Changelog

# Changelog — joakim.jardenberg.net

0.1.0-alpha.23 - 2026-10-11

Changed

• Profile edition 0.14 extends Stacked Principles to general-election choices: equal human worth takes precedence when it conflicts with JJ's free-market preference. The existing service example is unchanged; no parties are named.
• The same owner-requested addition is available in the website, downloads and signed MCP section. Tool contracts, sources, signing and section IDs are unchanged.

0.1.0-alpha.22 - 2026-10-09

Added

• Profile edition 0.13 connects the longer-term profile to jardenberg.com, Now and Notes, with clear links near the introduction and in the short version.
• A dedicated footer navigation row and an AI reading-guide section point to the same live destinations. All three sources are explicitly first-party.
• Existing nine MCP tools, source retrieval, discovery routes, signing and profile section IDs remain unchanged. Current writing stays on its canonical site.

0.1.0-alpha.21 - 2026-10-09

Added

• Correctly typed RFC 9727 API catalogue and browser-accessible discovery/reading endpoints for the published jardenberg.com collection.
• Fixed-origin public JSON proxy with an explicit path allowlist, bounded reads, redirect rejection, CORS for public GETs, and no private-source or credential access.
• Site publishing remains the single content source. Existing MCP tools, key and profile content are unchanged.

0.1.0-alpha.20 - 2026-10-09

Fixed

• Preserve complete validated public-source records when reading the expanded site archive, including shared-source attribution and archive-feed policy fields. Source-record hashes retain their exact source representation.
• Added full-record parity and larger-catalog pagination regression checks. Existing profile content and tool descriptors remain unchanged.

0.1.0-alpha.19 - 2026-10-09

Fixed

• Retrieve the public site collection using the edge runtime’s supported manual redirect mode. Redirect responses are still rejected; no arbitrary destination can be followed.
• Reproduced the prior failure in the local Workers runtime and added a redirect-rejection regression case.

0.1.0-alpha.18 - 2026-10-09

Fixed

• Public-site retrieval failures now report a bounded diagnostic stage in the signed error, so a hosting fetch failure can be distinguished from content validation. No private values or source bodies enter diagnostics.

0.1.0-alpha.17 - 2026-10-09

Added

• Three read-only tools to list, search and read all published jardenberg.com pages, including every Now edition and Note, with English and Swedish retrieval.
• Public site index resource and exact-page resource reading, with canonical links, full text, original language, image descriptions, CC BY 4.0 exceptions and AI credits in signed responses.
• Fixed-origin, bounded retrieval of the generated public collection, a maximum 60-second successful-fetch cache, and explicit errors instead of silent stale fallback.

Changed

• Setup and discovery describe the public-site tools and feeds. Existing six profile tools and profile content 0.12 are unchanged.
• The full tool-catalog fingerprint now covers nine descriptors. Persistent signing key and the three supported MCP revisions are unchanged.

Software releases for the public profile site and PPCP/MCP server. Software version and profile content version are distinct: this file tracks the software. The profile content edition is 0.14 (2026-10-11), approved for publication by Joakim Jardenberg.

The machine-readable copy of this file is served at /CHANGELOG.md.

0.1.0-alpha.16 - 2026-10-01

Changed

• Profile edition 0.12 links Cow on the Ice directly to its Spotify show page. The two episode links and explanatory text remain intact. All other profile prose and MCP contracts are unchanged.

0.1.0-alpha.15 - 2026-10-01

Added

• Owner-approved profile edition 0.11: a personal bookshelf, podcast selection including four Swedish additions, and five everyday AI experiments. Each recommendation retains its explanation and summer 2026 context.
• Three separately addressable sections, served consistently in the website, downloads, search and signed MCP tools/resources. Public links distinguish JJ's own episode and election project from destinations for books and shows.

Development

• The regression runner uses standard Node subprocess execution and Vite module loading, removing its Bun-only runtime requirement.

