Skip to content
UIAF

Changelog

Edition 3.1.1 Last verified 2026-07-19

All notable changes to the UIAF specification are documented here, payload-diff-first: fields added/removed/renamed, enum values, event-model changes, storage keys, and test-suite deltas. Format follows Keep a Changelog. Versioning rules are defined in VERSIONING.md; the current reader-facing edition is 3.1.1.

[3.1.1] — 2026-08-08

Section titled “[3.1.1] — 2026-08-08”

Editorial PATCH: a plain-language/accessibility rewrite of the reader-facing prose only. The accepted wire delta is empty: no payload fields added, removed, or renamed; no enum or registry semantic changes; the envelope, three-event model, consent wire object, storage keys, and requirement force are unchanged from 3.1.0.

  • Wire delta (mechanical only): _meta.uiaf_version const 3.1.0 → 3.1.1; payload schema $id → /schema/3.1.1/. Immutable snapshot published at docs-site/public/schema/3.1.1/, the v3/ alias advanced byte-identically, release-ledger.json appended; release tag uiaf-v3.1.1 (created at merge).
  • Prose (editorial only): plain-language/accessibility pass across the reader-facing specification and guide pages; requirement blocks, BCP 14 force, and wire literals preserved.
  • Release mechanics: golden fixtures and TREE_HASH regenerated against the 3.1.1 artifacts; validation BOUND hashes refreshed at release integration.

[3.1.0] — 2026-08-07

Section titled “[3.1.0] — 2026-08-07”

Compatible v3 advance from the weekend-refresh operation (75 findings adjudicated: 61 accepted, 1 rejected, 6 deferred; operation record: context/agent-plans/weekend-refresh/adjudication.md). The accepted breaking set is empty: no payload fields added, removed, or renamed; the envelope, three-event model, consent wire object, and storage keys are unchanged.

  • Wire delta (minimal): _meta.uiaf_version const 3.0.0 → 3.1.0; payload schema $id → /schema/3.1.0/. Immutable snapshot published at docs-site/public/schema/3.1.0/, the v3/ alias advanced byte-identically, release-ledger.json appended; release tag uiaf-v3.1.0.
  • Validator coherence invariants (new rejections, golden fixtures + regenerated TREE_HASH): per-value session reasons derivation (UIAF-04-REASON-001); identity-group coherence across uid / resolution_method / is_new (UIAF-04-ID-001); derived confidence — high only for an authoritative cookie read, fresh issuance, or post-crosscheck credential-verified recovery; medium only pre-crosscheck; low for ephemeral or indeterminate; full four-way attribution_completeness derivation (any click ID ⇒ full, else UTMs ⇒ utm_only, else request-context ⇒ request_context_only, else none); fail-closed top_level default.
  • Prose/contract coherence: edition string unified to 3.1.0 with a CI edition-parity gate; ledger prose rewritten as timeless process rules; closed cookie-endpoint route contract (UIAF-04-AUX-008); one-shot create/recovery trigger state machine (UIAF-04-TRIG-001); retry-queue entry encoding defined (UIAF-04-RETRY-002); 429 + bounded Retry-After carve-out from all-4xx-terminal (UIAF-04-EP-002 refresh); uiaf_dirty_baseline purge on terminal drop of a queued entry that advanced it (UIAF-04-DIRTY-001 refresh); BFCache pending-context lifecycle (UIAF-03-PEND-002); transport-agnostic envelope wording with destination-window coupling; resolveIdentity return contract aligned to the candidate-only model.
  • Browser/adtech/legal refresh: browser-landscape refresh (Firefox 151 fingerprinting protection, BFCache/no-store reality, Brave Shred, Safari 26.x version table, RWS retired / DBSC explicit non-goal, Chrome BTM note); universal Google Data Manager API requirement (2026-06-15) and the msclkid 7-day UET CAPI constraint; legal refresh (Digital Omnibus trilogue status, CNIL self-assessment regime, LGPD + Quebec Law 25 named opt-in regimes, Art 8 minors checklist, Art 21 objection note, 24-state US landscape + CPPA enforcement wave); new research/07-2026-08-landscape-refresh.md.
  • Consent/control-plane hardening: dated gpc_binding_jurisdictions site-policy config + gpc_strict (UIAF-07-CONSENT-014); state_updated_at adapter contract (CONSENT-015); server/client consent-record divergence fail-closed degraded mode (CONSENT-016); GCM-source Art 7(1) receipt persistence (CONSENT-017); TCF→four-signal no-over-disclosure mapping (CONSENT-018); revocation route contract (UIAF-08-REVOKE-002) + endpoint revoked-UID suppression (REVOKE-003); hard rejection of forged _meta.emitter: server on unauthenticated ingress (UIAF-08-TRUST-005, mirrored in UIAF-04-EP-004); pre-parse Content-Length 413 guard (UIAF-08-TRUST-006, mirrored in UIAF-04-EP-007); no privileged downstream effects from payload receipt (UIAF-08-RET-003); request-observability boundary documented.
  • Coverage/governance: every new/changed requirement ID mapped to scenarios with mandatory negative scenarios for security/rejection rules; conformance applicability manifest; minimal conforming end-to-end quickstart. Wire-shape proposals (ingress_signature, delivery_token, issuance_token, native consent-record carriage) and the capability-model restructure are deferred to the v4 candidate list.

[3.0.0] — 2026-07-19

Section titled “[3.0.0] — 2026-07-19”

Breaking redesign relative to the published 2.0.0 contract (frozen by context/agent-plans/master-remediation.md; release tag uiaf-v3.0.0):

  • Event model: exactly three data-plane events — session (dirty-flag, automatic), conversion, identify. Retired as event values: page_view, consent_update, identity_link, data_deletion_request, identity_init, identity_recover, attribution_capture (derivations/state now ride session payload fields; revocation/erasure/access/portability are control-plane workflows, never payload events).
  • Envelope: ten always-present common keys; discriminated event_data per event; required UUID-v4 event_id; identity.session_seq (required with non-null session_id) and identity.session_start; _meta.emitter (client|server) replacing the retired _meta.delivery; single bounded extension point event_data.extensions; two size profiles with a 32,768-byte cap.
  • Consent: three-layer model (observed signals / lifecycle / effective permissions) with the 16-row effective truth table; tiers T0–T4 become derived shorthand; no raw CMP string anywhere (opaque consent_record_id receipt reference only); pending never reaches the data plane.
  • Storage registry: live keys uiaf_uid, uiaf_recovery, uiaf_session_state, uiaf_attribution, uiaf_retry_queue, uiaf_dirty_baseline; purge-only legacy keys are defined solely by docs-site/public/schema/v3/uiaf-storage-keys.json (including the live uiaf_attribution row's separate legacy-cookie purge metadata) and are not hand-enumerated here; the attribution backup cookie, uiaf_consent_epoch, and uiaf_optout are removed and their absence is a tested property.
  • Machine contracts: versioned artifacts under docs-site/public/schema/v3/ (payload schema, events, enums, storage keys) with the append-only release-ledger.json; exact release snapshots at /schema/3.0.0/ with protected uiaf-v<edition> refs.

[2.0.0] — 2026-04-01

Section titled “[2.0.0] — 2026-04-01”

Published-site edition (uiaf.dtv.dev). Provenance: reconstructed from git history and the deployed site — marked as such; no earlier specification edition exists. (archive/v1-prototype/ is a pre-specification application prototype, not a spec release.)