Quoin v0.29.4

What's Changed

• spec: draft positive owner qualification for Quire evidence (PLAT-1196) by @kreneskyp in #728
• Handle explicit composite relationship metadata by @kreneskyp in #729

Full Changelog: v0.29.3...v0.29.4

Quoin v0.29.3

What's Changed

• Remove digest pins from quoin workflows by @kreneskyp in #710
• Fix clippy assert_is_empty lints for newer toolchains by @kreneskyp in #715
• Remove digests, pins, revisions and seals from Quoin; bump quire-rs and engineering-assurance by @kreneskyp in #716
• Remove recorded evidence data, oracle replay tests and ceremony floors by @kreneskyp in #717
• Remove the assurance source repository and revision; bump quire-rs by @kreneskyp in #718
• Remove recorded commits, revisions and sizes from evidence, audit, measurement and semantic sweep by @kreneskyp in #719
• Remove recorded attestation output size and stored commits by @kreneskyp in #721
• Bind live acceptance criteria to real tests; withdraw FR-098 replay criteria by @kreneskyp in #720
• Remove duplicate graph producer source revision by @kreneskyp in #722
• Remove producer.corpus_revision from graph-quality intake by @kreneskyp in #723
• Remove recorded scorer and extractor revisions from graph-quality intake by @kreneskyp in #724
• Fix stale producer-tuple comment in graph portfolio test by @kreneskyp in #725
• Bind FR-066 graph adapter criteria with trace attributes by @kreneskyp in #726
• Release Quoin 0.29.3 with ix-flow error envelope fix by @kreneskyp in #727

Full Changelog: v0.29.2...v0.29.3

Quoin v0.29.2

What's Changed

• QSL-1224: remove the language-boundary gate and Rust-port policy pieces by @kreneskyp in #698
• QSL-1224: remove FR-100/FR-103 gate and enforcement-run residue by @kreneskyp in #699
• spec(FR-103): remove port/delete disposition language (QSL-1224) by @kreneskyp in #700
• Remove the executable SHA-256 pin from the engine boundary by @kreneskyp in #701
• spec: finish removing data_schema digest leftovers by @kreneskyp in #702
• Restore review files edited by #701 by @kreneskyp in #704
• fix(spec-review): enforce P0 hash/digest/pin findings; release 0.29.2 by @kreneskyp in #703

Full Changelog: v0.29.1...v0.29.2

Quoin v0.29.1

Quoin now owns and ships its review and planning workflow files beside its agent plugin skills. Normal installations no longer require the archived private ix-spec-workflows repository or package. The native executable supplies their Rust validation provider.

• Agents and CI run the installed skill through ix-flow run review --path <skill-directory> (or to-plan), using published ix-flow 0.3.1 or newer.
• The Quoin convenience launchers take an explicit --path and initialize repository context. Workflow files are read directly; the binary does not embed or extract them.
• Validate actual review/plan documents using the installed catalog. Base review is mandatory; selected lenses and current AssuranceProfile review policies are checked.
• Revalidate evidence before explicit human acceptance. Existing runs and reviews are preserved without backfilling acceptance.
• Native archives on all four supported targets and the public npm launcher now run behavioral workflow smoke tests with a copied installation of the released plugin files.
• Claude and Codex plugin versions are 0.29.1. Updated setup instructions explain migration and legacy inventory.
• Update vulnerable dependencies and replace the unmaintained YAML implementation with its maintained successor.

Update the Quoin CLI and plugin together, install ix-flow >=0.3.1, and start a fresh agent session to load the updated skills. The workflows require their normal installed schema catalog; workflow ownership does not eliminate catalog prerequisites.

Source verification: 2,028 workspace tests passed; formatting, all-target/all-feature Clippy, cargo-deny and direct-plugin and relocated-binary workflow lifecycle smoke passed. Release archive and published npm smoke results are tracked in their release workflow runs.

ix-flow 0.3.1 fixes CRLF frontmatter parsing. The lifecycle checks now exercise both LF and CRLF skill files, and Windows workflow behavior is checked before tagging. The 0.29.0 tag remains an unpublished candidate whose Windows gate caught this defect.

Windows npm installations: use ix-flow 0.3.3 or newer. This supports npm-generated .cmd invariant providers and fixes the 0.3.2 bundle startup failure. Publication is gated by actual built-CLI provider lifecycles on Windows, including local/global npm installations and PATH/explicit launcher paths. Native executables work with ix-flow >=0.3.1; do not use 0.3.2.

Quoin v0.28.4

What's Changed

• fix(skills): ship a usable SpecReview contract pointer in 0.28.4 by @kreneskyp in #691

Full Changelog: v0.28.3...v0.28.4

Quoin v0.28.3

What's Changed

• Use shared ix-cli-kit outcomes and canonical JSON by @kreneskyp in #675
• Correct CLI kit review artifact schema by @kreneskyp in #676
• Refresh Discord invite link by @kreneskyp in #678
• Add IX agent skills badge beside Discord by @kreneskyp in #682
• Add plugin setup and scoped community help by @kreneskyp in #683
• PLAT-1156: remove update-log producers and prepare 0.28.3 by @kreneskyp in #685
• Align Quoin default catalog with ISO 0.3.0 by @kreneskyp in #686

Full Changelog: v0.28.1...v0.28.3

Quoin v0.28.1

What's Changed

• chore: delete recorded versions from workflows by @kreneskyp in #672
• chore: second-sweep removal of recorded versions, SHAs and pins by @kreneskyp in #673
• chore: release 0.28.1 by @kreneskyp in #674

Full Changelog: v0.28.0...v0.28.1

Quoin v0.28.0

What's Changed

• chore: delete recorded pins, toolchain manifests and captured revisions (sweep B) by @kreneskyp in #670
• chore: semantic-core 0.3.2; derive shipped version from the bundle by @kreneskyp in #671

Full Changelog: v0.27.1...v0.28.0

Quoin v0.27.1

What's Changed

• chore: delete unused engine::Version and recorded bench revisions by @kreneskyp in #666
• chore: delete workflow action SHA pins and toolchain literals by @kreneskyp in #667
• test: delete workflow toolchain census from tc_375 by @kreneskyp in #668
• chore: release v0.27.1 by @kreneskyp in #669

Full Changelog: v0.27.0...v0.27.1

Quoin v0.27.0

What's Changed

• fix(release): publish to npm via OIDC Trusted Publishing only by @kreneskyp in #657
• chore: delete tracking leftovers after #654; withdraw untested FR-043 criteria by @kreneskyp in #658
• chore: bump EA and spec modules to digest-free mains; reject data_schema digest by @kreneskyp in #659
• chore: delete schema_digest reads of the quire assurance export; move quire-rs pin to 4f1af21 by @kreneskyp in #660
• chore: delete semantic export digests by @kreneskyp in #661
• chore: delete the registry semantic pin and quoin-semantic's unused sha2/hex by @kreneskyp in #662
• chore: delete recorded revisions, digest pins and reviewed-revision ledgers by @kreneskyp in #663
• chore: drop the module version from the schema base by @kreneskyp in #664
• chore: release v0.27.0 by @kreneskyp in #665

Full Changelog: v0.26.1...v0.27.0