TreeHarbor 0.1.13-alpha.1 — Git-compatible Connected workspaces

TreeHarbor 0.1.13-alpha.1 is a Connected preview for teams running agents that use Git inside their working directory.

What changed

• Prepare a full Connected workspace at an exact imported Git commit with a private .git directory. Use workspace-create --git-compatible and node prepare-once --git /absolute/path/to/git --workspace WORKSPACE_UUID. Managed execution also needs the registered bounded volume and an approved agent image containing Git. Operator guide
• Capture selected working files after runtime removal. The accepted ChangeSet stays tied to the imported base even if an agent changes its local HEAD, index or Git configuration. The regular GitHub review and merge process remains the path to main.
• Inspect native file preparation counters, reproduce the published local benchmark and watch the recorded two-agent trial. Preparation benchmark · Trial walkthrough

Install

Use the Linux x86-64 or ARM64 archive and verify its SHA-256 and attestation before installation. The archive includes the CLI and runtime init. PostgreSQL and the external gVisor runtime are configured separately. Package verification · Connected quickstart

For an existing preview installation, retain your backup and use the same version of the CLI and runtime init. This release keeps the PostgreSQL schema and third-party Cargo dependencies of 0.1.12-alpha.1. Elastic License 2.0 applies to both modes with no workspace-count limit.

Verification

Source f02a2cb7af62efbd332306e033a98b5f80a2b21a. The exact main CI run and signed producer passed. Both Linux archives passed installed runtime checks. Independent online and bundled attestations matched each archive, its metadata and all associated subjects to the exact source, tag and workflow invocation.

A fresh installation of the signed ARM64 archive also ran real Git inside gVisor with a disposable PostgreSQL database and fixture GitHub authority. The agent reset its local HEAD, staged a file and changed its local Git config. TreeHarbor accepted the selected file against the original import and returned the same receipt after workspace cleanup. Live GitHub publication from this new format remains a separate acceptance scenario.

Git-compatible preparation currently requires a complete supported Git import and a full source profile. Managed check workspaces remain native. Complete Connected queue and recovery certification and the full Standalone release remain in progress.

TreeHarbor 0.1.12-alpha.1 — operator-assisted Connected recovery

TreeHarbor 0.1.12-alpha.1 — operator-assisted Connected recovery

After restoring a cold backup, inspect the live GitHub repository, recover exact source missing from the backup, and admit a new connection only after current evidence and explicit operator review. Old connections remain disabled and their writes are never automatically replayed.

This release adds:

• Retained context and all-state branch/PR inventory, including resumable paged capture.
• Read-only inspection of retained PR, queue/removal, check and delivery identities.
• Exact source acquisition, independent recovery pins and server-verified Git mappings.
• One repository-wide review and a bounded plan/probe/activate/status/cancel workflow.
• A permanently disabled discovery target when the backup predates the first binding.

Start with the recovery and upgrade guide. Recovery requires external fencing, investigation of uncertain host mutations, and separately scoped fresh credentials. A local passing review cannot prove those external facts or grant merge permission.

No database schema or third-party dependency change from 0.1.11. Source verification now links the existing Rust Git projection component into the metadata component. Update recovery clients and server together: context v2 rejects old hashes for new decisions. Older receipts stay historical. Do not downgrade to bypass quarantine.

Evidence and limits

An installed ARM64 development trial used actual backup/restore, discovered six branches and five PRs, preserved eight distinct Git revisions, reconnected under operator control and verified retained/new proposal export. Its source and archive are recorded exactly; it is not a live GitHub trial of the later release binaries. No branch, PR, check, queue or policy mutation was sent. Tasks used the external API, not managed agent execution.

Full uncertain-publication/queue disaster certification, old-node cleanup, automated fencing, unassisted onboarding and production readiness remain open. This alpha does not complete the full Connected/Standalone goal. ELv2 remains unchanged and has no workspace usage threshold.

Verification and installation

Signed producer, attempt 1
passed installed managed/native runtime and cold-recovery acceptance on
Linux x86-64
and ARM64.
Both restored source without the original store, refused missing/corrupt objects
and revoked old nodes, ran a fresh gVisor check, published/exported the exact native
candidate, and verified the retained backup after new writes.

Independent official online and bundled attestation checks matched all eight signed
subjects per architecture, the exact source/tag and producer invocation. A separate
installation of the original signed ARM64 archive verified recovery commands,
refusal to replace an existing installation, and the backup from the earlier live
trial. That final installation check started no service and used no GitHub access.

Assets below are the original tested bytes. Metadata contains the runtime receipt,
Rust dependency report and observed native link inputs. It is not a complete native
component inventory, a reproducible-build claim or a claimed SLSA level.

Linux target	Archive SHA-256
x86-64	5856f19945045b41c1e1a8ccededaafe2d7fc3d7f6e2d81fde9ed88b32752b21
ARM64	1586e9f94dda784b4989d739aa91ce22fd5f580f4f0cf4732953306da2672920

Reviewed source: ae3fe17f1b5dd92211c9ecbdb500267bb6832690.
Successful main CI.

