v0.1.1

Changelog

• 45c380c: chore(community): Discussions link, starter issues, AGENTS.md maintainer reframe (AD-8) (#114) (@Reederey87)
• 7d81415: feat(ci): make the spec-drift/work-log gate advisory on fork PRs (AD-8) (#116) (@Reederey87)
• b4a684d: feat(release): SLSA v1 build provenance for release artifacts (P4-SEC-05 / P4-QUAL-05) (#117) (@Reederey87)
• 987c8e7: feat(release): cosign keyless signing + per-archive SBOMs (P4-SEC-05 / P4-QUAL-05) (#115) (@Reederey87)
• eb73e94: feat(release): dormant Apple notarization config + enrollment runbook (P4-SEC-05 remainder) (#119) (@Reederey87)

---

Built with GoReleaser. Verify downloads against checksums.txt, or install via
brew install Reederey87/devstrap/devstrap or the scripts/install.sh one-liner.
checksums.txt is keylessly signed with cosign (Fulcio cert + Rekor log) and every
archive ships an SPDX SBOM — see "Verify a download" in the README.

v0.1.1-rc.1

Changelog

• 45c380c: chore(community): Discussions link, starter issues, AGENTS.md maintainer reframe (AD-8) (#114) (@Reederey87)
• 7d81415: feat(ci): make the spec-drift/work-log gate advisory on fork PRs (AD-8) (#116) (@Reederey87)
• b4a684d: feat(release): SLSA v1 build provenance for release artifacts (P4-SEC-05 / P4-QUAL-05) (#117) (@Reederey87)
• 987c8e7: feat(release): cosign keyless signing + per-archive SBOMs (P4-SEC-05 / P4-QUAL-05) (#115) (@Reederey87)
• eb73e94: feat(release): dormant Apple notarization config + enrollment runbook (P4-SEC-05 remainder) (#119) (@Reederey87)

---

Built with GoReleaser. Verify downloads against checksums.txt, or install via
brew install Reederey87/devstrap/devstrap or the scripts/install.sh one-liner.
checksums.txt is keylessly signed with cosign (Fulcio cert + Rekor log) and every
archive ships an SPDX SBOM — see "Verify a download" in the README.

v0.1.0

Changelog

• 87557bd: feat(agent): macOS Seatbelt sandbox for agent run (P4-GIT-03 slice 1) (#107) (@Reederey87)
• 0ae78ac: feat(hub): local-folder / cloud-drive-folder carrier completes AD-1 (#106) (@Reederey87)
• 257b137: fix(agent): fail closed when the sandbox home anchor cannot resolve (#109) (@Reederey87)
• 3249dbc: fix(release): pin GORELEASER_CURRENT_TAG for the rc → stable same-commit flow (#108) (@Reederey87)

---

Built with GoReleaser. Verify downloads against checksums.txt, or install via
brew install Reederey87/devstrap/devstrap or the scripts/install.sh one-liner.

v0.1.0-rc.2

Changelog

• 87557bd: feat(agent): macOS Seatbelt sandbox for agent run (P4-GIT-03 slice 1) (#107) (@Reederey87)
• 0ae78ac: feat(hub): local-folder / cloud-drive-folder carrier completes AD-1 (#106) (@Reederey87)
• 257b137: fix(agent): fail closed when the sandbox home anchor cannot resolve (#109) (@Reederey87)
• 3249dbc: fix(release): pin GORELEASER_CURRENT_TAG for the rc → stable same-commit flow (#108) (@Reederey87)

---

Built with GoReleaser. Verify downloads against checksums.txt, or install via
brew install Reederey87/devstrap/devstrap or the scripts/install.sh one-liner.

