@pleach/compliance changelog

This page collects the site-content changelog entries that materially touched the @pleach/compliance docs surface or named a @pleach/compliance symbol. It is not the runtime changelog — the canonical record of @pleach/compliance runtime behavior lives in the upstream package CHANGELOG.md and on npmjs.org/package/@pleach/compliance.

See the combined site changelog at /docs/changelog/combined for the chronological unified view across every SKU.

Unreleased

Fixed

• Audit-record claims now match what the code enforces. The homepage pillar, components/session-manifest-diagram.tsx, content/docs/security.mdx, replay.mdx, ci-enforcement.mdx, audit-ledger.mdx, and compliance/gdpr-erasure.mdx said rows are "written once and never edited or deleted" or "immutable". The ledger API has no update or delete primitive, but that does not stop a writer with direct database access. The pages now say so, and say what the hash chain adds: edits, deletions, and reordering become detectable after the fact.
• Attestation is signable, not signed by default. glossary.mdx, glossary.schema.ts, cloud-routed-agent.mdx, and region-pinned-agent.mdx called the manifest "signed". compliance.mdx already documents that envelopes stay unsigned unless a key store is configured; the other pages now agree.

Fixed

• @pleach/compliance does not add CI gates to a consumer's build (content/docs/compliance.mdx). The page described two gates — audit:tenant-scoping and audit:harness-event-log-tenant-id-required — as inherited at adoption time, across nine sites. Neither ships: the package declares no bin, and its files allowlist is dist, the two SBOMs, src/tenant-rls/policies.sql, and metadata — no scripts/ directory exists in the package at all. Both gates are monorepo-only; audit:tenant-scoping is an RLS-policy census over supabase/migrations/*.sql and never reads a .ts file. The section is now ## Wiring tenant isolation into your own CI and documents what does ship: the src/tenant-rls/policies.sql template and auditRlsPolicies(), which you call from your own CI. The gate table is reused verbatim from content/docs/audit-gates.mdx.

• "Four scrubbers, no broader set" corrected. PHI, Presidio, and LLM scrubbers plus a composable pipeline ship under @pleach/compliance/redaction. Added Advanced redaction and a Compliance certifier section (createDeterminismCertifier, verifyDeterminism from @pleach/compliance/determinism).

• Schema codeRepository + sameAs for @pleach/compliance corrected in the site's Organization + SoftwareApplication JSON-LD @graph (inlined in <head> on every page). Both fields now point at https://github.com/pleachhq/compliance (was https://github.com/pleachhq, a leftover from when the SKU schemas were drafted against an upstream monorepo). Load-bearing because sameAs is the field AI search engines use for entity reconciliation across the npm ↔ GitHub ↔ docs boundary. See the combined view for the full cross-SKU pack.

Added

• Per-recipe deep-dive pages under /docs/recipes/ — including compliantChatbot and enterpriseAgent, both composing @pleach/compliance. Each carries a quickstart, the runtime composition the recipe wires, a TypeScript config interface, common gotchas, and cross-links.

Changed

• Cross-docs status-flip pass — @pleach/compliance@0.8.0-alpha.0 four-scrubber bundle landed; "planned" / "no shipping code yet" claims across ~55 docs pages rewritten to name the actual alpha. Touched Audit ledger, Compliance, Event log, Subpath exports, Scrubbers, and others.
• Attestation page boundary — Attestation framed against policy and rotation, which stay in @pleach/compliance or host-side.
• Pricing / FAQ rewrites — compliance attestation drops as a standalone enterprise surface and folds inside Hosted Observe at enterprise scope.

2026-06-08

Changed

• Packages table corrected to real published version — @pleach/compliance 0.8.0-alpha.0 (was largely stale "Reserved · placeholder" framing).
• Plugin contract → Sibling SKUs as plugins section retitled and rewritten with per-row real Phase A status — includes @pleach/compliance.