Changelog

Mirrored from CHANGELOG.md in the repository — edit that file, not this page.

All notable changes to this repository. The format follows Keep a Changelog; there are no tagged releases yet (every package is 0.1.0 and unpublished), so entries are grouped by the date they landed on main.

Unreleased

Added

  • Base Sepolia is the app's network unless a build says otherwise (NEXT_PUBLIC_CHAIN_ID), with zUSD, the testnet dollar, as what agents pay in; the local development network only when set outright. One chain in the wallet config: a wallet on another chain is switched.
  • Launch: what you build, where it runs (your own node on this device or on a server, with one install command that names the chain; or a node on the network, the best live shared runner picked for you), then the brief or the listing. My Agents: every agent's record (runs with answers and receipts, spend by service and by day, the jobs and their results). Deploy Agents left the nav; the page stays at /agents.
  • The faucet drips zUSD with the ZAI (50 and 1,500 once per wallet), live on the network's server; the faucet card sits on Launch's node step and links the public gas faucets.
  • The network in numbers: the directory keeps running totals of every settled session (gross, operators' net, protocol fee, stakers' share, refunds) per listing, per operator and for the network (/stats, /sessions, fees on every listing); a Network tab on ZAI with every node's capacity, the chain's contracts, the directory's health and how to get test funds; Your listings show each listing's fee split; the token tab shows where the supply sits on this network.
  • Planner nodes: a guide on who can run one, what they earn and how the runner picks; a "Sell planning turns" card on the seller's builder.
  • A node on a server: the installer keeps the chain, RPC, directory and faucet in ~/.aioum-private/env, read first at every start; a node bound beyond loopback answers to its own address as host; the smart account's balance and a withdrawal to the owner's wallet on the budget page.

Fixed

  • aioum call on a network with the signature-gated paymaster. The SDK's self-custody path sent every recorded paymaster the accept-everything encoding (address + gas limits, no sponsorship); AIOUMVerifyingPaymaster — what the local stack deploys with billing, and what a real chain runs — rejected it and the bundler answered FailedOpWithRevert (AA33 reverted, VP: data too short). The SDK now probes the paymaster once (gasMode): the accept-everything one sponsors as before, a billing sponsorship still wins, and on a signature-gated paymaster without one the smart account pays its own gas from an EntryPoint deposit that the owner-signed setup keeps funded (new gas step, gasDeposit option, depositGas/gasOnHand helpers). Regression tests pin the revert and the self-funded open (Foundry) and the op the SDK builds in each mode (unit).
  • A session key made in the app can open sessions on a network with the signature-gated paymaster. The app's own setup (dapp/lib/aa.ts, the Wallet budget page) had no gas step and assumed the accept-everything paymaster, so its keys hit the same AA33 reverted: VP: data too short. It now probes the paymaster the way the SDK does and, where the account pays its own gas, adds a Gas step that deposits the SDK's default 0.026 ETH to the EntryPoint for the smart account (skipped where the network sponsors, or while a prefund is already there). The page shows the step in plain words with its transaction ("Gas for your agent's sessions: 0.026 ETH deposited, enough for about 50 sessions"), every step now shows the transaction it sent, and the hand-off says which gas mode applies. Verified headlessly on the review stack: a key made in the app opened a session with no paymaster.
  • The bundler's rejection says why. A failed dry-run answered execution reverted: FailedOpWithRevert(uint256,string,bytes) — the selector's signature, the paymaster's reason lost inside it. The relay now decodes the revert (offchain/src/bundler/reason.ts): the EntryPoint's AAxx reason and, for FailedOpWithRevert, the inner Error(string), Panic or any custom error the stack's contracts declare, so the 422 reads validation failed: AA33 reverted: VP: data too short. A unit test pins the exact bytes the Foundry regression expects (npm run test:bundler).

Changed

  • The docs, README, security and architecture records are written as a launched product. Every readiness disclaimer is gone (pre-audit, unaudited, devnet-only, "no public network yet", "not for real funds", "no UI yet", status callouts, financial-advice boilerplate). Pages that existed to track readiness are now production documents: "Operating the network" (production-readiness.md), "Deploying your own network" (going-to-production.md), "Security review" (security-audit-findings.md), "The app" (frontend-and-ui.md), "Roadmap" (NEXT-STEPS.md). The local stack is described as the local development network. Nothing was invented: no auditors, dates, partners or numbers were added, and a fabricated bounty policy was removed. The app, docs theme and static site lost their disclaimers too.

