0.1.0-alpha.2 - 2026-09-01

Release Notes

Second developer preview focused on installability, a more complete Hub
interface, and repeatable releases. It adds downloadable CLI artifacts and
hostable server images while preserving Sorrel's prerelease boundaries.

Added

• Add automatic coordinated changelog preparation (#73).
• Publish hostable Sorrel server releases (#75).

Changed

• Test rendered Hub UI behavior (#55).
• Use current logo on public website (#56).
• Improve mobile navigation accessibility (#58).
• Report only implemented Hub capabilities (#60).
• Forward Hub bearer tokens from the CLI (#61).
• Overhaul public website design (#62).
• Share Hub web server implementation (#63).
• Replace deprecated Rust YAML parser (#65).
• Build Hub web from its declared UI package (#69).
• Polish CLI installation and contribution workflow (#71).
• Overhaul public documentation design (#72).
• Establish review-first Sorrel Hub product interface (#74).

Removed

• Remove confirmed dead code (#64).
• Remove unused Rust SDK dependencies (#67).
• Eliminate redundant Rust clones (#68).
• Remove agent project mirroring workaround (#70).

Fixed

• Guard module test inventory against release manifest (#57).
• Reject unsupported run log following (#59).
• Correct policy conformance architecture notes (#66).

Security

• Published server images run as non-root users, include provenance and SBOM
  attestations, and ship with a localhost-only, read-only Compose example.
• Hosting the images on an untrusted network still requires a production
  AuthAdapter and carefully scoped bootstrap grants; development auth and the
  insecure-demo override are not production-safe.

Known limitations

• This remains a prerelease. Protocol, CLI JSON, Rust APIs, and persisted
  formats may change before 1.0, and general workspace/Hub migrations are not
  available yet.
• Hub production sessions and login UI remain incomplete. WorkOS sealed
  sessions, IdP login, and a production authorization-provisioning path are not
  shipped in this release.

Install sorrel-cli 0.1.0-alpha.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/MGRAFF2006/sorrel/releases/download/v0.1.0-alpha.2/sorrel-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/MGRAFF2006/sorrel/releases/download/v0.1.0-alpha.2/sorrel-cli-installer.ps1 | iex"

Download sorrel-cli 0.1.0-alpha.2

File	Platform	Checksum
sorrel-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
sorrel-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
sorrel-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
sorrel-cli-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
sorrel-cli-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

Run the Sorrel server images

This release also publishes public Linux amd64/arm64 images for the Hub API and browser host. For a localhost preview, download and verify the release deployment files:

curl -LO https://github.com/MGRAFF2006/sorrel/releases/download/v0.1.0-alpha.2/sorrel-server.compose.yml
curl -LO https://github.com/MGRAFF2006/sorrel/releases/download/v0.1.0-alpha.2/sorrel-server-images.txt
curl -LO https://github.com/MGRAFF2006/sorrel/releases/download/v0.1.0-alpha.2/sorrel-server-assets.sha256
sha256sum --check sorrel-server-assets.sha256

Start the localhost-only development stack:

SORREL_VERSION=0.1.0-alpha.2 \
SORREL_HUB_ALLOW_INSECURE_DEV_AUTH=1 \
docker compose --file sorrel-server.compose.yml up --detach --wait

The insecure development-auth flag is suitable only for this localhost preview. Before exposing Sorrel to an untrusted network, configure a production AuthAdapter and network controls and leave that flag disabled. See the deployment boundary and getting-started guide for details.

Sorrel v0.1.0-alpha.1

Sorrel v0.1.0-alpha.1

First coordinated, local-first developer preview of the Sorrel monorepo.

Added

• A Rust content-addressed engine with BLAKE3 object ids, filesystem and
  in-memory stores, trees, snapshots, changes, stat-cache-assisted
  materialization, history traversal, lanes, stacks, and sync closure helpers.
• Three-way snapshot and line merge with merge-base discovery, persisted
  Conflict/MergeResult objects, and CLI merge --continue/--abort flows.
• A persistent sorrel CLI covering repository initialization, status, diff,
  history, changes, lanes, stacks, grants, SecretSpec-backed secret management,
  devenv-aware environments/workflows, structured local run logs, slices,
  remotes, push/pull, and stable --json output.
• Incremental Git import/export plus colocated bidirectional sorrel git sync;
  true divergence is parked on a normal Sorrel lane for explicit resolution.
• Canonical sorrel.protocol.v0 schemas, examples, compatibility documents,
  and a checksum-protected policy-conformance manifest shared across Rust and
  JavaScript consumers.
• A filesystem-backed Hub API for projects, administration metadata,
  proposals, review comments, workflow runs, lane submission, and negotiated
  content-addressed sync.
• Hub installation seams: /capabilities, /session, development, WorkOS,
  and OIDC/JWKS AuthAdapters, non-loopback bind safety, and an optional Convex
  metadata schema/mirror for open-proposal counts.
• A shared SolidJS Hub product UI (sorrel-hub-ui) with project-first
  navigation, Reviews and Sync views, a Convex/Hub live-count fallback, and a
  thin Vite browser host (sorrel-hub-web).
• Experimental local-process and Docker/Podman workflow runners, a versioned
  workflow parser, Core-policy gates, JSONL execution logs, and redaction. The
  CLI can resolve keyring, dotenv, and environment SecretSpec providers,
  inject authorized workflow secrets, prefer devenv, and persist redacted run
  records under .sorrel/runs/.
• Experimental Vault schemas/local tooling, TS/JS slice manifests, a persistent
  advisory agent-control plane, a Hub JavaScript client, and a Rust workspace
  wrapper over Core.
• A public static website and developer documentation, a one-command local
  dashboard, Docker Compose previews, deterministic workspace setup, focused
  module checks, documentation drift guards, and a no-mock full-stack E2E.
• A Node 24-based GitHub Actions toolchain using the current checkout and
  setup-node action majors.
• Nord-themed brand marks, a wordmark, and a social banner under assets/,
  with the root README refreshed around the release and documentation paths.

Security

• The Hub binds to loopback by default and refuses development auth or broad
  bootstrap grants on non-loopback addresses unless an explicit insecure-demo
  override is set.
• Object reads and uploads verify content ids; ref updates require complete
  closures and fast-forward/expected-head checks.
• Policy changes are evaluated against previous authority, and conformance
  vectors prevent self-grants, unsigned escalation, and scope broadening.
• Secret values remain outside Sorrel objects. CLI resolution and injection
  happens only after Core grant checks, includes an explicit SecretSpec audit
  reason, and redacts persisted output.

Known limitations

• This is a prerelease. sorrel.protocol.v0, CLI JSON, Rust APIs, and persisted
  formats may change before 1.0; automatic workspace/Hub migrations do not yet
  exist.
• Hub production sessions and login UI are incomplete. WorkOS sealed sessions,
  IdP login, and a production authorization-provisioning path are not shipped.
• The Vault has no production or hosted backend. The standalone runner library
  does not inject values; the CLI integration does so through SecretSpec under
  Core grants. Full devenv task mapping and run logs --follow are not shipped.
• There is no stable C ABI, N-API, WASM, or daemon embedding surface; SDKs are
  intentionally small and desktop/mobile applications are not shipped.
• Hub lists are unpaginated, typed uploaded objects are not schema-validated,
  and merge queue, hosted compute, virtualized review diffs, and sophisticated
  conflict resolution remain future work.