can-v10.2.0

Pre-release Notes (Logs + LGit Overhaul)

This pre-release replaces the deprecated audit flow with a new signed logging system and introduces lgit, a git-style history layer for vault snapshots.

Highlights

• Deprecated pm audit removed.
• New pm logs command for unified logs.
• Cryptographic signing + verification badges added to logs.
• New pm lgit command group for history operations, integrity checks, rollback, and cleanup.

New: pm logs

pm logs now displays:

• Vault history
• Audit events
• LGit commits

Each record shows:

• [VERIFIED] when signature + chain checks pass
• [UNVERIFIED] otherwise

New: pm lgit command suite

• pm lgit tree – show commit history
• pm lgit log – alias of tree
• pm lgit status – compare current vault against HEAD
• pm lgit show [commit|head] – inspect a commit
• pm lgit verify – verify signed chain integrity
• pm lgit checkout [commit|head] – restore a snapshot
• pm lgit undo --steps N – rollback N steps
• pm lgit squash --keep N – compact history
• pm lgit prune – remove orphan snapshots

Security improvements

• Log entries are now chain-linked (prev_hash) and signed.
• Verification is available directly in CLI output and via pm lgit verify.
• Signing keys are stored in APM config dir with restricted permissions.

Internal behavior changes

• Vault saves now auto-create signed lgit SAVE commits.
• Undo/checkout operations restore encrypted vault snapshots and append signed history commits.

Compatibility notes

• Older unsigned or legacy log entries may appear as [UNVERIFIED].
• Legacy history remains readable; verification supports backward-compatible hash validation.

Known pre-release caveats

• This is a pre-release focused on logging/history architecture changes; users should keep regular backups while testing rollback workflows.
• Existing tooling/scripts that call pm audit should be migrated to pm logs.
• Credit to #35

GitHub release notes

• deprecate the audit command by @aaravmaloo in #36

Full Changelog: v10.1.1...can-v10.2.0