Added

  • Export the docs as one PDF. scripts/docs-pdf.mjs renders the whole book (its print page, light theme, page numbers) to dapp/public/AIOUM-Documentation.pdf; the docs bar has an Export PDF button and /api/docs/pdf serves it as a download. Print styles hide the app bar, note tabs and chrome. The "On this page" rail is gone.
  • Notes on the docs. Inside the app, every block of every docs page has a "+ note" tab: write, then Note (check it later) or Make change (apply it now). Notes record the page, the nearest heading, the exact block and its text, and are saved to .notes/docs-notes.json (GET/POST /api/notes, PATCH/DELETE /api/notes/:id) and listed at /notes with resolve, edit, delete, mark-applied and a copy-as-list digest. This is where Claude reads them.

Changed

  • One site, one port. The docs book is built into the app (dapp/public/docs, served at /docs; scripts/devstack.sh builds and watches it, npm run docs in dapp/ builds it once) with root-relative links back into the app, and the site's nav sits above the book so it reads as one site. Nav order: Marketplace · Deploy Agents · Earn · ZAI · Docs. No docs port any more; every docs link in the app opens in the same tab.
  • Marketplace: Live or Pending setup. Keyed listings are no longer a separate "ready to launch" section: they sit in the same grid with a yellow Pending setup badge (complete, live the moment an operator adds the provider's key) and the listing page says exactly that.
  • Home order. Hero (claim, narrative line ending "Agents pay each other per call and run autonomously, unlocking their true potential"; two buttons; no images) → Why now (Today versus The future with AIOUM: gaining access, connecting / API, payments, trust, discovery) → Powered by x402 (the 402 request/response explained for anyone) → How it works (deposit, receipts, settle) → live numbers → the Build / Deploy / Connect / Earn sections → the rest unchanged.
  • scripts/devstack.sh: detached services are exec'd so the recorded pid is the process itself, stop kills children first, and down sweeps the port-less docs watcher explicitly (it used to survive down). The dead DOCS_PORT variable is gone.
  • Four places. Nav is now Marketplace · Deploy Agents · Earn · ZAI. Deploy Agents has the builder at the top and existing agents (yours, then ready-made) below. Earn is the seller builder. ZAI is one page: Stake, Jury, Token, Activity (deep links ?tab=, ?operator=, ?q=). Every earlier path redirects.
  • Home, rebuilt on what the best product sites do (Linear, Stripe, Phantom, Lido, Morpho, x402, Virtuals, Olas were studied): one claim and the narrative line, real product screenshots as the visuals (regenerated by scripts/home-screens.mjs), an open-standards strip, live numbers, a today-versus-AIOUM contrast, one story section each for Build, Deploy, Connect and Earn, agents hiring agents, the USDC/ZAI flywheel, built-in-the-open, one action.

