keepshipping v0.1.0

What's Changed

• build: workspace scaffold, CI merge gates and contributor docs (#17, #18, #19) by @ParallelEntrepreneur in #158
• feat(core): port traits, fakes and conformance kits for RunContext, Secrets, supply chain, IaC, HTTP/Clock/IdGen/ScriptHost (#48, #49, #50, #51, #57) by @ParallelEntrepreneur in #159
• feat(core): StepKind trait and Harness::build() composition checks (#39) by @ParallelEntrepreneur in #161
• feat(lang,core): parser, references/expressions, triggers and environments (#23, #25, #26) by @ParallelEntrepreneur in #160
• feat(core): typed values, nominal domain types and Secret as a type (#24, #27) by @ParallelEntrepreneur in #162
• feat(cli,core): keepshipping check with stable diagnostic codes and human/json/github output (#31, #32) by @ParallelEntrepreneur in #163
• Hosted blocks index: metadata port, hosted client and blocks search by @ParallelEntrepreneur in #164
• feat(ventures): the early-access waitlist as a hosted Cratefield venture by @ParallelEntrepreneur in #165
• Upgrade to cratefield-core 0.7 by @ParallelEntrepreneur in #179
• Nightly: fix 'unrecognized subcommand nightly' (rustup show) by @ParallelEntrepreneur in #188
• feat(core): plain-terms plan summary for reviewers (plain, terminal, Markdown, HTML) (#68) by @ParallelEntrepreneur in #185
• Add a GitHub Actions OIDC RunContext adapter for CI runner identity by @ParallelEntrepreneur in #186
• keepshipping: themed waitlist mail on Cratefield 0.8, sent through Owlpost with Resend fallback by @ParallelEntrepreneur in #187
• ADR 0013: Rust workspace for the engine, checker, CLI and LSP (#2) by @ParallelEntrepreneur in #189
• ADR 0005: local-first core with optional hosted services by @ParallelEntrepreneur in #193
• ADR-0002: ports and adapters — steps and the engine only see ports by @ParallelEntrepreneur in #190
• ADR-0003: workflow syntax — our own typed syntax by @ParallelEntrepreneur in #192
• ADR 0004: Secrets — per-environment resolvers behind the Secrets port by @ParallelEntrepreneur in #191
• No ADR content to add: #3 is already satisfied on main. This PR carries one small hardening change to .gitignore. by @ParallelEntrepreneur in #196
• ADR 0011: Block distribution — OCI artifacts pinned by digest, git as source, index metadata-only by @ParallelEntrepreneur in #194
• ADR 0010: Image build backend — BuildKit through a pinned buildx builder by @ParallelEntrepreneur in #195
• ADR 0004: name the StateStore in the redaction rule, and record that check does not yet warn by @ParallelEntrepreneur in #197
• Decide the file name: keep ship.ks, associate by file name (#14) by @ParallelEntrepreneur in #200
• Version the three public contracts, and make a port trait change impossible to land without a STEP_API bump by @ParallelEntrepreneur in #202
• ADR-0012: Policy authority — the in-file policy can only narrow an org baseline by @ParallelEntrepreneur in #201
• ADR 0008: GitHub Actions first, generic runner mode from M1 by @ParallelEntrepreneur in #198
• ADR 0009: TypeScript escape-hatch runtime — pinned Deno subprocess behind ScriptHost (#10) by @ParallelEntrepreneur in #199
• ADR 0006: license the harness under Apache-2.0 (#7) by @ParallelEntrepreneur in #203
• ks-testing: a step conformance kit, the hello.echo sample, and a LogSink fake by @ParallelEntrepreneur in #204
• Machine-applicable fixes on diagnostics, and keepshipping check --fix (#33) by @ParallelEntrepreneur in #205
• Refuse unsafe auto: rules: KS0701 warning and an engine rule that never auto-approves destroys (#35) by @ParallelEntrepreneur in #208
• ks-lsp: keepshipping lsp with diagnostics, hover types, go-to-definition, completion and rename (#36) by @ParallelEntrepreneur in #210
• Executor: timeouts, cancellation, retries and failure semantics, with exit codes in docs/CLI.md (#41) by @ParallelEntrepreneur in #211
• Editor packages: VS Code extension, tree-sitter grammar, and Neovim/Zed/JetBrains setup docs (#37) by @ParallelEntrepreneur in #209
