CBE 0.3.1 — cbf package type

CBE 0.3.1 — CBF package type + opaque semantic gate

SIGNED via GitHub OIDC keyless cosign/sigstore.

• Tag: v0.3.1 -> c4b1539
• Signing workflow: .github/workflows/sign-release.yml
• Stage-only signing run: https://github.com/JunxiangPan/cbe/actions/runs/43117966063
• Production signature is the Sigstore keyless bundle, not Ed25519.

Changes

• package_type: cbf accepted in CLI, manifest, rule-pack and report enums.
• Legacy cbs/cbe/cbp/cbm/cbc/cbg package types remain valid.
• --gate-job '^cbf-privacy-gate$' and --gate-job '^semantic-gate$' work.
• CBE only checks gate reachability/non-skipping; it does not run CBF,
  run a semantic model, or interpret findings.
• No CBF import or runtime dependency.

Verification

tests: 292 passed
coverage: 81.91% (gate 80%)
CBE keyless verifier: 5 files PASS
cosign bundles: 5/5 verified

Artifacts:

wheel 8a06c99ae5213f36eeb72473ff14537524540d9216c949857c1889889ac08cc6
sdist c6c5159f4c41074b214b04bcb5f40862ba08587f0031ee8c99d3146fb77ca89d

CBF status

CBF 0.1.0rc1 exists, but this release does not claim an external CBF PASS.
CBF's CBE check is a local source check only; no external CBF evidence is
attached and no external CBF PASS is implied.

CBE 0.3.0 — multi-gate integrity

CBE 0.3.0 — MULTI-GATE INTEGRITY

SIGNED via GitHub OIDC keyless cosign/sigstore.

• Tag: v0.3.0 -> d1c7343
• Signing workflow: .github/workflows/sign-release.yml
• Stage-only signing run: https://github.com/JunxiangPan/cbe/actions/runs/43101056675
• Production signature is the Sigstore keyless bundle, not Ed25519.

Highlights

• Multi-gate integrity: --gate-jobs cbp-gate mutation-gate ai-gate.
• Per-gate bypass detection: if:false, commented gates, unreachable needs,
  continue-on-error, empty local reusable delegation.
• Optional --cbp-report records report/manifest hashes without importing CBP.
• Default 0.2.0 --gate-job behavior unchanged.
• CBE report schema unchanged.
• CBP v1.3.2 audit retained; CBP 1.5.0 is opt-in and does not block this release.

Verification

tests: 272 passed
coverage: 81.91% (gate 80%)
mutation: 10/10
CBE keyless verifier: 5 files PASS
cosign bundles: 5/5 verified

Verify:

cosign verify-blob \
  --bundle cbe_review-0.3.0-py3-none-any.whl.bundle \
  --certificate-identity-regexp \
    'https://github.com/JunxiangPan/cbe/.github/workflows/sign-release.yml@refs/heads/0.3.0-dev' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  cbe_review-0.3.0-py3-none-any.whl

Artifacts:

wheel 2dcfbfa28661705ddbf414f481dd5dae2fa999a45f015618074e602bb8a4b51a
sdist cdcfb5395c4088d6df333a7e6c1507813e5bdd8ff3f6a750d8a070549cb16c4d

CBE 0.2.0

CBE 0.2.0 — GATE-INTEGRITY RELEASE

SIGNED via GitHub OIDC keyless cosign/sigstore.

• Build: GitHub Actions, one build, from the tagged candidate commit.
• Verification: every wheel/sdist/report/attestation/manifest has a
  cosign bundle; the workflow ran cosign verify-blob and the CBE
  keyless verifier before creating this tag.
• Production signature is the Sigstore keyless bundle, not Ed25519.
• No Ed25519 manifest.sig is produced or claimed as production.
• Branch/tag protection is external; see the repository readiness page.

Assets include .bundle, .sig, .pem, SLSA attestations and
release-manifest.json.

---

ERRATUM (2026-11-12)

Status: ERRATUM — tag and published assets were not changed.

The v0.2.0 tag (8c1452e) contains stale staging hashes
(cb4c07ea... wheel / d04b60e0... sdist). The actual GitHub/PyPI artifacts
are the signed d9acbefa... wheel and e4c5cdb2... sdist. The tag was not
moved and no asset was rewritten. Use the Release/PyPI artifacts and the
signed release-manifest.json, not the tag staging manifest. No 0.2.1 was
created for this erratum.

CBE 0.1.1

CBE 0.1.1 Release Notes

Status: RELEASED on GitHub and PyPI.

• GitHub Release: https://github.com/JunxiangPan/cbe/releases/tag/v0.1.1
• PyPI: https://pypi.org/project/cbe-review/0.1.1/
• Tag: v0.1.1 → 06f8f50

CBE 0.1.1 is the external-use hardening release. Distribution remains
cbe-review; the import package and CLI remain cbe.

