Release notes rendered from the repository changelog at build time — the same file that ships with the code.
<p><a href="CHANGELOG.md">English</a> · <a href="CHANGELOG.id.md">Bahasa Indonesia</a> · <a href="CHANGELOG.zh.md">中文</a></p>
All notable changes to the AIFeed protocol and reference implementation are documented
here. The format follows Keep a Changelog.
> Evidence labels used across the project: [F] verified fact, [M] plausible,
> [E] model estimate, [S] measured in the local simulation harness, [H] needs legal
> review.
aifeed-mcp-server) — zero-dependency Model Context Protocol server over stdio: verify_manifest, fetch_aifeed (token-budgeted markdown with signature check), list_assets, verify_asset (byte-level size/sha-256 proof), select_index (query ranking within page/token budgets), and decide_usage; HTTPS only (loopback with AIFEED_MCP_ALLOW_PRIVATE=1); run with npm run mcp or npx aifeed-mcp-server.aifeed-mcp-server republished as 1.0.0-draft.2 with the registry-required mcpName (io.github.denyn1/aifeed-mcp-server) and published to registry.modelcontextprotocol.io under the io.github.denyn1 namespace via mcp-publisher. The same build packs into an MCPB bundle (npm run mcpb) and is listed on Smithery as denyn1/aifeed-mcp-server.@aifeed/deepseek-harness) — Cordis plugin that gives the harness six model-callable tools (aifeed_verify_manifest, aifeed_fetch_aifeed, aifeed_list_assets, aifeed_verify_asset, aifeed_select_index, aifeed_decide_usage); it reuses the zero-dependency MCP engine as a generated CJS copy (npm run build:harness / npm run harness:check). Published on npm as @aifeed/deepseek-harness, an installable dsh bundle (dsh plugin --profile web add @aifeed/deepseek-harness).zai-org/zcode-plugins PR #33 adds an aifeed plugin (vendored zero-dependency MCP engine plus a verify-first skill) for Z.ai's ZCode agent; pending maintainer review.[email protected] is public at <https://clawhub.ai/denyn1/skills/aifeed> and installable with npx clawhub install aifeed; the ClawHub security summary reports a documentation-only skill with no bundled executable payload.aifeed — the independent Python verifier now ships as a standard-library-only wheel (pip install aifeed): aifeed.verify and aifeed.mako modules, aifeed-verify/aifeed-mako console scripts, PEP 440 pre-release 1.0.0a1 mirroring the 1.0.0-draft core; the historical aifeed_verify/aifeed_mako imports remain as aliases.@aifeed/frameworks) — one-line build integrations: aifeed() for Vite and Astro, withAifeed() plus the aifeed-next postbuild bin for Next.js, and the generic aifeed-build CLI (with keygen) for any static generator; signs the build output in place (manifest, per-page AIFeed Markdown/MAKO, delta index, llms.txt), injects <link rel="alternate">, prunes stale generated files, and self-verifies signatures/digests; environment fallbacks AIFEED_DOMAIN, AIFEED_KEY, AIFEED_BASE_URL.aifeed) — npx aifeed publishes the publisher CLI (keygen, init, sign, validate, rotate, bundle, site build, AIFeed Markdown/MAKO tools) from packages/aifeed-cli/; sign now finds the default key next to the site directory and validate/verifyDirectory accept a site root with the manifest in .well-known/.verifyRemote() — one-call remote verification in @aifeed/verify: discovery → manifest + signature → DNS _aifeed anchor state, enabling the 3-line consumer quickstart on the npm pages.package.json metadata, the WordPress plugin catalogue header, and the namespace docs now point at github.com/denyn1/aifeed-protocol (canonical); the workflow pins tag v1.0.0-draft.2, gates on validate without || true, and points at @aifeed/frameworks for Vite/Astro/Next.js; check-consistency rejects stale aifeed/aifeed-protocol URLs.integrations/rust) — AifeedLayer Axum middleware (content negotiation, inline signatures, traversal guard), verified by 11 cargo test cases.site/feed.xml rendered from CHANGELOG.md at build time and linked from the homepage head; the sitemap lists it.badge.svg ("verified by AIFeed") with copy-paste HTML and Markdown snippets in the publisher guide, so signed origins can link back.examples/python/, covered by test_examples.py (+11 tests).skills/aifeed/SKILL.md teaches coding agents the verify/publish flows; smithery.yaml ships the MCP stdio start command.npm run studio serves a zero-dependency web UI on 127.0.0.1:7777: per-domain workspace, local HTML source ingestion, restrict-only policy editor (usage permissions, attribution text/URL, crawl limits, license, llms.txt, revocation interval, per-path rules), incremental builds, local verification of manifest/pages/indexes, and