Verify the exact source and signed bytes before extraction. Use
aarch64-unknown-linux-musl for ARM64:

TH_VERSION=0.1.12-alpha.1
TH_TARGET=x86_64-unknown-linux-musl
TH_SOURCE=ae3fe17f1b5dd92211c9ecbdb500267bb6832690
TH_ARCHIVE="treeharbor-$TH_VERSION-$TH_TARGET.tar.gz"
TH_BUNDLE="treeharbor-$TH_VERSION-$TH_TARGET.provenance.sigstore.json"
gh release download "v$TH_VERSION" --repo ArtAndrew/TreeHarbor \
  --pattern "$TH_ARCHIVE" --pattern "$TH_ARCHIVE.sha256" --pattern "$TH_BUNDLE"
gh attestation verify "$TH_ARCHIVE" --bundle "$TH_BUNDLE" \
  --repo ArtAndrew/TreeHarbor \
  --signer-workflow ArtAndrew/TreeHarbor/.github/workflows/release-provenance.yml \
  --signer-digest "$TH_SOURCE" --source-digest "$TH_SOURCE" \
  --source-ref "refs/tags/v$TH_VERSION" --deny-self-hosted-runners
sha256sum --check --strict "$TH_ARCHIVE.sha256"
tar -xzf "$TH_ARCHIVE"
cd "treeharbor-$TH_VERSION-$TH_TARGET"
TH_INSTALL_PREFIX="$HOME/.local/treeharbor-preview-0.1.12"
./install.sh --prefix "$TH_INSTALL_PREFIX"
"$TH_INSTALL_PREFIX/bin/treeharbor" --version

Installation does not provision PostgreSQL, a GitHub App or an execution runtime.
Keep the current deployment stopped during a reviewed update and retain independent
backups. Use a new installation prefix rather than overwriting an existing version.

• Recovery and upgrade sequence
• Reconnection protocol and limits
• Connected operator setup
• Package/provenance boundaries

TreeHarbor 0.1.11-alpha.1 — local recovery continuation

TreeHarbor 0.1.11-alpha.1 — continue a local restore

This alpha adds two operator commands after backup restore-stage:

• backup restore-quarantine retires restored execution intent in one journaled
  transaction: drain file workspaces, request stops, cancel pending native queue
  candidates, disable old nodes and revoke old GitHub bindings/event channels.
  Accepted source, published native history, pins, validation evidence and
  uncertain publication records remain intact. No runtime outcome is invented.
• backup restore-configure checks the current quarantine state, copies and
  verifies an independent live object store, and writes private configuration
  pointing at the restored database. The retained backup stays unchanged.

The release also makes generic background-job lease claims, renewals and completion
serialize with repository freeze. This is not authorization for external effects.

Operator workflow

First stage a trusted backup using the previous release's documented procedure.
Keep both deployments stopped and isolate the old database writers, nodes, runtimes
and publishers so they cannot restart. The following acknowledgment does not prove
that external fencing has happened:

: "${TH_BACKUP_SHA256:?Set the independently retained manifest digest}"
TH_STAGE=/srv/treeharbor-recovery/stage-001
treeharbor backup restore-quarantine \
  --stage "$TH_STAGE" --manifest-sha256 "$TH_BACKUP_SHA256" --writers-stopped
treeharbor backup restore-configure \
  --stage "$TH_STAGE" --manifest-sha256 "$TH_BACKUP_SHA256" \
  --writers-stopped --old-infrastructure-fenced

The configuration command requires prior quarantine and refuses an existing
STAGE/active directory. Partial output is retained for inspection, not overwritten
or silently resumed. Reserve disk for another complete object copy. Configuration
does not issue credentials or start a service; explicitly provision a fresh reader
and inspect/export retained source before enabling new work. Use fresh node
identities and storage rather than resuming old worker journals.

Connected bindings remain revoked. Reconciliation of GitHub refs, PRs, checks,
queues and uncertain attempts is still required before publishers can resume.
Old-node cleanup, full Connected disaster recovery and unattended production
readiness remain unfinished. This release does not complete both authority modes.

No database migration or dependency change from 0.1.10. Stop work before updating
binaries and preserve configuration, source, journals and independent backups.
The public license remains standard ELv2, without workspace usage thresholds.

Verification and installation

Signed producer,
attempt 1, passed installed runtime and recovery acceptance on
Linux x86-64
and ARM64.
Both restored retained source without the original store, rejected missing/corrupt
objects and old nodes, ran a fresh gVisor check, published/exported its exact native
candidate, and kept the copied backup unchanged after new live writes.

Independent official online and bundled attestation verification matched all eight
signed subjects per architecture, the exact source/tag and producer invocation.
Assets below are the original tested bytes. Metadata contains the runtime receipt,
Rust dependency inventory and native link-input observations; it is not a complete
native component inventory or a claim of reproducible builds or a SLSA level.
No new live GitHub disaster-recovery certification is claimed.

Linux target	Archive SHA-256
x86-64	7e7434b75aa7e9f9d992b2d9d26fe515c0b93ebc66b027caee542a4802de7601
ARM64	625be087bc827b7d11a403a1c651fc73a5f0558d4453a10cac492726468bf56b

Reviewed source: 6de30952b6d25e85a7ff5088d7fe2c0706c883f0.
Main CI.
Main CI and signed producer both completed successfully for this exact source.

After downloading the published assets, verify the exact source and signed bytes
before installation. Use aarch64-unknown-linux-musl for Linux ARM64:

TH_VERSION=0.1.11-alpha.1
TH_TARGET=x86_64-unknown-linux-musl
TH_SOURCE=6de30952b6d25e85a7ff5088d7fe2c0706c883f0
TH_ARCHIVE="treeharbor-$TH_VERSION-$TH_TARGET.tar.gz"
TH_BUNDLE="treeharbor-$TH_VERSION-$TH_TARGET.provenance.sigstore.json"
gh release download "v$TH_VERSION" --repo ArtAndrew/TreeHarbor \
  --pattern "$TH_ARCHIVE" --pattern "$TH_ARCHIVE.sha256" --pattern "$TH_BUNDLE"
gh attestation verify "$TH_ARCHIVE" --bundle "$TH_BUNDLE" \
  --repo ArtAndrew/TreeHarbor \
  --signer-workflow ArtAndrew/TreeHarbor/.github/workflows/release-provenance.yml \
  --signer-digest "$TH_SOURCE" --source-digest "$TH_SOURCE" \
  --source-ref "refs/tags/v$TH_VERSION" --deny-self-hosted-runners
sha256sum --check --strict "$TH_ARCHIVE.sha256"
tar -xzf "$TH_ARCHIVE"
cd "treeharbor-$TH_VERSION-$TH_TARGET"
TH_INSTALL_PREFIX="$HOME/.local/treeharbor-preview-0.1.11"
./install.sh --prefix "$TH_INSTALL_PREFIX"
"$TH_INSTALL_PREFIX/bin/treeharbor" --version

Installation does not provision PostgreSQL, a GitHub App or an execution runtime.