Highlights

• Apache-2.0 license, including wheel License-Expression / License-File.
• Complete PyPI metadata: author, maintainers, classifiers, keywords, project
  URLs, and homepage.
• README rewritten around audience, problem, and getting started.
• enforce-no-bypass --strict fails unverifiable workflow conditions.
• --gate-job REGEX for renamed gates (security-gate, enforce,
  policy-check); default is still ^cbe[-_]gate$.
• Local reusable workflows are followed recursively; remote reusable
  workflows report UNVERIFIABLE_REMOTE_WORKFLOW.

Compatibility

• Python >= 3.10.
• Runtime dependencies: jsonschema>=4.20, pyyaml>=6.0.
• Test-only e2e extra: cbp-action==1.2.2.
• cbe-review is the only PyPI distribution; do not install cbe.

0.1.0 metadata

The 0.1.0 wheel/sdist and tag v0.1.0 are immutable. PyPI cannot edit 0.1.0
metadata; the license/classifier/URL corrections apply only to 0.1.1.

CBE 0.1.0

CBE 0.1.0 — Release Notes

Status: RELEASED on GitHub and PyPI.

CBE (Cyber-Butler Enforcement gate) 0.1.0 is the first stable CBE release. It
provides the rule-pack manifest, provider execution, no-bypass enforcement,
SARIF evidence, and the CBE report/body fragment for the Cyber-Butler release
train.

Distribution identity:

PyPI distribution: cbe-review
Import package:    cbe
CLI:               cbe
package_id:        cbe
producer_id:       cbe

The cbe PyPI name belongs to azizo-b/CBE and is not used.

Highlights

• Five CLI commands: validate-manifest, enforce-no-bypass,
  symbol-index, run-provider, emit-sarif.
• Manifest schema and semantic validation; provider SARIF/JSON validation;
  native provider ID mapping; deterministic exemptions.
• No-bypass enforcement across config, comments, environment, and GitHub
  Actions workflows; dynamic workflow conditions are explicit warnings.
• CBE report and Release-body Section B assembly with warn_count.
• F4 baseline selection, F5/F6 release-train handling, and self-bootstrap
  harness.
• CBE-08 PASS against frozen contract-v1.7.1; authorized by
  FREEZE_NOTICE_ADDENDUM.md.
• CBE-07b PASS on CBP 1.2.2; CBE-10 PASS with the real CBP 1.2.2
  quality manifest.
• Schemas bundled in the wheel; installed-wheel smoke test passes.

Verification

Tests:      176 passed = 74 unit + 102 E2E
Coverage:   71.89% (gate 60%)
CI:         Ubuntu + Windows success
Run:        https://github.com/JunxiangPan/cbe/actions/runs/42648086977
Source:     4561e8338a09a7e681b08fc0c2b38fcff2d56e70
Package/tag target: 13f7ddc8af947a6bae10b4251beb2406e2d31f30

Tag choice B: v0.1.0 targets 13f7ddc, the release-package commit.
Artifacts are built from 4561e83; metadata corrections after 13f7ddc are
docs-only and do not change artifact hashes.

Contract and upstream pins:

CBS contract: tag contract-v1.7.1 / c2b5e9 / 209d75b4…
CBE-08 addendum: e318cbd / 51604f56…
CBP: cbp-action==1.2.2

Artifacts

File	SHA256	Size
cbe_review-0.1.0-py3-none-any.whl	87f0ad40a6cffdf4f9c657e6cc972a0f93787259c52445a1c112a5c7753599a7	52,090 B
cbe_review-0.1.0.tar.gz	a77c653d178d5d0ab179da73c92184d9a54d5104ca5202f41574588979b68854	46,253 B

Install from the wheel:

python -m pip install cbe_review-0.1.0-py3-none-any.whl
cbe --help

If and when PyPI publication is approved:

python -m pip install cbe-review==0.1.0

Runtime dependencies: jsonschema>=4.20, pyyaml>=6.0. Python >= 3.10.
Test-only e2e extra pins cbp-action==1.2.2.

PyPI status

cbe-review==0.1.0 is UPLOADED:
https://pypi.org/project/cbe-review/0.1.0/.

wheel  cbe_review-0.1.0-py3-none-any.whl  87f0ad40a6cffdf4f9c657e6cc972a0f93787259c52445a1c112a5c7753599a7
sdist  cbe_review-0.1.0.tar.gz            a77c653d178d5d0ab179da73c92184d9a54d5104ca5202f41574588979b68854

PyPI install verified: cbe-review==0.1.0, import cbe, CLI cbe 0.1.0,
five subcommands. The old cbe name belongs to a different project and is
never used.

Evidence

• CBE-08 PASS
• Contract guard
• CBE-07b on CBP 1.2.2
• Real CBP 1.2.2 quality manifest
• CBE-10 F5/F6 + RC2 fields
• Real CBE report vs RC2 schema

Release boundary

GitHub Release: https://github.com/JunxiangPan/cbe/releases/tag/v0.1.0
(tag v0.1.0 → 13f7ddc). PyPI:
https://pypi.org/project/cbe-review/0.1.0/ (uploaded and verified). See
RELEASE_RUNBOOK.md.