keepshipping v0.1.0

What's Changed

• build: workspace scaffold, CI merge gates and contributor docs (#17, #18, #19) by @ParallelEntrepreneur in #158
• feat(core): port traits, fakes and conformance kits for RunContext, Secrets, supply chain, IaC, HTTP/Clock/IdGen/ScriptHost (#48, #49, #50, #51, #57) by @ParallelEntrepreneur in #159
• feat(core): StepKind trait and Harness::build() composition checks (#39) by @ParallelEntrepreneur in #161
• feat(lang,core): parser, references/expressions, triggers and environments (#23, #25, #26) by @ParallelEntrepreneur in #160
• feat(core): typed values, nominal domain types and Secret as a type (#24, #27) by @ParallelEntrepreneur in #162
• feat(cli,core): keepshipping check with stable diagnostic codes and human/json/github output (#31, #32) by @ParallelEntrepreneur in #163
• Hosted blocks index: metadata port, hosted client and blocks search by @ParallelEntrepreneur in #164
• feat(ventures): the early-access waitlist as a hosted Cratefield venture by @ParallelEntrepreneur in #165
• Upgrade to cratefield-core 0.7 by @ParallelEntrepreneur in #179
• Nightly: fix 'unrecognized subcommand nightly' (rustup show) by @ParallelEntrepreneur in #188
• feat(core): plain-terms plan summary for reviewers (plain, terminal, Markdown, HTML) (#68) by @ParallelEntrepreneur in #185
• Add a GitHub Actions OIDC RunContext adapter for CI runner identity by @ParallelEntrepreneur in #186
• keepshipping: themed waitlist mail on Cratefield 0.8, sent through Owlpost with Resend fallback by @ParallelEntrepreneur in #187
• ADR 0013: Rust workspace for the engine, checker, CLI and LSP (#2) by @ParallelEntrepreneur in #189
• ADR 0005: local-first core with optional hosted services by @ParallelEntrepreneur in #193
• ADR-0002: ports and adapters — steps and the engine only see ports by @ParallelEntrepreneur in #190
• ADR-0003: workflow syntax — our own typed syntax by @ParallelEntrepreneur in #192
• ADR 0004: Secrets — per-environment resolvers behind the Secrets port by @ParallelEntrepreneur in #191
• No ADR content to add: #3 is already satisfied on main. This PR carries one small hardening change to .gitignore. by @ParallelEntrepreneur in #196
• ADR 0011: Block distribution — OCI artifacts pinned by digest, git as source, index metadata-only by @ParallelEntrepreneur in #194
• ADR 0010: Image build backend — BuildKit through a pinned buildx builder by @ParallelEntrepreneur in #195
• ADR 0004: name the StateStore in the redaction rule, and record that check does not yet warn by @ParallelEntrepreneur in #197
• Decide the file name: keep ship.ks, associate by file name (#14) by @ParallelEntrepreneur in #200
• Version the three public contracts, and make a port trait change impossible to land without a STEP_API bump by @ParallelEntrepreneur in #202
• ADR-0012: Policy authority — the in-file policy can only narrow an org baseline by @ParallelEntrepreneur in #201
• ADR 0008: GitHub Actions first, generic runner mode from M1 by @ParallelEntrepreneur in #198
• ADR 0009: TypeScript escape-hatch runtime — pinned Deno subprocess behind ScriptHost (#10) by @ParallelEntrepreneur in #199
• ADR 0006: license the harness under Apache-2.0 (#7) by @ParallelEntrepreneur in #203
• ks-testing: a step conformance kit, the hello.echo sample, and a LogSink fake by @ParallelEntrepreneur in #204
• Machine-applicable fixes on diagnostics, and keepshipping check --fix (#33) by @ParallelEntrepreneur in #205
• Refuse unsafe auto: rules: KS0701 warning and an engine rule that never auto-approves destroys (#35) by @ParallelEntrepreneur in #208