v0.1.0-rc.1

Changelog

• 9290890: Bootstrap DevStrap Go workspace (Reederey reederey@Reedereys-Mac-Studio.local)
• 5a4b217: Bump actions/checkout from 5.0.1 to 7.0.0 (#5) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• ea9e8ca: Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 (#9) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• c3c281f: Bump golang.org/x/text from 0.36.0 to 0.38.0 (#6) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• 27502f6: Clarify agent branch workflow (Reederey reederey@Reedereys-Mac-Studio.local)
• e982c05: Implement second-pass audit recommendations (P0 + medium severity) (#4) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• fd5b7e7: Initial commit (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 80c1e5a: chore(deps): Bump golangci/golangci-lint-action (#7) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• 66f40b2: chore(deps): Bump modernc.org/sqlite from 1.50.1 to 1.53.0 (#8) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• 76b98d6: chore(deps): Bump the github-actions group with 2 updates (#14) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• 3e54bc0: docs(agents): document the live-R2 dogfood credential convention (#84) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• e535024: docs(agents): rewrite AGENTS.md into concise branch/worktree/PR guidance (#42) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 835dcb3: docs(audit): sixth-pass design & implementation audit (post-PR-#25) + spec recommendations (#28) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 4366cce: docs(audits): Pass-6 status reconciliation — 30 SHIPPED markers, status banner, spec count refresh (#86) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 8927bd5: docs(claude): commit the model-selection policy + Pass 6 field notes (#43) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 36e970d: docs(claude): report-only nudge rule + pre-commit re-diff check for delegated worktrees (#53) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• d0b696a: docs(cli): document the shipped r2:// hub path; stop steering to the file hub (P6-CLI-05) (#47) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 577af16: docs(hub): record the live git-carrier GitHub dogfood run (AD-1, spec/19 F.2) (#98) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 158934a: docs(quickstart): make the git carrier the default hub; demote r2:// to scale-up (AD-1 swap) (#99) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 8ffad5f: docs(spec): accuracy sweep — flip two shipped pass-6 sections, fix the command list, drop a phantom flag (#52) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• d3d1e8a: docs(spec): pass-6 verification + architecture-direction revision of the full spec corpus (#29) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• a6d30d8: feat(agent): gate agent pr on run status + reconcile crash-stuck running rows (P6-GIT-06) (#93) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• d9a8312: feat(cli): ssh-add remedy hint on auth-class exits (#104) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 756992b: feat(db): full backup/restore for the whole workspace secret set (P6-DATA-04) (#83) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• ed6313f: feat(devices): device-key fingerprint + compare-and-confirm on approve (P4-SEC-04 part 1) (#54) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 5541df5: feat(devices): joiner-side founder pinning before first sync (P4-SEC-04 joiner half) (#49) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 9940810: feat(devices): one-paste pairing codes (P4-SEC-04 part 2, closes the residual) (#57) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 5b5728d: feat(dist): Homebrew cask + curl|sh installer + completions packaging (AD-8 / P4-PROD-05) (#105) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• ba83d82: feat(doctor): workspace-id mismatch detection + hub prefix-isolation tests (P4-SEC-07) (#50) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 6e6c8db: feat(hub): bounded errgroup fan-out for R2Hub.Push and referenced-blob pushes (P6-HUB-03) (#88) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 36c0661: feat(hub): devstrap hub init writes the carrier hub into config (AD-1 slice) (#101) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 5cc82fc: feat(hub): hub compact — snapshot production, floor advance, cold-event deletion (P4-HUB-11) (#74) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 4937691: feat(hub): keychain/op:// S3 credential custody + auth error hint (P6-HUB-02) (#45) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• bd3aeed: feat(hub): migrate-events + advisory sweep lock + dedup-PutBlob freshness (P4-HUB-12 residual) (#76) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• d4daa21: feat(hub): wire the live R2/S3 S3 adapter behind hubFromOptions (P5-HUB-01) (#24) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 5711a57: feat(hub): zero-infrastructure private-git-repo carrier (AD-1 first slice) (#96) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 81e0754: feat(init): adopt the founder's workspace id (--workspace-id) (P4-SEC-07) (#48) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 24dccf8: feat(keys): periodic WCK rotation — manual command + age-triggered auto-rotate (P4-SEC-07 remainder) (#56) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• a8fa2ba: feat(run-loop): implement the advertised idempotent scan stage (P6-XP-03) (#82) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 1a13271: feat(scan): compile the prune matcher from the root .devstrapignore (P6-XP-06) (#92) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 68086af: feat(sync): address workspace keys by (epoch, kid) so colliding keys coexist and grants never overwrite (P6-SEC-01b/c + P6-SEC-02) (#33) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• e3cbb56: feat(sync): enc.v2 — bind the full carrier tuple into the AEAD AAD (P6-SYNC-04) (#44) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 8c739b8: feat(sync): envelope-encrypt the namespace-map event log (P4-SEC-02 + P4-SEC-07 foundation) (#25) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• a9440ae: feat(sync): signed per-device sync acks + tombstone GC + revoked-stream cleanup (P6-HUB-04 completion, P4-SYNC-06 narrowed) (#75) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 746fbbf: feat(sync): snapshot + retention wire format and hub snapshot plane (P4-SYNC-02 part 1, P6-HUB-04 format) (#65) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 4b7e0d1: feat(sync): snapshot import + ErrSnapshotRequired recovery (P4-SYNC-02 part 2) (#73) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 2fe8f2c: feat(sync): transport cursor decoupled from HLC — per-device Seq pull plane (P5-SYNC-01) (#59) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 20b1367: feat: implement cloud-sync audit workstreams EAGER/DRAFT/HUB/XP (#16) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• cb824b9: fix(agent): diff agent runs against the recorded base SHA (P6-GIT-02) (#66) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• b804cce: fix(cli): gate scan --adopt on the workspace root (P6-CLI-02) (#40) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 652326d: fix(cli): make --quiet suppress progress chatter; results and errors still print (P6-CLI-04) (#90) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• e10b41e: fix(cli): wire every usage-error class to exitUsage=10 (P6-CLI-03) (#89) (Artem Matskevych <52060443+...