Lineage v1.1.1

Patch release for the current V1 distribution line.

Highlights:

• Refreshed public-facing documentation for current registry, add, workflow, inspect/list/doctor, and bootstrap-prompt behavior.
• Added workspace discovery and inventory support for compiling existing workspaces into Lineage packages.
• Added stable Go required CI coverage and release-policy refinements.
• Fixed explicit zero state schemas, project config schema documentation, Windows provider binary fixture/candidate handling, and legacy materialize state path handling.

Verification:

• Built from a753521 using Go 1.22.12.
• go test ./... passed.
• Five release binaries were built for darwin-amd64, darwin-arm64, linux-amd64, linux-arm64, and windows-amd64.
• checksums.txt was generated and verified with shasum -a 256 -c.

Lineage v1.0.1

Security patch release for the V1 line.

Includes safety hardening for released functionality:

• rejects unsafe manifest name/version characters
• fails closed when registry pull responses omit digest data
• fixes repeated confirmation prompts sharing reader state
• scans bounded prefixes in large files instead of skipping secret content entirely
• prevents add from reporting readiness when enable/setup did not complete
• writes important state atomically
• closes setup TOCTOU gaps
• rejects symlinked package entrypoints
• caps archive extraction size to reduce decompression-bomb risk
• detects materialized skill directory collisions
• keeps disable re-materialization behind confirmation
• recognizes shims by content to avoid recursion
• caps materialized file permissions instead of copying unsafe source modes

This patch intentionally excludes post-v1.0 feature work from develop, including the local graph/snapshot subsystem.

Lineage v1.0.0

The first V1 distribution release: install, publish, pull, inspect, enable, and run a package, end to end, without cloning the repo.

What V1 supports

• Install without cloning: curl -fsSL https://agenticlineage.vercel.app/install.sh | sh (primary path), or go install github.com/agentic-lineage/lineage/cmd/lineage@latest for Go developers.
• Author and publish: lineage login (GitHub OAuth device flow, no admin-minted tokens), lineage package publish <path> against the live registry, with content-addressed digest verification and interruption-safe (draft-then-finalize) uploads.
• Receive and enable, one command: lineage add <ref-or-local-archive> [--yes] - accepts a registry ref or a local .tgz from lineage package export, fetches/imports, shows exactly what it contains (skills, workflows, agents, policies, declared capabilities) and asks permission before enabling. Re-running against an already-present package is a no-op, not an error.
• Non-coder receiver path: a copy-paste prompt (docs/bootstrap-prompt.md, embedded per-package on each /packages/<name> page) that a fresh Claude/Codex session can run unattended - install the CLI, fetch, inspect, enable - reviewed and tested for the prompt-injection boundary (see that file's Verification status section for exactly what was and wasn't tried).
• Package setup playbook: a package can declare tracker files or directories its workflow expects; the receiver sees the plan and approves it before anything is created, and re-running is idempotent.
• Integrity and safety active throughout: secret scanning, path-traversal guards, and independent digest verification run on every publish, pull, and import - the registry's own metadata is never trusted blindly.
• Provider and capability disclosure: /packages and /packages/<name> show which providers (claude/codex) a package declares an entrypoint for and what filesystem/network access it asks for, searchable by provider; the same data is available via lineage inspect --yaml / lineage package validate --yaml for scripting.
• Documentation: README and the website both show the real, current install → publish → pull → enable flow.

What is experimental

• The bootstrap prompt's prompt-injection defenses are verified against one real adversarial test package - a real, useful check, but not a formal security guarantee. Wording changes should be re-verified.
• Package setup covers files and directories only, not simple local databases.

What is explicitly out of scope (non-goals)

• No marketplace, billing, enterprise UI, vector database, or cloud execution - none of this is part of V1 or any currently planned release.
• No enforcement of declared capabilities at runtime - they remain purely declarative (ADR 0006), shown to the receiver before enabling, not sandboxed.
• No fully type-enforced shared state machine across every artifact-processing code path - the CLI behavior is unified (local and pulled artifacts converge on the same inspect/confirm/enable pipeline), but deeper code-level unification remains a documented follow-up.
• No JSON output mode - structured output is YAML (--yaml), by deliberate choice, consistent with the rest of the project's manifests and config.

Compatibility

No breaking changes for already-published packages: releases published before this version simply show provider/capability fields as "not declared" rather than erroring.

Verification

Built from master commit cba66f1380e05fe3c329f6e202a60c3c0962eaa3. Every change in this release was individually reviewed and tested in its own PR before being promoted; see PR #126 for the full list and this release's own verification notes.

Install artifacts

lineage-darwin-amd64, lineage-darwin-arm64, lineage-linux-amd64, lineage-linux-arm64, lineage-windows-amd64.exe, with checksums.txt for verification.

Lineage v0.3.0

Minor release: the one-command non-coder receiver path lands.

Added

• lineage add <ref> [--yes] (#77): fetches a published package, shows what it contains (skills, workflows, agents, policies, declared capabilities), asks permission, then enables it - three commands (package pull, package inspect, enable) collapsed into one.
• docs/bootstrap-prompt.md (#98): the canonical copy-paste prompt for non-coder receivers, now embedded per-package on the website's /packages/<name> pages. Written and reviewed for the prompt-injection boundary on paper; adversarial testing against a real hostile package is tracked separately and not yet done - see the issue before treating this as a hardened security boundary.
• Grouped, per-subcommand CLI help (lineage <cmd> -h now works correctly instead of misreading -h as a positional argument) and lineage version/--version.

Also included

• ADR 0012 synced: decision 4/5 corrected (curl installer, not npx), Verified In Production section, stale issue-number fix.

Still pre-V1. Open before the full "Enable distribution" milestone closes: unified local/pulled artifact processing (#71), the package setup playbook (#72), and #98's adversarial hardening pass and real end-to-end verification.

Lineage v0.2.1

Patch release: fixes the module path so go install/go get actually work.

Fixed

• go.mod declared github.com/lineage-dev/lineage - that GitHub org doesn't exist. go install github.com/agentic-lineage/lineage/cmd/lineage@latest has never worked until this release.
• DefaultRegistryURL (used by lineage package publish/pull when LINEAGE_REGISTRY_URL isn't set) pointed at a placeholder domain instead of the real deployed registry.

Also included

• README documents the actual install path: the curl installer (curl -fsSL https://agenticlineage.vercel.app/install.sh | sh) as primary, go install as the alternative for Go developers.

This is still pre-V1. The full V1 distribution goal remains open until the receiver add/process UX and release policy work are complete.

Lineage v0.2.0

Stable pre-V1 release for the next distribution slice.

Included:

• ADR 0012 for the V1 distribution contract and receiver activation path.
• lineage package publish <path> and lineage package pull <package-ref> [--as name] against the registry API.
• lineage login, logout, and whoami using GitHub OAuth Device Flow for publisher identity.
• Pull-side digest verification that fails closed on mismatch.
• Gitignore cleanup for common Go, editor, OS, and local-output files.

Notes:

• This is still pre-V1. The full V1 distribution goal remains open until install, website/directory, receiver add/process UX, and release policy work are complete.
• The Go test suite passed locally before promotion.

Lineage v0.1.0

Baseline stable master release for Lineage.

This release marks the point where Lineage can create and run local workflow packages with package validation, export/import safety, provider materialization, provider shims, diagnostics, and open-source project governance foundations.

This is not the full V1 distribution release yet. The V1 goal is tracked separately under Goal: Enable distribution: easy CLI installation, website-backed package publishing, package pulling, and unified receiver artifact processing.