v0.1.0-beta.3

Verified Public Beta

Apache-2.0 licensed public CLI distribution from source b076abce83fa9d9bbae3fa64218e601478b6647a (reviewed PR #16). This licenses the CLI repository, not separate Convai services or trademarks.

• All nine merged-source CI checks and the complete native release workflow passed.
• All eight release assets were downloaded without GitHub authentication. All five archive checksums/inventories pass, and each contains exact-source LICENSE, NOTICE and THIRD_PARTY_NOTICES.txt alongside README and the executable.
• All eight downloaded assets pass provenance verification constrained to this repository, release workflow, source SHA/tag and GitHub-hosted runners. The public provenance API is also anonymously accessible.
• The source SPDX-2.3 SBOM asset is convai-cli-sbom.spdx.json (161 packages); its workflow-local subject name is convai-cli.spdx.json. It is not a per-binary SBOM.
• Downloaded macOS ARM64 executable passes installed version/help/profile/missing-credential smoke, 42 exact direct-REST command mappings and ten negative cases against a synthetic HTTPS owner. No live account, SaaS/customer resource or database was used.

Native CI covers its macOS/Linux/Windows runner architecture; it does not prove downloaded execution on every OS/CPU. macOS notarization and Windows code signing are not configured. Live SaaS/customer authorization and on-prem SSO activation remain separate gates. No npm/Homebrew/WinGet installer or hosted rollout is introduced.

Use the version-pinned assets below; beta prereleases do not establish a stable latest installer. Preserve all legal files when redistributing. Previous beta tags/assets are unchanged; use beta.3 for the licensed public handoff.

---

Changelog

• b076abc Merge pull request #16 from Conv-AI/codex/cli-apache-public-release
• 4f726b9 build: license CLI under Apache-2.0 and package redistribution notices
• e8b401d build: preserve the default make build target

v0.1.0-beta.2

Verified Beta Release

Source: 71f75b12bfd6930ec945ed137546c5e092fc4907 (Go 1.27.3).

• Native merged-source CI: all nine checks passed, including macOS/Linux/Windows race tests and native archive installation.
• Release workflow: validation, reachable-vulnerability scan, current owner-contract check, archive preflight, publication, source SPDX SBOM attachment and build provenance all passed.
• All five downloaded archive checksums and member inventories passed. The installed native executable reports exactly 0.1.0-beta.2 and passes help, isolated profile import/readback and missing-credential checks.
• All eight downloaded assets passed provenance verification constrained to this repository, release workflow, exact source SHA and tag, with GitHub-hosted runners required. The source SBOM asset is convai-cli-sbom.spdx.json. It is a source SBOM, not a per-binary SBOM or OS code signature.
• Downloaded macOS ARM64 and Linux ARM64 binaries each passed 42 direct-REST/API-key command mappings plus ten negative cases against an isolated synthetic HTTPS owner. Linux AMD64 passed the same suite under emulation. These are not live SaaS or customer-environment tests. Downloaded Windows and macOS Intel runtime acceptance is not claimed; native source/archive CI and all archive/provenance checks are separate evidence.

This successor preserves the incomplete v0.1.0-beta.1 tag and assets. Use beta.2 rather than the incomplete beta.1 release. No hosted service was deployed.

As of October 20, the repository remains private, so these assets require repository access. Public download availability is pending the owner's visibility/license decision. There is no Homebrew, WinGet, npm or self-updating installer. The executable requires no Go/Node/Python runtime. macOS notarization and Windows code signing are not configured; follow the customer's installation/signing policy without bypassing OS protections.

Actual customer HTTPS/API compatibility, CA/network access, authorization and disposable-resource acceptance remain separate handoff gates. On-prem OAuth/SSO is not required for existing API-key use and remains parked.

Changelog

• 357d045 Merge pull request #12 from Conv-AI/codex/cli-release-sbom-permissions
• ff483ea Merge pull request #14 from Conv-AI/codex/cli-current-owner-contract
• 71f75b1 Merge pull request #15 from Conv-AI/codex/cli-config-read-lock
• fe99204 Merge remote-tracking branch 'origin/codex/cli-current-owner-contract' into codex/cli-release-sbom-permissions
• 55a63a0 fix: allow SBOM release artifact download with least privilege
• 602140e fix: refresh owner contracts and patched release toolchain
• f433721 fix: serialize config reads with concurrent profile updates

v0.1.0-beta.1

Incomplete Release: Do Not Use For Customer Handoff

The native release workflow uploaded these archives, but SBOM release attachment failed and build-provenance attestation did not run. This beta does not meet the release verification gates. Its tag and source are preserved; a reviewed permission fix and separately approved successor release are required. No hosted deployment is involved.

Failed release workflow

Changelog

• 8cd9343 Initial commit
• 9224723 Merge pull request #1 from Conv-AI/codex/initial-convai-cli
• d5207db feat: add initial REST-native Convai CLI
• 9b1f71c feat: add trusted on-prem CLI profiles and release verification (#10)
• d505cb7 feat: browser OAuth login with managed refresh and revocation (#9)
• 580d5aa feat: native authoring CLI, contract drift gates and auth verification (#6)
• 91bcfac fix: make CLI operations fail closed
• 3fa27d8 fix: refresh version contract and harden beta publication (#11)
• 34f5250 fix: require patched Go 1.25 toolchain