• Warn about CI-only steps before a run: check --context, run pre-flight gate, ci-only: on steps (#34) by @ParallelEntrepreneur in #206
• File-format versioning: keepshipping: 0.N header, N-1 support with deprecation warning, fmt --upgrade by @ParallelEntrepreneur in #207
• keepshipping run locally: live step lines, the y prompt, partial runs (#45) by @ParallelEntrepreneur in #212
• Run log: RunLog port, engine Journal, hash-chained JSONL adapter and keepshipping log (#46) by @ParallelEntrepreneur in #214
• Step caching: content-addressed keys, skip a step only when its cached output still exists by @ParallelEntrepreneur in #218
• Add keepshipping check --repro (KS0801) and document when "same digest" actually holds by @ParallelEntrepreneur in #215
• DAG planner: deterministic plan and scheduler, after:, and keepshipping graph (#40) by @ParallelEntrepreneur in #216
• Run state and resume: park at approval, resume in another job, bind to the exact plan file (#42) by @ParallelEntrepreneur in #217
• Port: DecisionModel — typed questions, enum answers, calibrated confidence by @ParallelEntrepreneur in #219
• Ports: ApprovalChannel and Directory — ask a named team, bind the answer to exact artifacts by @ParallelEntrepreneur in #221
• Ports: Cluster, RemoteShell, FunctionHost — the three deploy-target ports by @ParallelEntrepreneur in #222
• Add sign: true signing (keyless or local key) and an oci.verify step (#61) by @ParallelEntrepreneur in #223
• Attestation core for SBOMs and SLSA v1 provenance (in-toto + DSSE, attached as OCI referrers) by @ParallelEntrepreneur in #225
• OCI distribution Registry adapter, zot and distribution conformance in CI, and a matrix of tested registries by @ParallelEntrepreneur in #227
• tofu.plan: save the plan, parse it into typed changes (#65) by @ParallelEntrepreneur in #229
• oci.image: build from a Dockerfile, return the registry's digest, never a tag (#59) by @ParallelEntrepreneur in #224
• oci.image: host-independent platforms default so STEPS.md drift check passes on every OS by @ParallelEntrepreneur in #231
• Ports: BlockSource and PolicyStore by @ParallelEntrepreneur in #226
• keepshipping fmt: aligned columns as on the site, idempotent, comment-preserving by @ParallelEntrepreneur in #228
• oci.artifact: push charts, SBOMs and other artifacts by digest, attach as referrers, optionally sign (#62) by @ParallelEntrepreneur in #230
• Typed IaC outputs: apply.out.cluster checks as a k8s.Cluster, and a missing output is a check-time error (#70) by @ParallelEntrepreneur in #238
• tofu.apply: apply exactly the approved plan file (#66) by @ParallelEntrepreneur in #232
• policy: semantics: can / ask-before / never, agents on a leash, and keepshipping policy explain (#101) by @ParallelEntrepreneur in #261
• Stale-plan guard: when the world changes after the plan, apply stops and asks again (#67) by @ParallelEntrepreneur in #237
• Block definitions: block:, typed inputs with defaults, outputs, internal steps (#80) by @ParallelEntrepreneur in #240
• Blocks: @v3 / @3.1.2 / @sha256: resolution and a stable ship.lock format (#81) by @ParallelEntrepreneur in #244
• @keepshipping/sdk: the step() API, input constructors, log, typed return (#87) by @ParallelEntrepreneur in #246
• Script runtime: pinned Deno, deny-by-default permissions, frozen deps, determinism by @ParallelEntrepreneur in #257
• GitHub approvals: the ks-github adapter — a PR comment with the plan, a command to approve, resume on approval by @ParallelEntrepreneur in #255
• decide step: ask a decision model a typed question; the engine writes the reason (#104) by @ParallelEntrepreneur in #266
• Per-step cloud credentials: role: on plan/apply, OIDC federation, run log records the role (#71) by @ParallelEntrepreneur in #233
• OpenTofu and Terraform: terraform.* steps, a real tofu-cli adapter for both binaries, licence note by @ParallelEntrepreneur in #235
