ProtocolSoup v4.1.1

Highlights

[4.1.1] - 2026-08-22

Added

• Looking Glass OID4VC permutation tests
• Wallet deploy volume migration handler script
• Wallet agent discovery via llms.txt, skills, and markdown
• SSF stream management client (#128)

Changed

• CI to copy the verifier x509 CA into the wallet
• Looking Glass to provide informative and preventative failures
• Wire deploy-migrate script to ci-cd
• Host migrate script for Machines API
• Looking Glass OID4VC format and HAIP selectors
• Looking Glass OID4VCI Advanced and HAIP UI
• SSF Final SET, stream API, and CAEP revoke-subject hop and merge sandbox to looking glass (#118)
• Consolidate SSF looking-glass flows into Chrome UI (#119)
• Landing page to remove SSF Sandbox (it is now in the looking glass!)
• Landing page to remove SSF Sandbox (it is now in the looking glass!)
• Landing page and SEO to advertise the wallet harness
• Advertised catalog to eight families and Coming Soon
• Sitemap and agent profiles
• Homepage and chrome for Looking Glass, Protocols, Wallet
• SSF copy to Looking Glass session
• Docs to list only executable OAuth, SPIFFE, and SCIM flows
• Public brand from Protocol Soup to ProtocolSoup
• SEO copy to lead with live execute and inspect
• Wallet origin so agents can find and use the HTTP API (#123)
• Dashboard.tsx
• Data auto-purge and trust remediations (#124)
• Trust page with hosted-instance information (#125)
• Stylize the trust page
• Trust page content
• SSF transmitter for CAEP Interop push Stream Management (#126)
• Wallet subdomain SEO assets
• SSF transmitter for spec subjects poll and Device Compliance (#129)
• Ssf session transmitter streams + isolation (#130)
• Certification doc references
• OpenID Certified mark on trust, homepage, and README (#131)
• Readme
• Security docs

Fixed

• OID4VCI issuance for ES256 proofs and deferred request encryption
• The wallet to encrypt credential requests only when required
• Wallet proof selection, batch keys, and post-issuance notification
• OID4VP encrypted responses to use ECDH-ES for every jwt
• Looking Glass x509_hash create onto the HAIP encrypted path
• Host migrate script for Machines API
• Host migrate script for Machines API
• OID4VP HAIP presentation to stop requiring issuance attestation
• OID4VCI Authorization Server JWKS at jwks_uri
• Protocol pages to fall back to the catalog
• Wallet sitemap for Next static export

Pull Requests

What's Changed

Protocol Behavior

• Feature/ssf fidelity by @ParleSec in #118
• Feature/ssf fidelity by @ParleSec in #119
• Feature/wallet agent readiness by @ParleSec in #123
• Feature/trust page remediation by @ParleSec in #124
• UPDATE SSF transmitter for CAEP Interop push Stream Management by @ParleSec in #126
• CREATE SSF stream management client by @ParleSec in #128
• Feature/ssf/receiver20260822 by @ParleSec in #129
• UPDATE ssf session transmitter streams + isolation by @ParleSec in #130

Documentation

• Feature/openid4vc certified by @ParleSec in #131

Platform And UI

• UPDATE trust page with hosted-instance information by @ParleSec in #125

Full Changelog: v4.1.0...v4.1.1

ProtocolSoup v4.1.0

Highlights

[4.1.0] - 2026-08-15

Added

• Wallet HAIP OID4VCI client for token proof and credential exchange
• Wallet DPoP client for OAuth protected-resource GET
• Wallet protocol transcript for Looking Glass glass-box hops
• Looking Glass wallet-client helper for same-origin harness calls

Changed

• JWT issuer verification to use advertised keys and trust anchors
• Client attestation PoP iss to the attested client_id
• Mdoc storage to keep batch secondaries without activating them
• Wallet import for wallet-initiated issuer discovery
• Wallet harness to bind cnf and wire the HAIP issuance client
• VC requirement matrix for wallet-role HAIP issuance
• Wallet UI for issuer discovery picker and Request again
• Looking Glass pre-authorized flow to redeem via the wallet
• Looking Glass issuer-initiated offer to stay wallet-driven
• Frontend rewrite to proxy /wallet-harness to the wallet
• Looking Glass chrome for wallet authorization_required
• Frontend docs for WALLET_BACKEND_ORIGIN
• Wallet docs for hosted HAIP OID4VCI client
• OID4VCI docs for wallet-driven issuance
• Platform docs to describe the wallet as an OID4VCI client

