Skip to content

Cejel v0.2.2

Choose a tag to compare

View all tags
@houman44 houman44 released this 29 Jul 15:15
· 264 commits to main since this release
v0.2.2
1054811
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cejel 0.2.2

This coordinated patch release adds Windows and OpenClaw distribution, ships the hardening already merged on main, and fixes confirmed-live certificate presentation issues without changing the rubric, detectors, scores, criterion statuses, or verdict behavior.

Added

  • cejel-Windows-x86_64.exe, built as a Node SEA and verified on Windows with --version, --help, a real scan, source/binary parity, and a second scan while outbound networking is denied.
  • A per-binary SPDX SBOM alongside every own-platform verification receipt, SHA-256 checksum, and GitHub-signed release-set provenance bundle.
  • OpenClaw MCP configuration through the package's shipped cejel-mcp stdio bin, with the OCI image as an alternative.

Fixed

  • Certificates now show both the producing Cejel CLI version and the exact rubric version.
  • Certificates explain when a calibrated dimension band differs from the weighted numeric-score band.
  • Tarball scans now warn when Git history is unavailable and the B2 recent-PR proxy may undercount the criterion.
  • npm documentation uses @latest, explains the stale npx cache footgun, and shows how to check the executing version.

Included from main

  • #39 patch-distribution documentation
  • #40 and #42 D8 Git transport hardening
  • #41 free-core v50 multiple-comparisons disclosure
  • #43 cross-repository preflight script

Windows signing

The Windows executable is intentionally not Authenticode-signed in 0.2.2. The build removes Node's inherited signature and asserts that the final executable is NotSigned. Microsoft SmartScreen may therefore intervene. This release uses the documented verification-first path: own-platform receipts, SPDX SBOMs, SHA-256 checksums, and GitHub-signed build provenance. The NotSigned assertion must be replaced when an approved Authenticode or Azure Trusted Signing path is introduced.

Product boundary

Free Cejel scans code selected by the caller. OpenClaw distribution is an adoption surface; it does not watch, intercept, or govern an agent's runtime actions. Runtime-action governance remains a separate future Agent Pack boundary.

Full details: CHANGELOG.md

Assets 14
Loading