• k8s.rollout: pin images by digest, apply, wait for healthy, roll back (#73) by @ParallelEntrepreneur in #236
• k8s.rollout with Helm charts, including OCI charts pinned by digest by @ParallelEntrepreneur in #239
• One health and rollback model across deploy targets (#78) by @ParallelEntrepreneur in #241
• vm.deploy: rolling deploys over SSH, one health-gated batch at a time by @ParallelEntrepreneur in #243
• Block upgrades: classify signature changes as breaking or compatible (#83, part 1) by @ParallelEntrepreneur in #245
• blocks search --offline: search the local blocks cache without a network by @ParallelEntrepreneur in #247
• Block trust: allowed publishers in the org baseline, a fail-closed verify, and KS0404 for a block that declares policy: (#84) by @ParallelEntrepreneur in #249
• keepshipping blocks publish: push a block to an OCI registry and refuse a breaking minor (#82) by @ParallelEntrepreneur in #242
• Script steps: ./path.ts step kinds, an action: declaration, the agents-in-prod approval gate, and a run seam to ScriptHost (#89) by @ParallelEntrepreneur in #251
• Secrets in scripts: script logs go through the redactor, and a step can't return a secret (#91) by @ParallelEntrepreneur in #252
• Type bridge: a TS step's declared outputs become ks types in check and LSP hover (#88) by @ParallelEntrepreneur in #250
• Engine policy enforcement: preflight, step-boundary gate, and policy-aware Secrets port (#103) by @ParallelEntrepreneur in #265
• --as agent[:name]: actor identity for agent runs, agent detection, and agent runs wait on a human by @ParallelEntrepreneur in #262
• approval: expiry, quorum and binding to the artifacts it was given for by @ParallelEntrepreneur in #256
• Denials, timeouts and aborts: a run has one ending, and it is logged by @ParallelEntrepreneur in #259
• CLI approvals: keepshipping runs pending, approve <run>, deny <run> by @ParallelEntrepreneur in #254
• Web and Slack approvals as an ApprovalChannel adapter (ks-hosted-approvals) (#98) by @ParallelEntrepreneur in #260
• Auto-approve rules: evaluate auto: / else: at run time, with hard rules for destroys, untrusted decisions and the org baseline (#106) by @ParallelEntrepreneur in #263
• ks-jev: Jev adapter for DecisionModel (pinned model, bounded retries, fails closed) by @ParallelEntrepreneur in #264
• k8s.Cluster: a typed cluster target that names how a run authenticates, never a credential by @ParallelEntrepreneur in #248
• Parking a run at an approval instead of holding a runner open, and resuming it later by @ParallelEntrepreneur in #258
• CLI run --input and the @keepshipping/sdk testing helper (no secret-shaped literals) by @ParallelEntrepreneur in #253
• Decision audit: log model version and input hashes, record overrides, keepshipping decisions report|export, calibration script (#108) by @ParallelEntrepreneur in #267
• Secrets: redact encoded forms, add env / github-actions resolvers, end-to-end redaction test (#111) by @ParallelEntrepreneur in #268
• decide sends a redacted, data-quoted plan summary; keepshipping decide --explain shows what left the machine (#107) by @ParallelEntrepreneur in #270
• Deploy-time verification: verify: signed-by <identity> refuses an unsigned or wrongly-signed digest before anything is applied by @ParallelEntrepreneur in #271
• Threat model in docs/SECURITY.md, and fork-PR classification in the GitHub adapter by @ParallelEntrepreneur in #278
• Signed run log: seal the chain head with an ed25519 key, verify by line, attach to the shipped digest (#112) by @ParallelEntrepreneur in #280
• feat(engine): SLSA v1 provenance attestation from oci.image, with an honest SLSA Build-track assessment (#114) by @ParallelEntrepreneur in #281
• Supply chain: SHA-pinned actions, workflow lint, release SBOM + SLSA provenance, verifying install.sh, Dependabot (#116) by @ParallelEntrepreneur in #282
• Approval binds to what kind of artifact was shown, not just to a bare digest by @ParallelEntrepreneur in #283
