Changelog

Notable changes to what agents and verifiers see from Sill: the embed script, the signed agent card, the MCP server, the signed catalog, llms.txt, the /agent page, UCP checkout and the public JWKS. Newest first, dates in UTC. Dashboard-only changes are listed only when they change how you set Sill up.

For what each protocol supports today, see Supported agent protocols.

Endpoints covered

Surface	Address
Embed script	https://cdn.sill.so/embed.js
Agent card	https://edge.sill.so/v1/agent-card/{site_key}.json
MCP server	POST https://edge.sill.so/v1/mcp/{site_key}
Catalog	https://edge.sill.so/v1/catalog/{site_key}.json
llms.txt	https://edge.sill.so/v1/llms/{site_key_hash}.txt
/agent page	https://edge.sill.so/v1/agent/{site_key_hash}
UCP profile	https://edge.sill.so/v1/ucp/{site_key_hash}/profile
UCP checkout	https://edge.sill.so/v1/ucp/{site_key_hash}/checkouts
Public JWKS	https://edge.sill.so/.well-known/jwks.json

2026-10-05 — Large audit days export in parts

• Audit bundles: a day with more than 1,000 records on one chain exports in signed parts of 1,000 instead of one large file. The download is the part holding the record you opened, and the others are listed under the export buttons. Files are named …-part-{k}-of-{n}.{html|json}. Days with 1,000 records or fewer are exported exactly as before. See Audit log and export.
• Hosted verifier: sill.so/verify checks a part on its own, including that its records belong to the day, and shows Part k of n verified. The part format is described in Audit envelope.

2026-10-04 — Business skills in onboarding, scan additions, audit file names

• Onboarding: on a site that is not a store, the Skills step lists the pricing, demo, contact and similar pages found on your homepage as business skills, with links filled in and off until you turn them on. Store skills move under a collapsed More skills. Store sites are unchanged. See Sites and onboarding.
• Readiness scan: the sill.so scan, shared report and report email list the business pages found (Agents could answer for you: …) and add a Charges agents row for x402 and Cloudflare pay-per-crawl. Neither is scored. The dashboard’s Agent readiness page shows the same row, uncounted, under Discoverable.
• Audit bundles download as sill-audit-{domain}-{YYYY-MM-DD}-{discovery|transactional}-{id}.{html|json}. See Audit log and export.
• Stripe and Shopify connections are not saved if your access changes while connecting; ask an owner or admin to connect again. See Connect payments.

2026-10-04 — New ID for the card-signing key

The key that signs agent cards and catalogs has a new ID, sill-card-ed25519-v1-5f03060ef5f77675, derived from the public key. The key itself has not changed. Cards name the ID in signing.signing_key_id and catalog trust manifests in the JWS header kid. Until at least 2026-11-05 the public JWKS also lists the same key under its previous ID, foyer/edge/card-signing-v1, so cards and catalogs signed before the change keep verifying. Verifiers that select the key by kid need no change; refresh your key set if a kid is not found.

2026-10-04 — Business skills and UCP checkout guide

Business skills are documented: seven built-in skills (get_pricing, request_demo, sign_up, book_meeting, contact_support, get_status, get_trust_center) that answer an agent with a link to your pricing, demo, sign-up, booking, support, status or trust page. An enabled business skill appears on your agent card, as a tool on your MCP server, in llms.txt and on the /agent page. Turn them on under Settings → Skills → Business skills.

The UCP checkout guide now covers the full checklist for getting checkout advertised (Stripe connected, Stripe as the settlement rail, the rail on, a published policy and, with a live Stripe account, a Google Pay merchant ID), signed terms, shipping and tax, and how to check your setup. Being listed on Google’s shopping surfaces requires Google’s merchant approval.

2026-10-01 — Agent readiness page

In the dashboard, the new Agent readiness page replaces Visibility, with step-by-step fixes and a Check again button.