Preserved

• Earlier section IDs and prose, whole-person context, the closing signature and humour, CC BY 4.0 and owner approval. Framtidig remains explicitly unread at the time of the July recommendation; no new reading completion is inferred.
• All six tool descriptors and both full-profile formats. Signing, the persistent key, protocol revisions and hosting restrictions are unchanged.

0.1.0-alpha.14 - 2026-09-26

Added

• Short-version-first retrieval guidance in discovery instructions, tool descriptions, the starter prompt and llms.txt. Relevant full sections follow the overview; full reading remains available when requested.
• An optional format: "compact" for ppcp_get_profile. It returns the same exact Markdown and every public source pointer, without a second embedded set of section bodies or a duplicated source list.
• A plain-language FAQ on how much the AI reads and technical guidance on client-side verification and context selection.

Compatibility and verification

• Omitted format and format: "ppcp" retain the original full PPCP response shape. All six tool names remain available. The optional input and revised descriptions change the catalog fingerprint; clients may need to refresh metadata.
• Both text and structured representations remain complete, with provenance, sources and Ed25519 signatures. Both payload and text digests remain bound; clients decide what reaches model context.
• Profile edition 0.10 and all downloadable profile content remain unchanged. This is a software release only; no new personal-profile approval is implied.

0.1.0-alpha.13 - 2026-09-26

Added

• Four substantial profile sections covering recognition, early internet/media/enterprise work, openness/culture/public life, and learning/community/adoption.
• Owner-supplied Apple Sweden 1998 award and first Swedish-delivery Bondi Blue iMac account, plus the spring silver and autumn win in the internal 2022 Volvo Group Strategy forecasting championship.
• Public sources with explicit first-party/external-source roles, while preserving historical source IDs, individual/team credit and clear boundaries on what each source establishes.

Changed

• Published owner-authorised content edition 0.10 dated 26 September 2026. Family, practical working preferences and the closing signature and food joke are preserved.
• Approval labels now say approved for publication, reflecting the owner's authorisation of the expanded edition.

The six tool descriptors, catalog hash, signing key and protocol behaviour are unchanged. New sections and source pointers use the existing retrieval tools.

0.1.0-alpha.12 - 2026-09-25

Added

• A closing “And finally” section with JJ's long-standing email signature and his bacon, mos and rostad lök joke, exactly where readers finish the profile.
• The new section is available through the existing section, search and resource tools, alongside all prior sections.

Profile content is edition 0.9, with both additions requested by JJ. Owner-approved status, AI-assisted authorship, quotation boundaries, all six tool contracts and the signing key are unchanged.

0.1.0-alpha.11 - 2026-09-25

Changed

• Recorded Joakim Jardenberg's explicit approval of the public profile as content edition 0.8.
• Updated current page labels, downloads, HTTP review headers, vCard, discovery files and signed MCP provenance to published / owner-approved.
• Kept the AI-assisted editorial authorship label, quotation distinctions, licence and authority boundaries.
• Updated the full-profile tool description to reflect approval. All six tool names, inputs and read-only behavior are unchanged; the computed catalog fingerprint reflects the corrected description.

0.1.0-alpha.10 - 2026-09-25

Added

• Custom JJ favicon in SVG and ICO formats, plus an Apple touch icon.
• A 1200 × 630 social sharing card in the site's paper, charcoal and red palette.
• Open Graph and Twitter image metadata for the profile and its supporting pages.

Fixed

• Replaced leftover Lovable title, author and social-account defaults in the shared page metadata.

Profile content remains edition 0.7. The public profile, MCP tool definitions, signing key and protocol behavior are unchanged.

0.1.0-alpha.9 — 2026-09-17

Content revision: profile content edition 0.7 (Markdown SHA-256 d5cb1fd2f7bb7f33922d4ee7cdb3736eab3750d9b7167f250cfe42f9c854cc11, 23 sections, 16 public sources). PPCP 0.1.0, verifiable-mcp 0.2.1, signing key, origin policy, the six tool descriptors and the catalog hash sha256:e91bcd62686ef346cd9f9f36d40f5ad4ffdb1882ffa96d7e0050b8dea93c3c51 are unchanged, as are alpha.8's top-level ttlMs: 60000 / cacheScope: "public" hints for 2026-07-28, the legacy paths and the no-store diagnostics headers.

