Upgrade your build — here’s what’s new.

• KYE Data Mapping Agent™ (no action — new regulator-walkthrough surface): per-tenant data-flow graphs derived from the §0.3 audit chain. Signed kye.data_flow_graph.v1 envelope. kye data-flow build/get CLI. Mechanism is proprietary and is not disclosed in this repository.
• KYE Native Search Engine™ (action: opt in via the search.read SKU): signed kye.search_result.v1 envelope. kye search CLI. Mechanism is proprietary and is not disclosed in this repository.
• KYE Memory Engine™ (action: opt in via the memory.read / memory.write SKUs): signed agent-memory records with classification-coupled retention. kye memory put/recall CLI. Mechanism is proprietary and is not disclosed in this repository.
• KYE Reporting Engine™ (action: opt in via the reports.read / reports.write SKUs): per-framework compliance report synthesis; signed report envelope; opt-in auto-delivery via reports@kyeprotocol.com. kye report CLI. Mechanism is proprietary and is not disclosed in this repository.
• Phase 6 — Manifest-First (no action — new master proof object):
  • kye.authority_proof_bundle.v1 — master portable proof object binding a privileged action to its full evidence chain (purpose manifest, scope snapshot, state snapshot, runtime decision, decision map, evidence pack, replay proof, rule-pack refs, conformance profiles).
  • Authority Proof Bundle™ Engine™ and its HTTP Worker (POST /v1/bundles/assemble · POST /v1/bundles/verify) ship signed bundles + 10-check signed verification results.
  • 5 new canonical manifest schemas: kye.purpose_manifest.v1, kye.scope_snapshot.v1, kye.state_snapshot.v1, kye.runtime_decision.v1, kye.delegation_chain.v1 — every ref in the bundle now resolves to a canonical declaration.
• Phase 9 — KYE Rule Pack Marketplace™ (optional — browse the catalogue): signed listings carrying deterministic trust scores (5-component, 0..100 range, explainable), filter by sector / regime / jurisdiction / pricing model / publisher tier. Library (@kye/marketplace-registry), HTTP Worker (GET /v1/listings/search), and 6 seed listings (financial-services-eu, cargo-routing, eu-ai-act, payments-eu-psd2, transparency, pension-uk-tpr).
• Phase 30 — Audit WORM + Retention (no action — tamper-impossible audit trail): D1 BEFORE UPDATE / BEFORE DELETE triggers on 9 protected tables (audit_events, evidence_packs, audit_chain_entries, etc.); R2 Object Lock COMPLIANCE archival with per-table retention years (10y / 7y / 50y) framework-justified against SEC 17a-4, FINRA 4511, EU AI Act Art 12, DORA Art 28. kye-audit-archiver (cron) + kye-audit-chain-worker (POST /append · GET /verify) close the immutability stack. The audit-chain construction and verification algorithm are proprietary and are not disclosed in this repository.
• Phase 28 — CKAN Open Data connector (optional — data-portal operators): V1 read-only connector (@kye/ckan-connector) and hourly harvester Worker (kye-ckan-connector-worker) project CKAN portals / datasets / resources / activity onto canonical kye.ckan_*.v1 entities. Constitution §28 platform-inside-sector lock preserved: KYE™ integrates with CKAN, never replaces it.
• Phase 29 — Profiles-Lite (action: opt in to the 10-profile model on your next conformance run): 60 legacy profile files reclassified as 10 canonical profiles + 57 rule packs + 49 sector packs + 185 dictionaries, with KYE Rules Gateway™ as the runtime. The cargo-routing rule pack is the portability proof — same evaluator, different rule pack, financial-services + maritime sectors simultaneously.
• Tier-1 readiness pass (optional — turn on the new env vars to harden your deployment):
  • CI supply-chain: dependency-review, gitleaks, signed-commit check, SBOM retention.
  • Governance templates: GDPR DPA, ROPA, DSR procedure, PCI scope, customer SLA, sub-processor inventory, BCDR tabletop.
  • Gateway hardening middleware: auth, rate-limit, body-size, structured logging, JSONL + Postgres audit-chain adapters, receiver-side webhook verifier, COSE_Sign1 binary signing, OPA policy-engine adapter, Authority Graph™ traversal engine, HSM/KMS key-custody interface.
  • SDK crypto + errors + retry across TS + Python + Go.
  • CLI keystore + sign + verify-webhook.
• Sovereign AI build-out (action: optional — only if you adopt the v1.1 preview profile) — Sovereign AI Profile™ + 9 sub-profiles + 5 planned apps; sovereign-ai-authority.json schema + example + conformance fixture + SDK types.
• Numeric ledger reconciled (no action) — site claims now match repo counts line-for-line: 10 canonical profiles + 57 rule packs + 49 sector packs + 185 dictionaries, 133 conformance fixtures (133/133 pass), 556 JSON Schemas, 286 validated examples, 50 reference connectors (now served by GET /v1/connectors), 24 event families × 79 types, 289 control mappings across 20 frameworks.
• Trademark family unified (no action) — open-source / spec surface continues as Reference Gateway / Runtime Gateway / KYE-Gateway v1 without the ™; protected marks documented in legal.html.

The preview profiles are gated until each one ships its own conformance suite and at least one runtime fixture passes against the reference Gateway. Until then, they live on the main branch as preview normative drafts; implementations following them carry no official Conformance badge.

• Conformance Certification Program — program-level badge issuance + verification record schema, landing as the conformance-certification rule pack + badge-levels dictionary. Powers the capability-scoped ladder.
• Authority Graph™ normative model — graph_node + graph_edge + decision_map schemas + a graph-query endpoint surface, landing as the graph dictionary + graph-traversal additions to the runtime-authority profile.
• Payload Trust™ lifecycle — payload-artefact lifecycle + trust binding (verified / rejected / executed states + signed payload references), landing in the action-admissibility rule pack + pep profile.
• Self-Audit Attestation — self-attestation envelope (signed Ed25519 / JWS) covering the L2 ladder rung, landing in the evidence-replay profile + compliance-evidence rule pack.
• Cross-rule-pack taxonomy + metadata-binding — cross-pack metadata-binding schema for sector-overlay mapping; consolidates into the 12 canonical dictionaries.

KYE™ MCP Server reference implementation is gated to v1.1 (see mcp.html for the design specification).