Changelog
Weekly Driftlock updates, reverse-chronological and linkable.
Every Monday a new entry lands here: what shipped in the past week, what changed under the hood, and the things we deliberately paused. Each entry carries a surface badge and a one-line description, and the title links back to the source commit, doc, or architecture diagram it describes — so a trial cohort can drop the row straight into an evidence binder without context.
Cadence
One entry every Monday covering the prior week's shipping, drift, and pauses.
Format
Reverse-chronological, permalinkable, and tagged so a reader can scope to a single surface — demo, governance, or pricing.
Append-only
Older entries stay published verbatim; the page grows downward as the weekly update flow comes online.
Updates
Every entry, in order.
The newest entry lands at the top. Months are grouped so a reader can locate the relative date of any item without re-reading the list.
August 2026
August 3, 2026
2026-08-03Public changelog is live
Every Monday this page picks up a new Driftlock engineering update — what shipped, what changed, what we paused — with a deep link back to the source commit, doc, or architecture diagram. Each entry is reverse-chronological and permalinkable so a trial cohort can drop the link straight into Slack, and the title itself is the link to the live surface it describes.
July 2026
July 27, 2026
2026-07-27Pricing ROI table — what manual overnight triage actually costs in labour
The pricing page now ships a side-by-side labour table that puts a real cost against the overnight Dependabot, RustSec, and TypeScript advisory diffs a regulated monorepo absorbs in a quarter. Each row has a stated unit — staff-engineer hours, SBOM re-emissions, audit-trail fields stitched by hand — so a platform-security lead reading the page alongside a finance buyer lands on the same number, not a marketing estimate.
July 20, 2026
2026-07-20Comparison pages for Cursor, Claude Code, and internal bot frameworks
Three new comparison pages landed this week — /vs/cursor, /vs/claude-code, and /vs/internal-bot-frameworks — each running the same six-row ask a regulated platform lead opens an evaluation with: where the audit-trail row lives, who holds the signing key, whether the SBOM survives a key rotation, and which sign off on the overnight diff. The Cursor and Claude Code pages name the in-IDE pattern directly; the internal-bot-framework page is for the team running their own OpenHands-style runner in a VPC and wondering where the gap shows up in a SOC 2 evidence pack.
July 13, 2026
2026-07-13Audit-trail / RBAC / SBOM / signing reference expanded on /governance
The /governance explainer now walks the seven-column audit-trail row end to end and adds a row-by-row owner column — the watcher, the sandbox, the signing controller, and the SBOM signer each have a single column and a single retention tier. RBAC, SBOM, and signing references sit in the same table, in the vocabulary a SOC 2 / PCI reviewer actually reads, so a regulator replays the page the same way the platform team replays a PR.
July 6, 2026
2026-07-06Self-host runbook published
A self-host runbook now lives at /docs/self-host: the Helm + Terraform deployment, the egress policy that keeps the sandbox reachable only to the customer artifact registry and the customer KMS, the Rekor claim payload the signing controller writes, and the customer KMS-resident cosign key onboarding on day one. The runbook is the same shape the trial cohort walks during a ten-day scoped engagement, so a buyer can read it before the call and start the deployment from the same page.
June 2026
June 29, 2026
2026-06-29Sandbox configuration reference at /docs/sandbox-config
A new /docs/sandbox-config page enumerates every knob the Driftlock sandbox exposes — the hermetic-build hash, the bounded VPC egress, the Bazel cache mount, and the toolchain identity — and maps each one to the audit-trail column it feeds and the SBOM field it signs. The page is the reference a platform-security lead reads once and then keeps open during a SOC 2 walk-through.
June 22, 2026
2026-06-22Webhook payload schemas published at /docs/webhooks
The webhook payload schema pages now publish per-source shapes — Dependabot, RustSec, OSV / GHSA, and the on-call pager integration — with the exact JSON the watcher expects on each delivery and the audit-trail column the watcher writes back. A platform team wiring Driftlock into an existing PagerDuty webhook reads the schema off the same page the regulator replays the row from.
June 15, 2026
2026-06-15Healthcare seed customer story — CareBridge Health
A third seed customer story landed this week, written in the same posture as the regulated fintech narratives on /customers. CareBridge Health runs a TypeScript and Go monorepo through a single protected main branch and a single GitHub App identity, and the per-PR audit row the page describes is the row a HIPAA-leaning auditor replays against the run id — including a sandbox test result, an approver chain, and a cosign signature over the SBOM hash.
May 2026
May 25, 2026
2026-05-25Architecture page exposes the signing section in full
The architecture page now breaks out the signing controller as its own labelled section — the cosign key it expects on the customer KMS, the Rekor claim payload it posts on every merged PR, and the verification command a security reviewer runs on the SBOM hash. The section sits next to the sandbox and triage diagrams so a platform-security lead reading top-to-bottom sees the custody chain end to end.