• Owner-selected content edition 0.7 replaces the source Markdown byte-for-byte. Stacked Principles was corrected against the owner's own correspondence to make contextual priorities, a boundary beyond which another principle takes precedence, personal freedom in both directions, and the difference between a personal decision and a public campaign explicit. The correspondence stays private; no private provenance links were added.
• New dedicated top-level section family-home-and-everyday-life near the beginning, carrying the family names, homes, occupations, ages, animals and shared vehicles the owner expressly chose to publish, plus the 1966 birth year and turning 60 in 2026. All earlier section anchors are retained.
• /about-this-profile no longer suggests family detail is categorically excluded: selected family names and everyday details are deliberately public, while personal identity numbers, exact addresses, private correspondence, customer confidences and operational detail remain outside the public subset.
• Home page family jump link now points at the new section anchor.
• Link compatibility: the earlier fragment #family-relationships-and-care is preserved as an unobtrusive alias anchor at the start of the new family section, so old links still land on that heading. No duplicate section id, no new MCP resource (the earlier family heading was never a standalone section), and navigation targets only the current id.
• This release records the owner's authorization to publish this revision and the factual correction. It is not a blanket assertion that all wording has been reviewed or independently fact-checked; the profile remains public-draft / owner-review-pending with the AI-assisted editorial label.

0.1.0-alpha.8 — 2026-09-16

Bounded MCP freshness correction. Profile content edition 0.6 (Markdown SHA-256 1b1fe2c14abe2f0f35bd4b1e7f1001155ae044ada77dd2e6508d50e74953308a), PPCP 0.1.0, verifiable-mcp 0.2.1, signing key, origin policy and the six tool descriptors are unchanged.

• Standards fix: for 2026-07-28, complete results of server/discover, tools/list, resources/list and successful resources/read now carry top-level ttlMs: 60000 and cacheScope: "public", as required by the caching utility (https://modelcontextprotocol.io/specification/2026-07-28/server/utilities/caching). The previous, non-conforming _meta["io.modelcontextprotocol/ttlMs"] and _meta["io.modelcontextprotocol/cacheScope"] keys are removed. serverInfo metadata is retained. No cache hints on tools/call, initialize or errors. 2025-11-25 and 2025-06-18 responses omit the new fields.
• Still one deterministic complete page of six tools with no nextCursor. This server remains stateless with no server push: listChanged and subscriptions are deliberately not advertised, and no SSE or subscription infrastructure was added. The limit is documented on the /mcp page and in /health.
• New deterministic catalog diagnostic computed from the full six tool descriptors sorted by name with a locale-independent comparator, RFC 8785 canonicalized and SHA-256 hashed: { tool_count, sha256, canonicalization: "RFC8785", scope }. Exposed as tool_catalog in the signed ppcp_get_version payload, /health, /api/health and /.well-known/mcp.json, and in _meta["org.jardenberg/tool-catalog"] on tools/list and server/discover. Software version, timestamps, content version and the diagnostic itself are excluded from the hashed array. The bare hash is not authentication: only the enclosing signature attests it.
• Cache-Control: no-store on /health, /api/health and /.well-known/mcp.json so freshness diagnostics are never cached. POST /mcp stays no-store. Public content downloads keep their independent five-minute cache, now documented explicitly.
• /mcp page: one new question, "What if my AI shows old tools or information?", covering connector refresh, starting a new conversation, retained app context, workspace administrator action and the fact that a working connection does not prove an updated tool list, linking OpenAI's current refresh instructions. A collapsed "Freshness and tool updates" panel in the technical reference states the actual on-next-use hints, the no-push limit, legacy and host limits, the live tool count and hash, source edition/date/hash as distinct from software, MCP and PPCP versions, the five-minute download cache and links to /health and the MCP caching spec.
• New docs/mcp-release-checklist.md: verify revision support against current dated docs before advertising, check catalog completeness/pagination/count/ hash, diff schemas and keep host-approved inputs working, test every advertised revision plus signed errors and resource reads, verify the deployed server separately from the model-facing host inventory, and use host-specific refresh or review paths.

