Permesh 0.1.0-alpha.1

Permesh 0.1.0-alpha.1

Know who has access to what.

First public CLI prerelease for evaluation. Permesh discovers and correlates access locally, with read-only providers, no backend and no telemetry.

Download the archive for your OS/CPU and its adjacent SHA-256 file. Verify before extraction; each archive includes the MIT license, dependency notices and installation instructions. See the installation guide.

permesh init --demo
permesh doctor
permesh user alice@example.com
permesh user alice@example.com --json

The offline demo needs no credentials or network. GitHub is installed separately:

permesh provider install github --version 0.1.0
permesh provider update github --check

Installation does not trust or run provider code. Follow the explicit trust/setup/approval guide before querying GitHub. Google directory discovery and demo remain bundled.

Qualification

• Cross-platform CI: fmt, strict Clippy, locked tests, native secret-store exercises and Rust 1.91 minimum.
• Dependency checks: cargo-deny and cargo-audit with fresh advisories.
• Native artifacts: five native test/build/version/demo/package jobs. Published bytes are promoted unchanged from these artifacts.
• Independently checked archive allowlists, file types, SHA-256 checksums, MIT text and dependency notice integrity.
• Downloaded Apple Silicon binary passed demo, exact human/JSON version, public provider installation/update checks, and configuration/trust preservation.
• Read-only GitHub health, canonical-user and privileged-access observations matched the previously validated adapter. Only aggregate outcomes were retained; no organization details, credentials or access reports are included.

Known limitations

This is alpha, not stable v0.1. Binaries are unsigned/unnotarized, with no attestation, SBOM or reproducible-build guarantee. Checksums detect corruption, not publisher authenticity. Linux builds target GNU systems using Ubuntu 24.04 system libraries; older OS compatibility is unqualified.

Interactive Windows/Linux credential-store acceptance, broader live GitHub fixtures and live Google tenant qualification remain open. Google requires externally supplied OAuth access tokens. Observed access is not proof of exhaustive effective authorization. External native code is not sandboxed, and provider protocols remain drafts.

There is no CLI self-update, crates.io or package-manager release. provider update updates provider packages only. AWS, Cloudflare, broader authentication flows, Google provider extraction, and stable-release qualification remain next steps.

Full limitations · Roadmap · Private vulnerability reporting

Revision and build environment

Release tag targets 929ae3e2c69d0cd4cbfb2fdbfce6ed3085f36f69. Its entire tree matches reviewed PR head 0e6792eeb848e86b06eb5fb36ab74affae1885e7 and tested PR merge c8f1e92c05aeea4c81daa073075e2e579ef0de89.

Target	Runner image	Image version
macOS ARM64	macos-15-arm64	20260829.0321.1
macOS Intel	macos-15	20260824.0482.1
Linux x86_64	ubuntu-24.04	20260831.293.1
Linux ARM64	ubuntu-24.04-arm	20260831.111.1
Windows x86_64	windows-2025-vs2026	20260824.214.3

Archive SHA-256

eb2d29b4320535777529ec6fe8326c685ac206dc529d8d2d2b10df74c0a293db  permesh-0.1.0-alpha.1-aarch64-unknown-linux-gnu.tar.gz
183339136a6f0a6a2d6ef09119e32896f837d675e7a105d244f32a807f590908  permesh-0.1.0-alpha.1-x86_64-unknown-linux-gnu.tar.gz
8168852d2b206f73ec9b3fa8cb674a7f435752376976636f915d1c20edcf990a  permesh-0.1.0-alpha.1-aarch64-apple-darwin.tar.gz
a6e80169e55cb636a25d90822396ff53ec00218949896f761b72b833c3324ef5  permesh-0.1.0-alpha.1-x86_64-apple-darwin.tar.gz
93f95259d84983a5a086723dffaefaaf81240281bdc11ca2588680d28634eceb  permesh-0.1.0-alpha.1-x86_64-pc-windows-msvc.zip