v0.8.2-rc.1

v0.8.2-rc.1 — portable CLI and all-demo replay

This prerelease makes the first experience possible without installing Go or
checking out the repository.

• Precompiled CLI archives for Linux and macOS, each on amd64 and arm64.
  Linux archives also include agentprov-sensor from the committed bindings.
• SHA256SUMS, individual .sha256 files, and build metadata identify each
  archive and its source commit. Checksums provide download integrity, not
  publisher signatures. macOS binaries are not Developer ID signed/notarized.
• agentprov demo opens a local gallery of all existing examples. Six signed
  captures are embedded, verified before import, and checked for graph integrity.
  Named replays automatically select their Run and lens and start playback for timed lenses; placement lenses show their topology.
• LLM Judge and Jev appear as optional setup guides; their complete original
  sources, along with all other demo sources, ship under demo/ in the archive.
  Live evaluator calls remain explicit and require their own environment.
• agentprov --version reports the release, source commit, date and platform.

Try it

Download the archive and matching .sha256 file for your platform. For Linux
x86-64, in the download directory:

sha256sum -c agentprov_v0.8.2-rc.1_linux_amd64.tar.gz.sha256
mkdir agentprov-demo
tar -xzf agentprov_v0.8.2-rc.1_linux_amd64.tar.gz -C agentprov-demo
cd agentprov-demo
./agentprov demo

For macOS, choose darwin_amd64 (Intel) or darwin_arm64 (Apple Silicon) and
use shasum -a 256 -c. Windows users run the matching Linux package in WSL.

./agentprov demo --list
./agentprov demo multiagent-provenance
./agentprov demo k8s-cross-pod-a2a --no-browser

Replay is offline and read-only. It opens a loopback server with a temporary
store and removes that store on normal exit. Ctrl-C stops it. A forced kill
can leave an agentprov-demo-* directory in the system temporary directory.
No captured commands or agents are executed. Signature verification uses the
bundled demo public keys; it does not establish complete capture or prove every
inferred relationship.

Validation and limits

The release workflow runs Go vet and race tests, including all six fixture
imports and tamper rejection. Each of the four native runner platforms then
builds, extracts and exercises its own archive with Go absent from PATH,
checking the gallery, every signed run, graph APIs, guides and shutdown cleanup.
All four packages must pass before publication. This validates portable replay,
not additional live eBPF or long-running node acceptance.

Linux runtime capture keeps its kernel/cgroup/privilege requirements. macOS
supports replay and application evidence; the Linux sensor is not available
on macOS. No capture bindings or deferred correlation/retention logic changed.