Fixed

• Keep W3C formats out of HAIP issuer metadata
• Remove unused wallet issuance types and wrappers
• The wallet-dependencies group across 1 directory with 7 updates (#115)
• Go 1.26.6 and wallet HTTPS navigation checks

Dependencies

• Dependency and wallet docs
• Bump the go-dependencies group across 1 directory with 3 updates (#114)
• Bump the docs-dependencies group across 1 directory with 2 updates (#103)
• Bump the docker-images group across 2 directories with 1 update (#94)

Pull Requests

What's Changed

Protocol Behavior

• Conformance/oid4vci wallet by @ParleSec in #117
• Bump the wallet-dependencies group across 1 directory with 7 updates by @dependabot[bot] in #115
• Bump the docker-images group across 2 directories with 1 update by @dependabot[bot] in #94

Dependencies

• Bump the go-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #114
• Bump the docs-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #103

Full Changelog: v4.0.0...v4.1.0

ProtocolSoup v4.0.0

Highlights

[4.0.0] - 2026-08-11

Added

• Hardened CBOR decode gate for externally-supplied mdoc credentials
• Mso_mdoc as a registered credential format with trust-enforced import
• Credential decode endpoint for Looking Glass inspection
• RFC 7800 key binding display in the token inspector
• Cross-language verification for the RFC 7638 thumbprint helper
• SCIM outbound sync with durable mappings and SSRF guards
• RFC 9449 DPoP for OAuth2 and OID4VCI (#109)
• OIDC Dynamic OP with RFC 7592, pairwise subjects, and third-party login (#112)
• OID4VCI RFC 9126 PAR endpoint
• OID4VCI encrypted credential request decoding
• OID4VCI OAuth status list index allocation
• OID4VP external SD-JWT issuer trust anchors
• Wallet HAIP credential issuance bootstrap
• Looking Glass OID4VCI issuer-initiated offer flow

Changed

• README.md
• Og-image
• Dockerfiles for SPIRE components to 1.15.2
• Dependabot config for nested SPIRE dirs
• Credential format validation to report issuer trust as a tri-state
• Credential inspection docs and OpenAPI spec for the decode endpoint
• VCInspector to collapse empty set claims panel
• Feature/agent-readiness (#99)
• Add agentauth and mcp presentation metadata to /protocols
• Palette taxonomy terms
• Feature/vc dcql (#101)
• KB-JWT freshness check boundary case
• Wire plugin lifecycle into /health readiness
• Document SCIM outbound client endpoints and production auth
• Dep audit findings
• SCIM handlers
• DPOP coverage gaps Feature/dpop (#110)
• OID4VCI, OID4VP, DPoP, SD-JWT VC, mdoc/COSE, DCQL Conformance (#113)
• OID4VCI plugin routes for PAR and HAIP issuance
• OID4VCI HAIP attestation DPoP and credential drivers
• OID4VCI HAIP and issuance regression tests
• OID4VP HAIP verifier request and trust handling
• OID4VP mdoc empty claims and presentation verification
• Mdoc verification for trust-anchor document signers
• Wallet authorize consent and presentation paths
• Wallet UI auto-issue matching and result acceptance
• Looking Glass OID4VP HAIP controls and offer endpoint UI
• OIDC Cancel access_denied and PAR preload continue
• Mock IdP session and claims handling for OP flows
• OAuth2 and DPoP replay store hardening
• VC conformance requirements for HAIP and mdoc trust
• OpenAPI VC contract for HAIP issuance surfaces
• Docs for hosts and integrators after HAIP wallet work
• OIDC UserInfo discovery and OP requirement matrix
• OpenAPI federation contract for shared VC notes

