Skip to content

v0.3.0 — first public release

Latest
Latest

Choose a tag to compare

View all tags
@Jppblue Jppblue released this 14 Jul 12:17
v0.3.0
652b117

Local, metadata-only proof bundles from your git history. Your source code never leaves your machine.

@redential/cli turns the git history you already have — including private, NDA-bound employer repos you could never share — into a verifiable, privacy-preserving credential: commit cadence, languages, technical categories, ownership share, and detected skills, as bounded aggregates. Nothing free-form derived from your code can ever appear in the output.

What's in 0.3.0

The headline: structural skill detection (the "proof graph"). Instead of only matching imports ("this repo touched Stripe"), the CLI now parses your TypeScript locally, builds an in-memory graph of code relations, and verifies connected patterns — e.g. webhook signature verification → database write → idempotency guard — across six payment providers (Stripe, PayPal, Mercado Pago, Lemon Squeezy, Paddle, and RevenueCat in-app purchases).

  • redential explain <skill> — a new local-only command that shows why a skill was detected: which anchors matched, in which files, how they connect, and whether the work is attributable to you. Runs entirely on your machine; writes nothing; sends nothing.
  • Two new optional bundle fields (evidence: "structural", confidence: "direct" | "inferred") under bundle schema 1.2.0 — closed enums, additive and backward-compatible. These two words are the entire surface the proof graph exposes outward: no file paths, no function names, no graph structure, ever. An ambiguous or unattributable pattern is simply never claimed.
  • Fast on real repos: live phase progress on stderr, git-level author filtering, and a deterministic work budget that guarantees the analysis always terminates — measured at seconds on 5,000-file production repos.

Full details in the CHANGELOG.

Install

npm install -g @redential/cli

Requires Node.js >= 20. Verified by CI on Linux, macOS and Windows × Node 20/22 on every release.

Quick start

cd your-repo
redential scan                                    # prints the EXACT payload + a local summary
redential explain payments/payment-webhook-flow   # why a skill was (or wasn't) detected — local only
redential login && redential submit               # upload, only after you review and confirm

What scan shows for a structurally-verified skill:

SKILLS DETECTED
frontend/nextjs                  139 commits
payments/payment-webhook-flow     30 commits  ⚡ structural · DIRECT

STRUCTURAL EVIDENCE (proof graph)
payments/payment-webhook-flow — verified connected flow
→ full local evidence: redential explain payments/payment-webhook-flow

Privacy guarantees (the short version)

  • Local: scan and explain make zero network calls — the only commands that ever touch the network are login and submit. Enforced by tests.
  • Bounded output: everything in the bundle is an aggregate, a salted hash, or a member of a closed public vocabulary (taxonomy.json). No source code, no file names, no commit messages, no other contributors' identities, no repo name.
  • User-reviewed: scan prints the exact JSON, byte-for-byte, that submit would send. No hidden fields, no post-review enrichment.
  • Explicit: nothing uploads without you running submit and confirming. No daemon, no watch mode, no telemetry.
  • Honest about trust: local git history is falsifiable, so this credential is explicitly the Attested tier — never presented as Proven or Verified.

Every guarantee maps to executable tests in test/privacy/ — if a change breaks one, the change is wrong, not the test. Deterministic detection, no LLMs, no remote inference. Published to npm with --provenance from GitHub Actions; zero install scripts; two runtime dependencies.

Links

Prior tags (v0.1.0–v0.2.2) were internal iterations; this is the first officially announced release.

Assets 2
Loading