Changelog

Notable changes to the resolver, verification flow, and API contract, newest first. Every entry has a permanent anchor link. API stability rules live in the specification; when a year ends, its entries move to a per-year archive page.

2026

September 8, 2026 — brand & verification hardening

• Verification lifetime uniformly documented as 365 days; malformed verification dates now fail closed (treated as expired, never "verified forever").
• Added a no-network regression test suite covering domain normalization, apex-only ownership proofs, URL rules, expiry, and private-IP detection.
• Refreshed brand identity: new mark, display typeface, and a single restrained accent shared with the verified state.

September 8, 2026 — institutional hardening

• Repositioned messaging: NessGate is the verified data resolver for AI — a DNS-like lookup model, not DNS itself.
• Registry moved to a replicated authoritative database; the public GitHub registry.json continues as an audit-trail snapshot. GitHub is no longer in the runtime resolution path.
• verified_at added to /resolve and /registry.json responses (additive). Verification lifetime defined: 365 days, renewable by re-verifying.
• Ownership proofs tightened to the apex domain exactly — www and all other subdomains can no longer prove the parent.
• HSTS enabled on all responses; edge burst rate limiting added ahead of the hourly cap.
• Added security@, abuse@, and privacy@nessgate.com.

September 8, 2026 — specification & discovery

• Published the v1 specification with explicit stability guarantees, an OpenAPI description, and this changelog.
• Security hardening: ownership proofs are accepted only from the claimed domain itself (apex/www) — control of an unrelated subdomain can never claim its parent. Registry reads now fail closed.
• Added /llms.txt, /ai-info.json, and /.well-known/security.txt. First verified domains listed.
• DNS TXT record (_nessgate.{domain}) added as a verification method.

September 7, 2026 — launch

• NessGate v1 live at nessgate.com: public resolver, open registry, and account-free domain verification via .well-known file or JSON field.