v0.3.2

Proofpack 0.3.2 release notes

Tag: v0.3.2

Status: Published to npm as proofpack-cli@0.3.2 on 2026-11-10 (Asia/Shanghai). Runtime and report behavior are unchanged from 0.3.1.

Distribution

• Add mcpName: io.github.2648782102/proofpack to package metadata for MCP Registry ownership verification.
• Add a matching server.json with one npm package and a local stdio transport.
• Add the MCP Registry metadata file to the npm tarball contents.
• Refresh the README first screen around the evidence-receipt use case, a 30-second command, an example report image, and explicit non-goals.
• Add a reproducible demo script, distribution plan, social preview, directory entry, Show HN draft, and Chinese community post draft.
• Expand npm keywords for MCP and developer-tool discovery.

Verification

• npm run check.
• npm test.
• npm run build.
• npm pack --dry-run.
• mcp-publisher validate server.json when the publisher CLI is available.
• Clean-install smoke tests for proofpack and proofpack-mcp after npm approval.
• npm view proofpack-cli@0.3.2 version dist.integrity dist.shasum mcpName reports the expected version, integrity, shasum, and io.github.2648782102/proofpack.
• npx -y --package=proofpack-cli@0.3.2 proofpack --version prints proofpack 0.3.2 from a clean working directory.
• npx -y --package=proofpack-cli@0.3.2 proofpack-mcp < /dev/null exits with clean stdout and stderr from a clean working directory.
• A clean temporary npm install proofpack-cli@0.3.2 exposes both proofpack and proofpack-mcp binaries.
• mcp-publisher validate server.json passes against the MCP Registry schema.
• mcp-publisher publish server.json publishes io.github.2648782102/proofpack@0.3.2.
• The MCP Registry search API returns one active, latest record for io.github.2648782102/proofpack@0.3.2.

npm artifact

• dist.integrity: sha512-ZzvIKNWNqvXH/KU4IVcGFm1s/4HlCMZuqHpaVVglsC5yPir89GHM/lPIogQjV4lpWf9PbxZIW+wTK7ccTTdhyA==
• dist.shasum: 8767360b055e2a0c610aa42d2d842adecfa8d47b

Boundaries

• The MCP tool remains read-only relative to Git inspection: no project command execution, report-file writing, system opener, network request, or model call.
• CLI --run commands are still explicit, unsandboxed, and use the user's shell and privileges.
• Passing checks are evidence of one invocation, not correctness or security.
• The MCP Registry is a preview service; publication is performed through mcp-publisher, not a registry pull request.

v0.3.1

Proofpack 0.3.1 release notes

Tag: v0.3.1

Status: Published to npm on 2026-11-08 via staged publishing with security-key approval. The Git tag and GitHub Release are created from the final commit.

Change

• Documentation-only patch for the two-binary package introduced in 0.3.0.
• README, UX, MCP host examples, and installation snippets now name the executable explicitly: npx -y --package=proofpack-cli@0.3.1 proofpack ... and npx -y --package=proofpack-cli@0.3.1 proofpack-mcp.
• The release checklist now requires smoke-testing both binaries from a clean temporary install.
• Runtime behavior, CLI flags, MCP protocol contract, and report schema are unchanged.

Why

0.3.0 added proofpack-mcp alongside proofpack. npm cannot infer which executable should run from npx proofpack-cli@0.3.0 ... when a package exposes two bins. The published 0.3.0 tarball's README predates the corrected examples; npm does not permit replacing that tarball, so this patch republishes the same runtime with corrected package documentation.

Verification

• npm run check, npm test, npm run build, and npm pack --dry-run.
• CI smoke tests node dist/cli.js --version and node dist/mcp.js < /dev/null after the build.
• GitHub Actions succeeded for the release-preparation commit on main.
• Published package smoke tests: npx -y --package=proofpack-cli@0.3.1 proofpack --version, proofpack check --help, a proofpack-mcp stdio EOF check, and a legacy MCP initialize response reporting server version 0.3.1.

Boundaries

• The MCP tool remains read-only relative to Git inspection: no project command execution, report-file writing, system opener, network request, or model call.
• cwd supplied by an MCP host is a local path, not a sandbox boundary.
• Passing checks are evidence of one invocation, not correctness or security.
• Redaction and share-safe omission are best-effort; review reports before sharing.

Publication

The version was staged with PUBLISH_MODE=stage scripts/publish.sh and approved through npm's security-key flow with npm stage approve.

Published tarball metadata:

• dist.integrity: sha512-NWZR+N2sdYNe1Gz7i0CFNFFZ3AKBZ77E+ta/GNuJgtxqLKwAokcVBWzKkddd519A64g635+U6Jm/aFJ/xTTu+g==
• dist.shasum: 3c09086cc5b1068cd6f9bee298d2c67f24b631fb

The package has no runtime dependencies. The CLI binary is proofpack; the MCP binary is proofpack-mcp.

v0.3.0

Proofpack 0.3.0 release notes

Tag: v0.3.0

Status: Published to npm on 2026-11-08 via staged publishing with security-key approval. The Git tag and GitHub Release are created from the final commit.