Fixed

• Replace golang.org/x/crypto/pbkdf2 with stdlib crypto/pbkdf2 in wallet store
• Stop emitting a false mso_mdoc disclosure count in the inspector
• Llms.txt markdown link syntax
• Protocol catalog data slugs
• Fix agentauth/mcp empty set looking glass
• Agent protocol flow diagram
• Use ParseRawPrivateKey in HAIP issuance JWK parsing
• Accept encoded openid4vp URI in wallet authorize canary

Removed

• Static OIDF conformance client provisioning
• OIDF VC plan runner scripts
• OIDF VC plan job from protocol-conformance workflow
• Wallet OIDF verifier trust anchor CI sync
• Suite-only CORS and conformance redirect deploy config

Dependencies

• Bump the wallet-dependencies + enable experimental TS CLI (#86)
• Sync frontend lockfile

Pull Requests

What's Changed

Protocol Behavior

• Bump the wallet-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #86
• Feature/mso mdoc 260731 by @ParleSec in #96
• Feature/agent ready by @ParleSec in #99
• Feature/vc dcql by @ParleSec in #101
• Feature/SCIM 20260806 by @ParleSec in #107
• Feature/dpop by @ParleSec in #109
• Feature/dpop by @ParleSec in #110
• Conformance/connect by @ParleSec in #112
• Conformance/vc by @ParleSec in #113

Platform And UI

• Feature/mso mdoc 260731 by @ParleSec in #98

Full Changelog: v3.0.0...v4.0.0

ProtocolSoup v3.0.0

Highlights

This release changes the deployment contract. Read the breaking changes before
upgrading a self-hosted deployment.

• Next.js App Router migration: the frontend is now server-rendered on the
  Next.js App Router. The legacy Vite SPA entrypoints are gone, the Looking Glass
  execution stack and runtime hooks were rebuilt around it, protocol content now
  renders from server-backed catalog paths, and canonical metadata, sitemap,
  robots, and OG image infrastructure landed with it.

• OpenID Provider conformance: persistent OP signing keys with historical
  JWKS retention, discovery served at the issuer root, form_post response mode,
  the claims parameter, acr/amr in ID tokens, and reworked token, refresh,
  and UserInfo handling. An OIDF conformance harness now runs in CI with drift
  monitoring, backed by OP certification documentation.

• Verifiable credentials: a VC format registry covering Data Integrity,
  DCQL, DID resolution, and Presentation Exchange matching. OID4VCI gained
  multi-format issuance, LDP compliance, ES256 registry metadata, deferred
  credentials, and transaction codes. OID4VP gained a DCQL policy engine,
  verifier identity, JSON-LD VP verification, ephemeral X.509 chains, and
  ISO mdoc/MSO support.

• Private key JWT client authentication: public and private client profiles
  with private_key_jwt assertions, replay protection, and Looking Glass owner
  capabilities scoping session access.

• Deterministic content palette: homepage search and a global cmd+K palette
  backed by an in-process SQLite index built from the content/ tree with no
  external search service and no embeddings

• Learning surface: inline parameter explainers with a typed
  attack/mitigation schema across all protocols, specs and references panels on
  protocol and flow pages, deep-linkable Looking Glass references, and a
  verifier script that keeps spec citations honest.

• Release automation: releases are now cut by pushing a version tag, with
  generated release notes and a generated CHANGELOG.

• The Vite SPA build is removed. Container and Compose topology were realigned
  for the Next.js runtime, so existing compose overrides need review.

• The wallet harness is now a standalone package published as its own image.

• SHOWCASE_PALETTE_DB must point at a readable palette index. The server
  refuses to start in production without it. Images built from
  docker/Dockerfile.backend and docker/Dockerfile.fly bake it in
  automatically.

• Private key JWT replay protection requires Redis in production.

• The backend core now fronts a unified frontend proxy with scoped rate
  limiting.