• ks-lsp: keepshipping lsp with diagnostics, hover types, go-to-definition, completion and rename (#36) by @ParallelEntrepreneur in #210
• Executor: timeouts, cancellation, retries and failure semantics, with exit codes in docs/CLI.md (#41) by @ParallelEntrepreneur in #211
• Editor packages: VS Code extension, tree-sitter grammar, and Neovim/Zed/JetBrains setup docs (#37) by @ParallelEntrepreneur in #209
• Warn about CI-only steps before a run: check --context, run pre-flight gate, ci-only: on steps (#34) by @ParallelEntrepreneur in #206
• File-format versioning: keepshipping: 0.N header, N-1 support with deprecation warning, fmt --upgrade by @ParallelEntrepreneur in #207
• keepshipping run locally: live step lines, the y prompt, partial runs (#45) by @ParallelEntrepreneur in #212
• Run log: RunLog port, engine Journal, hash-chained JSONL adapter and keepshipping log (#46) by @ParallelEntrepreneur in #214
• Step caching: content-addressed keys, skip a step only when its cached output still exists by @ParallelEntrepreneur in #218
• Add keepshipping check --repro (KS0801) and document when "same digest" actually holds by @ParallelEntrepreneur in #215
• DAG planner: deterministic plan and scheduler, after:, and keepshipping graph (#40) by @ParallelEntrepreneur in #216
• Run state and resume: park at approval, resume in another job, bind to the exact plan file (#42) by @ParallelEntrepreneur in #217
• Port: DecisionModel — typed questions, enum answers, calibrated confidence by @ParallelEntrepreneur in #219
• Ports: ApprovalChannel and Directory — ask a named team, bind the answer to exact artifacts by @ParallelEntrepreneur in #221
• Ports: Cluster, RemoteShell, FunctionHost — the three deploy-target ports by @ParallelEntrepreneur in #222
• Add sign: true signing (keyless or local key) and an oci.verify step (#61) by @ParallelEntrepreneur in #223
• Attestation core for SBOMs and SLSA v1 provenance (in-toto + DSSE, attached as OCI referrers) by @ParallelEntrepreneur in #225
• OCI distribution Registry adapter, zot and distribution conformance in CI, and a matrix of tested registries by @ParallelEntrepreneur in #227
• tofu.plan: save the plan, parse it into typed changes (#65) by @ParallelEntrepreneur in #229
• oci.image: build from a Dockerfile, return the registry's digest, never a tag (#59) by @ParallelEntrepreneur in #224
• oci.image: host-independent platforms default so STEPS.md drift check passes on every OS by @ParallelEntrepreneur in #231
• Ports: BlockSource and PolicyStore by @ParallelEntrepreneur in #226
• keepshipping fmt: aligned columns as on the site, idempotent, comment-preserving by @ParallelEntrepreneur in #228
• oci.artifact: push charts, SBOMs and other artifacts by digest, attach as referrers, optionally sign (#62) by @ParallelEntrepreneur in #230
• Typed IaC outputs: apply.out.cluster checks as a k8s.Cluster, and a missing output is a check-time error (#70) by @ParallelEntrepreneur in #238
• tofu.apply: apply exactly the approved plan file (#66) by @ParallelEntrepreneur in #232
• policy: semantics: can / ask-before / never, agents on a leash, and keepshipping policy explain (#101) by @ParallelEntrepreneur in #261
• Stale-plan guard: when the world changes after the plan, apply stops and asks again (#67) by @ParallelEntrepreneur in #237
• Block definitions: block:, typed inputs with defaults, outputs, internal steps (#80) by @ParallelEntrepreneur in #240
• Blocks: @v3 / @3.1.2 / @sha256: resolution and a stable ship.lock format (#81) by @ParallelEntrepreneur in #244
• @keepshipping/sdk: the step() API, input constructors, log, typed return (#...