# Changelog of CityCompliance MCP: Hiring Compliance Auditor (`frayess_mosbehi/compliance-auditor-mcp`) Actor

- **URL**: https://apify.com/frayess\_mosbehi/compliance-auditor-mcp/changelog.md
- **Full Actor documentation**: https://apify.com/frayess\_mosbehi/compliance-auditor-mcp.md

## Changelog

### 2026-02-08

- Added auth/paywall scope enforcement and billable MCP search tool.
- Added marketplace decision ADR (`docs/adr/0001-marketplace-and-payment-rail.md`).
- Added billable API contract v1 (`docs/contracts/billable-api-contract.v1.md`).
- Added service policy (`docs/policies/service-policy.md`).
- Added versioned pricing config (`config/pricing.v1.json`) and runtime pricing loading.
- Added billable usage metering in SQLite (`billing_events`) with idempotent writes.
- Added admin export tool `export_billing_events` (JSON/CSV) for payout reconciliation.
- Added metering tests for event integrity, duplicate prevention, and export format coverage.
- Switched ingest automation from daily to weekly (`0 6 * * 1`, Monday 06:00 UTC).
- Added GitHub Actions failure alert path that opens/comments an `ops` issue when ingest fails.
- Updated `scripts/ingest_sources.py` to return non-zero on failure so CI alerts trigger correctly.
- Added freshness policy config (`config/freshness.v1.json`) with jurisdiction-aware thresholds.
- Added stale-data guardrails: `check_hiring_compliance` now blocks when freshness SLA is exceeded.
- Added freshness metadata in paid tool responses and tests for warn/block behavior.
- Added Docker packaging (`Dockerfile`, `.dockerignore`, `docker-compose.yml`).
- Added runtime transport config via env (`COMPLIANCE_MCP_TRANSPORT`, host/port/path) for HTTP/stdio deployment modes.
- Added Docker MCP usage guide (`docs/mcp-usage-guide.md`).
- Added HTTP pages on Uvicorn transport: `/`, `/docs`, `/404`, `/500`.
- Added OAuth/JWT auth mode with issuer/audience/expiry validation and JWKS support.
- Added HTTP auth integration tests for 401/403 responses and `WWW-Authenticate` headers.
- Added unit-economics model with margin guardrails and SKU auto-disable logic.
- Added `scripts/finance_report.py` and weekly finance artifact workflow (`finance-report.yml`).
- Added tenant-isolated billing export authorization (`compliance:billing.read`) with admin override.
- Added billable-call abuse detection hooks for burst and idempotency replay anomalies.
- Added response/export sanitization controls for ordinance payloads and CSV formula injection.
- Added paid-endpoint OWASP threat model doc (`docs/security/paid-endpoints-threat-model.md`).
- Added configurable quota/rate-limit policy (`config/limits.v1.json`) and runtime usage guardrails.
- Added hard-cap loop protections (`calls_per_minute`, `calls_per_day`) on billable tool calls.
- Added quota/rate-limit test coverage (`tests/test_limits.py`) including edge-case enforcement.
- Added local payment precheck/capture gateway with insufficient-funds and provider-failure handling.
- Added paid-flow validation script (`scripts/validate_paid_flow.py`) with JSON/Markdown evidence outputs.
- Added paid-flow test coverage (`tests/test_paid_flow.py`) for pricing, ledger, and failure scenarios.
- Added buyer launch collateral (`docs/marketplace/buyer-quickstart.md`) with paid MCP integration quickstart.
- Added explicit tool versioning/deprecation policy (`docs/policies/versioning-and-deprecation.md`).
- Added legal/commercial pack docs for marketplace listing:
  - terms of service
  - privacy/data handling policy
  - refund/dispute policy
  - jurisdiction support matrix
- Added MCP protocol-version contract tests (`tests/test_protocol_matrix.py`) across active protocol versions.
- Added PR CI workflow for protocol matrix enforcement (`protocol-contract-matrix.yml`).
- Added protocol compatibility contract doc (`docs/contracts/protocol-version-matrix.md`).
- Added dispute-ready billing evidence:
  - immutable `billing_event_attempts` table with request/response hashes
  - `billing.charge_ref` in billable responses
  - `export_dispute_report` tool for support operations
- Added revenue/usage analytics pipeline:
  - dashboard computation module (`city_compliance/analytics.py`)
  - export script (`scripts/revenue_dashboard.py`)
  - daily workflow artifact job (`revenue-dashboard.yml`)
  - KPI/anomaly test coverage (`tests/test_analytics.py`)
- Added multi-city expansion onboarding templates:
  - source discovery checklist
  - sources entry template
  - jurisdiction risk profile template
- Added city pack configs and validation tests (`config/city_packs/*.json`, `tests/test_city_packs.py`).
- Onboarded Los Angeles, Chicago, and London baseline city packs:
  - new source entries in `data/sources.yaml`
  - new city pack configs in `config/city_packs/`
  - citation recall tests in `tests/test_city_pack_citations.py`
  - UK date parsing enhancements in `scripts/fetch_ordinances.py`
- Added x402-compatible payment adapter mode with feature flag controls and receipt verification tests.
- Added AWS Bedrock AgentCore channel readiness docs/tests:
  - `docs/channels/aws-bedrock-agentcore-compat.md`
  - `tests/test_bedrock_channel_compat.py`
- Added marketplace publish runbook for final external listing steps (`docs/marketplace/publish-runbook.md`).

### Changelog policy

- Every pricing or billable schema change must add a dated changelog entry.
- Breaking pricing/schema changes require new versioned contract and pricing files.