0.1.0-alpha.7 — 2026-09-16

Human-first restructure of the browser setup page at GET /mcp only. No change to the profile content (edition 0.6), PPCP 0.1.0, schema, tool definitions, transport, auth, signing logic, keys or domains.

• src/lib/mcp-page.server.ts rewritten in the owner-approved order: why connect, connector address with the existing copy control, starter prompt, official per-app setup guides, first-use prompts, common questions, friendly capability labels, then a Technical reference at the bottom.
• The no-authentication statement now sits immediately under the address and is answered again in an FAQ entry that is open by default: no password, API key or OAuth credentials for this public connector, separate from the visitor's own AI-service account and eligibility.
• New copyable natural-language starter prompt with its own button, keeping the exact preface "If you want to add this to your AI client, start with this prompt and see if that works." The prompt asks the AI to guide the user when it cannot install the connector itself, and to verify real access.
• Setup guides link to the services' own current instructions (ChatGPT, Claude, Grok, Mistral Work, Gemini, Perplexity remote connectors), checked 2026-09-16. The footnote states only that these are official guides checked 2026-09-16 and that menus and availability can change; the Mistral link points to the verified topic guide without a fragment.
• Added the file fallback: download /profile.md and attach or paste it, noted as a snapshot that does not refresh.
• Tools are still generated from TOOLS; friendly labels precede the unchanged real names and descriptions.
• Transport and header rules, the working curl example, resources internals, signing and key discovery, provenance limits and the hosting-filter note all moved into accessible disclosure panels under Technical reference, with the live signing/unsigned status preserved.
• Copy controls report truthful success or a manual-copy fallback through an aria-live status region, with visible keyboard focus and 44px targets. Prose and URLs wrap on mobile; only the code block scrolls horizontally.
• Conformance suite extended with page-structure, ordering, provider-link, copy-payload and disclosure checks, including the visible plus/minus expand indicator on every disclosure: 189/189 passing.

0.1.0-alpha.6 — 2026-09-16

Content edition 0.6: three owner-approved editorial additions, plus release metadata. No transport, signing-key, protocol, schema or design change.

• src/content/profile.md updated to the 0.6 edition, SHA-256 1b1fe2c14abe2f0f35bd4b1e7f1001155ae044ada77dd2e6508d50e74953308a (37 751 bytes). Metadata date/date_processed and the visible heading date are 2026-09-16; updated_at derives from that source date.
• Section 9 "What counts as value" gains, immediately after "Time saved is useful, but it is not the whole case.", the distinction between efficiency AI (improving work we already do) and opportunity AI (what becomes possible when capabilities, costs and constraints change), including direction-setting when generating ideas becomes easier than choosing among them.
• Section 14 "My chosen interface and my memory" gains, after the first Interface Sovereignty paragraph, a paragraph on revisiting the job a familiar deliverable is meant to do — who needs to understand or decide something and when — while keeping sources, responsibilities and the existing approach's useful qualities visible.
• Section 6 "Learning, curiosity and play" gains, after its first paragraph, a paragraph on building learning environments on the natural ways people ask, explore and express understanding, with reading's intrinsic value retained and the design question framed as expanding access while preserving capabilities worth valuing.
• These three additions are owner-approved (Joakim, 2026-09-16). This does not extend approval to the rest of the profile wording: publication status stays public-draft, review status stays owner-review-pending, and the AI-assisted editorial label is unchanged.
• All existing sections, section IDs, sources and source roles, licence boundaries, signing key and MCP transport are unchanged. Every surface (HTML, /profile.md, /profile.json, /profile.signed.json, MCP tools and resources, download and vCard metadata, server cards, /health) derives 0.6 and the new source hash from the single source.
• Software version 0.1.0-alpha.6. PPCP protocol 0.1.0, the profile schema and org.jardenberg/verifiable-mcp 0.2.1 are unchanged.
• Conformance: new checks that each approved paragraph appears exactly once, in the right section, in served HTML, in ppcp_get_section (signed) and via ppcp_search; the 0.6 source hash, the dated 0.6 source changelog entry, the visible 0.6 heading date, and retained draft/review metadata. All previous checks preserved.

