0.1.2

Publishes the static Linux binary for the source already on main, so a repository pinning a current Gates commit downloads a verified asset for that exact source. The 0.1.1 tag attests 0b0220a36e37b5899e9b298c7b42a7daf6e83850, three commits behind the branch head consumers resolve.

No check, policy field or receipt format changes. src/, tests/, ess/ and the dependency lock are unchanged from 0.1.1, so the binary differs only in the version it reports. That version increment alone invalidates receipts retained under 0.1.1; a fresh scan restores zero-invocation reuse.

.github/workflows/common.yml on main now downloads this release and checks its published SHA-256. The four existing adopters still pin workflow commit 547c6bc58d734e679f21bdeeb365f7dcc88059b1, which downloads 0.1.1; repinning them is a separate coordinated operation.

Validation: cargo run --locked -- gate passed on the tagged tree — 17 tests, cargo fmt --all --check and cargo clippy --all-targets --locked -- -D warnings clean. Shared common / Security and privacy and repository correctness checks passed on the candidate before integration. The asset is a stripped static-pie musl build with every source path remapped; it contains no home-directory string.

0.1.1

Shared checks now require the exact organization bot or GitHub Actions author on every commit after the trusted adoption baseline. Admission runs before scanning and signed-receipt reuse, and covers intermediate commits and merged side branches. Mailmaps and other bot names cannot authorize a commit.

Local commit hooks require exact organization-bot author and committer. The new commit-authorship result and Gates version invalidate earlier receipts. A valid current receipt still reuses common checks with zero scanner invocations.

Validation includes the full Rust gate, real-scanner regressions, signed-evidence tests and mutation tests that fail when either identity guard is removed. The static Linux binary is built with source-path remapping and scanned for private provenance and secrets.

0.1.0

Public Rust tooling and reusable workflows for shared security and privacy checks, signed local evidence, coordinated hooks, and standalone bot delivery. Repository correctness and release artifacts remain repository-owned.