• Configure a quarantined restore
• Quarantine old work
• Stage a trusted backup
• Backup boundaries
• Connected operator setup

The source at this tag may describe the package as an unreleased candidate because
documentation preceded publication; the verified release record establishes its
availability. The current main documentation can be updated after publication.

TreeHarbor 0.1.10-alpha.1 — verified restore staging

TreeHarbor 0.1.10-alpha.1 — stage a verified cold restore

This alpha adds treeharbor backup restore-stage to rebuild a trusted cold backup
in isolated infrastructure. It creates a new PostgreSQL database, copies and verifies
the complete saved inventory, checks the restored schema and live objects, and
revokes old service tokens with append-only audit records.

Supply a trusted backup, its separately retained manifest digest, a new private
output directory, a private connection file for an isolated local PostgreSQL server
and the matching trusted pg_restore. The role needs CREATEDB and the server must
match the backup's PostgreSQL major version with fsync enabled. SQL backups are
executable input; a digest proves identity/integrity, not that untrusted SQL is safe.

: "${TH_BACKUP_SHA256:?Set the separately retained manifest digest}"
treeharbor backup restore-stage \
  --backup /your/private/backups/snapshot-001 \
  --manifest-sha256 "$TH_BACKUP_SHA256" \
  --directory /your/private/recovery/stage-001 \
  --database-url-file /your/private/recovery/isolated-database.url \
  --pg-restore /usr/lib/postgresql/18/bin/pg_restore \
  --isolated-target

The directory must not already exist. A private target record precedes database
creation so interrupted outcomes remain identifiable; a staged receipt is written
last after successful restore, identity checks and token revocation. Errors retain
partial files and the new database. There is no automatic DROP, overwrite or resume.

Staging does not generate runnable configuration, start services, issue new tokens,
fence old infrastructure or authorize activation. Keep the target isolated with
workers/publishers disabled. Connected additionally needs external GitHub state and
uncertain-attempt reconciliation before any publishing resumes. The original backup
and original deployment credentials are unchanged; revocation applies to the new
database. Full operational activation and both complete modes remain release gates.

No migration or new dependencies from 0.1.9. Stop work before binary updates and
preserve configuration, source, journals and independent backups. Both authority
modes retain standard ELv2 without a workspace usage threshold.

Verified build

Source: df7bb976c06c55d522278192724a563138fa0a96.
Main CI and
signed producer,
both attempt 1, passed. Both Linux packages were installed and exercised through
actual backup creation, restore-stage, denial of old credentials, inspection and
export without the original object directory, corruption refusal, pending-check
refusal and deliberate replacement-node execution through gVisor. The fresh check
landed its exact native candidate once and exported to ordinary Git.

The disposable drill deliberately creates its own inspection configuration and
issues selected new credentials after staging. It does not establish an operator
activation command, live GitHub recovery, unassisted onboarding or full mode readiness.

Independent official GitHub verification succeeded online and with the downloaded
signature bundles. The eight subjects per architecture, their hashes and producer
invocations match. The attached assets are unchanged producer output. Metadata ZIPs
contain scoped Rust/native-input reports; these are not complete native inventories
or claims of reproducible builds. Candidate/unreleased labels in the tagged source
reflect preparation before publication; restore-stage is included in this release.

Archive SHA-256:

Linux architecture	SHA-256
x86_64	dc3de860ff8e6799d94b8c5bcc10466c9c23e3477c079139283d67531ca1c7aa
aarch64	5c1f9fba634e0869c4f79aa2d0ca35d86d457493df73bd782829d34e58219a98

Install after verifying the downloaded package

Choose x86_64-unknown-linux-musl or aarch64-unknown-linux-musl for your Linux host.
Run in a new download directory with GitHub CLI installed:

TH_VERSION=0.1.10-alpha.1
TH_TARGET=x86_64-unknown-linux-musl
TH_SOURCE=df7bb976c06c55d522278192724a563138fa0a96
TH_ARCHIVE="treeharbor-$TH_VERSION-$TH_TARGET.tar.gz"
TH_BUNDLE="treeharbor-$TH_VERSION-$TH_TARGET.provenance.sigstore.json"
gh release download "v$TH_VERSION" --repo ArtAndrew/TreeHarbor \
  --pattern "$TH_ARCHIVE" --pattern "$TH_ARCHIVE.sha256" --pattern "$TH_BUNDLE"
gh attestation verify "$TH_ARCHIVE" --bundle "$TH_BUNDLE" \
  --repo ArtAndrew/TreeHarbor \
  --signer-workflow ArtAndrew/TreeHarbor/.github/workflows/release-provenance.yml \
  --signer-digest "$TH_SOURCE" --source-digest "$TH_SOURCE" \
  --source-ref "refs/tags/v$TH_VERSION" --deny-self-hosted-runners
sha256sum --check --strict "$TH_ARCHIVE.sha256"
tar -xzf "$TH_ARCHIVE"
cd "treeharbor-$TH_VERSION-$TH_TARGET"
TH_INSTALL_PREFIX="$HOME/.local/treeharbor-preview-0.1.10"
./install.sh --prefix "$TH_INSTALL_PREFIX"
"$TH_INSTALL_PREFIX/bin/treeharbor" --version

Use the operator setup guide
with the new executable path. Its historical examples may name an earlier preview.
Installation does not provision PostgreSQL, a GitHub App or a runtime.

