ProofDrift v0.0.2 — Hardened Public Preview

ProofDrift v0.0.2 is the hardened public preview of the local-first change-control and evidence layer for coding agents.

Highlights

• Synchronizes all 15 workspace packages at version 0.0.2.
• Adds a self-contained composite GitHub Action with scan/patch exit codes and JSON report-path outputs.
• Adds CI coverage for the action itself in addition to Linux, Windows, macOS, strict Clippy and Rust 1.89 MSRV gates.
• Pins third-party GitHub Actions to reviewed full commit SHAs.
• Automates tag releases with platform archives, SHA256SUMS.txt, an SPDX 2.3 JSON SBOM and GitHub build-provenance attestations.
• Adds public changelog, roadmap, support, governance and release-maintenance documentation.

Verified release artifacts

The tag workflow completed successfully for:

• Linux x64
• Windows x64
• macOS ARM64

The published SHA256SUMS.txt was verified against all four covered assets (three platform archives plus the SBOM). The SPDX SBOM parses successfully and contains 282 packages and 1,137 relationships. gh attestation verify --repo WahuVN/proofdrift succeeds for all three platform archives.

Security boundary

proofdrift run provides L1 brokered control at the direct process-dispatch boundary. This is not an OS/container sandbox. Production stdio/HTTP MCP transport and L2 isolation are still intentionally unclaimed until concrete end-to-end enforcement is available.

Verify a download

sha256sum -c SHA256SUMS.txt
gh attestation verify proofdrift-v0.0.2-linux-x64.tar.gz --repo WahuVN/proofdrift

See CHANGELOG.md, ROADMAP.md, SUPPORT.md, and RELEASING.md in the repository for maintenance and compatibility details.

Full changelog: v0.0.1...v0.0.2