2026-09-25 — UCP checkout

Sill can act as your store’s UCP endpoint. Your business profile is served at /.well-known/ucp on Cloudflare Worker and WordPress plugin installs, and at GET https://edge.sill.so/v1/ucp/{site_key_hash}/profile. Checkouts run at https://edge.sill.so/v1/ucp/{site_key_hash}/checkouts: priced from your catalog, checked against your guardrails, sent to human review when a rule asks, paid through Google Pay into your Stripe account, and recorded in the signed audit log. Signed webhooks for order updates followed on 2026-09-30. Checkout is advertised once Stripe is connected, the rail is on and a policy is published.

2026-09-25 — Web Bot Auth

On Cloudflare Worker and WordPress plugin installs, Sill checks Web Bot Auth signatures (RFC 9421) that agents attach to their requests. A valid signature shows as VERIFIED · SIGNED on the visit; a failed one is shown on that visit and does not block the agent on its own. ChatGPT agent mode and ExaSearchBot sign their requests; the plain ChatGPT-User and Claude-User fetchers do not.

2026-09-08 — The /agent page

Sill serves an HTML page for each site at GET https://edge.sill.so/v1/agent/{site_key_hash}, for assistants that read pages rather than JSON. It lists your discovery endpoints and skills, with the agent card embedded as JSON-LD. GET https://edge.sill.so/v1/agent/domain/{domain} redirects to it by domain name. Worker and plugin installs serve it at /agent on your domain.

2026-09-07 — llms.txt and firewall-block detection

Sill generates an llms.txt for each site from your skills and endpoints, at GET https://edge.sill.so/v1/llms/{site_key_hash}.txt. Worker and plugin installs serve it at /llms.txt on your domain. You can edit the description and add sections in the dashboard.

Sill also detects when a firewall returns 403 to AI crawlers and shows a WAF is blocking AI agent crawlers banner with the paths to allow. See Let AI crawlers through your firewall.

2026-08-08 — Shareable readiness reports

Each public readiness scan has a shareable report at sill.so/report?id=…, which search engines do not index.

2026-08-04 — Public readiness scan

The public readiness scan on sill.so reads eight signals on any domain and gives a verdict: AGENT-READY, PARTIAL SIGNAL or NOT DISCOVERABLE.

2026-07 — Site keys start with us_

New site keys start with us_ followed by 43 characters. Older keys that start with sk_ keep working everywhere.

2026-06-19 — Public JWKS

The ed25519 key that signs agent cards and catalogs is published at https://edge.sill.so/.well-known/jwks.json (application/jwk-set+json, CORS *):

{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "alg": "EdDSA",
      "use": "sig",
      "kid": "foyer/edge/card-signing-v1",
      "x": "<base64url public key>"
    }
  ]
}

Anyone can now verify a card or catalog with a standard RFC 8785 canonicalizer and an ed25519 library. See Verify a signature.

2026-06-19 — Signed catalog

Sill publishes a signed ai-catalog.json for each site (specVersion 1.0, host.identifier set to did:web for your domain). Each trustManifest carries a detached ed25519 JWS over the canonical manifest. The signature covers the trust manifest; each entry’s url, capabilities and description rely on did:web and TLS.

2026-06-19 — Live Stripe payments (early access)

The full order path — signed mandate, policy evaluation, Stripe payment authorization and a signed audit record — has been validated end-to-end on the live Stripe rail. Transactional is in early access. Sill never holds funds: Stripe holds the card, charges it, settles and pays out. The Shopify rail runs in test mode only.

Available since launch

• Embed script — a one-line script that records page views and identifies agents against a list of known agents (Anthropic, OpenAI, Google and others).
• Agent card — a signed, A2A-compatible card per verified site, with protocol_version: "a2a/1.2" and only the skills your site offers.
• MCP server — initialize, tools/list and audited tools/call per verified site. Responses are not signed; the agent card that points to the server is.
• Audit log and export — an append-only, signed, Merkle-chained audit log, exportable as signed JSON, an HTML bundle or OCSF NDJSON.

Frequently asked

Is this every change?

No. It lists changes to what agents and verifiers see. Dashboard-only changes appear when they change how you set Sill up.

Why do some entries have no date?

They describe what has been available since launch, before this changelog was kept.

Where is the roadmap?

This changelog lists only what has shipped. For the status of each protocol, see Supported agent protocols.

See also

• Supported agent protocols
• API endpoints
• Verify a signature
• Audit envelope