export with the _aifeed DNS TXT record; a robots-aware crawler (sitemap or link discovery, rate limits, ETag/Last-Modified cache) covers live sites; site-type presets (news, ecommerce, marketplace, government, open, restrictive, blog), per-path page types (product, article, listing, …), and opt-in freshness metadata (page dates/tags) complete the site-type support. M3 adds .tar.gz overlay download, stack detection wired to integrations/ adapter hints, one-click live verification (manifest, signature, DNS anchor), and a guarded key-rotation ceremony that swaps the key and re-signs every page. G4 adds schema-validated types/capabilities/actions editors and OpenAPI import for e-commerce actions, plus an audit journal (journal.ndjson) and inline fix hints for common DNS, schema, signature, and rotation failures. Private keys stay in the workspace (0600) and are never served; UI in EN/ID/ZH. The manifest builder (lib/site.js) gained optional limits, license, attribution_text/url, and maxCheckIntervalHours options (backward compatible).aifeed.assets entries may carry mime, size, and sha-256 (hashed from local files at build time, ≤16 MiB); delta-index entries expose an assets count, the SDK adds listAssets() and verifyAsset(), Studio shows asset totals and digest coverage, and verify:live proves edge enforcement on asset paths.studio.html (Publish) and updates.html (release notes rendered from the changelog in EN/ID/ZH at build time) pages, linked from the navbar, the artifacts grid, and the apex sitemap; both pages ship signed AIFeed Markdown.rotation.successor_fp directive plus an advisory DNS pk2 cross-check, bounded overlap (effective_at → grace_until, 1 h hard floor), new-key-signed predecessor_fp cutover binding, then permanent revocation. Six result codes: rotation_invalid, rotation_anchor_unverified, grace_accepted, rotation_denied, rotation_resync, key_revoked. Implemented in lib/rotation.js, single-command CLI aifeed rotate [--dry-run], SDK rotation export, Python directive parity, PHP manifest validation, vectors 008–011 / 119–123, and the runbook in docs/rotation.md.1.0.0-draft.2 — includes the key-rotation helpers (rotation.*), the v0.2 manifest builder options used by Studio (limits, license, attribution text/URL), and the htmlToMako page-type and opt-in freshness options.text/aifeed+markdown, .aifeed.md, aimd: "1.0", first-class aifeed policy block, token budget up to the publisher's choice (reference default 4,000 in AIFeed Markdown-only mode).aimd / mako); cross-format replay rejected.content.profile (mako | aifeed-md | both) and content.index_url; AIFeed Markdown index at /.well-known/aifeed-index.json.aifeed aimd <generate|sign|verify|index|fetch> alias, --format for generate, index, and fetch; profile auto-detection for sign/verify.@aifeed/verify 1.0.0-draft: fetchAimd, verifyAimdDocument, verifyAimdIndex, media-type constants.aifeed_dual_stack filter, per-format signatures and indices.spec/en|id|zh/aifeed-aimd-v1.md (operating modes, IANA considerations).conformance/aimd/ (11 cases: markers, cross-format replay, tamper, assets, alternates, strict optional-field validation) with Python parity; fuzz corpus includes AIFeed Markdown.CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, GOVERNANCE.md, spec/README.md, SDK README, plugin LICENSE and starter .pot.aifeed site build <dir> generates manifest, delta index, per-page content with signatures, and optional llms.txt for any static output (Hugo, Jekyll, Astro, Next export, plain HTML), with opt-in <link rel="alternate"> injection. File naming is profile-specific — .aifeed.md for AIFeed Markdown, .mako.md for MAKO, both written for --profile both — with {file}.sig sidecars whose context matches the media type. Directory indexes (/dir/index.html) are addressable at the clean path (/dir) across every adapter, including nested paths.integrations/: nginx, Caddy, Apache, Node/Express, Next.js, PHP, Python ASGI, Go, and a GitHub Action (with tests for the Node handler).GOVERNANCE.md: the verification path (spec, schemas, verifiers, vectors, publisher tooling) is permanently open with no proprietary verification extensions; only secrets, customer data, and anti-abuse tactics stay private. Contribution licensing (inbound=outbound) added to CONTRIBUTING.md.paper/): LaTeX source + Markdown mirror, refs.bib with metadata verified against primary sources (17 RFCs, pinned IETF drafts, Crossref DOIs, publisher pages), CLAIMS.md claim→source ledger, CHECKLIST.md submission readiness, and npm run paper:check for citation/environment cross-checks (52/52 cited).1.0.0-draft (was 