• Restore staging prerequisites and limits
• Backup and restore boundaries
• License: standard ELv2

TreeHarbor 0.1.9-alpha.1 — local initialization

TreeHarbor 0.1.9-alpha.1 — initialize local service files

This alpha adds treeharbor init to prepare a source-enabled local service without
hand-writing configuration JSON or separately configuring object storage. Supply
a protected PostgreSQL connection file and a new absolute instance directory under
an existing owner-private parent:

treeharbor init --directory /your/private/parent/service \
  --database-url-file /your/private/parent/database.url

The connection file contains a UTF-8 local PostgreSQL connection string, not JSON.
It must be a private regular file under a private parent. Keep passwords in the
protected file, not command arguments or shell history. Optional --schema and
--backend select the namespace and storage label; neither creates database state.

The command creates mode-0700 directories for the instance, objects and private
operator state, plus mode-0600 service.json. It synchronizes entries and publishes
configuration last. Any existing destination, including a partial previous attempt,
is refused; inspect and retain uncertain output rather than overwriting it. Short
resolved socket paths (at most 100 bytes) are required. Existing local connection and
configuration limits apply. Success returns paths and explicit false flags for
database initialization, repository creation, credential issuance and service start.

Then explicitly prepare the intended database/schema, inspect with doctor, apply
migrations with admin migrate, register scoped identities/repositories and start
serve. Init does not connect to PostgreSQL, install infrastructure, select repository
authority, grant credentials, execute hooks or start services/runtimes. Both authority
modes use this same service configuration. It is not an upgrade/restore command or
a claim that the full Connected/Standalone platform is production-ready.

No metadata migration or new dependencies from 0.1.8. Update service/client binaries
together into a new prefix after safely stopping work; preserve configuration,
credentials, source data and request journals. Continue to use the existing backup
and operator setup instructions. Standard ELv2 has no workspace threshold.

Verified build

Source: 2c402a934a6bb828e6a63484004c35685a235304.
Main CI and
signed producer,
both attempt 1, passed. Both Linux architectures installed the actual packages,
created configuration through init, refused existing output and exercised explicit
database migration, API/MCP tasks, managed execution, native checks/publication,
cleanup/export and the scoped operator backup/replacement-node restore drill.
The existing PostgreSQL test also verified absent/unmigrated/current schema states
and actual service startup after explicit migration.

Independent official GitHub verification succeeded online and with each downloaded
signature bundle. All eight signed subjects per architecture, their hashes and
producer invocation matched. Attached packages are unchanged producer output.
The metadata ZIP contains Rust dependency and observed native-input reports with
explicit coverage limits; it is not a complete native component inventory or a
claim of reproducible builds. Candidate/unreleased labels in the tagged source
reflect preparation before this publication; init is included here.
This is not a real LLM-host trial, unassisted deployment or full mode certification.

Archive SHA-256:

Linux architecture	SHA-256
x86_64	70b187f8f6af9444805fade294ae1b2fc2f926cab3b750045b46c293132050b3
aarch64	56bbbf13a15feeef9660d6fc87af426a44851ebea7aaf43cd49c1a3523186023

Install after verifying the downloaded package

Choose x86_64-unknown-linux-musl or aarch64-unknown-linux-musl for your Linux host.
Run in a new download directory with GitHub CLI installed:

TH_VERSION=0.1.9-alpha.1
TH_TARGET=x86_64-unknown-linux-musl
TH_SOURCE=2c402a934a6bb828e6a63484004c35685a235304
TH_ARCHIVE="treeharbor-$TH_VERSION-$TH_TARGET.tar.gz"
TH_BUNDLE="treeharbor-$TH_VERSION-$TH_TARGET.provenance.sigstore.json"
gh release download "v$TH_VERSION" --repo ArtAndrew/TreeHarbor \
  --pattern "$TH_ARCHIVE" --pattern "$TH_ARCHIVE.sha256" --pattern "$TH_BUNDLE"
gh attestation verify "$TH_ARCHIVE" --bundle "$TH_BUNDLE" \
  --repo ArtAndrew/TreeHarbor \
  --signer-workflow ArtAndrew/TreeHarbor/.github/workflows/release-provenance.yml \
  --signer-digest "$TH_SOURCE" --source-digest "$TH_SOURCE" \
  --source-ref "refs/tags/v$TH_VERSION" --deny-self-hosted-runners
sha256sum --check --strict "$TH_ARCHIVE.sha256"
tar -xzf "$TH_ARCHIVE"
cd "treeharbor-$TH_VERSION-$TH_TARGET"
TH_INSTALL_PREFIX="$HOME/.local/treeharbor-preview-0.1.9"
./install.sh --prefix "$TH_INSTALL_PREFIX"
"$TH_INSTALL_PREFIX/bin/treeharbor" --version

Use the operator setup guide
with the new executable path. Its historical examples may name an earlier preview.
Installation does not provision PostgreSQL, a GitHub App or a runtime.

• Local initialization and explicit next steps
• Backup and restore boundaries
• License: standard ELv2

TreeHarbor 0.1.8-alpha.1 — cold backups

TreeHarbor 0.1.8-alpha.1 — cold backups for controlled deployments

This alpha adds operator backup create and backup verify for a stopped local
TreeHarbor deployment. Save the PostgreSQL schema, complete object backend,
configuration and explicitly selected private state together; retain the returned
manifest digest separately and verify the inventory after transfer.

All writers must be stopped before creation. The commands exclude cooperating
service startup and conflicting table writes, but do not discover/fence other
hosts or stop runtimes. Unsubmitted workspace edits need separate capture/export.
The copy contains plaintext source and credentials; protect it as private backup
data. Existing destinations are never overwritten, incomplete copies are retained
and copied live objects must match catalog identities.

Upgrade CLI/service together from 0.1.7; no schema migration is added. Full safe
restore activation, resumption of old nodes, Connected GitHub reconciliation and
production readiness are not included. The repository's backup/restore guide
defines the operator boundary. The complete two-mode goal remains unfinished.