[3.0.0] - 2026-07-29

Added

• Migrate frontend toolchain to Next.js foundations
• Scaffold App Router route tree and migrate page views
• Establish canonical metadata, sitemap, robots, and OG image infrastructure
• Wallet UI into standalone package
• Docs host sitemap endpoint and robots sitemap declaration
• VC format registry with Data Integrity, DCQL, DID resolution, and PE matching
• Inline parameter explainer panels for all protocols
• Specs & references panel on protocol and flow pages
• Spec reference verifier script
• Homepage search with deterministic content palette (#39)
• Persistent OP signing keys with historical JWKS retention
• OIDC OP regression and conformance tests
• OIDF conformance client provisioning and deployment config
• OIDF conformance harness and drift-monitoring CI
• OP certification and compliance documentation

Changed

• OID4VP and Wallet Credential Models
• Move protocol content rendering to server-backed catalog paths
• Refactor Looking Glass execution stack and runtime hooks
• Wallet harness runtime to standalone wallet-ui artifacts
• Backend core for unified frontend proxy and scoped rate limiting
• OID4VCI issuance drivers and protocol registry behavior
• Align container and compose topology with Next.js runtime
• Platform and deployment documentation for Next.js architecture
• OID4VP and Wallet Credential Models (#17)
• (MIGRATION) frontend to Next.js and update wallet integration (#18)
• Crypto library with JWK helpers, X509 utilities and Ed25519 key support
• OID4VCI with multi-format issuance, LDP spec compliance, and ES256 registry metadata
• OID4VP with DCQL policy engine, verifier identity, and JSON-LD VP verification
• Wallet harness with VP token building, external issuer support
• Wallet UI with Next.js migration
• Looking Glass frontend OID4VP
• OID4VP support ephemeral X.509 certificate chains
• VC docs
• VC docs
• VC query format inference
• OID4VP client ID logic
• OID4VCI deferred credential handling
• OID4VCI tx code handling
• LookingGlass panel component
• OID4VCI and OID4VP protocols (minor legacy rm)
• Oid4vp credential error handling
• Parameter explainers with typed Attack/Mitigation schema
• ADDING_PROTOCOLS guide for explainers and references
• Uplift contributor documentation and CI quality gates (#22)
• Add palette index build artifact and backend image smoke test to CI
• Document canonical palette.db build + runtime paths
• README (#48)
• Embed palette into gateway services (#49)
• SSF documentation links to reflect correct SSF URL (#63)
• Looking Glass references with deep-link URLs (#64)
• ID tokens with acr and amr and embed requested UserInfo claims in access tokens
• Shared models for address, phone, claims parameter, and discovery metadata
• Demo identity data, scope-to-claim mapping, client registration, and code-replay revocation
• Authorization endpoint request handling for OIDC Core
• Token, refresh, and UserInfo endpoints and claims handling
• OIDC discovery metadata and serve discovery at the issuer root
• OAuth2 authorization-code issuance for the claims parameter
• Public OIDC protocol documentation with OP request-handling behaviour
• OIDC authorization endpoint with form_post response mode and request-object rejection channel
• OIDC discovery to advertise form_post response mode
• Fly deployment to register form_post conformance redirect URIs
• Conformance harness with Form Post OP certification plans
• Public OIDC documentation for form_post and request-object rejection
• .gitignore
• Looking glass reference breadcrumbs (#81)
• Feature/public private client (#85)
• Automated release pipelines (Feature/releases (#88))
• Release workflow to verify CHANGELOG.md instead of updating it automatically

Fixed

• Isolate client header logic and fix mobile drawer accessibility semantics
• Gitignore dockerignore for build artifact directories
• Functions handlers and WalletCredentialStore
• GHCR publish
• GHCR Publish
• Gitignore
• Deployment workflow and docs
• OID4VP plugin
• StepCard component for memoization
• OID4VCI wallet modal selection
• Vulnerability alert remediation
• CI toolchain compatibility
• Spec references and section numbers per PR review
• Explainer spec references and section numbers
• Ambiguous reference labels to match section headings
• Verify-references comments to explain non-obvious choices
• Explainer attacks, mitigations, and references for spec accuracy
• Error handling in verify-references
• Bake palette.db into Fly image and set SHOWCASE_PALETTE_DB
• Bake palette.db into backend Docker image and compose
• Require palette index in production and expose palette stats on /health
• Degrade palette search when the query route is not mounted
• Query load status
• Header layout components structure (#50)
• Looking glass deeplinks + button controls (#59)
• Separation of wallet holder DID from issuer identity
• Synchronize mdoc trust for wallet flows