0.3.0-draft) across the protocol package, SDK, CLI, WordPress plugin, docs, and site. Wire/spec versions are unchanged: manifest 0.1 / 0.2, AIFeed Markdown 1.0, external MAKO 0.2 — the renumbering does not change any signed bytes or compatibility claims.0.1.x and 0.2.x; other versions report upgrade_required.aifeed.org (third-party) to aifeed.md across specs, schemas, registry/revocation URLs, docs, tests, SDK, and the WordPress plugin — including escaped regex forms in JSON schemas and PHP. All signed vectors, fixtures, and indexes were regenerated and the full regression re-run. The migration is repeatable via node tools/replace-domain.js --domain aifeed.md (dry-run by default).aifeed.md registered (maintainer, 2026-09-16). DNS and the spec/docs site are the next configuration step; normative URLs in specs, schemas, and registry links already point at aifeed.md.aifeed.md: site/ (landing page), npm run build:site (tools/build-site.js) to refresh the copied artifacts, .github/workflows/pages-cf.yml for Cloudflare Pages, and docs/deploy-site.md covering the DNS, deploy, and demo-subdomain layout.max-image-preview), JSON-LD on the landing and every demo page, apex robots.txt + sitemap.xml covering all demo pages, a zero-dependency 1200×630 og-image.png generator (tools/gen-og-image.js), and docs/seo.md with the Google Search Console runbook.demo, news, shop, gov, strict, revoked, verify) generated deterministically from demos/sites.js with public demo keys, served on Cloudflare Pages through functions/[[path]].js (host routing, CORS, live 403/429 enforcement on strict, browser verifier on verify, multi-signature revocation registry under site/revoke/). The apex aifeed.md now dogfoods AIFeed with its own signed manifest. New tooling: npm run demos, npm run demos:check (in verify), npm run verify:live.AGENTS.md (agent/dev contract: generated files, version locations, pitfalls), docs/architecture.md (module map, invariants, extension points), docs/release.md (release/upgrade checklist), and zero-dependency checkers (npm run lint:syntax, npm run check:consistency) rolled into one gate: npm run verify.aifeed-protocol/), the WordPress plugin at wp-plugin/, and the Indonesian project documents under docs/. Canonical paths are now github.com/denyn1/aifeed-protocol/tree/main/<path> (no doubled prefix); the CI workflow, site links, and documentation were updated accordingly.render-html → build-site), so /process.html and /enforcement-report.html ship again; build-site now fails loudly when a generated source is missing instead of silently skipping it (both were gitignored during the cleanup).docs/agent-quickstart.md (check-first flow and failure handling) plus a runnable compliant-agent example (examples/agent/compliant-agent.js) covered by tests/agent-example.test.js. The SDK now forwards allowPrivate/ca through fetchMako, fetchIndexDelta, and sidecar signature fetching (for local, self-signed test environments).npm run render:html, npm run build:site) and are now gitignored. The arXiv bundle is built directly from paper/.@aifeed/[email protected] (dist-tags latest and next), 27 files, 44.7 kB packed; npm install @aifeed/verify resolves out of the box. Updated to 1.0.0-draft.1 (2026-09-16) with the TLS/private-fetch option forwarding fix; both dist-tags now point at it. The monorepo package is marked "private": true to prevent accidental publishes.site/logo.svg.docs/process.html), the enforcement benchmark (benchmarks/enforcement-report.html), and the long-form complete guide (penjelasan-aifeed.html → site/penjelasan.html) now share the warm dark-first palette, vermilion accent, and a light/dark toggle; all remain self-contained/offline with no external resources.aimd, aimd-index, AIMD-C1..C4 level codes, AIMD_* constants, .aifeed.md). EN/ID spec headings now state the wire identifier explicitly.npm run jcs:fixtures (tools/gen-jcs-php-fixtures.js) rebuilds tools/jcs-php-fixtures.json from conformance vector 001, so the plugin's cross-language JCS/Ed25519 test (tests/jcs-test.php) can no longer go stale after regeneration.paper/CHECKLIST.md domain item updated to reflect the applied migration.aifeed.mako.v0.2), permission binding (restrict-only), YAML-safe subset, delta index with per-entry digests.aifeed.assets), site resume and triage fields in the index, /llms.txt (v2) publishing in the WordPress plugin.aifeed mako generate|sign|verify|index|fetch; SDK fetchMako, fetchIndexDelta, selectEntries, decideUsage./.well-known/ai.json, Ed25519 + JCS, DNS anchor (_aifeed), revocation with multi-signature documents, offline bundles.keygen|sign|validate|bundle|init|import-openapi), 24 manifest vectors, independent JavaScript and Python verifiers, WordPress publisher plugin (0.1.0-rc1) verified end-to-end (17/17 admin checks).<p><a href="CHANGELOG.md">English</a> · <a href="CHANGELOG.id.md">Bahasa Indonesia</a> · <a href="CHANGELOG.zh.md">中文</a></p>
