Methodology changes. Announced, dated, signed.

An address reported by one source (or by one source relayed by another) now shows an amber 'Reported — under review' badge instead of a plain 'Not rated' mark. A Trustifer reviewer can confirm such a report after checking the evidence; the address then reads flagged, and the answer names the review, its date and the evidence, and can be disputed. A token's page shows a market profile of facts (liquidity, holders, age, public links, GoPlus contract-property checks) instead of a token trust score. Every safety answer now carries its own signature over the level, so a copy cannot be relabelled. API keys are verified on every scoring route.

Why: Twelve known drainer contracts reported by only one origin showed no warning on their badges after the independence rule. A token trust score contradicted the rule that Trustifer never grades tokens. The score signature covered the verdict but not the safety level.
Applies to: All methodologies · pre-versioning (no revision number) · Impact: some current scores may move
Announced: 2026-09-29 · Approved by: founder · Reference: docs/DESIGN_10C_CONTRACT_SAFETY.md

A threat-intelligence flag now needs two independent origins. GoPlus publishes where each of its reports came from; when it only passes on ScamSniffer's report, the two count as one report, so the address reads 'reported — under review' (still a warning, naming the relay) instead of 'flagged'. The 'as of' time is now the time of the oldest evidence used. A source's partial or rate-limited answer counts as incomplete, never as 'no hits', and a confirmed flag is not lost while one source is briefly rate-limited (kept for at most 7 days). A wallet that delegates control (EIP-7702) to different contracts on Base and Ethereum carries the worse of the two, and a generated written summary can no longer contradict the safety answer.

Why: For 17 of 32 flagged addresses in our test set, GoPlus's report was ScamSniffer's report passed on, so 'two independent sources' was not true for them. The 'as of' time showed when the answer was built, not when its evidence was read (cached evidence can be up to a day old). A partial or rate-limited source answer could be read as 'no hits', and exhausting a source's rate limit could turn a confirmed flag into 'could not confirm'. Only the first chain's EIP-7702 delegate was checked, and a generated summary could call a reported address safe.
Applies to: All methodologies · pre-versioning (no revision number) · Impact: some current scores may move
Announced: 2026-09-29 · Approved by: founder · Reference: docs/DESIGN_10C_CONTRACT_SAFETY.md

If Trustifer's own records cannot be read (a database outage), or a threat-intelligence source does not answer, the safety answer now says the checks are incomplete instead of listing them as checked; such answers are no longer cached for long. Every not-rated answer — the trust, reliability, oversight and bureau answers as well as the score — now carries the same flag and signs exactly what it shows. The health page reports the threat-intelligence sources. No rated subject's score, band or verdict changes.

Why: A database outage could have shown a blacklisted address as having no known red flags, because a failed read looked like an empty record. An address flagged only by a filed incident report or a flagged delegate contract was shown as not flagged on the trust answer while its first reason was the flag. Answers made while a source was down were cached like complete ones.
Applies to: All methodologies · pre-versioning (no revision number) · Impact: no current score expected to move
Announced: 2026-09-26 · Approved by: founder · Reference: docs/DESIGN_10C_CONTRACT_SAFETY.md

Contracts and tokens are still not rated, but every surface now gives them the same safety answer that wallets already had. A sanctions match, or a report confirmed by two independent threat-intelligence sources, leads the page as a warning; a single report reads as under review; a check that could not run never reads as clear. A wallet that has handed control of its funds to a contract (EIP-7702) carries that contract's warning. A single source's tag on a small, founder-reviewed list of canonical infrastructure contracts is set aside and disclosed in the answer; a sanctions match or a second source still flags them. For flagged addresses and for contracts, the explorer no longer shows its wallet-activity score, and the written summary of a flagged address is a fixed warning instead of a generated narrative. No rated subject's score, band or verdict changes.

Why: A drainer contract confirmed by two independent sources showed no warning at all, because the safety answer was computed for wallets only. The explorer showed a reassuring activity score next to a flagged contract and a flagged wallet; a flag must never sit beside a reassuring number. A wallet that delegates control to a flagged contract moves its funds by that contract's code, so it carries the same warning.
Applies to: All methodologies · pre-versioning (no revision number) · Impact: no current score expected to move
Announced: 2026-09-25 · Approved by: founder · Reference: docs/DESIGN_10C_CONTRACT_SAFETY.md

Every public score surface — passport, explorer, profile, directory, badges, embeds and the machine-readable payloads — will show the same certainty line: the confidence label, the count of evidenced factors behind it, a thin-file flag where it applies, and what would raise it. Every score is presented as an informational opinion for the reader's own assessment. No score, band or verdict changes.

Why: A score without its certainty is a claim without its caveat. The same confidence words meant different things on different surfaces; one definition per score is now published on the methodology page.
Applies to: All methodologies · pre-versioning (no revision number) · Impact: no current score expected to move
Announced: 2026-09-16 · Approved by: founder · Reference: docs/DESIGN_10_CERTAINTY_SURFACES.md

If the on-chain check or the name lookup cannot complete, the subject is now withheld as not rated instead of receiving a score with a small caveat. An unavailable sanctions screen never reads as clear: the verdict is held at Review until the screen answers. The health page reports a refused data provider as down, and a daily sentinel emails the operator.