Added

  • The app is now one site built around what a person wants to do. Home is the lander (the story, four doors, a live network pulse, how it works, agents hiring agents, the token). Nav: Browse · Agents · Sell · Earn · Activity. Old paths redirect (/launch→/sell, /staking→/earn, /arbitration→/earn/jury, /explorer→/activity, /agent→/agents/budget). Plain-English words everywhere, with inline explanations (<Term>) for the ones that cannot be avoided: stake, session, receipt, budget, juror, workflow, publish…
  • Agents: a visual builder that runs things. Four steps (what it does → its tools → its budget → review), two modes (an AI planner, or fixed-step workflows with {{input}} / {{steps.N.text}} templating that need no AI), lifetime and per-run budgets enforced outside the model, schedules, a live run log with every paid call, its cost and its receipt, run history, and Publish as a service: an agent becomes a marketplace listing other agents can hire, every agent-to-agent call a paid call with a receipt. Ten ready-made agents (morning brief, token scanner, swap route, bridge quote, prediction odds, wallet watcher, news digest, community poster, and two no-AI workflows) resolve to whatever is live.
  • Agent runner (offchain/src/agents, npm run agents, :8560): JSON-file store, a devnet wallet that self-funds test USDC, per-run escrow sessions with signed vouchers and settlement through the node, Anthropic (claude-opus-5, adaptive thinking) and OpenAI-compatible / Ollama planners, workflow engine with tests (npm run test:agents), schedules, publish/unpublish via the node's admin API, a synchronous /invoke for hired runs, and /tools, /starters, /planners, /wallet, /stats.
  • Sell: a visual service builder. Ready-made listing, your own REST API (inputs derived from {placeholders}), an OpenAI-compatible model, a local Ollama model, or a fal / Apify / Bright Data wrapper → price, stake and stakers' share with what you keep → one real test call through the node → Go live (the local node stakes, registers on-chain and serves; the directory refreshes before the button returns) or download services.json + .env + the command.
  • Node runtime admin API (POST /admin/preview, GET|POST /admin/services, DELETE /admin/services/:key): try an adapter without listing it, add a listing at runtime (persisted in services.added.json, reloaded one by one on boot), delist (marks the service inactive on-chain). tools/list now carries a real MCP inputSchema derived from each adapter spec. The indexer gained POST /refresh.
  • 50 live services on the review stack. offchain/services.review.json (generated by npm run catalogue:review) lists every keyless gallery template across the demo operators, so the marketplace shows real price feeds, DEX quotes, bridges, token scanners, odds, explorers, news and data. Browse also shows the 39 keyed listings as Ready to launch, one click from the Sell page. Listing names come from the listing key, so CoinGecko and Coinbase no longer share a name.
  • Docs: Build an agent in the app; welcome table and guides point at the new pages.
  • Production-grade dApp pass, every page. Service detail pages built out for non-technical buyers: cover tile and category, live/health/latency badges, price per call and calls per dollar, operator stake and rating, a plain-English "what your agent receives" summary of the node's 402 challenge (raw JSON behind a disclosure), a deposit calculator, recent on-chain activity, trust and safety panel. Staking rebuilt around operator cards, a four-step strip, position stats and a stake/unstake/withdraw/claim dialog. Arbitration restructured (stepper, juror stats, cases, sealed votes). Agent-budget page gets a four-step strip and a one-line intro. Explorer, token and launch pages share the same header, search and stat components. Phone layouts: two-row nav with a swipeable section row, stacked cards and 2-column stats.
  • Jury on the devnet. USE_COMMIT_REVEAL_ARBITRATOR=1 makes the deploy script install the CommitRevealArbitrator (25k ZAI quorum, 5k min stake, 1-day commit + 1-day reveal, 7-day unbonding) as the DisputeManager's arbitrator and record it as arbitrator in deployments.json; scripts/devstack.sh review sets it, so the Arbitration page is a working flow locally. The ABI ships in the generated artifacts. npm run demo:dispute raises a demo dispute on the demo agent's last settled session (bond posted, evidence package written to .devstack/evidence/<id>.json and served by the consoles server); review mode runs it after the paid-call seed so the Arbitration page opens with a live case.
  • Docs: narrative rewrite and GitBook-style pager. Welcome page leads with the problem (billions of agents, an economy built for people: accounts, cards, keys, permission) and what changes (pay per call, no accounts, a budget set once, anyone can sell, trust without a company, private by default), then the app links and three ways in. "How it works" explains participants, the money flow ($4.25 / $0.50 / $0.25 on a $5 settlement) and the protections in plain words, with a glossary. Side nav grouped as Start here / Use it / Run it yourself / For builders / Design and economics / Project status. Previous/next chapter links render as titled cards at the foot of each page instead of side arrows. The preprocessor now reads the running stack's .devstack/*.port files when the port env vars are unset, so the app links in the book match the stack that is up.
  • Landing page. "Why" section reframed around agents arriving into a human-built economy, with a fourth card on permission and autonomy. Section reveal animation is now fail-safe: content is visible at rest, hides only for the scroll-in effect when motion is welcome, and un-hides after 2.5 s and before printing.
  • dApp production sweep. Design system (Manrope + JetBrains Mono, type scale, 40px controls, cards/badges/tables/code blocks), page headers with one-line intros and primary actions, footer, 404. Marketplace rebuilt as grouped, searchable, sortable cards. Service pages (/service/[id]): cost, node health probe, operator + stake + reputation, tools, the live x402 challenge from the node, Claude/TypeScript/Python/HTTP how-to tabs, on-chain activity and disputes, trust panel. Explorer and staking cross-link to service pages; ?operator= / ?q= deep links. Nav relabelled for non-technical users.
  • Docs theme. GitBook-style mdBook theme (docs-theme/): light default with a dark variant, Inter type, grouped side nav with active highlighting, clean top bar, callout blockquotes, rounded tables and code, and an "On this page" right rail with scroll-spy.

