DevHub v1.0.0-rc.6

DevHub v1.0.0-rc.6 community release

This release publishes the privacy-scanned community snapshot for DevHub v1.0.0-rc.6, including the optional owner-only Sites companion workflow. Preview remains the default, and creating, publishing, rolling back, or removing a Site remains a separate explicit owner action.

Exact provenance

• public commit: 0bbb5eb87d1e00b671b727d01df9ac319b6baf6e
• public Git tree: 6056ab9ae31c93c230ffe4f83aee41068a9e2cb1
• public manifest SHA-256: 47217e0f1a98628fa23aa4a0a349d8ee1f794b4d0a61e7164496982d5f24e078
• private annotated tag object: 0220182354fa1c89e1310ab3fffcb69c33203dd8
• private source commit: 82b7b1dcc0d1ee0d9f2866a15530bbd231b71017

The public tree contains only the generic devhub plugin in the devhub-community marketplace. It contains no owner hosting metadata, Site project ID, private endpoint profile, connection binding, credential, or private catalog.

Install after the public annotated tag exists

codex plugin marketplace add MrUversky/devhub-core --ref v1.0.0-rc.6
codex plugin add devhub@devhub-community

Use the checksummed CLI runtime, installer, SHA256SUMS, and RELEASE-EVIDENCE.json from this same release. The plugin supplies guidance; it does not install the DevHub runtime by itself.

Evidence and limitations

Exact-main CI passed on Linux Node 22/24, macOS CLI smoke, the narrow Windows CLI/path job, and deterministic checksums/SBOM. The Windows result does not claim a user-wide installer, local discovery, dashboard service, recovery lifecycle, or service installer. This release performs no Sites deployment, account change, provider call, public ingress, production change, or automatic update.

DevHub v1.0.0-rc.5

DevHub v1.0.0-rc.5 community prerelease

This prerelease packages the reviewed Codex-led community bootstrap from one
immutable public source snapshot. The proposed annotated public tag
v1.0.0-rc.5 must peel to public commit
0520069df543a6c405365afc4128e291b582cbdf, whose Git tree is
8a1e824e835e255f7f553a84212996730b8680e0.

Provenance

• Public repository: MrUversky/devhub-core
• Public parent: 2ad2e5743c59b21bcc557655d02695418738d81f
• Public manifest SHA-256: 0f58855810e5c637fc65aabae77acf8e1e5c1c52d7ad3b9f5a40e450abe224a3
• Approved private tag object: 3ab0fbd8773aa07734c61439c7bd90ede1ea8736
• Approved private source commit: 7b3552406df64dc19f660a1ccde20b72b7489561
• Release evidence records a clean, privacy-scanned 329-file public manifest
  and version 1.0.0-rc.5.

Outcome

From the exact public tag, Codex can verify the release assets and
workflow/install doctors, create a separate user-owned Git catalog, run
selected-only onboarding and isolated apply, and deploy a read-only dashboard
and MCP either through loopback Docker or one explicitly reviewed private Linux
systemd host. Every write boundary remains separately approved; the release
does not introduce another setup engine, review database, provider
authorization flow, public ingress, resident agent or unattended updater.

The devhub-community marketplace contains exactly one generic devhub
plugin (0.7.0-alpha.5). It contains no private endpoint profile, and portable
release source contains no .openai/hosting.json metadata.

Verified release assets

Asset	SHA-256
RELEASE-EVIDENCE.json	eccdb7a0ab7a71ee8d36dec9bdb7bea11611b8ba6551a0eed730b41a201b91a7
SHA256SUMS	a2bb7750f4f40d7018eda7623e1d72cdffd85862a86bbab565d3baf35af6ad65
devhub-self-hosted-v1.0.0-rc.5-source.tar.gz	7f3b5353e4bde322dac15e54a9545f37a8d913a61e5c381591f152884ddee233
devhub-cli-v1.0.0-rc.5.tar.gz	3a0bbcdca5eb6cb2ee9c007b20dfc6ae87c57200111ad3993a640d91bc23cba1
devhub-install-v1.0.0-rc.5.mjs	1c60605ea58aadb23b948ca9ab8fbf81bf5b610893e116c22210a59bad0ad27e
devhub-self-hosted-v1.0.0-rc.5-sbom.cdx.json	768d86f7f4290a24f37c710cf61f2ba44df6a42d40e779b5ba517fc1dc7018ce
RC-GATE-EVIDENCE-Linux.json	cdfd49a99babc8c4b0d4439606f8d67bf270bad5a4f6ddfa2362cd35f383e679
RC-GATE-EVIDENCE-macOS.json	3e5d84d708a5ad4a6d7291ea0f986f57bacdeef896d8dd7c0e5362c8f8532719
WINDOWS-CLI-PATH-EVIDENCE.json	ab1bfd22e45f2f918d7428bfe7b06c7081c91bde41b96d5425fa82fef64af30a

The macOS and Linux reports pass all 22 clean-room checks. The Windows report
is intentionally limited to canonical source-manifest, CLI and external-path
coverage; this release does not claim Windows user-wide installation, local
discovery, dashboard service operation, recovery lifecycle or a Windows
service installer.

Remaining publication proof

Publication does not deploy DevHub or modify Sites, providers, production,
plugins, user configuration or HappyPass. After the annotated public tag and
these exact assets are published, issue #118 still requires a fresh isolated
Codex install from remote --ref v1.0.0-rc.5 before the end-to-end community
bootstrap can be considered complete.

