Release v0.4.2

Ashlar 0.4.2

A patch release so the official MCP Registry can list the MCP brick host. Apart from the version number, only the host's server.json and package README change. There are no code changes and no public API changes.

Fixed

• The MCP brick host's registry name now uses the GitHub account's exact capitals: io.github.IanFrelinger/ashlar. The registry matches names case-sensitively and refused 0.4.1's lowercase name, so 0.4.1 can't be listed. 0.4.2 carries the corrected name in .mcp/server.json and in the package README line the registry checks.
• server.json names NuGet by its v3 index, https://api.nuget.org/v3/index.json, the only address the registry accepts for NuGet packages, and uses the current schema, 2025-12-11. Neither change alters what an MCP client runs.

Upgrading

• MCP host: dnx Ashlar.Mcp.Server.Host@0.4.2 --yes
• PR blockers Action: uses: IanFrelinger/Ashlar/actions/pr-blockers@v0.4.2
• Packages: move your Ashlar.* pins to 0.4.2.
• Operator image: ghcr.io/ianfrelinger/nexo-cli:0.4.2

The source is the same as 0.4.1's, so moving from 0.4.1 is optional.

Defaults

Nothing changes by default. As since 0.3.0, the AirGapped and SecureWorkstation profiles refuse disallowed egress by default. SecureWorkstation's ASHLAR_EGRESS_MODE=report break-glass is unchanged, and AirGapped ignores it.

Release artifacts

• Built and published by release run 40628831317 from the release commit 85ab5261 on release/0.4.2, a branch cut from v0.4.1. Every lane group of the readiness gate ran and passed on that commit. A 0.4.2-rc1 rehearsal ran the same publish and post-push checks against nuget.org first.
• The packages, symbols, nuget-publish-manifest.json and a .sha256.txt per package are attached below.
• Images: ghcr.io/ianfrelinger/nexo-cli:0.4.2 (linux/amd64 and linux/arm64, index sha256:e143323c…) and ghcr.io/ianfrelinger/nexo-api:0.4.2 (linux/amd64).

Release v0.4.1

Ashlar 0.4.1

A patch release for the GitHub blockers brick. No public API changes.

Fixed

• github.blockers 1.2.0 re-reads mergeability that GitHub had not computed yet. When GitHub answers mergeable: null for an open pull request, the brick reads it up to two more times, two seconds apart, before it reports mergeability as unknown. In the 25 October dogfood run, all four "unknown" answers were this case, and they hid three merge conflicts and one branch behind its base. A re-read that fails keeps the first answer. Merged and closed pull requests are not re-read.

Changed

• The MCP brick host's package README carries an ownership line for the official MCP Registry. Correction: 0.4.1 can't be listed. The registry matches names case-sensitively, and this line spells the GitHub account in lowercase. 0.4.2 fixes it.

Also in this release

• The "what is blocking this PR?" accuracy study: 44 pull requests, then 100 pull requests across 10 public repositories. See docs/benchmarks/blockers-accuracy.md.
• The token benchmark's official GitHub MCP server arm, plus Haiku 5.5 and local qwen3:4b runs.
• github.blockers now dogfoods on Ashlar's own pull requests and release tags.

Upgrading

• MCP host: dnx Ashlar.Mcp.Server.Host@0.4.1 --yes
• PR blockers Action: uses: IanFrelinger/Ashlar/actions/pr-blockers@v0.4.1
• Packages: move your Ashlar.* pins to 0.4.1.
• Operator image: ghcr.io/ianfrelinger/nexo-cli:0.4.1

Defaults

Nothing changes by default. As since 0.3.0, the AirGapped and SecureWorkstation profiles refuse disallowed egress by default. SecureWorkstation's ASHLAR_EGRESS_MODE=report break-glass is unchanged, and AirGapped ignores it.

Release artifacts

• Built and published by release run 40582413546 from the release commit 2dda4f1d, on which every lane group of the readiness gate ran and passed. A 0.4.1-rc1 rehearsal ran the same publish and post-push checks against nuget.org first.
• The packages, symbols, nuget-publish-manifest.json and a .sha256.txt per package are attached below.
• Images: ghcr.io/ianfrelinger/nexo-cli:0.4.1 (linux/amd64 and linux/arm64, index sha256:d7b31de2…) and ghcr.io/ianfrelinger/nexo-api:0.4.1 (linux/amd64).

Release v0.4.0

Ashlar 0.4.0 brings Ashlar bricks to your editor and your CI: an MCP brick host, GitHub bricks that answer "what is blocking this pull request or release?", and a free GitHub Action that runs them on every pull request.

Your agents decide what to do. Ashlar decides what is allowed to run, and keeps the receipt.

Highlights

• MCP brick host (Ashlar.Mcp.Server.Host, new). Run it with dnx Ashlar.Mcp.Server.Host@0.4.0 --yes, or install it as the ashlar-mcp .NET tool. It exposes only the bricks you allowlist to MCP clients such as GitHub Copilot in VS Code, Claude Code, Cursor and Visual Studio. Every call, refusals included, writes one audit record; the records form a hash chain, and a call whose record can't be written returns no result. See the host README.

