v2.1.0 — Proof Artifact, Policy Profiles, Apache-2.0

What's New

Proof Artifact

Every PR check now generates agentmesh-proof.json — a machine-readable JSON artifact with per-commit provenance, policy configuration, and an evidence fingerprint (SHA256). Uploaded automatically via actions/upload-artifact@v4 with 90-day retention.

Policy Profiles

Named presets for common enforcement levels:

Profile	require-trailers	verify-witness	require-witness
baseline	false	false	false
strict	true	true	false
enterprise	true	true	true

Explicit flag values always override the profile.

License Transition

Apache-2.0 for all current and future development. The v1 tag and prior releases remain under their original terms.

Migration from v1

# Before
- uses: Haserjian/agentmesh-action@v1

# After
- uses: Haserjian/agentmesh-action@v2
  with:
    policy-profile: strict  # optional

All v1 inputs remain supported. New inputs (policy-profile, upload-proof) default to backward-compatible values.

Tests

7/7 tests passing (3 existing + 4 new covering proof artifact, fingerprint stability, profile resolution, and override precedence).