• A plan carrying an instruction-shaped glyph is never sent to the decision model by @ParallelEntrepreneur in #284
• Plan files are secretish: owner-only, deleted after apply, and gitignored by @ParallelEntrepreneur in #285
• Actor: --as agent is self-declared — give the org baseline a way to reach the binary, and state the laptop risk plainly by @ParallelEntrepreneur in #286
• Blocks: enforce the publisher allowlist at the gate, and refuse a block that ships its own policy by @ParallelEntrepreneur in #287
• A step's own net export can no longer grant itself network egress, and the sandbox's subprocess/write/ffi/sys refusals are now proven against a real Deno by @ParallelEntrepreneur in #288
• Prod environments are ci-only for apply and deploy: a local run stops before apply by @ParallelEntrepreneur in #289
• A branch can no longer widen its own policy: fold in the default branch's policy: and gate run on it (#118) by @ParallelEntrepreneur in #290
• GitHub Actions: composite action that installs a pinned, verified keepshipping and runs it (#128, part 1) by @ParallelEntrepreneur in #291
• Generic CI mode: keepshipping run --ci on any CI that can run a binary by @ParallelEntrepreneur in #292
• GitLab CI as the second native CI integration: a RunContext adapter, a CI template, and docs by @ParallelEntrepreneur in #293
• GitHub Checks API: a check-run client that turns check diagnostics into annotations on the diff by @ParallelEntrepreneur in #294
• Treat fork and untrusted-branch pull requests as untrusted, in the adapter rather than only in the workflow YAML by @ParallelEntrepreneur in #295
• docs/LANGUAGE.md: check the reference's examples against the real parser by @ParallelEntrepreneur in #296
• keepshipping import shell <script.sh>: best-effort conversion of a deploy script, with a report by @ParallelEntrepreneur in #297
• docs/STEPS.md: render step capabilities and the named-type vocabulary by @ParallelEntrepreneur in #298
• docs: a coexistence guide for adopting Keep Shipping one environment at a time by @ParallelEntrepreneur in #299
• keepshipping import github-actions: best-effort conversion to ship.ks with an IMPORT-REPORT.md by @ParallelEntrepreneur in #300
• Getting started: a walkable guide and a real example repo by @ParallelEntrepreneur in #308
• docs: what the agent policy decides, and what it does not (#141) by @ParallelEntrepreneur in #307
• docs: STEP-AUTHORING.md with a doctested hello.echo, and a per-port reference in PORTS.md by @ParallelEntrepreneur in #309
• docs/EARLY-ACCESS.md: batch criteria, onboarding checklist and the one invite email (#153) by @ParallelEntrepreneur in #314
• docs/METRICS.md: a metrics sheet with definitions, and what is behind each number by @ParallelEntrepreneur in #316
• docs: an early-access interview script that decides pricing, scope and the second CI by @ParallelEntrepreneur in #317
• docs/research/landscape.md: competitive landscape with sources and dates (#157) by @ParallelEntrepreneur in #320
• Telemetry policy: nothing ships; the would-be payload is written down and leak-tested by @ParallelEntrepreneur in #319
• Hosted on Cloudflare (#175): a RunLock port so one module never has two applies at once, plus ADR 0201 by @ParallelEntrepreneur in #321
• ks-module-runlog: the hosted run-log viewer — batched upload, chain and seal verification, per-repo browsing by @ParallelEntrepreneur in #315
• ks-cloudflare: read a Cloudflare account and generate Terraform with import blocks, gated on an empty plan by @ParallelEntrepreneur in #322
• Show "Built with" in the product: about, --version, approvals About panel, registry sync check by @ParallelEntrepreneur in #323
• check: warn on unknown step kinds (KS0603) and make their outputs type any, as LANGUAGE.md already promised by @ParallelEntrepreneur in #324
• ks-module-approvals: hosted approval requests, signed decisions, repository_dispatch through the outbox by @ParallelEntrepreneur in #318