0.1.0-alpha.5 — 2026-09-13

Content edition 0.5 plus the source classification and navigation it needs. No transport, signing-key, protocol or design change.

• src/content/profile.md replaced with the owner-supplied 0.5 edition, SHA-256 a401da9c12900d7d336cbe377b5abb1b8a10f48f24e0e913ac625d72612b79d7 (36 145 bytes). All previous family, personal-life and source wording is preserved; every existing section anchor is unchanged.
• New navigable section "Working with me in practice" at /#working-with-me-in-practice: contact and booking via cal.com, async pace and late-night expectations, prepared agendas, physical meetings with equal remote participation, visible Klang/Circleback capture (sometimes without JJ present), post-meeting material, and transparency/no bullshit.
• Section 13 now links JJ's public AI team (aiteam.jardenberg.net, with the .se address noted as a redirect) and his public whole-genome sharing folder with its CC0 1.0 licence document. The profile text itself stays CC BY 4.0. No genome or private data is imported; only links.
• Source classification: cal.com/jardenberg, aiteam.jardenberg.net, aiteam.jardenberg.se, go.jardenberg.se/wgs and the linked licence document are primary-self-source pointers. The genome link is explicitly not treated as independent corroboration of personality, and not as permission to access or reproduce relatives' data.
• Home page: a "working with me" jump link sits beside the existing family and everyday-life links; family stays first.
• Every surface (HTML, /profile.md, /profile.json, /profile.signed.json, MCP tools and resources, download and vCard metadata, server cards, /health) derives 0.5 and the new source hash. Nothing hardcodes 0.4 for current content; the historical changelog entries stay historical.
• Software version 0.1.0-alpha.5. PPCP protocol 0.1.0 and the schema are unchanged, as is the signing key.
• Conformance: new checks for the exact 0.5 source SHA-256, retrieval and search of the new section, stability of all pre-0.5 anchors, the full source ID set and every source role. All previous checks preserved.

0.1.0-alpha.4 — 2026-09-13

Error-binding correction found in independent production testing against joakim.jardenberg.net (42/44 grouped checks passed; the two failures were the exact v0.2.1 error payloads for a missing MCP-Protocol-Version header and an unsupported protocol version). No content, key, protocol or design change.

• signedErrorFrame now signs exactly the v0.2.1 SPEC.md §8 payload { id, error: { code, message } }. Previously any extraData (for example supported / requested for version negotiation) was spread into the signed payload.error, so the signed payload no longer matched the published error test vector.
• extraData is unchanged on the wire: it still sits in error.data alongside the signed envelope, so MCP version negotiation still sees supported and requested.
• Setup-page regression: the /mcp "Try it" curl example omitted MCP-Protocol-Version, so the corrected server rejected its own documented example. The example now sends the required MCP-Protocol-Version, Mcp-Method and Mcp-Name headers plus modern _meta, and documents the legacy initialize + 2025-11-25 alternative. A conformance test extracts the exact rendered example from the served HTML and runs it.
• The example includes a descriptive User-Agent, because the hosting edge in front of this site has been observed to block some default library user-agents (e.g. Python-urllib/3.11) with an edge error before the request reaches the server; named clients are served. Documented as a factual observation; no server-side workaround.
• ppcp_get_profile description now states "Public draft; owner review pending; AI-assisted editorial wording". Profile 0.4 source unchanged.
• Regression tests cryptographically verify both failing cases (missing header and unsupported version): the envelope signature is checked against the published JWKS, payload_digest is recomputed from the canonical payload, and the payload's exact key sets are asserted (id, error; code, message), including that negotiation fields are absent from the signed payload.

0.1.0-alpha.3 — 2026-09-13

Transport edge cases found in the alpha.2 review. No content, key or design change.