DevHub v1.0.0-rc.4

DevHub v1.0.0-rc.4 community candidate

This candidate is the public, privacy-scanned handoff of application version 1.0.0-rc.4.

Exact provenance

• private annotated tag object: 1e9b8b788b13ac51d5b644e55d3b8c93c08124c1
• private source commit: facc67efdcbc9b626f256db8d34473531e4788c6
• public base commit: 9a38124e1c9e67c361ee135d9d4516b82be5b0e1
• pre-merge promotion commit: 8cec5ae9e2342a4692a62f905879909e165df6de
• public tag and release commit: 2ad2e5743c59b21bcc557655d02695418738d81f
• public Git tree: e283d619ab1f7c2b16bd17cf2d35ba89c206f609
• public manifest SHA-256: 390f63af21569e622da27dfabbb65928c785981dc2043313c34d22e07ee51ab4

Assets

• RC-GATE-EVIDENCE-Linux.json: da266f81b1fb58039f6fcc62d6bc4f8707afde706097bfd7e3c3bc90f326b0e4
• RC-GATE-EVIDENCE-macOS.json: 217cf6022789dc5fa7915cf8f5bda1356c487b1d8d2d65cc00a219b2e30e44f9
• RELEASE-EVIDENCE.json: c9f1f344709736cdd73bfb43ccdb7268393004c83ab1f7d569d29344a6674758
• SHA256SUMS: 402278b188b88efe5b0a02f790316af21337542843704a66888c293e94b7484e
• WINDOWS-CLI-PATH-EVIDENCE.json: f95481699d5c2d0fa24832cf9a23278ccba5da463eb95f14f1d13b9e8c62d69b
• devhub-cli-v1.0.0-rc.4.tar.gz: 631e271becc535c0e3fa2c0cce01bf97d2e2cfa237dc59bd8699acdeda0aa04f
• devhub-install-v1.0.0-rc.4.mjs: 1c60605ea58aadb23b948ca9ab8fbf81bf5b610893e116c22210a59bad0ad27e
• devhub-self-hosted-v1.0.0-rc.4-sbom.cdx.json: f6272d807be958f16020d1b64ee5da2b568fed053c0d0e5953674deb308f1aa5
• devhub-self-hosted-v1.0.0-rc.4-source.tar.gz: ce036b261bd94d4c3d71059b86018f1871f393e4d13f5ab89e2d9b78a95afe74

Install after separate public tag approval

codex plugin marketplace add MrUversky/devhub-core --ref v1.0.0-rc.4
codex plugin add devhub@devhub-community

Record a fresh isolated run of both commands against the remote tag after the
public tag and release exist. The staged-tree install gate cannot substitute for
that post-publication smoke.

The plugin is guidance only. Install and verify the separately checksummed user-wide CLI before provider I/O.

Rollback and retry

After publication, roll back only by reverting public commit 2ad2e5743c59b21bcc557655d02695418738d81f; never rewrite the annotated public tag. The pre-merge promotion commit remains provenance evidence for the reviewed snapshot but is not the commit on public main after the squash merge.

DevHub v0.7.0-alpha.1

DevHub v0.7 turns external provider facts into narrow, reviewable evidence candidates.

Highlights:

• provider-neutral, fail-closed read-only evidence adapter contract
• GitHub Release, Actions deployment, and workflow-monitoring pilots
• collect-evidence and binding-aware Portfolio Guardian review
• review questions for deployment drift, stale recovery evidence, and possible recurring costs
• exact catalog/service/repository preflight with environment-only credentials
• no enumeration, writes, restart, rollback, deletion, or automatic remediation

Evidence remains transient until a reviewed YAML diff is merged. Dashboard and MCP continue to expose only the reviewed catalog.

Release assets include a deterministic sanitized source archive, CycloneDX 1.5 SBOM, SHA-256 checksums, and provenance evidence.

DevHub v0.6.0-alpha.1 — Operational Guardian

DevHub now helps multi-project builders understand not only what is running, but whether each service is owned, monitored, affordable, and recoverable.

Highlights:

• App Passport with evidence-backed readiness states
• read-only Portfolio Guardian with actionable gaps and no magic score
• Recovery & ownership guidance in the dashboard
• one-command catalog initialization
• portable Codex workflow and read-only MCP
• deterministic, privacy-scanned source artifact, SBOM, checksums, and release evidence

This public release was created from a sanitized snapshot with fresh history. It contains fictitious demo data only.

DevHub v0.5.0-alpha.1

First public self-hosted alpha from a deterministic privacy-scanned snapshot with fresh Git history.

Highlights:

• runtime-agnostic catalog for apps, APIs, workers, bots, databases and local tools
• honest live, reported, catalog-only and cross-device status
• canonical/fallback endpoints and clear Here / Other device / Unknown placement
• App Passport preview for evidence-backed monitoring, recovery, security, ownership and cost
• read-only dashboard, CLI and MCP; reviewed Git diffs remain the mutation boundary
• non-root Docker and portable systemd deployment
• deterministic source archive, CycloneDX SBOM, checksums and release evidence

This is an alpha. Keep the dashboard on loopback, a private network or behind an authenticated reverse proxy. MCP may additionally use bearer authentication.