Removed

• Remove legacy Vite SPA entrypoints and obsolete client SEO plumbing

Dependencies

• Backend dependencies
• Bump package-lock
• Bump dependencies
• CHORE bump github-actions group with 18 updates (#28)
• CHORE bump golang from 1.25.9-alpine to 1.26.3-alpine in /docker (#27)
• CHORE bump dependencies (#33)
• CHORE bump dependencies (devalue)
• CHORE bump modernc.org/sqlite in /backend (#35)
• CHORE bump astro in /docs/starlight (#36)
• CHORE bump the wallet-dependencies group in /wallet-ui (#37)
• CHORE bump the frontend-dependencies group in /frontend (#38)
• Lockfile conflict (#40)
• Bump dependencies
• Node.js versioning in documentation + new optional dependencies
• BUMP actions/upload-artifact from 4 to 7 (#47)
• Bump the frontend-dependencies group in /frontend with 5 updates (#46)
• BUMP wallet-dependencies group in /wallet-ui with 4 updates (#45)
• BUMP astro in /docs/starlight in the docs-dependencies group (#43)
• BUMP spiffe/spire-server from 1.14.6 to 1.15.0 in /docker ([#42](https://github.com/ParleSec/ProtocolSoup/p...

v2.0.0

ProtocolSoup v2.0.0

First major release since v1.0.0
A long-span upgrade with broad platform, docs, and protocol improvements. In the future, I will look to introduce a more progressive release pipeline

Major Changes

• Verifiable Credentials (VC) Support: a major body of work across featuring oid4vci and oid4vp support, including wallet-related capabilities and query customisation.
• Docs subdomain release: standalone docs experience covering comprehensive use cases from user and developer personas (see docs.protocolsoup.com)
• Existing protocol uplift: various improvements across existing capabilities for consistency, maintainability, and usability.

What's Changed

• Feat/tls layer visibility by @ParleSec in #6
• Feat/protocolreference by @ParleSec in #7
• Feat/ssfuplift by @ParleSec in #8
• UPDATE Protocol Reference Code Examples by @ParleSec in #9
• UPLOAD contributing DOCS and Templates by @ParleSec in #10
• Feat/verifiable credential by @ParleSec in #11
• Feat/verifiable credential by @ParleSec in #12
• Feat/verifiable credential by @ParleSec in #13
• Feat/modulate by @ParleSec in #14
• Feat/docs uplift by @ParleSec in #15
• UPDATE docs deployment workflow by @ParleSec in #16

Full Changelog: v1.0.0...v2.0.0

Next release will be major, but largely unnoticeable, being the ongoing migration from SPA to SSR architecture via nextJS in order to support a more performant web experience.

v1.0.0

ProtocolSoup v1.0.0 - Public Container Release

ProtocolSoup container images are now publicly available on GitHub Container Registry (GHCR)!

What's New

Public Container Images

All ProtocolSoup microservices are now available as pre-built container images, making it easy to deploy individual protocol services or the complete stack.

Available Images:

Image	Description
ghcr.io/parlesec/protocolsoup-gateway	API Gateway - unified entry point for all services
ghcr.io/parlesec/protocolsoup-federation	OAuth 2.0, OpenID Connect, and SAML 2.0
ghcr.io/parlesec/protocolsoup-scim	SCIM 2.0 user and group provisioning
ghcr.io/parlesec/protocolsoup-ssf	Shared Signals Framework (SSF/CAEP/RISC)
ghcr.io/parlesec/protocolsoup-spiffe	SPIFFE/SPIRE workload identity
ghcr.io/parlesec/protocolsoup-frontend	React-based web UI
ghcr.io/parlesec/protocolsoup-spire-server	SPIRE Server for workload identity
ghcr.io/parlesec/protocolsoup-spire-agent	SPIRE Agent for workload attestation
ghcr.io/parlesec/protocolsoup-spire-registration	SPIRE workload registration

What's Changed

• Feat/protocol refinement by @ParleSec in #1
• PATCH websocket reconnect logic by @ParleSec in #2
• PULL master into branch by @ParleSec in #3
• Pull from master by @ParleSec in #4
• Feat/microservices by @ParleSec in #5

Full Changelog: https://github.com/ParleSec/ProtocolSoup/commits/v1.0.0