• The GET SSE refusal and the DELETE refusal now use the same signed error-frame constructor as every other error; both also carry CORS headers.
• Origin validation now applies to GET and DELETE as well as POST and OPTIONS, matching the transport's rule for all incoming connections. Origin-less non-browser clients are still accepted.
• JSON-RPC envelope validation: "jsonrpc": "2.0" is required, and a request id must be a string or a safe integer. Missing/wrong jsonrpc, id: null, and boolean, fractional, array or object ids get a signed -32600 + HTTP 400.
• Notifications (any method sent without an id) now always return HTTP 202 with no body; a tools/call notification can no longer receive a result.
• MCP-Protocol-Version is now required as an HTTP header on every non-initialize request that carries an id, including requests with neither the header nor _meta: the oldest advertised revision is 2025-06-18, so an absent header must not silently take an unsupported pre-2025 path. Missing header → signed -32020 HeaderMismatch + HTTP 400. initialize (legacy negotiation) and notifications remain exempt. clientCapabilities must be a JSON object, so arrays are rejected; clientInfo stays optional, as in the spec.
• Request bodies are decoded as UTF-8 fatally (malformed bytes → signed -32700 + 400) and structural nesting is bounded at depth 32 before any recursive traversal, so deep nesting yields a signed -32600 + 400 rather than an unhandled error.

0.1.0-alpha.2 — 2026-09-13

MCP transport and signing-binding corrections.

• Implements the 2026-07-28 Streamable HTTP binding: MCP-Protocol-Version must agree with _meta["io.modelcontextprotocol/protocolVersion"], Mcp-Method and (for tools/call / resources/read) Mcp-Name are required and validated against the body, with -32020 HeaderMismatch + HTTP 400 on any mismatch or missing header, including Base64-sentinel decoding.
• Adds server/discover, resultType: "complete" on every result and io.modelcontextprotocol/serverInfo in result _meta. Unknown methods now return HTTP 404 with -32601; notifications return 202. The legacy initialize path for 2025-11-25 and 2025-06-18 is unchanged.
• -32022 UnsupportedProtocolVersion lists supported versions for unknown ones.
• resources/read now signs exactly the result's contents binding, with the exact resource text as the signed text arm.
• Origin checking uses an exact documented allowlist (no host pattern matching); origin-less clients are still accepted. DELETE returns 405 (stateless).
• Every JSON-RPC error frame — parse errors, oversized bodies, batch rejection, header mismatches, RPC errors — is now produced by one signed constructor.
• Request bodies are read with a hard byte bound instead of being buffered first; JSON-RPC batches are rejected; lone UTF-16 surrogates are rejected before anything is canonicalized or signed.

0.1.0-alpha.1 — 2026-09-13

First release of the public profile site.

• Public, anonymous, account-free reading of the full profile at /, with a sticky contents sidebar, mobile contents drawer, section anchors and in-page search.
• Exact public Markdown at /profile.md (text/markdown) as the single source for every other representation.
• PPCP 0.1.0 JSON at /profile.json, validated against the published profile schema, and a signed packaging at /profile.signed.json.
• Read-only MCP server on POST /mcp (stateless streamable HTTP), with ppcp_get_profile, ppcp_list_sections, ppcp_get_section, ppcp_search, ppcp_get_sources and ppcp_get_version, plus resources/list and resources/read over an exact URI allowlist.
• Browser setup page on GET /mcp with an endpoint copy button; SSE GET streams are not supported and return 405.
• org.jardenberg/verifiable-mcp 0.2.1 signing: Ed25519 (EdDSA), RFC 8785 canonicalization, RFC 7638 kid, signed wrapper with iat, payload, payload_digest, content_digest and provenance, signed error frames and signed isError results. Missing key degrades visibly to unsigned.
• Discovery: /.well-known/mcp.json (with the signing JWKS), /.well-known/ppcp.json, /llms.txt, /robots.txt, /sitemap.xml, /contact.vcf.
• /about-this-profile, /changelog and /api/health.
• Schema.org ProfilePage + Person with sameAs to Wikidata and Swedish Wikipedia.