reset requests are rate-limited.
  • Documents submitted to AI extraction get magic-byte (real file type) validation.
  • Public DPP routes fail closed if a published snapshot's integrity hash is missing.
  • Storage access is tenant-scoped at the database policy layer.