• Billing through Polar (Merchant of Record): plan state from webhooks, disputes, checkout and portal by @ParallelEntrepreneur in #325
• docs(telemetry): list about, --version and KS0603 (main is red) by @ParallelEntrepreneur in #326
• vscode: the language server failed to start (trace channel must be a LogOutputChannel) by @ParallelEntrepreneur in #327
• Bump the github-actions group across 1 directory with 6 updates by @dependabot[bot] in #303
• Data inventory for the hosted parts: docs/PRIVACY.md, per-module privacy declarations, and a drift guard by @ParallelEntrepreneur in #311
• Fail closed: GitLab fork-MR detection, and generic CI trusted only when the operator says so by @ParallelEntrepreneur in #313
• Docs hosting (docs.keepshipping.run): a static site generator, a deploy script, and llms-full.txt by @ParallelEntrepreneur in #312
• Bump the cargo-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #301
• Bump the npm-sdk-dependencies group in /sdk/ts with 2 updates by @dependabot[bot] in #302
• Venture: CI builds ventures/keepshipping to wasm, harness_builds + /__health tests, daily cron declared (#145) by @ParallelEntrepreneur in #310
• Cloudflare IaC: R2 state with locking and encryption, a least-privilege token check on connect, and lock waits in the tofu adapter by @ParallelEntrepreneur in #329
• Console: a fleet view of every zone, site and Worker (#169) by @ParallelEntrepreneur in #328
• Console: a Standard setup page per domain with live status and one Terraform PR by @ParallelEntrepreneur in #330
• Google Search Console: verify the domain and submit the sitemap, as Terraform (#274) by @ParallelEntrepreneur in #331
• Edit as code: console forms that open Terraform PRs, show the plan, and apply only after approval (#170) by @ParallelEntrepreneur in #332
• Deploy the console as keepshipping-console on console.keepshipping.run by @ParallelEntrepreneur in #333
• tools/deploy.sh: restore the exec bit by @ParallelEntrepreneur in #334
• Agent-friendly run: keep exit 4 = parked / 5 = policy refused, add 6 = denied, and --format json (#306) by @ParallelEntrepreneur in #335
• Record the pricing deferral: ADR 0203 "Pricing not set" and a docs pricing guard by @ParallelEntrepreneur in #336
• Docs site: the keepshipping.run look, a sidebar, and Internal docs left off by @ParallelEntrepreneur in #340
• Console sign-in: authorization code + PKCE against the Cratefield auth instance by @ParallelEntrepreneur in #341
• tools/deploy.sh: build the docs into an empty directory by @ParallelEntrepreneur in #342
• Licence: MIT (ADR 0016) by @ParallelEntrepreneur in #343
• fix(ci): macOS install.sh crash, unpinned venture actions, libyaml advisory by @ParallelEntrepreneur in #344
• fix(oci-distribution): pull layers from the blob endpoint when the manifest endpoint does not hold them by @ParallelEntrepreneur in #345
• fix(ci): offline check exit code (pipefail); script cold budget 1 s by @ParallelEntrepreneur in #346
• test(deno): add the log-secret conformance fixture by @ParallelEntrepreneur in #347
• Bump @types/node from 26.6.3 to 26.6.4 in /sdk/ts in the npm-sdk-dependencies group across 1 directory by @dependabot[bot] in #338
• Bump the github-actions group across 1 directory with 4 updates by @dependabot[bot] in #348
• Bump the cargo-dependencies group across 1 directory with 9 updates by @dependabot[bot] in #349
• ci(bench): pin Node 22 for the script cold path by @ParallelEntrepreneur in #350
• release: workspace version 0.1.0 by @ParallelEntrepreneur in #351
• fix(release): run cross build, not cross cargo build by @ParallelEntrepreneur in #352
• fix(release): drop the inert release-plz step by @ParallelEntrepreneur in #353
• fix(release): download archives and checksums in two steps by @ParallelEntrepreneur in #354

New Contributors

• @ParallelEntrepreneur made their first contribution in #158
• @dependabot[bot] made their first contribution in #303

Full Changelog: https://github.com/Keep-Shipping/harness/commits/v0.1.0