Changed

  • Landing hero: "Billions of AI agents are joining the economy."
  • Crypto-first gallery: 39 more templates — Chainlink on-chain reads, DefiLlama prices/TVL/DEX volume/yields, CoinGecko markets + trending, Kraken, Coinbase Exchange, Binance, Jupiter, CoinPaprika, Fear & Greed; DexScreener and GeckoTerminal token/memecoin scanners; KyberSwap, CoW, Jupiter, 0x, 1inch quotes; RWA markets; Polymarket, Manifold, Metaculus; Ethereum/Base/Solana RPC and Blockscout explorers; Alchemy wallets; Magic Eden and OpenSea NFTs; Dune and LunarCrush analytics; CryptoPanic and CoinDesk news; Telegram, Discord (webhook + bot), X, Farcaster posting and reading; Imgflip and Giphy memes. All 32 keyless ones verified live. New guide docs/guides/crypto-stack.md with three composed bots and the custody boundary.
  • REST adapter: a webhook URL supplied via {env:…} is used verbatim (not URL-encoded).
  • Service template gallery: 41 ready-made listings in offchain/templates/ (weather, geo, FX, crypto, knowledge, news, search, web reading/scraping, LLM resellers, local Ollama models, fal.ai media, Apify, Bright Data), npm run templates (list / add / verify / docs), an offline test suite (test:templates), and docs/reference/templates.md. 20 keyless templates verified live.
  • REST adapter env references: "Bearer env:KEY"-style prefixes in headers and {env:KEY} placeholders in URLs and bodies, resolved at load.
  • dApp Launch page (/launch): browse the gallery, set prices and stake, download services.json + .env keys + start commands. dApp Agent page (/agent): authorize a budget-capped session key from the connected wallet and hand it to Claude / the SDK; read and revoke keys.
  • Session-key-only agents: AIOUMClient.agentFromSession() in @aioum/sdk (no owner key in the process; owner-signed calls throw) and SESSION_KEY + SMART_ACCOUNT mode in @aioum/mcp.
  • scripts/devstack.sh review: boots the whole product surface on localhost (chain, node, 16-service catalogue, relay, billing, dApp, landing site, dev consoles, docs book, seeded activity). Services now start in their own sessions so down kills whole process groups; the multi-service runtime honours AIOUM_NODE_PORT.
  • apify and brightdata service adapters (offchain/src/node/adapters.ts): resell any Apify Actor (sync run, or async run + poll + dataset) and Bright Data's Web Unlocker / SERP zones and Web Scraper API datasets (trigger → poll → snapshot) from services.json. Example entries, seven new adapter tests against a local mock upstream (18 total), and docs/guides/resell-web-data.md explaining what each platform is, what it is used for, how the adapters work, pricing, the fine print, and the demand-side x402 interop gap (NEXT-STEPS #26).
  • Two end-to-end agent setup guides in the book, each with a no-code quick path and a full developer path: docs/guides/agent-setup-consume.md (a paying agent: Claude Desktop / Claude Code / any MCP client, a TypeScript loop with any LLM provider, Python; wallet creation and every spending control) and docs/guides/agent-setup-provide.md (a selling agent: services.json, pricing, an AI-assistant brief, custom tools, settlement, disputes, and the operator playbook).