Semua perubahan penting pada protokol AIFeed dan implementasi referensinya didokumentasikan
di sini. Format mengikuti Keep a Changelog.
> Label bukti yang dipakai di seluruh proyek: [F] fakta terverifikasi, [M] masuk akal,
> [E] estimasi model, [S] terukur di harness simulasi lokal, [H] butuh review hukum.
aifeed-mcp-server) — server Model Context Protocol tanpa dependensi lewat stdio: verify_manifest, fetch_aifeed (markdown berbujet token dengan cek tanda tangan), list_assets, verify_asset (bukti size/sha-256 level byte), select_index (pemeringkatan query dalam bujet halaman/token), dan decide_usage; hanya HTTPS (loopback dengan AIFEED_MCP_ALLOW_PRIVATE=1); jalankan via npm run mcp atau npx aifeed-mcp-server.aifeed-mcp-server diterbitkan ulang sebagai 1.0.0-draft.2 dengan mcpName yang diwajibkan registry (io.github.denyn1/aifeed-mcp-server) dan dipublikasikan ke registry.modelcontextprotocol.io di namespace io.github.denyn1 lewat mcp-publisher. Build yang sama dikemas menjadi bundel MCPB (npm run mcpb) dan terdaftar di Smithery sebagai denyn1/aifeed-mcp-server.@aifeed/deepseek-harness) — plugin Cordis yang memberi harness enam tool yang bisa dipanggil model (aifeed_verify_manifest, aifeed_fetch_aifeed, aifeed_list_assets, aifeed_verify_asset, aifeed_select_index, aifeed_decide_usage); memakai ulang mesin MCP tanpa dependensi sebagai salinan CJS yang di-generate (npm run build:harness / npm run harness:check). Terbit di npm sebagai @aifeed/deepseek-harness, bundle dsh yang bisa dipasang (dsh plugin --profile web add @aifeed/deepseek-harness).zai-org/zcode-plugins menambahkan plugin aifeed (mesin MCP zero-dependency yang divendor plus skill verify-first) untuk agen ZCode milik Z.ai; menunggu review maintainer.[email protected] publik di <https://clawhub.ai/denyn1/skills/aifeed> dan bisa dipasang dengan npx clawhub install aifeed; ringkasan keamanan ClawHub menyebutnya skill dokumentasi tanpa payload eksekutabel.aifeed — verifier Python independen kini terbit sebagai wheel hanya pustaka standar (pip install aifeed): modul aifeed.verify dan aifeed.mako, skrip konsol aifeed-verify/aifeed-mako, pra-rilis PEP 440 1.0.0a1 yang mencerminkan inti 1.0.0-draft; impor lama aifeed_verify/aifeed_mako tetap sebagai alias.@aifeed/frameworks) — integrasi build satu baris: aifeed() untuk Vite dan Astro, withAifeed() plus bin postbuild aifeed-next untuk Next.js, dan CLI generik aifeed-build (dengan keygen) untuk generator statis apa pun; menandatangani output build di tempat (manifest, AIFeed Markdown/MAKO per halaman, indeks delta, llms.txt), menyuntikkan <link rel="alternate">, memangkas berkas generate basi, dan memverifikasi sendiri tanda tangan/digest; fallback environment AIFEED_DOMAIN, AIFEED_KEY, AIFEED_BASE_URL.aifeed) — npx aifeed menerbitkan CLI penerbit (keygen, init, sign, validate, rotate, bundle, site build, tools AIFeed Markdown/MAKO) dari packages/aifeed-cli/; sign kini menemukan kunci default di sebelah direktori situs dan validate/verifyDirectory menerima root situs dengan manifest di .well-known/.verifyRemote() — verifikasi remote satu panggilan di @aifeed/verify: discovery → manifest + tanda tangan → status anchor DNS _aifeed, sehingga quickstart konsumen 3 baris tampil di halaman npm.package.json, header katalog plugin WordPress, dan dokumen namespace kini menunjuk github.com/denyn1/aifeed-protocol (kanonik); workflow mem-pin tag v1.0.0-draft.2, memverifikasi dengan validate tanpa || true, dan menunjuk @aifeed/frameworks untuk Vite/Astro/Next.js; check-consistency menolak URL aifeed/aifeed-protocol yang usang.integrations/rust) — middleware Axum AifeedLayer (negosiasi konten, tanda tangan inline, penjaga traversal), diverifikasi 11 kasus cargo test.site/feed.xml dirender dari CHANGELOG.md saat build dan ditautkan dari head beranda; sitemap memuatnya.badge.svg statis ("verified by AIFeed") dengan snippet HTML dan Markdown siap salin di panduan penerbit, agar origin bertanda tangan bisa menaut balik.examples/python/, tercakup test_examples.py (+11 tes).skills/aifeed/SKILL.md mengajarkan agen coding alur verify/publish; smithery.yaml mengirim perintah start MCP stdio.npm run studio menyajikan UI web tanpa dependensi di 127.0.0.1:7777: workspace per domain, pengambilan sumber HTML lokal, editor kebijakan restrict-only (izin