This history records dated documentation and integration changes. Use the current API reference and quickstart for request contracts.
4 November 2026 — Integration documentation
The documentation now separates concepts, integration guides, API contracts and ecosystem examples. Mail, messages and agents are described as compositions of available primitives. Git signer membership has a server route. Calls and call screening are concepts with missing pieces documented explicitly.
Access remains by arrangement: reach out for SDK access and app-origin allowlisting, then develop on staging. Public SDK distribution is coming soon.
November 2026 — Operations
This archived note preserves the operations documentation published on 4 November 2026. Deployment status and external-service settings below are dated operator observations, not current-status guarantees. The policy describes the operated TrustGraph staging and production services, not an automatic retention rule for clients or independently operated deployments.
The retention rollout was reported live on staging and production by the founder's operator on 4 November. The pinned server deployment and migration workflows were reported complete. Omnibus remains one example client: its device storage and interface choices are documented separately.
Data and log retention
The operated staging and production services use persistent host journals with a 29-day retention setting and hourly rotation and cleanup. Whole-file expiry and scheduling delay mean the published bound is 30 days in healthy operation, not a strict 29-day per-record deadline. Failed cleanup jobs and powered-off disks cannot provide live erasure. Operators alert within two hours of a missed sweep and treat records older than 30 days as an incident.
Login-history archives are rotated and expired by timestamp to 29 days. The separate per-account last-login record remains outside that established expiry scope. The legacy host log daemon is retired; old container log copies are removed only after replacement collection is verified. Public administrative access is closed; operators use a private network.
The separate log store retains logs and traces for 15 days. CI logs and artifacts have 30-day retention for new runs; this does not shorten existing artifacts retroactively or change other repositories' defaults. There is no third-party edge log export. Diagnostic copies retain the original event's expiry. The dated operator report recorded no host snapshots or backups; these controls do not establish a blanket database or historical-backup deletion policy.
Request-record minimisation
The collector selects application and proxy records, rather than exporting the whole host journal. It removes journal metadata and limits proxy request fields. Routine proxy health-check request records are dropped; application warnings and errors are kept. Other bodies may still contain personal data. This is request-record minimisation, not general redaction.
Operator details
- The message becomes the log body. Selected container labels, service and environment labels, timestamps and severity remain; host, process, command, image identifiers and journal cursors are discarded.
- JSON objects are parsed and recognized severity levels are mapped. Unknown severity remains unset. Plain text, malformed JSON and non-object JSON retain their plain body.
- Only proxy request records whose parsed path equals
/healthzor/readyzare dropped after query stripping. Application records are not filtered by this rule. - Remaining proxy requests retain only time, level, message, path, method, status and duration. Client addresses, ports, user agents, headers, host/target, query strings and client request identifiers are removed without retaining linkable hashes.
- Other JSON retains its fields except top-level process/host fields and query strings in path fields. Plain text is unchanged. Path segments and other bodies may contain identifiers.
Minimisation does not rewrite the local journals or previously exported records. Only receiver cursors persist; there is no on-disk payload queue. Export retries last five minutes, so extended outages can lose remote copies while local retention still applies.
Operational boundaries
Deployment success is reported only after rollout and readiness checks pass. Unclear deployment state stops for operator review. Operators verify log age, cleanup health and receipt of application and proxy records before retiring legacy copies. Production changes require the founder's explicit approval at the time; this documentation grants no operational approval.
These settings are dated operator observations from 4 November 2026, not current-status guarantees or automatic rules for independently operated deployments.
Omnibus-specific services launched; they are part of the Omnibus app layer, separate from the core TrustGraph API.
August 2026 — Authentication archive
The August documentation introduced the AuthenSee key-binding ceremony, device-signed graph mutations, strict request validation and signed reachability responses. Its request examples are historical and should not be used for current integrations.
Continue with how TrustGraph works and what a proof tells you.