Verified build

Source: cc9a9043911ff6377244c474f53cf54652cdfb99.
Main CI and
signed producer,
both attempt 1, passed. Both Linux architectures installed the actual packages
and exercised operator backup creation and verification, restoration of all
retained tables/sequences, configuration and selected private state, Git export
with original storage unavailable, corrupt/missing object refusal, old-node denial
and a fresh node's actual gVisor check, native publication, export and cleanup.
Original writers remained stopped throughout the controlled restore trial.

Independent official GitHub verification succeeded online and with each downloaded
signature bundle. All eight signed subjects per architecture, their hashes and
producer invocation matched. Attached packages are unchanged producer output.
The metadata ZIP contains Rust dependency and observed native-input reports with
explicit coverage limits; it is not a complete native component inventory or a
claim of reproducible builds. Candidate/unreleased labels in the tagged source
reflect preparation before this publication; the backup commands are included here.
These trials do not establish automatic restore activation or live GitHub recovery.

Archive SHA-256:

Linux architecture	SHA-256
x86_64	cd5f1f387e5a3072942fb498534e2ab084d20d0e0521f4ac815b50f2d6142d8c
aarch64	77b693edbf9b0460b09bb51304cfd30989c70ed6943f42724aa56ce065b9cdf5

Install after verifying the downloaded package

Choose x86_64-unknown-linux-musl or aarch64-unknown-linux-musl for your Linux host.
Run in a new download directory with GitHub CLI installed:

TH_VERSION=0.1.8-alpha.1
TH_TARGET=x86_64-unknown-linux-musl
TH_SOURCE=cc9a9043911ff6377244c474f53cf54652cdfb99
TH_ARCHIVE="treeharbor-$TH_VERSION-$TH_TARGET.tar.gz"
TH_BUNDLE="treeharbor-$TH_VERSION-$TH_TARGET.provenance.sigstore.json"
gh release download "v$TH_VERSION" --repo ArtAndrew/TreeHarbor \
  --pattern "$TH_ARCHIVE" --pattern "$TH_ARCHIVE.sha256" --pattern "$TH_BUNDLE"
gh attestation verify "$TH_ARCHIVE" --bundle "$TH_BUNDLE" \
  --repo ArtAndrew/TreeHarbor \
  --signer-workflow ArtAndrew/TreeHarbor/.github/workflows/release-provenance.yml \
  --signer-digest "$TH_SOURCE" --source-digest "$TH_SOURCE" \
  --source-ref "refs/tags/v$TH_VERSION" --deny-self-hosted-runners
sha256sum --check --strict "$TH_ARCHIVE.sha256"
tar -xzf "$TH_ARCHIVE"
cd "treeharbor-$TH_VERSION-$TH_TARGET"
TH_INSTALL_PREFIX="$HOME/.local/treeharbor-preview-0.1.8"
./install.sh --prefix "$TH_INSTALL_PREFIX"
"$TH_INSTALL_PREFIX/bin/treeharbor" --version

Use the operator setup guide
with the new executable path. Its historical examples may name an earlier preview.
Installation does not provision PostgreSQL, a GitHub App or a runtime.

• Cold backup instructions and restore boundaries
• Backup inventory format
• License: standard ELv2

TreeHarbor 0.1.7-alpha.1 — saved external task requests

TreeHarbor 0.1.7-alpha.1 — saved external task requests

This alpha makes external task creation resumable without manually generating
and saving workspace/run UUIDs and a request key. It adds a CLI helper over the
existing API; it does not launch an agent, supervise external execution or complete
the full Connected/Standalone releases.

Create and retry one external task

After source/profile registration and local service/credential setup:

treeharbor client --socket "$TH_SOCKET" --credential-file "$TH_CREDENTIAL" \
  api-run-new --state "$TH_PRIVATE/task.json" --authority connected --epoch 1 \
  --base "$BASE" --profile-digest "$SOURCE_PROFILE" \
  --agent my-controller/1 --task fix-parser

Use an absolute state path in an owner-private directory. Choose standalone
instead when that is the repository's registered authority. Use the exact registered
revision and profile. Read result.workspace and result.run for subsequent source,
proposal, status and close operations. Execution remains your controller's responsibility.

The helper generates both IDs and the key, publishes an owner-private intent without
overwriting an existing file, and synchronizes the file and its directory before
sending. The journal binds repository scope, authority/epoch, source/profile and
agent/task labels; it contains no credential. Concurrent calls using the same state
path use the same winning intent. Server-side owner and permission rules still apply.

After a lost reply, repeat the same command with the same state path and inputs.
Do not delete the journal to retry: that could create a different task. Unknown,
corrupt or mismatching state is rejected before sending. Errors leave the file
intact. There is no automatic mutation retry.

A successful replay returns the original creation receipt even after logical close.
Its historical recorded state does not reopen the task or prove execution. Use
api-run-status for current state. A genuinely new task needs a new state path.
Controllers that already persist identities can continue using api-run-create;
MCP's existing API tools are unchanged and accept no local state-file argument.

Upgrade and limits

No new database migration, dependencies or permissions from 0.1.6. Safely stop active
tasks/workers and the service, keep backups and private retry journals, then update
binaries together using a fresh prefix. Keep runtime-init matched to the service.
Mixed-version operation and unattended upgrades are not certified.

Infrastructure setup remains operator-assisted. External contexts assert
execution_observed: false; trusted checks, review and integration remain separate.
Full server recovery, authority migration, complete mode readiness and production
support remain unfinished. Standard ELv2 has no workspace threshold or license meter.

Verified build

Source: 88cd5c5a06f02d5ffcd3dbc798d7300e083c4056.
Main CI and
signed producer,
both attempt 1, passed. Both Linux architectures installed the packaged binaries
and exercised the saved external task creation/replay, explicit API and MCP tasks, managed/native
runtime workflows, cleanup/export and the existing scoped cold-restore drill.