May 18, 2026
2026-05-18Custody and retention rows land on /security
The /security data-handling section now ships two new rows: the per-tenant custody boundary (sandbox egress reaches only the customer artifact registry and the customer KMS) and the retention tier (180 days hot, 7 years cold, signed-verifiable on read). Both rows map to the same vocabulary the /docs/compliance reference uses, so a SOC 2 reviewer reading the narrative and the regulator reading the reference land on identical text.
May 11, 2026
2026-05-11Acme Platform customer story published
A new customer story shipped at /customers/acme-platform — the first Series-B fintech narrative in the seed set, covering the migration off an in-house Renovate runner, the per-PR audit trail the SOC 2 evidence pack stitches against, and the SBOM re-emission cost the new nightly desk replaces. The page reads in the same posture as the rest of the customer voices — audit-linked, permalinkable, and written for a regulated platform-security lead skimming it the night before a procurement call.
May 4, 2026
2026-05-04/docs/install page published with the Helm chart
The /docs/install page is now the home of the Driftlock Helm chart, the values.yaml knobs the platform team overrides on day one (image pull policy, registry mirror, customer KMS endpoint, egress firewall), and the smoke-test pipeline that runs after the chart apply. It sits beside the self-host runbook so the deploy-and-onboard path is one bookmark chain.
April 2026
April 27, 2026
2026-04-27Audit-trail immutability row added to the compliance deep-dive
The /docs/compliance reference now publishes the audit-trail immutability row directly under the merge-audit-trail section: rows are written once, signed once, and append-only — there is no UPDATE or DELETE path any Driftlock component exposes. The same row ships alongside the SOC 2 controls table so a compliance reviewer cross-references the two on the same call.
April 20, 2026
2026-04-20/docs/compliance reference published
A new /docs/compliance reference page replaces the regulatory-as-marketing slide deck with the four-section record a platform-security lead actually replays against: the RBAC matrix with config snippet, the seven-column audit-trail row, the SPDX document per merged PR, and the four cosign verifier commands. The page lives at its own path so the /security narrative and the regulator-facing record stay independent.
April 13, 2026
2026-04-13SOC 2 controls table added to the compliance reference
The /docs/compliance reference now carries a SOC 2 controls table that maps each Common Criterion (CC1–CC9) to the Driftlock component responsible and the audit-trail column a reviewer replays on. The same table underpins the SOC 2 evidence pack the platform-security lead downloads under NDA, so the public reference reads in the same vocabulary as the pack itself.
April 6, 2026
2026-04-06Architecture triage column published
The architect triage path is now its own labelled section on /architecture: how the system clock-locks a Dependabot advisory against the running repo, how the triage pass assigns confidence and severity, and how the rejected diff is bubbled into the audit-trail column rather than dropped. The section closes the gap between the watcher fan-in and the eventual sandbox run.
March 2026
March 30, 2026
2026-03-30Cosign verification commands published in the compliance reference
The four cosign verification commands a security reviewer runs against an SBOM hash are now published at /docs/compliance, with the Rekor log URL, the cert subject expectation, and the failure modes a reviewer should expect to see. Each command prints the same line a SOC 2 reviewer reads out of the evidence pack, so an audit-team replay matches a live PR replay.
March 23, 2026
2026-03-23Quickstart page published
The Driftlock quickstart page is now live at /docs/quickstart — the ten-minute path from a sandbox GitHub App install to the first signed PR delivered against an open Dependabot advisory. The page is the front door the trial cohort enters from after the procurement call: same vocabulary as /docs/install, same audit-trail shape as /docs/compliance, but no prerequisite reading.
March 16, 2026
2026-03-16Audit-write step in the architecture pipeline
The /architecture pipeline now shows the audit-write step in full — what columns receive a write, what hash the row is signed under, and what Rekor claim payload the signing controller posts. The step sits between the sandbox run and the SBOM emit so a reader following the diagram top-down sees the custody path complete before the diff is presented for human review.
March 9, 2026
2026-03-09/governance audit-trail explainer published
A new /governance explainer page is live — the seven-column audit-trail row, the four owners (watcher / sandbox / signing / SBOM), and the two reference pages (/security and /docs/compliance) it sits between. The page reads in the vocabulary a SOC 2 / PCI reviewer scans first, so the regulator audience lands on a familiar frame rather than a marketing one.
March 2, 2026
2026-03-02Driftlock v0.3 — the dependency desk goes live
Driftlock v0.3 ships this week — the first self-hosted nightly desk a regulated monorepo can run for an open Dependabot advisory stream, end to end, with one human approver at the end of the pipeline. The launch lands on /get-started and is described in the same posture as the rest of the seed set: audit-linked, permalinkable, and built for a trial cohort evaluating the audit-trail bar Driftlock sets.
weekly · reverse-chronological · linkable
Read next
Field notes from the engineering deskLonger posts that argue the case for the audit-trail bar above.
Read next
What ships next quarterThe roadmap that the next two entries on this page will be drawn from.
Read next
The audit trail and the signatureThe seven-column row a regulator replays against the run id.