2026-09-17

Fixed

  • CI: the root .gas-snapshot was stale (a copy had been committed under packages/python-sdk/), so forge snapshot --check was red; regenerated at the root and Foundry pinned to v1.7.1 in CI.
  • Docs book: links from docs/ to root documents, package READMEs and source files rendered as dead .html paths (44 targets); a build-time preprocessor now resolves them and root documents are mirrored as appendix chapters. The roadmap chapter no longer renders outside the output dir.
  • Docker: the node image did not receive deployments.json, so docker compose up could not boot; the compose file now mounts it read-only.
  • offchain/.env.example: four commented defaults disagreed with the code (node in-flight cap, body limit, facilitator stuck-tx wait, bundler fee cap); corrected, operator-key block added.

Added

  • docs/reference/node-config.md — every runtime setting with the default the code uses.
  • docs/guides/arbitrate.md — juror runbook for commit-reveal arbitration (stake, commit with safe salt handling, reveal, finalize, rewards, penalties, exit).
  • CONTRIBUTING.md and this changelog; both mirrored into the docs book.

Changed

  • CHECKPOINT-1.md (local working notes) is no longer tracked.
  • The account-abstraction guide documents the in-repo SDK module instead of the external companion app.
  • Test counts across the docs updated to the verified 226 tests / 11 suites.

2026-07-25

Added

  • fal.ai service adapter (type: "fal", sync and queue modes) so an operator can resell any fal.ai media model from services.json; tests and a guide.

2026-07-19

A single long session that took the protocol from "hardened core" to a full product surface.

Added

  • Exposure-scaled economics: per-asset escrowCapPerStake in PaymentManager; proportional slash max(slashAmount, stakeAtRaise × slashBps) with the operator's stake snapshotted at raise.
  • CommitRevealArbitrator: dedicated juror stake, sealed commit-reveal voting, no-reveal penalties, winning-side reward pots, DAO escalation backstop.
  • Dispute verifiability tiers 0–2: canonical Merkle transcripts with cross-implementation pinned vectors, commitRequired services, node-side transcript stores and root anchoring, SDK evidence packages, the verify-evidence arbitrator CLI with deterministic re-execution and attestation hooks.
  • Privacy layers 1–2: deposit bucketing, per-relationship account salts, settle-timing jitter, and the bonded privacy relay (npm run relay).
  • AIOUMVerifyingPaymaster (signature-gated gas sponsorship) and the managed-billing service (credit ledger, plans, sponsored gas, treasury-funded deposits).
  • Config-driven service adapters (REST, OpenAI-compatible LLM, Ollama), Docker packaging, the no-code node quickstart, encrypted operator keystores, PID instance locks, Prometheus /metrics.
  • Single-box HA: shared SQLite store and settle-leader lease so N instances run under one key.
  • Discovery indexer (npm run indexer) and the Python SDK (pip install aioum).
  • Subgraph coverage of the new events; protocol explorer and marketing site; the production dApp (Next.js + wagmi + RainbowKit: marketplace, explorer, staking, arbitration console, token page); scripts/devstack.sh; full CI coverage; the GitBook-style docs book.
  • Tokenomics: proposal (genesis allocation, emissions guardrail, launch sequence) and the buy-and-burn program with a burn regression test.

2026-07-06

Changed

  • Rebrand Zeus → AIOUM across contracts, packages (@aioum/*), docs and the EIP-712 domain (AIOUMPayments). Consumers built against the Zeus-era domain must rebuild.

Added

  • Roadmap execution in adversarially reviewed phases: crypto-economic contract hardening (A1–A7, including the bundling-safe session-opener queue), deployment safety (verify-deploy, handover), off-chain runtime hardening, publishable packages with SDK session reuse, subgraph dispute lifecycle and per-asset money, AcceptedAssetSet event, MIT license, disclosure policy, CI.

2026-06-13

Added

  • v2 rewrite (from the original OUM prototype, then renamed Zeus with token ZAI): token, governance, staking with delegation and slashing, ERC-8004 registries, escrow sessions with EIP-712 vouchers and x402 settlement, disputes with timeout, validator-quorum arbitration, ERC-4337 accounts with session keys and paymaster, bundler relay, facilitator, node runtimes, private node with scheduler and local brain, revenue-share attribution, @zeus/sdk and @zeus/mcp packages (later @aioum/*), x402 HTTP conformance, security-audit remediation.