v0.4.1

Single-binary ch (CLI + ch mcp stdio server). Verify any asset with:

gh attestation verify <asset> --repo Cork-Technology/cork-cli --signer-workflow Cork-Technology/cork-cli/.github/workflows/build-binaries.yml

Reproduce: same commit, Bun pinned by mise.toml, bun scripts/compile-binaries.mjs --version v0.4.1 --commit 723573f57e8c9ef3773b5235f15951684f49252f — checksums must match checksums.txt. One caveat: match your host's libc to the asset you verify (glibc assets on a glibc host, musl on musl) — for same-OS targets Bun embeds the HOST's libc flavor, so a musl host rebuilding ch-linux-x64 gets a correct-but-different binary, a false mismatch (verified empirically: musl assets reproduce byte-identically from an independent musl machine).

SDK: the cork-*.tgz assets are the npm-installable @cork/schemas + @cork/core + @cork/mcp packages, attested and checksummed like every other asset. Add the schemas AND core tarball URLs to your dependencies (core's dependency on schemas resolves to the sibling tarball; your lockfile pins the sha512). Install guide: docs/sdk.md.

Changes: the 0.4.1 section of CHANGELOG.md in this tag's tree. Covered surface (versioning policy R11): JSON output, tool names, input schemas, exit codes. A -rc tag is a release candidate: pre-release flagged, not a production cut.

v0.4.1-rc.2

Single-binary ch (CLI + ch mcp stdio server). Verify any asset with:

gh attestation verify <asset> --repo Cork-Technology/cork-cli --signer-workflow Cork-Technology/cork-cli/.github/workflows/build-binaries.yml

Reproduce: same commit, Bun pinned by mise.toml, bun scripts/compile-binaries.mjs --version v0.4.1-rc.2 --commit 19e8b8a087e8b5385faa6b884c65a84253677ecb — checksums must match checksums.txt. One caveat: match your host's libc to the asset you verify (glibc assets on a glibc host, musl on musl) — for same-OS targets Bun embeds the HOST's libc flavor, so a musl host rebuilding ch-linux-x64 gets a correct-but-different binary, a false mismatch (verified empirically: musl assets reproduce byte-identically from an independent musl machine).

SDK: the cork-*.tgz assets are the npm-installable @cork/schemas + @cork/core + @cork/mcp packages, attested and checksummed like every other asset. Add the schemas AND core tarball URLs to your dependencies (core's dependency on schemas resolves to the sibling tarball; your lockfile pins the sha512). Install guide: docs/sdk.md.

Changes: the 0.4.1-rc.2 section of CHANGELOG.md in this tag's tree. Covered surface (versioning policy R11): JSON output, tool names, input schemas, exit codes. A -rc tag is a release candidate: pre-release flagged, not a production cut.

v0.4.1-rc.1

Single-binary ch (CLI + ch mcp stdio server). Verify any asset with:

gh attestation verify <asset> --repo Cork-Technology/cork-cli --signer-workflow Cork-Technology/cork-cli/.github/workflows/build-binaries.yml

Reproduce: same commit, Bun pinned by mise.toml, bun scripts/compile-binaries.mjs --version v0.4.1-rc.1 --commit 4d1e220957edfdfe67e62f5ddef0493728b4424a — checksums must match checksums.txt. One caveat: match your host's libc to the asset you verify (glibc assets on a glibc host, musl on musl) — for same-OS targets Bun embeds the HOST's libc flavor, so a musl host rebuilding ch-linux-x64 gets a correct-but-different binary, a false mismatch (verified empirically: musl assets reproduce byte-identically from an independent musl machine).

SDK: the cork-*.tgz assets are the npm-installable @cork/schemas + @cork/core + @cork/mcp packages, attested and checksummed like every other asset. Add the schemas AND core tarball URLs to your dependencies (core's dependency on schemas resolves to the sibling tarball; your lockfile pins the sha512). Install guide: docs/sdk.md.

Changes: the 0.4.1-rc.1 section of CHANGELOG.md in this tag's tree. Covered surface (versioning policy R11): JSON output, tool names, input schemas, exit codes. A -rc tag is a release candidate: pre-release flagged, not a production cut.

v0.4.0

Single-binary ch (CLI + ch mcp stdio server). Verify any asset with:

gh attestation verify <asset> --repo Cork-Technology/cork-cli --signer-workflow Cork-Technology/cork-cli/.github/workflows/build-binaries.yml

Reproduce: same commit, Bun pinned by mise.toml, bun scripts/compile-binaries.mjs --version v0.4.0 --commit e410e63634d0b4d493bdd1bb487c0fce22ed4eb4 — checksums must match checksums.txt. One caveat: match your host's libc to the asset you verify (glibc assets on a glibc host, musl on musl) — for same-OS targets Bun embeds the HOST's libc flavor, so a musl host rebuilding ch-linux-x64 gets a correct-but-different binary, a false mismatch (verified empirically: musl assets reproduce byte-identically from an independent musl machine).

SDK: the cork-*.tgz assets are the npm-installable @cork/schemas + @cork/core + @cork/mcp packages, attested and checksummed like every other asset. Add the schemas AND core tarball URLs to your dependencies (core's dependency on schemas resolves to the sibling tarball; your lockfile pins the sha512). Install guide: docs/sdk.md.