Highlights

• A shared, read-only report core now backs both the CLI and the local MCP stdio adapter.
• proofpack-mcp exposes one proofpack_check tool with cwd, base, format, and shareSafe inputs.
• The adapter supports modern 2026-07-28 and legacy initialize-based MCP openings without runtime dependencies.
• MCP server metadata reports the package version 0.3.0.
• Host configuration, protocol behavior, security boundaries, and verification steps are documented in docs/MCP.md.
• Automated tests cover both MCP eras, tool calls, share-safe and base reports, protocol errors, malformed input, and stdout cleanliness.

Verification

• Node.js 24.
• npm run check, npm test, npm run build, and npm pack --dry-run.
• CI smoke tests node dist/cli.js --version and node dist/mcp.js < /dev/null after the build.
• GitHub Actions succeeded for the release-preparation commit on main.
• Published package smoke tests: npx -y --package=proofpack-cli@0.3.0 proofpack --version, proofpack check --help, a proofpack-mcp stdio EOF check, and a legacy MCP initialize response reporting server version 0.3.0.

Boundaries

• The MCP tool is read-only relative to Git inspection: no project command execution, report-file writing, system opener, network request, or model call.
• cwd supplied by an MCP host is a local path, not a sandbox boundary.
• Passing checks are evidence of one invocation, not correctness or security.
• Redaction and share-safe omission are best-effort; review reports before sharing.
• The published 0.2.0 tarball remains CLI-only; this release does not modify it.

Publication

Direct npm publish was blocked by npm's current account policy: the granular access token can stage a package but cannot directly publish. Version 0.3.0 was staged with PUBLISH_MODE=stage scripts/publish.sh and approved using a security-key one-time password with npm stage approve.

Published tarball metadata:

• dist.integrity: sha512-StYl6DD+SUsWrugtsp38T4mB8Z17J4YoJ1K6lmbImEO9orBl+9DRF/WYFA+QyOaM/maZ1TgTg0+td7lI/0Uuuw==
• dist.shasum: 6d83162728f977a6316186ab6045017c0d27afb1

The package has no runtime dependencies. The CLI binary is proofpack; the MCP binary is proofpack-mcp.

Because the package now exposes two binaries, a one-command npx invocation must name the executable explicitly, for example npx -y --package=proofpack-cli@0.3.0 proofpack check. After npm install --save-dev proofpack-cli@0.3.0, npx proofpack check works from the project. The older single-binary npx proofpack-cli@0.2.0 ... form does not select an executable for 0.3.0.

Proofpack 0.2.0

Proofpack 0.2.0 release notes

Tag: v0.2.0

Status: Published to npm on 2026-11-08 via staged publishing with 2FA approval.

Highlights

• Read-only Git change summary with explicit untracked-file handling.
• Explicit --run check evidence with timing, exit status, bounded output, timeout, redaction, and truncation metadata.
• Markdown and versioned 0.3 JSON reports.
• Deterministic review prompts for dependency, CI, auth/permission, migration, secret-like filename, and large-deletion heuristics.
• --base <ref> comparison, --share-safe omission, and opt-in local --open.
• Release checklist, publish script, changelog, package metadata, and 40 automated tests.

Verification

• Node.js 24.
• npm run check, npm test, npm run build, npm pack --dry-run.
• Clean checkout install/build/test smoke.
• Local tarball CLI smoke for --version, default check, explicit check, --base, and share-safe report.
• GitHub Actions succeeded for main and v0.2.0.
• Published package smoke test: npx proofpack-cli@0.2.0 --version and check --help.

Boundaries

• Default check makes no network request, runs no project command, and writes no file.
• Explicit commands are not sandboxed and may modify the working tree.
• Passing checks are evidence of one invocation, not correctness or security.
• Redaction and share-safe omission are best-effort; review reports before sharing.
• The repository is public as of 2026-11-08.

Publication

Direct npm publish was blocked by npm's current account policy: a granular access token with bypass 2FA can stage a package but cannot directly publish a package that does not yet exist. The release was staged with PUBLISH_MODE=stage scripts/publish.sh and approved with 2FA using npm stage approve.

Published tarball metadata:

• dist.integrity: sha512-QQE6gm7aiEt3nwohp9GDI33sWI1V430Re0TJS9htO1j9FICJEfaOYMR4PU+j1P5H2Ck+ed8kij+zbicsC8ROMg==
• dist.shasum: b9be0399f8b6ea8604efb09ad41807c2ede0a88e

The package has no runtime dependencies. npx proofpack-cli@0.2.0 check --help resolves the proofpack binary. GitHub Release notes use the existing v0.2.0 tag; no second tag is created.