penggunaan, teks/URL atribusi, batas crawl, lisensi, llms.txt, interval revokasi, aturan per-path), build incremental, verifikasi lokal manifest/halaman/indeks, dan ekspor bersama record DNS TXT _aifeed; crawler yang menghormati robots (sitemap atau penemuan tautan, rate limit, cache ETag/Last-Modified) menangani situs live; preset jenis situs (news, ecommerce, marketplace, government, open, restrictive, blog), tipe halaman per-path (product, article, listing, …), dan metadata freshness opt-in (tanggal/tag halaman) melengkapi dukungan jenis situs. M3 menambahkan unduhan overlay .tar.gz, deteksi stack dengan petunjuk adapter integrations/, verifikasi live sekali klik (manifest, tanda tangan, anchor DNS), dan upacara rotasi kunci terjaga yang menukar kunci dan menandatangani ulang seluruh halaman. G4 menambahkan editor types/capabilities/actions tervalidasi schema dan impor OpenAPI untuk aksi e-commerce, plus jurnal audit (journal.ndjson) dan petunjuk perbaikan inline untuk kegagalan DNS, schema, tanda tangan, dan rotasi yang umum. Private key tetap di workspace (0600) dan tidak pernah disajikan; UI EN/ID/ZH. Pembangun manifest (lib/site.js) mendapat opsi opsional limits, license, attribution_text/url, dan maxCheckIntervalHours (backward-compatible).aifeed.assets halaman boleh membawa mime, size, dan sha-256 (di-hash dari berkas lokal saat build, ≤16 MiB); entri indeks delta mengekspos jumlah assets, SDK menambah listAssets() dan verifyAsset(), Studio menampilkan total aset dan cakupan digest, dan verify:live membuktikan penegakan edge pada path aset.studio.html (Publish) dan updates.html (catatan rilis yang dirender dari changelog dalam EN/ID/ZH saat build), tertaut dari navbar, grid artifacts, dan sitemap apex; keduanya menyertakan AIFeed Markdown bertanda tangan.rotation.successor_fp bertanda tangan kunci lama plus cross-check DNS pk2 yang advisory, overlap terbatas (effective_at → grace_until, batas keras 1 jam), pengikatan cutover predecessor_fp bertanda tangan kunci baru, lalu revokasi permanen. Enam kode hasil: rotation_invalid, rotation_anchor_unverified, grace_accepted, rotation_denied, rotation_resync, key_revoked. Diimplementasikan di lib/rotation.js, CLI satu perintah aifeed rotate [--dry-run], ekspor SDK rotation, paritas direktif Python, validasi manifest PHP, vektor 008–011 / 119–123, dan runbook di docs/rotation.md.1.0.0-draft.2 — mencakup helper rotasi kunci (rotation.*), opsi pembangun manifest v0.2 yang dipakai Studio (limits, license, attribution text/URL), serta opsi tipe halaman dan freshness opt-in di htmlToMako.text/aifeed+markdown, .aifeed.md, aimd: "1.0", blok kebijakan aifeed kelas satu, budget token sesuai pilihan penerbit (default referensi 4.000 pada mode AIFeed Markdown-only).aimd / mako); replay lintas format ditolak.content.profile (mako | aifeed-md | both) dan content.index_url; indeks AIFeed Markdown di /.well-known/aifeed-index.json.aifeed aimd <generate|sign|verify|index|fetch>, --format untuk generate, index, dan fetch; deteksi otomatis profil untuk sign/verify.@aifeed/verify 1.0.0-draft: fetchAimd, verifyAimdDocument, verifyAimdIndex, konstanta media type.aifeed_dual_stack, tanda tangan dan indeks per format.spec/en|id|zh/aifeed-aimd-v1.md (mode operasi, pertimbangan IANA).conformance/aimd/ (11 kasus: penanda, replay lintas format, tamper, aset, alternates, validasi field opsional yang ketat) dengan paritas Python; korpus fuzz mencakup AIFeed Markdown.CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, GOVERNANCE.md, spec/README.md, README SDK, LICENSE plugin, dan starter .pot.aifeed site build <dir> menghasilkan manifest, indeks delta, konten per halaman dengan tanda tangan, dan llms.txt opsional untuk output statis apa pun (Hugo, Jekyll, Astro, Next export, HTML polos), dengan injeksi <link rel="alternate"> opt-in. Penamaan file spesifik profil — .aifeed.md untuk AIFeed Markdown, .mako.md untuk MAKO, keduanya ditulis untuk --profile both — dengan sidecar {file}.sig yang konteksnya cocok dengan media type. Indeks direktori (/dir/index.html) dapat diakses di path bersih (/dir) pada setiap adapter, termasuk path bersarang.integrations/: nginx, Caddy, Apache, Node/Express, Next.js, PHP, Python ASGI, Go, dan GitHub Action (dengan tes untuk handler Node).GOVERNANCE.md: jalur verifikasi (spec, schema, verifier, vektor, tooling penerbit) permanen terbuka tanpa ekstensi verifikasi proprietary; hanya secret, data pelanggan, dan taktik anti-abuse yang tetap privat. Lisensi kontribusi (inbound=outbound) ditambahkan ke CONTRIBUTING.md.paper/): sumber LaTeX + cermin Markdown, refs.bib dengan metadata terverifikasi