Signal Log
A dated, public record — not a changelog dressed up as marketing.
This replaces a conventional changelog. Every entry below is either verifiable inside this codebase — an article count, a method-version date — or a genuinely public standards fact. Nothing here is a roadmap item presented as shipped, and nothing is back-dated to manufacture a longer history than we have.
The record
What changed, and when.
This log begins on the date we started keeping it: 27 July 2026. Anything earlier appears only where it is a genuinely public fact — a standard being finalised, a regulation taking effect — cited for context, not presented as something we tracked in real time.
- 27 Jul 2026Method
The Theos Method reaches v1.0
theos-method-v1.0 is now the current, canonical scoring method, published in full at /methodology. It supersedes theos-method-v0.1, published two days earlier, which remains referenced only as a historical revision.
- Method version identifier: theos-method-v1.0, published 2026-07-27
- Five weighted dimensions — Primitive Fragility, Confidentiality Horizon, Reachability, Change Cost, Substitution Gap — plus the fragility-floor override
- Four tiers: Acute, Elevated, Watch, Contained
- 27 Jul 2026Site
This Signal Log begins
This page publishes today, alongside the rest of the pages below. Going forward it records true, dated changes to the product, the method, the standards we track and this site — not aspirational roadmap items and not a running list of marketing announcements.
- 27 Jul 2026Site
Knowledge Base and Lexicon published
The Knowledge Base went live at /knowledge with 41 articles across nine categories, alongside the Lexicon at /knowledge/lexicon, a 164-term glossary of post-quantum and cryptographic-inventory vocabulary. Both are searchable through the site's ⌘K palette.
- 41 articles across Start Here, Discovery, Risk & Scoring, Migration, Standards & Compliance, The Threat, Platform & Access, Data & Privacy, and The Theos Method
- 164 terms in the Lexicon, cross-referenced to related terms and to the article that uses each one
- 27 Jul 2026Security
Assurance Center and Attestation Lookup published
Two trust-surface pages went live: the Assurance Center at /assurance, documenting our controls and posture in plain language, and Attestation Lookup at /attest, where a recipient of a Posture Attestation can verify the reference independently rather than trusting the copy they were sent.
- 27 Jul 2026Security
Security & Disclosure policy published
Our vulnerability disclosure policy went live at /security, setting out how to report a security concern about this site or the platform, and what happens to a report once we have it.
- 27 Jul 2026Site
Help Desk published
A task-shaped Help Desk went live at /help, answering how-do-I questions across setup, running an assessment, reading results, exporting and sharing, and account access — distinct from the Knowledge Base, which explains how the method works rather than how to operate the platform.
- 27 Jul 2026Site
Sector Pulse published
Sector Pulse went live at /pulse, a public feed of cryptography-relevant advisory and standards activity organised by sector.
- 27 Jul 2026Standards
FIPS 206 (FN-DSA) remains unpublished
As of today, NIST has not published FIPS 206, the planned standard for FN-DSA (FALCON). We record its status here rather than mapping any finding against a draft, and we will log the publication the day it happens rather than anticipate a date.
- 25 Jul 2026Method
theos-method-v0.1 published
An earlier revision of the scoring method, theos-method-v0.1, was published on this date. It has since been superseded by theos-method-v1.0 (above) and is kept only as a historical reference — it is never presented as current.
- 17 Jan 2025Standards
EU DORA becomes applicable
The EU's Digital Operational Resilience Act became applicable across the financial sector on 17 January 2025, adding ICT and operational-resilience obligations that reach into cryptographic key management and third-party risk for in-scope entities.
- 13 Aug 2024Standards
NIST finalises FIPS 203, 204 and 205
NIST published the final versions of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) on 13 August 2024, settling the first generation of post-quantum key-establishment and signature standards that AutoPQC maps findings against.
Evidence Ledger
How a sealed finding resists silent alteration.
A distinct mechanism from this log above — the Signal Log is our own editorial record of what changed; the Evidence Ledger is a structural property of how AutoPQC stores findings, described in full in the Theos Method's method-versioning article.
What it proves
- An append-only record of the evidence digest behind each finding — what was observed, when, and under which method version.
- Tamper evidence: each record is chained to the one before it, so altering a sealed record changes the chain in a way that is detectable on inspection.
- A stable reference you can hand to an auditor or attach to a Posture Attestation, independent of whether the underlying report file is later moved or renamed.
What it does not prove
- It is not a blockchain. There is no distributed network, no token, and no consensus mechanism — it is an internal append-only log with a chaining scheme.
- It is not notarised by any third party. No external timestamping authority or public ledger currently attests to these records. [PLACEHOLDER: whether a third-party timestamp authority will be added, and which one]
- It does not prove the original observation was correct. It proves that a sealed record has not been silently altered since it was sealed — it says nothing about whether the finding itself was accurate. That question is answered by the review process described in the Help Desk, not by the ledger.
Illustrative sealed record — placeholders, not real digests
{
"record_id": "eld_9f2ac1d4e8b04a2e",
"asset_id": "ast_00042",
"sealed_at": "2026-07-27T09:14:02Z",
"method_version": "theos-method-v1.0",
"evidence_digest": "sha256:4f2b9a0c-EXAMPLE-NOT-REAL-DIGEST",
"prev_record_hash": "sha256:0c771e3d-EXAMPLE-NOT-REAL-DIGEST",
"signature": "[PLACEHOLDER: signing scheme and key identifier]"
}Every digest and identifier above is a placeholder. We will not publish a plausible-looking hash before the mechanism is live — see the concrete construction (hash function, chaining structure, publication cadence) in How the method is versioned.
Not yet built
- [PLACEHOLDER: public inspection endpoint — where a recipient can independently verify a record's chain without contacting us]
- [PLACEHOLDER: whether the ledger will be periodically anchored to an external timestamping service, and which one]
- [PLACEHOLDER: retention period for sealed records after a workspace closes]
Public inspection endpoint: [PLACEHOLDER: public inspection endpoint URL for the Evidence Ledger]
How to be notified of changes
We do not operate a mailing list or an RSS feed for this page today, and would rather say so plainly than link a subscribe form that goes nowhere. [PLACEHOLDER: mailing list, RSS feed, or webhook for Signal Log updates — to be built] Until then, checking back here, or asking through /contact, are the only reliable ways to know what changed.
Related