v0.3.0

First release under the new canonical home, github.com/Cliftonz/Jarvy.
The repository was transferred from the bearbinary org; the old URL
continues to auto-redirect for git and HTTP traffic, but signing and
package metadata now point at the new owner. Existing users on v0.2.x
do not need to re-clone — git pull will follow the redirect — but the
cosign cert-identity baked into v0.3.0 is anchored to Cliftonz/jarvy
and will reject artifacts signed under the old subject. There is no
backwards-compatible overlap window; this is a clean cut.

Bundled with the move: [mcp_register] now opts in by default when
jarvy setup runs against a project with no explicit block, the
scripts/bootstrap.sh one-command onboarding is now the canonical
entry point for contributors, and two CI bugs that surfaced during the
v0.2.2 publish (missing Linux tarballs for AUR/chocolatey, parent-vs-
templates version gating) are fixed.

Changed — repository home

• Repository relocated to github.com/Cliftonz/Jarvy. All in-tree
  references — Cargo.toml repository, install scripts, package
  manifests (Homebrew, AUR, RPM, Debian, winget, chocolatey, Helm),
  documentation URLs, CODEOWNERS, FUNDING — rewritten in a single
  sweep. Cosign cert-identity regex anchored to the new owner; releases
  signed under bearbinary/jarvy will no longer verify. GitHub Pages
  (jarvy.dev), crates.io ownership (jarvy, jarvy-templates), and
  Actions secrets carried over via the transfer. CODEOWNERS team
  syntax (@bearbinary/maintainers) collapsed to @Cliftonz since the
  new home is a user account, not an org.

Added

• [mcp_register] default-on auto-register. jarvy setup now
  synthesizes a default [mcp_register] block when the project has no
  explicit block and at least one supported AI agent (Claude Code,
  Cursor, Codex, Windsurf, Cline, Continue) is detected on disk. The
  built-in jarvy MCP server is registered against each detected agent
  with project scope (this repo only), not user scope. Fires the
  mcp_register.auto_detected telemetry event with count, agents,
  platform. Suppressed in dry-run, test mode, seamless / CI sandboxes,
  and when JARVY_MCP_REGISTER=0. Explicit blocks always win.

Fixed

• AUR and chocolatey downstream publish unblocked. The v0.2.2
  release workflow built macOS+Windows artifacts but skipped the Linux
  tarballs that AUR PKGBUILD-bin and chocolatey's MSI bundler expect
  (CPMR0041). The release matrix now produces
  x86_64-unknown-linux-gnu and aarch64-unknown-linux-gnu tarballs
  alongside the existing platforms, so the downstream publish step
  finds its inputs.
• jarvy-templates publish gate now reads the templates crate's own
  version. Before this fix, the publish workflow keyed off the parent
  jarvy crate's version, which meant a parent-only release would
  attempt to re-publish a jarvy-templates version that already
  existed on crates.io (and fail). The workflow now reads
  crates/jarvy-templates/Cargo.toml::version and only publishes when
  that specific version is new.

Docs

• scripts/bootstrap.sh is now the canonical one-command onboarding
  path. End-user repos integrating Jarvy should copy it into their
  own scripts/ so contributors run ./scripts/bootstrap.sh to
  install Jarvy (via dist/scripts/install.sh) and execute jarvy setup against the repo-root jarvy.toml. Idempotent. Flags:
  --no-setup, --channel <stable|beta|nightly>, passthrough args to
  jarvy setup. Quickstart and contributor docs updated to surface
  this over hand-rolled curl-pipe + cargo install snippets.

Full Changelog: v0.2.2...v0.3.0

Installation

Quick Install (Unix)

curl -fsSL https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.sh | bash

Quick Install (Windows PowerShell)

irm https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.ps1 | iex

Homebrew

brew install Cliftonz/tap/jarvy

Cargo

cargo install jarvy

Early-Release Channel

Pre-release tags (-rc.N, -beta.N) are routed through the beta channel.
Opt in: JARVY_CHANNEL=beta on the install script, or jarvy update --channel beta.
See docs/release-testing.md.

See installation docs for more options.

Security

Verify Signatures

All release artifacts are signed with Sigstore keyless OIDC. Verify any artifact:

ARTIFACT=jarvy-linux-x86_64.tar.gz
BASE=https://github.com/Cliftonz/jarvy/releases/download/v0.3.0
curl -LO $BASE/$ARTIFACT
curl -LO $BASE/$ARTIFACT.sig
curl -LO $BASE/$ARTIFACT.pem
cosign verify-blob \
  --signature $ARTIFACT.sig \
  --certificate $ARTIFACT.pem \
  --certificate-identity-regexp '^https://github\.com/Cliftonz/Jarvy/\.github/workflows/release\.yml@refs/tags/v[0-9.]+(-[A-Za-z0-9.]+)?$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  $ARTIFACT

Tag Signature

This release was cut from a signed git tag. Verify with:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers tag --verify v0.3.0

SBOM

Software Bill of Materials in SPDX 2.3 (sbom.spdx.json) and CycloneDX 1.4 (sbom.cdx.json).

Checksums

SHA256 checksums for all artifacts are in SHA256SUMS.txt.