terhadap sumber primer (17 RFC, draf IETF yang dipin, DOI Crossref, halaman penerbit), ledger klaim→sumber CLAIMS.md, kesiapan submission CHECKLIST.md, dan npm run paper:check untuk cek silang sitasi/lingkungan (52/52 disitasi).1.0.0-draft (sebelumnya 0.3.0-draft) di paket protokol, SDK, CLI, plugin WordPress, dokumen, dan situs. Versi wire/spec tidak berubah: manifest 0.1 / 0.2, AIFeed Markdown 1.0, MAKO eksternal 0.2 — penomoran ulang tidak mengubah byte bertanda tangan atau klaim kompatibilitas apa pun.0.1.x dan 0.2.x; versi lain melaporkan upgrade_required.aifeed.org (pihak ketiga) ke aifeed.md di spec, schema, URL registry/revokasi, dokumen, tes, SDK, dan plugin WordPress — termasuk bentuk regex ter-escape di schema JSON dan PHP. Semua vektor bertanda tangan, fixture, dan indeks diregenerasi dan regresi penuh dijalankan ulang. Migrasi dapat diulang via node tools/replace-domain.js --domain aifeed.md (dry-run secara default).aifeed.md terdaftar (maintainer, 2026-09-16). DNS dan situs spec/docs adalah langkah konfigurasi berikutnya; URL normatif di spec, schema, dan tautan registry sudah menunjuk aifeed.md.aifeed.md: site/ (landing page), npm run build:site (tools/build-site.js) untuk menyegarkan artefak salinan, .github/workflows/pages-cf.yml untuk Cloudflare Pages, dan docs/deploy-site.md yang mencakup DNS, deploy, dan tata letak subdomain demo.max-image-preview), JSON-LD di landing dan setiap halaman demo, robots.txt + sitemap.xml apex yang mencakup semua halaman demo, generator og-image.png 1200×630 tanpa dependensi (tools/gen-og-image.js), dan docs/seo.md dengan runbook Google Search Console.demo, news, shop, gov, strict, revoked, verify) yang dihasilkan deterministik dari demos/sites.js dengan kunci demo publik, disajikan di Cloudflare Pages melalui functions/[[path]].js (routing host, CORS, enforcement 403/429 live pada strict, verifier browser pada verify, registry revokasi multi-tanda-tangan di bawah site/revoke/). Apex aifeed.md kini memakai AIFeed pada dirinya sendiri dengan manifest bertanda tangannya. Tooling baru: npm run demos, npm run demos:check (di dalam verify), npm run verify:live.AGENTS.md (kontrak agen/dev: file hasil generate, lokasi versi, jebakan), docs/architecture.md (peta modul, invarian, titik ekstensi), docs/release.md (checklist rilis/upgrade), dan pemeriksa tanpa dependensi (npm run lint:syntax, npm run check:consistency) yang digabung jadi satu gerbang: npm run verify.aifeed-protocol/), plugin WordPress di wp-plugin/, dan dokumen proyek Indonesia di bawah docs/. Path kanonik kini github.com/denyn1/aifeed-protocol/tree/main/<path> (tanpa prefiks ganda); workflow CI, tautan situs, dan dokumentasi diperbarui mengikuti.render-html → build-site), sehingga /process.html dan /enforcement-report.html kembali terkirim; build-site kini gagal dengan berisik saat sumber hasil generate hilang alih-alih melewatinya diam-diam (keduanya di-gitignore saat pembersihan).docs/agent-quickstart.md (alur periksa-dulu dan penanganan kegagalan) plus contoh agen patuh yang bisa dijalankan (examples/agent/compliant-agent.js) yang dilindungi tests/agent-example.test.js. SDK kini meneruskan allowPrivate/ca melalui fetchMako, fetchIndexDelta, dan pengambilan tanda tangan sidecar (untuk lingkungan tes lokal self-signed).npm run render:html, npm run build:site) dan kini di-gitignore. Bundel arXiv dibangun langsung dari paper/.@aifeed/[email protected] (dist-tag latest dan next), 27 file, 44,7 kB terpaket; npm install @aifeed/verify langsung berfungsi. Diperbarui ke 1.0.0-draft.1 (2026-09-16) dengan perbaikan penerusan opsi TLS/private-fetch; kedua dist-tag kini menunjuk versi itu. Paket monorepo ditandai "private": true untuk mencegah publikasi tak sengaja.site/logo.svg.docs/process.html), benchmark enforcement (benchmarks/enforcement-report.html), dan panduan lengkap bentuk panjang (penjelasan-aifeed.html → site/penjelasan.html) kini berbagi palet warm dark-first, aksen vermilion, dan toggle terang/gelap; semuanya tetap mandiri/offline tanpa sumber eksternal.aimd, aimd-index, kode level AIMD-C1..C4, konstanta AIMD_*, .aifeed.md). Heading spec EN/ID kini menyatakan identifier wire secara eksplisit.npm run jcs:fixtures (tools/gen-jcs-php-fixtures.js) membangun ulang tools/jcs-php-fixtures.json dari vektor konformansi 001, sehingga tes lintas bahasa JCS/Ed25519 plugin (tests/jcs-test.php) tidak bisa lagi basi setelah regenerasi.paper/CHECKLIST.md diperbarui untuk mencerminkan migrasi yang sudah diterapkan.aifeed.mako.v0.2), pengikatan izin (restrict-only), subset YAML aman, indeks delta dengan digest per entri.aifeed.assets), resume situs dan field triage di indeks, penerbitan /llms.txt (v2) di plugin WordPress.aifeed mako generate|sign|verify|index|fetch; SDK fetchMako, fetchIndexDelta, selectEntries, decideUsage./.well-known/ai.json, Ed25519 + JCS, anchor DNS (_aifeed), revokasi dengan dokumen multi-tanda-tangan, bundel offline.keygen|sign|validate|bundle|init|import-openapi), 24 vektor manifest, verifier JavaScript dan Python independen, plugin penerbit WordPress (0.1.0-rc1) terverifikasi end-to-end (17/17 pemeriksaan admin).<p><a href="CHANGELOG.md">English</a> · <a href="CHANGELOG.id.md">Bahasa Indonesia</a> · <a href="CHANGELOG.zh.md">中文</a></p>