Changes: the 0.4.0 section of CHANGELOG.md in this tag's tree. Covered surface (versioning policy R11): JSON output, tool names, input schemas, exit codes. A -rc tag is a release candidate: pre-release flagged, not a production cut.

v0.4.0-rc.1

Single-binary ch (CLI + ch mcp stdio server). Verify any asset with:

gh attestation verify <asset> --repo Cork-Technology/cork-cli --signer-workflow Cork-Technology/cork-cli/.github/workflows/build-binaries.yml

Reproduce: same commit, Bun pinned by mise.toml, bun scripts/compile-binaries.mjs --version v0.4.0-rc.1 --commit ebce323212af8e8a9f127ba1a002c3d0bbfb23af — checksums must match checksums.txt. One caveat: match your host's libc to the asset you verify (glibc assets on a glibc host, musl on musl) — for same-OS targets Bun embeds the HOST's libc flavor, so a musl host rebuilding ch-linux-x64 gets a correct-but-different binary, a false mismatch (verified empirically: musl assets reproduce byte-identically from an independent musl machine).

SDK: the cork-*.tgz assets are the npm-installable @cork/schemas + @cork/core + @cork/mcp packages, attested and checksummed like every other asset. Add the schemas AND core tarball URLs to your dependencies (core's dependency on schemas resolves to the sibling tarball; your lockfile pins the sha512). Install guide: docs/sdk.md.

Changes: the 0.4.0-rc.1 section of CHANGELOG.md in this tag's tree. Covered surface (versioning policy R11): JSON output, tool names, input schemas, exit codes. A -rc tag is a release candidate: pre-release flagged, not a production cut.

v0.3.0-rc.1

Single-binary ch (CLI + ch mcp stdio server). Verify any asset with:

gh attestation verify <asset> --repo Cork-Technology/cork-cli --signer-workflow Cork-Technology/cork-cli/.github/workflows/build-binaries.yml

Reproduce: same commit, Bun pinned by mise.toml, bun scripts/compile-binaries.mjs --version v0.3.0-rc.1 --commit d2605a8d42d22f5e6c194c863fb594322d398dfa — checksums must match checksums.txt. One caveat: match your host's libc to the asset you verify (glibc assets on a glibc host, musl on musl) — for same-OS targets Bun embeds the HOST's libc flavor, so a musl host rebuilding ch-linux-x64 gets a correct-but-different binary, a false mismatch (verified empirically: musl assets reproduce byte-identically from an independent musl machine).

v0.2.0-rc.2

Single-binary ch (CLI + ch mcp stdio server). Verify any asset with:

gh attestation verify <asset> --repo Cork-Technology/cork-cli --signer-workflow Cork-Technology/cork-cli/.github/workflows/build-binaries.yml

Reproduce: same commit, Bun pinned by mise.toml, bun scripts/compile-binaries.mjs --version v0.2.0-rc.2 --commit 585dc445e555761ebed4c1e6fc511f51b57d3683 — checksums must match checksums.txt. One caveat: match your host's libc to the asset you verify (glibc assets on a glibc host, musl on musl) — for same-OS targets Bun embeds the HOST's libc flavor, so a musl host rebuilding ch-linux-x64 gets a correct-but-different binary, a false mismatch (verified empirically: musl assets reproduce byte-identically from an independent musl machine).

v0.2.0-rc.1

Single-binary ch (CLI + ch mcp stdio server). Verify any asset with:

gh attestation verify <asset> --repo Cork-Technology/cork-cli --signer-workflow Cork-Technology/cork-cli/.github/workflows/build-binaries.yml

Reproduce: same commit, Bun pinned by mise.toml, bun scripts/compile-binaries.mjs --version v0.2.0-rc.1 --commit 89e18a9ef125cd6dd180816f045d7603fac6b7ff — checksums must match checksums.txt. One caveat: match your host's libc to the asset you verify (glibc assets on a glibc host, musl on musl) — for same-OS targets Bun embeds the HOST's libc flavor, so a musl host rebuilding ch-linux-x64 gets a correct-but-different binary, a false mismatch (verified empirically: musl assets reproduce byte-identically from an independent musl machine).

v0.1.0-rc.3

Single-binary ch (CLI + ch mcp stdio server). Verify any asset with:

gh attestation verify <asset> --repo Cork-Technology/cork-cli --signer-workflow Cork-Technology/cork-cli/.github/workflows/build-binaries.yml

Reproduce: same commit, Bun pinned by mise.toml, bun scripts/compile-binaries.mjs --version v0.1.0-rc.3 --commit 7986702974a656ee853fbcdb7e523e6577c8d9a8 — checksums must match checksums.txt. One caveat: match your host's libc to the asset you verify (glibc assets on a glibc host, musl on musl) — for same-OS targets Bun embeds the HOST's libc flavor, so a musl host rebuilding ch-linux-x64 gets a correct-but-different binary, a false mismatch (verified empirically: musl assets reproduce byte-identically from an independent musl machine).

v0.1.0-rc.2

Single-binary ch (CLI + ch mcp stdio server). Verify any asset with:

gh attestation verify <asset> --repo Cork-Technology/cork-cli --signer-workflow Cork-Technology/cork-cli/.github/workflows/build-binaries.yml

Reproduce: same commit, Bun pinned by mise.toml, bun scripts/compile-binaries.mjs --version v0.1.0-rc.2 --commit 4f06d028cc0d6b6a99719c7c5702367a4afc8f2d — checksums must match checksums.txt.