Independent official GitHub verification succeeded online and with each downloaded
signature bundle. All eight signed subjects per architecture, their hashes and
producer invocation matched. Attached packages are unchanged producer output.
The metadata ZIP includes Rust dependency and observed native-input reports with
explicit coverage limits; it is not a complete native component inventory or a
claim of reproducible builds. Candidate/unreleased labels in the tagged source
reflect preparation before this publication; the new CLI helper is included here.

Archive SHA-256:

Linux architecture	SHA-256
x86_64	1920756d14300836f5edbf8873906ad698c95fc7b2b712fbbd87646a58c226de
aarch64	3d1b4db58df2f84bd4214f1246584c429ab69e0d50308d486859f80c9c83e459

Install after verifying the downloaded package

Choose x86_64-unknown-linux-musl or aarch64-unknown-linux-musl for your Linux host.
Run in a new download directory with GitHub CLI installed:

TH_VERSION=0.1.7-alpha.1
TH_TARGET=x86_64-unknown-linux-musl
TH_SOURCE=88cd5c5a06f02d5ffcd3dbc798d7300e083c4056
TH_ARCHIVE="treeharbor-$TH_VERSION-$TH_TARGET.tar.gz"
TH_BUNDLE="treeharbor-$TH_VERSION-$TH_TARGET.provenance.sigstore.json"
gh release download "v$TH_VERSION" --repo ArtAndrew/TreeHarbor \
  --pattern "$TH_ARCHIVE" --pattern "$TH_ARCHIVE.sha256" --pattern "$TH_BUNDLE"
gh attestation verify "$TH_ARCHIVE" --bundle "$TH_BUNDLE" \
  --repo ArtAndrew/TreeHarbor \
  --signer-workflow ArtAndrew/TreeHarbor/.github/workflows/release-provenance.yml \
  --signer-digest "$TH_SOURCE" --source-digest "$TH_SOURCE" \
  --source-ref "refs/tags/v$TH_VERSION" --deny-self-hosted-runners
sha256sum --check --strict "$TH_ARCHIVE.sha256"
tar -xzf "$TH_ARCHIVE"
cd "treeharbor-$TH_VERSION-$TH_TARGET"
TH_INSTALL_PREFIX="$HOME/.local/treeharbor-preview-0.1.7"
./install.sh --prefix "$TH_INSTALL_PREFIX"
"$TH_INSTALL_PREFIX/bin/treeharbor" --version

Use the operator setup guide
with the new executable path. Its historical examples may name an earlier preview.
Installation does not provision PostgreSQL, a GitHub App or a runtime.

• MCP tools and authority boundaries
• External task lifecycle
• License: standard ELv2

TreeHarbor 0.1.6-alpha.1 — external tasks through MCP

TreeHarbor 0.1.6-alpha.1 — external tasks through MCP

This alpha adds three named MCP tools over TreeHarbor's existing external-task
API. A controller can register its own task, read pinned source, submit immutable
changes and close the context through one stdio connection. Execution and
isolation remain the controller's responsibility. The full Connected and
Standalone releases remain incomplete.

Changes

• api_run_create pins an exact registered revision and records an external task.
  It does not launch a process or materialize a working directory.
• api_run_status reports the owning task's state with execution_observed: false.
  A recorded task is not evidence of code execution or passing tests.
• api_run_close prevents new API work and releases the logical source pin while
  retaining accepted changes. It does not stop an external process or remove its files.
• Existing source-read, upload, proposal and review tools complete the workflow.
  Keep original request keys and IDs for uncertain retries. Server-side ownership,
  generation, authority epoch and permission checks remain unchanged.

The adapter accepts no database configuration, arbitrary command or credential
from model tool arguments. An operator configures its private service socket and
repository-scoped credential. There is no managed launch, validation submission,
review approval or merge tool. Connected GitHub publication remains a separate
owner/bridge workflow; the native queue tools remain experimental.

Connect an MCP host

After the operator has started the service and issued a repository-scoped agent
credential, configure the host to launch the installed binary with these arguments:

{
  "command": "/absolute/path/to/treeharbor",
  "args": [
    "mcp", "--socket", "/private/path/service.sock",
    "--credential-file", "/private/path/agent.json"
  ]
}

Use your actual private paths. Host configuration wrappers vary; this is the child
process configuration, not a universal host settings file. Do not put the token or
credential contents into model prompts. MCP uses stdin/stdout, not a public HTTP
endpoint. Register the exact base and source profile before starting a task.

Most successful tool results contain the original API result at
structuredContent.response.result. File reads additionally place content_hex
and untrusted_source_content directly under structuredContent.response, beside
that metadata result. Treat source bytes as untrusted data. These tools do not
run a coding model or supervise its external processes.

Upgrade and limits

No database migration from 0.1.5 or new permission is introduced. Safely stop active
tasks and workers, stop the service, retain backups and private retry journals,
then update binaries together using a fresh prefix. Mixed-version operation is
not certified. Keep the runtime-init binary matched to the service.

The packaged MCP scenario uses the 2025-11-25 initialization lifecycle. Separate
Rust transport tests cover both supported protocol lifecycles. This does not
establish compatibility with every MCP host or an actual LLM trial. Infrastructure
setup remains operator-assisted, transport remains local/private, and full server
recovery, fenced authority migration and production readiness remain open.
Standard ELv2 has no workspace threshold or license meter.

Verified build

Source: fef8b1166141f1e9d485cfdfe85ead25c6a26e8b.
Main CI and
signed producer,
both attempt 1, passed. Both Linux architectures installed the packaged binaries
and exercised the full external MCP task, the two CLI API tasks, managed/native
runtime workflows, cleanup/export and the existing scoped cold-restore drill.