AIFeed 协议与参考实现的所有重要变更都记录于此。格式遵循
> 全项目使用的证据标签：[F] 已验证事实、[M] 可信、[E] 模型估计、[S] 本地模拟装置实测、
> [H] 需法律审查。
aifeed-mcp-server） — 零依赖的 stdio Model Context Protocol 服务器： verify_manifest、fetch_aifeed（按 token 预算获取 markdown 并验签）、list_assets、 verify_asset（字节级 size/sha-256 证明）、select_index（在页面/token 预算内按 查询排序）、decide_usage；仅限 HTTPS（回环需 AIFEED_MCP_ALLOW_PRIVATE=1）；用 npm run mcp 或 npx aifeed-mcp-server 运行。aifeed-mcp-server 重新发布为 1.0.0-draft.2，带上 registry 要求的 mcpName（io.github.denyn1/aifeed-mcp-server），并通过 mcp-publisher 发布到 registry.modelcontextprotocol.io 的 io.github.denyn1 命名空间。 同一构建可打包为 MCPB 包（npm run mcpb），并以 denyn1/aifeed-mcp-server 收录于 Smithery。@aifeed/deepseek-harness） — Cordis 插件，为 harness 提供六个 可由模型调用的工具（aifeed_verify_manifest、aifeed_fetch_aifeed、 aifeed_list_assets、aifeed_verify_asset、aifeed_select_index、 aifeed_decide_usage）；复用零依赖 MCP 引擎的 CJS 生成副本 （npm run build:harness / npm run harness:check）。已发布到 npm：@aifeed/deepseek-harness， 可直接作为 dsh bundle 安装（dsh plugin --profile web add @aifeed/deepseek-harness）。zai-org/zcode-plugins 的 PR #33 为 Z.ai 的 ZCode 智能体新增 aifeed 插件（内置零依赖 MCP 引擎 + verify-first 技能）；等待维护者审核。[email protected] 已在 <https://clawhub.ai/denyn1/skills/aifeed> 公开，可用 npx clawhub install aifeed 安装；ClawHub 安全摘要显示为仅文档型技能，不包含可执行负载。aifeed — 独立 Python 验证器现以仅标准库 wheel 发布（pip install aifeed）： aifeed.verify 与 aifeed.mako 模块、aifeed-verify/aifeed-mako 控制台脚本、 镜像 1.0.0-draft 核心的 PEP 440 预发布 1.0.0a1；历史 aifeed_verify/aifeed_mako 导入仍作为别名。@aifeed/frameworks） — 一行构建集成：Vite 与 Astro 用 aifeed()，Next.js 用 withAifeed() 加 aifeed-next postbuild 命令，任意静态生成器 用通用 aifeed-build CLI（含 keygen）；就地签名构建输出（manifest、逐页 AIFeed Markdown/MAKO、增量索引、llms.txt）、注入 <link rel="alternate">、清理过期生成文件、 自校验签名/摘要；环境变量回退 AIFEED_DOMAIN、AIFEED_KEY、AIFEED_BASE_URL。aifeed） — npx aifeed 发布发布方 CLI（keygen、init、sign、 validate、rotate、bundle、site build、AIFeed Markdown/MAKO 工具），源码位于 packages/aifeed-cli/；sign 现在会在站点目录旁查找默认密钥， validate/verifyDirectory 接受 manifest 位于 .well-known/ 的站点根目录。verifyRemote() — @aifeed/verify 的一次调用远程验证：discovery → manifest + 签名 → DNS _aifeed 锚点状态，使 npm 页面上的 3 行消费者快速上手成为可能。package.json 元数据、WordPress 插件目录头部 与命名空间文档现已指向 github.com/denyn1/aifeed-protocol（规范地址）；workflow 固定 tag v1.0.0-draft.2，用不带 || true 的 validate 作为门禁，并指向 @aifeed/frameworks（Vite/Astro/Next.js）；check-consistency 会拒绝过期的 aifeed/aifeed-protocol URL。integrations/rust） — Axum 中间件 AifeedLayer（内容协商、内联签名、 遍历防护），经 11 个 cargo test 用例验证。site/feed.xml 在构建时由 CHANGELOG.md 渲染，并从首页 head 链接； sitemap 收录它。badge.svg（"verified by AIFeed"），发布者指南附可复制的 HTML 与 Markdown 片段，已签名源站可借此回链。examples/python/ 下可复制的 LangChain、LlamaIndex 与 Crawl4AI 加载器，由 test_examples.py 覆盖（+11 测试）。skills/aifeed/SKILL.md 教编程智能体验证/发布流程； smithery.yaml 给出 MCP stdio 启动命令。npm run studio 在 127.0.0.1:7777 提供 零依赖 Web UI：按域名的工作区、本地 HTML 来源接入、restrict-only 策略编辑器 （使用许可、署名文本/URL、抓取限额、许可证、llms.txt、撤销间隔、路径规则）、 增量构建、manifest/页面/索引的本地验证，以及带 _aifeed DNS TXT 记录的导出。 遵守 robots 的抓取器（sitemap 或链接发现、限速、ETag/Last-Modified 缓存）覆盖线上 站点；站点类型预设（news、ecommerce、marketplace、government、open、restrictive、 blog）、按路径的页面类型（product、article、listing……）以及可选的 freshness 元数据（页面日期/标签）补齐了站点类型支持。M3 新增 .tar.gz 覆盖层下载、与 integrations/ 适配器提示相连的技术栈检测、一键线上验证（manifest、签名、DNS 锚点），以及会换钥并重新签名所有页面的受保护密钥轮换仪式。G4 新增经 schema 校验的 types/capabilities/actions 编辑器、面向电商动作的 OpenAPI 导入，以及审计日志 （journal.ndjson）和针对常见 DNS、schema、签名与轮换失败的内联修复提示。私钥保留在工作区（0600）且永不对外提供； 界面支持 EN/ID/ZH。manifest 构建器 （lib/site.js）新增可选 limits、license、attribution_text/url 与 maxCheckIntervalHours 选项（向后兼容）。aifeed.assets 条目可携带 mime、size 与 sha-256（构建时对本地文件计算，≤16 MiB）；增量索引条目暴露 assets 数量，SDK 新增 listAssets() 与 verifyAsset()，Studio 显示资源总数与摘要覆盖率，verify:live 在资源路径上验证边缘执行。studio.html（Publish）与 updates.html（构建时从 EN/ID/ZH 变更日志 渲染的发布说明）页面，已从导航栏、artifacts 网格与 apex sitemap 链接；两者均附带 签名 AIFeed Markdown。rotation.successor_fp 指令加建议性 DNS pk2 交叉校验、有界重叠期 （effective_at → grace_until，1 小时硬下限）、新密钥签名的 predecessor_fp 切换 绑定，然后是永久撤销。六个结果码：rotation_invalid、rotation_anchor_unverified、 grace_accepted、rotation_denied、rotation_resync、key_revoked。