Why: During a data-provider outage the site published scores for names that do not exist and grades for plain wallets, because the checks failed open. A score we could not verify is not an opinion we can stand behind; withholding is the honest answer. Readers already understand the not-rated answer; nothing about a verified subject changes.
Applies to: All methodologies · pre-versioning (no revision number) · Impact: no current score expected to move
Announced: 2026-09-22 · Approved by: founder · Reference: docs/DESIGN_10B_DEGRADED_MODE.md

Each scoring methodology has a numbered revision in code, stamped onto every recorded score so that validation never mixes revisions. This is the baseline (revision 1) for every methodology except the Trust Score, which was already at revision 3.

Why: A score produced under one revision and one produced under another are different instruments. Validation cohorts must be segmented by revision to mean anything.
Applies to: All methodologies · rev 1 · Impact: no current score expected to move
Announced: 2026-08-27 (recorded retroactively — this entry documents history and does not claim advance notice was given) · Approved by: founder · Reference: src/lib/explorer/methodologyRev.ts · Docs/RESEARCH_STEP6_OUTCOME_LEDGER_2026-08-27.md

When too little evidence backs a subject, the unified score publishes a signed Unrated envelope instead of a number. Fabricated-looking grades for evidence-less subjects are no longer possible.

Why: A junk address and a domain with no DNS were receiving confident-looking grades. A number with nothing behind it is worse than no number.
Applies to: Trustifer Score · pre-versioning (no revision number) · Impact: some current scores may move
Announced: 2026-08-11 (recorded retroactively — this entry documents history and does not claim advance notice was given) · Approved by: founder · Reference: docs/DESIGN_SCORING_HONESTY_EVIDENCE_FLOOR.md

Permissionless, self-solicitable feedback from the ERC-8004 registry no longer carries weight in the certified reputation blend and cannot satisfy the competence validations factor. The rows stay visible for transparency.

Why: Registry feedback can be bought or self-generated; it must not move a certified score. Pre-versioning: this change predates the version registry, so it carries no revision number.
Applies to: Reputation, Competence · pre-versioning (no revision number) · Impact: some current scores may move
Announced: 2026-08-11 (recorded retroactively — this entry documents history and does not claim advance notice was given) · Approved by: founder · Reference: docs/DESIGN_SCORING_HONESTY_EVIDENCE_FLOOR.md (S5)

Plain wallets are out of scoring scope. They receive the safety screen (sanctions, threat intelligence) and an honest wallet caveat instead of an agent grade.

Why: An agent grade on a human wallet is a category error. Safety information is still owed to the reader.
Applies to: All methodologies · pre-versioning (no revision number) · Impact: some current scores may move
Announced: 2026-08-11 (recorded retroactively — this entry documents history and does not claim advance notice was given) · Approved by: founder · Reference: docs/DESIGN_SCORING_HONESTY_EVIDENCE_FLOOR.md

A passing security assessment may help a score or do nothing — it can never hurt it. A narrow certification no longer counts as broad coverage; the union of what was actually assessed is what counts.

Why: Revision 2 could score an agent with a passing audit lower than one never audited; that is a trust-breaking defect. Narrow certificates were being read as broad credit.
Applies to: Trust Score · rev 3 · Impact: some current scores may move
Announced: 2026-08-06 (recorded retroactively — this entry documents history and does not claim advance notice was given) · Approved by: founder · Reference: docs/TRUST_SCORE_ASSURANCE.md (REVISION 3)

The Trust Score began to use verified contract-security evidence (audits and attestations from allowlisted attestors) as an input. Absence of evidence is neutral; only verified evidence counts.

Why: Security evidence was collected but did not yet reach the score. Re-certified under the assurance protocol before activation.
Applies to: Trust Score · rev 2 · Impact: some current scores may move
Announced: 2026-08-05 (recorded retroactively — this entry documents history and does not claim advance notice was given) · Approved by: founder · Reference: docs/TRUST_SCORE_ASSURANCE.md (REVISION 2)

The scope rule was found to hold on only a few routes; it was moved into one shared gate that every scoring route now passes through, verified in both positions of its switch.

Why: A rule that holds on two routes and not on the others is not a rule. One shared gate cannot drift route by route.
Applies to: All methodologies · pre-versioning (no revision number) · Impact: some current scores may move
Announced: 2026-07-30 (recorded retroactively — this entry documents history and does not claim advance notice was given) · Approved by: founder · Reference: docs/GATE_REGISTER.md (B2.2)

Subjects outside our scope — token contracts, and contracts with no registered agent behind them — stopped receiving agent grades. They receive an honest out-of-scope answer instead.

Why: An agent grade for something that is not an agent misleads the reader. The rule had to hold on every scoring surface, not only the main one.
Applies to: All methodologies · pre-versioning (no revision number) · Impact: some current scores may move
Announced: 2026-07-23 (recorded retroactively — this entry documents history and does not claim advance notice was given) · Approved by: founder · Reference: docs/DESIGN_L1_SCORING_SCOPE.md