• GitHub bricks (Ashlar.Bricks.GitHub, new). github.blockers returns a verdict for a pull request or release, each blocker with an evidence link, and every fact it could not read, with the reason. Version 1.1.0 reads required checks and reviews without admin rights. github.pr-status and github.ci-status cover pull request state and CI runs.

• A free check for PR blockers (actions/pr-blockers). A GitHub Action that writes the github.blockers verdict to the job summary. No account, no API key, no telemetry: it reads GitHub with the job's own token, and a run that gets no answer fails instead of reading as ready.

  - uses: IanFrelinger/Ashlar/actions/pr-blockers@v0.4.0

• Lighter authoring. Ashlar.Authoring no longer brings the host. A new brick project's first restore on an empty cache goes from 144 packages and 998 MiB to 30 packages and 144 MiB.

Hardening from the MCP host's adversarial audit

• Calls to unlisted tools and calls the policy gate denies are recorded, and the caller gets the auditId.
• Arguments over Ashlar:Mcp:Bricks:MaxArgumentBytes (64 KiB by default) are refused and recorded before the brick runs.
• No record, no result: a call whose audit record can't be written returns an error, not a result.
• Audit files are no longer pruned after ten server starts.
• Text read from GitHub (check names, status descriptions, reviewer logins, refs) reaches answers and the job summary as one inline code span each, capped and stripped of control characters. Evidence links are kept only for absolute http(s) URLs.

Measured

In our token benchmark, one github.blockers call cost 87–94% less than an agent using the official GitHub MCP server's tools, on three workloads with caching on, with the same verdicts. The accuracy study, published after the release, grades the 1.1.0 brick shipped here: 211 of 211 true blockers across 100 pull requests in 10 public repositories.

Upgrading

• A host that referenced only Ashlar.Authoring and calls AddAshlar() now also adds Ashlar.Hosting.Bundle.
• CLI image: ghcr.io/ianfrelinger/nexo-cli:0.4.0 (linux/amd64 and linux/arm64).
• Packages, symbols, nuget-publish-manifest.json and per-package .sha256.txt files are attached to this release.

Full details are in the 0.4.0 changelog.

Release v0.3.0

Automated draft for v0.3.0.

• Workflow: https://github.com/IanFrelinger/Ashlar/actions/runs/40015228812
• NuGet: Ashlar.Hosting.Bundle 0.3.0 (+ graph). Packages, symbols, nuget-publish-manifest.json and per-package .sha256.txt are attached as release assets (also in the nuget-packages-0.3.0 workflow artifact).
• Images: ghcr.io/ianfrelinger/nexo-cli:sha-c0c0287e141d, ghcr.io/ianfrelinger/nexo-api:sha-c0c0287e141d

Changes since v0.3.0

Edit notes and publish when ready. See docs/RELEASE.md and docs/SdkCompatibilityPolicy.md.

v0.2.0 — fail-closed trust

Ashlar 0.2.0 — fail-closed trust.

Full notes: CHANGELOG.md, 0.2.0.

Upgrading from 0.1.x — read this first

• CertificationVerifyOptions.Default and .Strict now fail closed. Both require an Ed25519 signature and a schema floor. A record your 0.1.x deployment produced HMAC-only, or under schema v1, is refused after upgrading. Legacy is the named opt-out and is insecure by design. Requiring a signature is not trusting one: pin TrustedEd25519PublicKeys.
• Signed gate records (SPEC-006 S-6, S-7). A removed gate-record signature is treated as corruption, and a signed record names the store it belongs to — older readers cannot read it.
• CLI. Progress and diagnostic markers moved from stdout to stderr. --format-json is refused by commands that have no JSON rendering. rag index requires --sensitivity; rag search without --max-sensitivity searches at Public.
• API surface. 41 types in Ashlar.Infrastructure, and UnitTestFrameworkBridge, are no longer public.

Security

• A package could forge a refused admission row into an admitted one through its formatVersion. Fixed; sender-chosen text on refusal lines is now escaped and length-bounded.
• The mesh serve daemon read .ashpkg files outside the bounded read — an arbitrary file read. Every .ashpkg read path is now bounded, symlinked packages are refused, and one planted file can no longer deny every package in a pkg pull.
• OutputPathSandboxed approved <root>-evil as inside <root>. Containment is now one helper, Ashlar.Abstractions.Paths.PathContainment.
• The commercial Fleet.Host served Swagger unauthenticated in every environment. It is now Development-only unless Ashlar__Api__EnableSwagger=true.
• Missing data-sensitivity information now fails closed: an omitted clearance means the floor, an unlabelled record is the most restrictive, a sanitizer with no filter blocks, and an agent with no exfiltration policy gets the restrictions its level implies.