实现于 lib/rotation.js、单命令 CLI aifeed rotate [--dry-run]、SDK rotation 导出、 Python 指令对等、PHP manifest 校验、向量 008–011 / 119–123，操作手册见 docs/rotation.md。1.0.0-draft.2 —— 包含密钥轮换辅助（rotation.*）、Studio 使用的 v0.2 manifest 构建器选项（limits、license、attribution 文本/URL），以及 htmlToMako 的页面类型与可选 freshness 选项。text/aifeed+markdown、.aifeed.md、 aimd: "1.0"、一等 aifeed 政策块、token 预算由发布方自选（仅 AIFeed Markdown 模式 下参考默认 4,000）。aimd / mako）；跨格式重放被拒绝。content.profile（mako | aifeed-md | both）与 content.index_url；AIFeed Markdown 索引位于 /.well-known/aifeed-index.json。aifeed aimd <generate|sign|verify|index|fetch> 别名，generate、index、fetch 支持 --format；sign/verify 自动识别配置。@aifeed/verify 1.0.0-draft：fetchAimd、verifyAimdDocument、 verifyAimdIndex、媒体类型常量。aifeed_dual_stack 过滤器实现仅 AIFeed Markdown 模式、按格式的签名与索引。spec/en|id|zh/aifeed-aimd-v1.md（运行模式、IANA 考虑）。conformance/aimd/（11 个用例：标记、跨格式重放、篡改、资源、alternates、 严格可选字段校验）并带 Python 对等；模糊语料包含 AIFeed Markdown。CONTRIBUTING.md、SECURITY.md、CODE_OF_CONDUCT.md、GOVERNANCE.md、 spec/README.md、SDK README、插件 LICENSE 与初始 .pot。aifeed site build <dir> 为任意静态输出（Hugo、Jekyll、Astro、 Next export、纯 HTML）生成 manifest、增量索引、带签名的逐页内容与可选的 llms.txt， 并支持可选注入 <link rel="alternate">。文件命名按配置区分——AIFeed Markdown 用 .aifeed.md、MAKO 用 .mako.md、--profile both 两者都写——附带与媒体类型匹配的 {file}.sig 边车。目录索引（/dir/index.html）在所有适配器上都可通过干净路径 （/dir）访问，包括嵌套路径。integrations/）：nginx、Caddy、Apache、Node/Express、Next.js、 PHP、Python ASGI、Go 与 GitHub Action（含 Node handler 测试）。GOVERNANCE.md：验证路径（规范、schema、验证器、向量、 发布工具）永久开放，不含专有验证扩展；只有密钥、客户数据与反滥用策略保持私有。 贡献许可（inbound=outbound）加入 CONTRIBUTING.md。paper/）：LaTeX 源 + Markdown 镜像、对照一手来源核验元数据的 refs.bib（17 个 RFC、固定版本 IETF 草案、Crossref DOI、出版商页面）、 CLAIMS.md 主张→来源台账、CHECKLIST.md 投稿就绪清单，以及用于引文/环境交叉检查的 npm run paper:check（52/52 已引用）。1.0.0-draft（原 0.3.0-draft），覆盖协议包、SDK、CLI、WordPress 插件、文档与站点。线格式/规范版本不变：manifest 0.1 / 0.2、AIFeed Markdown 1.0、外部 MAKO 0.2——重新编号不改变任何签名字节或兼容性主张。0.1.x 与 0.2.x；其他版本报告 upgrade_required。aifeed.org（第三方）迁移到 aifeed.md，覆盖规范、schema、 注册表/撤销 URL、文档、测试、SDK 与 WordPress 插件——包括 JSON schema 与 PHP 中 转义的正则形式。所有签名向量、夹具与索引重新生成，完整回归重跑。迁移可通过 node tools/replace-domain.js --domain aifeed.md 重复执行（默认 dry-run）。aifeed.md 已注册（维护者，2026-09-16）。DNS 与规范/文档站点是下一步 配置；规范、schema 与注册表链接中的规范 URL 已指向 aifeed.md。aifeed.md 静态站点部署资产：site/（落地页）、用于刷新复制产物的 npm run build:site（tools/build-site.js）、面向 Cloudflare Pages 的 .github/workflows/pages-cf.yml，以及涵盖 DNS、部署与演示子域名布局的 docs/deploy-site.md。max-image-preview）、落地页与每个演示页的 JSON-LD、覆盖全部演示页的 apex robots.txt + sitemap.xml、零依赖 1200×630 og-image.png 生成器 （tools/gen-og-image.js），以及含 Google Search Console 操作手册的 docs/seo.md。demo、news、shop、gov、strict、 revoked、verify）由 demos/sites.js 与公开演示密钥确定性生成，通过 functions/[[path]].js 部署于 Cloudflare Pages（主机路由、CORS、strict 上的 实时 403/429 执行、verify 上的浏览器验证器、site/revoke/ 下的多签名撤销注册 表）。apex aifeed.md 现在以自身签名 manifest 自我吃狗粮。新工具：npm run demos、 npm run demos:check（在 verify 内）、npm run verify:live。AGENTS.md（智能体/开发者契约：生成文件、版本位置、陷阱）、 docs/architecture.md（模块地图、不变量、扩展点）、docs/release.md （发布/升级清单），以及零依赖检查器（npm run lint:syntax、 npm run check:consistency）并入一个门禁：npm run verify。aifeed-protocol/），WordPress 插件位于 wp-plugin/，印尼语项目文档位于 docs/ 下。规范路径现在是 github.com/denyn1/aifeed-protocol/tree/main/<path>（无双重前缀）；CI workflow、 站点链接与文档已相应更新。render-html → build-site），因此 /process.html 与 /enforcement-report.html 恢复发布；build-site 现在在生成源缺失时大声失败， 而不是静默跳过（两者在清理时被 gitignore）。docs/agent-quickstart.md（先检查流程与失败处理）与可运行的 合规智能体示例（examples/agent/compliant-agent.js），由 tests/agent-example.test.js 覆盖。SDK 现在通过 fetchMako、fetchIndexDelta 与 边车签名抓取转发 allowPrivate/ca（用于本地自签名测试环境）。npm run render:html、 npm run build:site）并已 gitignore。arXiv 包直接从 paper/ 构建。@aifeed/[email protected]（dist-tag latest 与 next）， 27 个文件、打包 44.7 kB；npm install @aifeed/verify 开箱即用。更新为 1.0.0-draft.1（2026-09-16），含 TLS/私有抓取选项转发修复；两个 dist-tag 均 指向它。monorepo 包标记为 "private": true 以防误发布。site/logo.svg 使用它。docs/process.html）、执行 基准（benchmarks/enforcement-report.html）与长文完整指南 （penjelasan-aifeed.html → site/penjelasan.html）现在共享暖黑调色板、朱红强调色 与明暗切换；全部保持自包含/离线，无外部资源。aimd、aimd-index、AIMD-C1..C4 级别码、AIMD_* 常量、.aifeed.md）。 EN/ID 规范标题现在明确说明线标识。npm run jcs:fixtures （tools/gen-jcs-php-fixtures.js）从一致性向量 001 重建 tools/jcs-php-fixtures.json，插件的跨语言 JCS/Ed25519 测试 （tests/jcs-test.php）在重新生成后不会再过期。paper/CHECKLIST.md 的域名项更新以反映已执行的迁移。aifeed.mako.v0.2）、许可绑定（restrict-only）、 YAML 安全子集、带逐条摘要的增量索引。aifeed.assets）、索引中的站点摘要与分流字段、WordPress 插件中的 /llms.txt（v2）发布。aifeed mako generate|sign|verify|index|fetch；SDK fetchMako、 fetchIndexDelta、selectEntries、decideUsage。/.well-known/ai.json 的签名 manifest、Ed25519 + JCS、DNS 锚点 （_aifeed）、带多签名文档的撤销、离线包。keygen|sign|validate|bundle|init|import-openapi）、24 个 manifest 向量、 独立 JavaScript 与 Python 验证器、经端到端验证的 WordPress 发布插件 （0.1.0-rc1，17/17 管理检查通过）。