Independent official GitHub verification succeeded online and with each downloaded
signature bundle. All eight signed subjects per architecture, their hashes and
producer invocation matched. Attached packages are unchanged producer output.
The metadata ZIP includes Rust dependency and observed native-input reports with
explicit coverage limits; it is not a complete native component inventory or a
claim of reproducible builds. Candidate/unreleased labels in the tagged source
reflect preparation before this publication; these MCP tools are included here.

Archive SHA-256:

Linux architecture	SHA-256
x86_64	9a0e8155903a3a6028aea0f45622e20135e8bb6983f16709ca72e978548887b3
aarch64	7b163dc6d331736e030b5ed14ebbceb8f7c7f57fa63ec04f6498b6dcf57767a2

Install after verifying the downloaded package

Choose x86_64-unknown-linux-musl or aarch64-unknown-linux-musl for your Linux host.
Run in a new download directory with GitHub CLI installed:

TH_VERSION=0.1.6-alpha.1
TH_TARGET=x86_64-unknown-linux-musl
TH_SOURCE=fef8b1166141f1e9d485cfdfe85ead25c6a26e8b
TH_ARCHIVE="treeharbor-$TH_VERSION-$TH_TARGET.tar.gz"
TH_BUNDLE="treeharbor-$TH_VERSION-$TH_TARGET.provenance.sigstore.json"
gh release download "v$TH_VERSION" --repo ArtAndrew/TreeHarbor \
  --pattern "$TH_ARCHIVE" --pattern "$TH_ARCHIVE.sha256" --pattern "$TH_BUNDLE"
gh attestation verify "$TH_ARCHIVE" --bundle "$TH_BUNDLE" \
  --repo ArtAndrew/TreeHarbor \
  --signer-workflow ArtAndrew/TreeHarbor/.github/workflows/release-provenance.yml \
  --signer-digest "$TH_SOURCE" --source-digest "$TH_SOURCE" \
  --source-ref "refs/tags/v$TH_VERSION" --deny-self-hosted-runners
sha256sum --check --strict "$TH_ARCHIVE.sha256"
tar -xzf "$TH_ARCHIVE"
cd "treeharbor-$TH_VERSION-$TH_TARGET"
./install.sh --prefix "$HOME/.local/treeharbor-preview-0.1.6"
"$HOME/.local/treeharbor-preview-0.1.6/bin/treeharbor" --version

Use the operator setup guide
with the new executable path. Its historical examples may name an earlier preview.
Installation does not provision PostgreSQL, a GitHub App or a runtime.

• MCP tools and authority boundaries
• External task lifecycle
• License: standard ELv2

v0.1.5-alpha.1 — preparation and retry improvements

TreeHarbor 0.1.5-alpha.1 — preparation and retry improvements

This alpha updates the existing Connected PR Preview and adds an experimental
Standalone queue helper. It does not make either full mode production-ready.

Changes

• Workspace preparation synchronizes new files in bounded parallel batches. Every
  file and the required directories still finish synchronization before publication;
  failures refuse preparation. The limit is 32 additional open files and four
  synchronization workers per active preparation. No general speedup is claimed.
• client native-advance discovers one pending Standalone entry and persists its
  candidate identity before requesting preparation. Repeat the same command and
  private state file after a lost response. It returns current status and never
  runs checks, approves review or lands code. Empty/busy queues do not create an
  additional candidate. Full automatic queue scheduling remains unfinished.
• The source-import benchmark uses the actual CLI, service and PostgreSQL. The
  published macOS sample is a single local observation, not a cold/warm or
  concurrent comparison with tuned Git, nor a measurement of these release binaries.

Upgrade and boundaries

No schema migration from 0.1.4 is added. Stop active tasks safely, stop workers and
service, retain backups and private retry journals, then update binaries together.
Use a fresh installation prefix and keep runtime-init matched to the service.
Mixed-version operation and unattended upgrades are not certified. Earlier
versions must follow their intervening schema upgrade instructions.

The supported preview remains operator-assisted Linux workspaces to GitHub PRs;
GitHub handles review, checks and merge. Standalone helpers are experimental.
There is no fresh live GitHub/LLM trial in this update. Workspace directories do
not supply process isolation. Full server disaster recovery, authority migration
and remote fleets remain unfinished. Standard ELv2 has no workspace quota.

Verified build

Source: 2d0f99b1a57ef759ab4b31f1a94620ec3da10b1a.
Main CI and
signed producer,
both attempt 1, passed. Both Linux architectures installed the packaged binaries
and exercised the managed/native workflows, including journal replay after native
publication, cleanup/export and the scoped cold-restore drill.

Independent official GitHub verification succeeded online and with each downloaded
signature bundle. All eight signed subjects per architecture, their hashes and
producer invocation matched. The attached packages are unchanged producer output.
The metadata ZIP includes Rust dependency and observed native-input reports with
explicit coverage limits; it is not a complete native component inventory or a
claim of reproducible builds. The source snapshot's candidate/unreleased labels
reflect preparation before this publication; MCP external-context tools merged
later and are not included in this tag.

