HEPHA v0.1.0-alpha.2 — Public Alpha

HEPHA v0.1.0-alpha.2

This public-alpha security refresh supersedes v0.1.0-alpha.1. It contains the
same HEPHA product capabilities and public-launch documentation, with patched
versions of dependencies identified by GitHub immediately after publication.

Security refresh

• Updated Mermaid to the current compatible patched release.
• Updated DOMPurify and Browserslist to patched runtime dependency versions.
• Updated shell-quote, undici, PostCSS, and the affected esbuild range used by
  development and test tooling.
• Enabled GitHub private vulnerability reporting, dependency alerts, and
  automated security updates.
• Protected master with required pull requests, strict status checks, linear
  history, resolved conversations, and force-push/deletion prevention.

GitHub reported zero open Dependabot alerts on master after the dependency
update merged through the protected pull-request workflow.

Verification

• Public release audit: passed with zero warnings and zero failures.
• Type checking: passed.
• Automated tests: 801 files, 6,160 passed, 1 todo.
• Production build: passed.
• Required pull-request checks: passed.

The release tag is created only after the post-merge master checks pass.

Upgrade from alpha.1

No HEPHA workflow or SQLite schema migration is introduced by this release.
Check out v0.1.0-alpha.2 and run:

pnpm install --frozen-lockfile

As with every early-alpha update, back up local .hepha/ state before moving
between versions.

Known limitations

HEPHA remains early-alpha, local-first software. Interfaces and storage
contracts may change before beta. The live supervised clean-clone walkthrough
remains a disclosed follow-up; its automated synthetic-demo verification
passes. See the README and roadmap for the supported environment and current
direction.

Paulo Aboim Pinto

HEPHA v0.1.0-alpha.1 — Public Alpha

HEPHA v0.1.0-alpha.1

Superseded by v0.1.0-alpha.2, which refreshes dependencies in response to
the security alerts GitHub identified immediately after publication.

This is HEPHA's first public alpha from its sanitized repository history. It is
published as a prerelease so early users can evaluate the supervised workflow
while interfaces and storage contracts are still evolving.

What is included

• The local-first HEPHA dashboard and durable TypeScript orchestrator.
• EPIC, FEAT, phase, and task workflows backed by portable MemoryBank files.
• Human-supervised Deep-Dive, feature refinement, implementation, review,
  remediation, and acceptance flows.
• Local provider configuration and task-aware model routing.
• Evidence-oriented delivery status, automated tests, and release auditing.
• A synthetic supervised-demo project and public onboarding documentation.
• MIT licensing, contribution guidance, governance, and security policies.

Verification

The clean repository root and the release-preparation commit were tested on
Linux and in GitHub Actions with Node.js 24 and pnpm 11. The release audit,
Gitleaks scan, type checking, 6,160 automated tests, production build,
synthetic-demo generator, and demo verifier passed. The clean fresh-clone scan
reported no secrets.

Known limitations

• HEPHA is early-alpha software. Interfaces, workflow contracts, and SQLite
  schemas may change before beta.
• Linux or WSL is the supported development environment for this release.
• The product is currently optimized for a local, single-maintainer workflow;
  organizational and multi-user controls are planned.
• A live supervised walkthrough from the sanitized fresh clone remains a
  public-launch gate. The non-interactive synthetic-demo verification passes.
• Some delivery-verification screenshots are intentionally marked as legacy
  until the evidence contract is revalidated end to end.
• Performance or delivery-acceleration claims are not part of this release.
• master is protected by required pull requests and the Typecheck, Unit Tests, and Web Coverage checks. The current one-maintainer policy does not
  require a second person's approval.

Installation

Use Node.js 24 and pnpm 11:

git clone https://github.com/aboimpinto/AgenticDevelopmentProcess.git
cd AgenticDevelopmentProcess
pnpm install
cp .env.example .env
pnpm dev:all

See the repository README and the supervised-demo guide for the complete
onboarding path. Never commit provider credentials or local HEPHA databases.

Migration and recovery

This is the first alpha from the sanitized history, so there is no supported
Git migration from the former private repository history. Existing local
HEPHA SQLite data is intentionally ignored by Git. Back up .hepha/ before
trying a later alpha and expect storage migrations to remain provisional until
beta.

The repository became public only after an explicitly supervised launch gate.

Paulo Aboim Pinto