Skip to content

Release 0.4.0

Choose a tag to compare

View all tags
@houman44 houman44 released this 09 Aug 16:34
· 135 commits to main since this release
v0.4.0
03ef74b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cejel 0.4.0

This coordinated release carries the prospective B4 commit-year v19 implementation for explicit evaluation harnesses while keeping the public default on v17. It also adds the separate resource-bounded discovery collector v2 without modifying the SHA-pinned v1.9 collector or historical contracts.

The distribution path reads the exact MCP Registry version back, requires its workflow-derived immutable OCI digest, verifies the GitHub SLSA attestation against the exact release tag and source commit, and reports that tagged-source commit.

The preregistered v19 paired rescore completed 24/24 rows with 0 raw freshness, B4 score/status, headline/coverage, placement, or non-B4 changes. This authorizes the prospective implementation and published delta only; it does not promote v19. The reserved Free LLM CLI remains unavailable.

Release provenance note

The first v0.4.0 distribution run published the OCI image, its signed provenance, and the exact-digest MCP Registry record, then its final automated verifier stopped before GitHub attestation verification because GH_TOKEN was not exported. The Registry readback itself succeeded. An authenticated independent execution of the same verifier confirmed:

  • MCP/OCI digest: sha256:63bd4342c2006c823b0283313036109040651741078e1a0e38677d605a2849ee
  • signed tagged-source commit: 03ef74b
  • source ref: refs/tags/v0.4.0

PR #132 adds the missing job-scoped token for future tagged workflows and records the incident. The immutable v0.4.0 tag and published artifacts were not moved, rebuilt, overwritten, or republished.

See CHANGELOG.md for the full evidence boundary.

Full Changelog: v0.3.2...v0.4.0

CONSTRAINTS-VERSION: 2026-08-01.3

Assets 14
Loading