Artifacts

• NuGet: 22 Ashlar.* packages at 0.2.0 on nuget.org (Ashlar.Hosting.Bundle is the usual entry point). Each .nupkg is attached with its SHA-256, plus nuget-publish-manifest.json; the release checked the bytes nuget.org serves against that manifest.
• Images: ghcr.io/ianfrelinger/nexo-cli:0.2.0 (index sha256:56827bbcf74d8bc1a9589915afa6dd822925de411cf27e5a8d662fd8562230c5, linux/amd64 + linux/arm64) and ghcr.io/ianfrelinger/nexo-api:0.2.0 (index sha256:7c0c25c649a63e5577d470f74f67b064f60b754258c8ac003aa187967d090e34).

How this release was verified

• Rehearsed against the live feed as 0.2.0-rc1 and 0.2.0-rc2; rc2 was built from the release commit itself, and every post-push check passed — including the SHA-256 comparison and restores from nuget.org.
• The readiness gate reported VERIFIED for release commit 5bd7b893: every platform lane group ran and passed (scripts/release/readiness-verdict-for-sha.sh).

v0.1.2 — compile-authority

Ashlar v0.1.2 — compile-authority. A certificate names the bytes the certifier compiled and fenced.

Disk certify and generate→certify mint gate-emitted-artifact. Production hot-swap and self-extend admission use CertificationVerifyOptions.Strict; hot-swap binds judged PE when the supplied image matches that input.

This tag starts release.yml (GHCR + nuget.org). ci/published-version stays 0.1.1 until that publish finishes. Do not pin 0.1.2 from nuget.org until the workflow Summary shows the push succeeded.

The 2-arg Verify(record, source) helper remains HMAC-era for callers that opt into it. Strict without artifact bytes still checks input kinds, not fence/identity hashes.

Install (after release.yml publishes)

dotnet add package Ashlar.Hosting.Bundle --version 0.1.2

dotnet tool install -g Ashlar.CLI --version 0.1.2

Or run the node image: ghcr.io/ianfrelinger/nexo-cli:0.1.2 (multi-arch; see deploy/node.yml). Start with docs/GettingStarted.md and consumer-template/CONSUMING.md.

Since v0.1.1

• Compile-authority fences — the certifier compiles the candidate itself (GateEmittedArtifactCompiler) under closed-world BrickCompileOptions, allowlist-fences the IL (allowlist-v3), activates those bytes, and binds gate-emitted-artifact / compile-options / il-import-fence / certifier-identity into the signed record. Exporters write gate-emitted-brick.dll.
• Consumer verify binds judged bytes — generate→certify mints gate-emitted-artifact. Hot-swap and self-extend use CertificationVerifyOptions.Strict. When hot-swap is given a PE whose hash matches the certificate, the artifact-bytes Verify overload binds those bytes. HMAC-era records without that input are refused at those hosts.
• Adversarial corpus at tests/adversarial-corpus/ replayed by AdversarialCorpusTests (cert-gate).
• Stable public API promoted — unshipped symbols in the stable-tier PublicAPI.*.txt files moved to Shipped.txt for the v0.1.2 promise.

Full notes: CHANGELOG.md section [0.1.2].

Tagged commit: 33a26f2ca08103aa38064f3b3ceeda23d6a82a1f (PR #499, after #494).

v0.1.1 — the slimmed keep

Ashlar v0.1.1 — "the slimmed keep." The first release published to nuget.org.

A governed, certified, self-extending AI-app runtime: every artifact passes a real admission gate (analyzer fence → witness → mutation → determinism), everything admitted is Ed25519-signed and content-hashed, the audit trail refuses tampering on the execution path, and nodes federate hub-less with each receiver re-deciding trust under its own root.

Install

dotnet add package Ashlar.Hosting.Bundle --version 0.1.1

dotnet tool install -g Ashlar.CLI --version 0.1.1

Or run the node image: ghcr.io/ianfrelinger/nexo-cli:0.1.1 (multi-arch; see deploy/node.yml). Start with docs/GettingStarted.md and consumer-template/CONSUMING.md.

Since v0.1.0

• First nuget.org publish — the full Ashlar.* graph (22 packages) plus the ashlar CLI tool, published via Trusted Publishing (OIDC, no long-lived keys) with SPDX SBOMs per package attached below.
• The open-core boundary got teeth — LICENSING.md now carries seven published covenants (verify-free-forever, one-way ratchet, architectural walls, buyer-based placement, no commercial trust exceptions, no telemetry in open packages, data freedom); the commercial evaluation grant is in force; apps/release-manager and apps/runtime-studio graduated commercial → open.
• The native-responsibility slim — the repository now carries the runtime and its own fleet tier only; vertical products (game, spatial/AR, physical-atom, provenance-graph) moved out, preserved intact on archive/verticals-2026-08-31 for their own repositories.
• Documentation audited against source — every documented path, command, env var, and claim verified against the tree; the docs are gated by CI the same way the kernel is.

Verify

Every package carries a .sha256.txt sidecar and an SPDX SBOM (assets below). Images are pinned by digest in deploy/node.yml. Anything Ashlar signs verifies offline with the Apache-2.0 tooling — that is covenant 1, and it is load-bearing.

— Workflow run: https://github.com/IanFrelinger/Nexo/actions/runs/33466312501