Archive SHA-256:

Linux architecture	SHA-256
x86_64	6230edb8a9bef33278239b61b31dfc27e9ac4099201c3da6b15bfca54241bb0a
aarch64	ac5e6d01931f2279d64862539f144ee2caf446b7ea296dcad981401b8fd02843

Install after verifying the downloaded package

Choose x86_64-unknown-linux-musl or aarch64-unknown-linux-musl for your Linux host.
Run in a new download directory with GitHub CLI installed:

TH_VERSION=0.1.5-alpha.1
TH_TARGET=x86_64-unknown-linux-musl
TH_SOURCE=2d0f99b1a57ef759ab4b31f1a94620ec3da10b1a
TH_ARCHIVE="treeharbor-$TH_VERSION-$TH_TARGET.tar.gz"
TH_BUNDLE="treeharbor-$TH_VERSION-$TH_TARGET.provenance.sigstore.json"
gh release download "v$TH_VERSION" --repo ArtAndrew/TreeHarbor \
  --pattern "$TH_ARCHIVE" --pattern "$TH_ARCHIVE.sha256" --pattern "$TH_BUNDLE"
gh attestation verify "$TH_ARCHIVE" --bundle "$TH_BUNDLE" \
  --repo ArtAndrew/TreeHarbor \
  --signer-workflow ArtAndrew/TreeHarbor/.github/workflows/release-provenance.yml \
  --signer-digest "$TH_SOURCE" --source-digest "$TH_SOURCE" \
  --source-ref "refs/tags/v$TH_VERSION" --deny-self-hosted-runners
sha256sum --check --strict "$TH_ARCHIVE.sha256"
tar -xzf "$TH_ARCHIVE"
cd "treeharbor-$TH_VERSION-$TH_TARGET"
./install.sh --prefix "$HOME/.local/treeharbor-preview-0.1.5"
"$HOME/.local/treeharbor-preview-0.1.5/bin/treeharbor" --version

Use the operator setup guide
with the new executable path. Its historical examples may name an earlier preview.
Installation does not provision PostgreSQL, a GitHub App or a runtime.

• Native queue helper
• Source-import benchmark and sample limitations
• License: standard ELv2

TreeHarbor 0.1.4-alpha.1 — external agent API contexts

TreeHarbor 0.1.4-alpha.1 — external agent API contexts

Connect an agent controller that already provides execution: pin an exact source revision, read files through the API, submit immutable changes and retain the results after closing the task context. This path uses the Rust service, PostgreSQL and local object storage without requiring TreeHarbor-managed execution. The existing managed workspace/runtime workflow remains available.

New commands: client api-run-create, api-run-status and api-run-close. Creation atomically records the task and its exact source/profile; closing fences further reads and submissions while preserving accepted versions and replay receipts. External tasks report origin: external_api and execution_observed: false. Their registration does not attest process isolation, execution, stopping or successful tests. The client supplies its own execution environment and protects its credentials.

See the API workflow and protocol, immutable proposals and operator setup.

Upgrade

This version introduces schema migration 032. Stop the service and workers, take a consistent backup, install the 0.1.4 binaries, run admin migrate with the new binary, then restart the updated service and workers together. Installation never runs a migration automatically. Mixed-version/rolling upgrades and downgrade after API records are created are unsupported. Existing workspace/run identities, old request digests and saved receipts are preserved.

Verified packages

Tag v0.1.4-alpha.1 identifies source 6f095bc123abba186f8cfe06b73fe3cf35893663. Main CI and signed producer, both attempt 1, passed. Both Linux packages were installed and exercised before those same bytes were signed. Independent official verification checked online and bundled signatures, all eight subjects per architecture, metadata/data hashes and the exact producer invocation.

Archive	SHA-256
Linux ARM64	99c6337c7e25327d17d72fa8fa564be6b38e7ae6e02d0d931f63739148c80779
Linux x86-64	ca2c25119674329d9106d60adf67bca1d9df1cc496c8a9f98a99036a6bc7d7e1

Installed acceptance includes two separately scoped API tasks reading the same exact base, proposing overlapping edits, closing without runtime observations, replaying receipts and inspecting retained diffs. Existing managed execution/capture/cleanup and native check/publication/replacement-node recovery scenarios also pass. CLI/PostgreSQL tests cover process loss before and after acceptance, close/accept races, stale/revoked authorization, retained pins and populated-schema upgrades. A separate Connected projection test exports ordinary Git after context close and preserves the exact parent.

Install

Choose aarch64 for Linux ARM64 or substitute x86_64. Use GitHub CLI with attestation verification, a shell and tar. The API path needs the documented PostgreSQL/local-storage setup and scoped credentials. Managed execution additionally needs its supported Docker/gVisor deployment profile.

tag=v0.1.4-alpha.1
stem=treeharbor-0.1.4-alpha.1-aarch64-unknown-linux-musl
source_commit=6f095bc123abba186f8cfe06b73fe3cf35893663
gh release download "$tag" --repo ArtAndrew/TreeHarbor \
  --pattern "$stem.tar.gz" --pattern "$stem.tar.gz.sha256" \
  --pattern "$stem.provenance.sigstore.json"
gh attestation verify "$stem.tar.gz" --bundle "$stem.provenance.sigstore.json" \
  --repo ArtAndrew/TreeHarbor \
  --signer-workflow ArtAndrew/TreeHarbor/.github/workflows/release-provenance.yml \
  --source-ref "refs/tags/$tag" --source-digest "$source_commit" \
  --signer-digest "$source_commit" --deny-self-hosted-runners
sha256sum --check --strict "$stem.tar.gz.sha256"
tar -xzf "$stem.tar.gz"
sh "$stem/install.sh" --prefix "$HOME/.local/treeharbor-preview-0.1.4"
"$HOME/.local/treeharbor-preview-0.1.4/bin/treeharbor" --version

Verify signed bytes before executing the installer and use a fresh prefix. Each architecture's metadata ZIP contains the original dependency observations and installed-runtime receipt; it can be verified with the same signature bundle and source/workflow options. Signatures do not establish a reproducible build, complete native dependency attribution or production readiness.

Scope

This remains an operator-assisted alpha for controlled repositories. The API uses a private Unix socket. Acceptance provides no implicit review, validation, publication or merge authority. Connected uses a separately authorized bridge and GitHub PR/check/review processes. This release has no fresh live GitHub or LLM trial; earlier live-trial evidence retains its original source identity. Full Connected queue/recovery certification, complete Standalone readiness, authority cutover, broader deployments and measured performance remain unfinished.

Standard Elastic License 2.0, without workspace-count limits. Third-party notices remain intact. Report first-use problems without private source or credentials.