hSUM v0.1.0-alpha.4

Zero-touch Codex onboarding

hSUM can now install itself as one user-wide, workspace-dynamic Codex MCP server. After the first repository is activated, future Codex tasks can call hSUM's four read-only evidence tools without copied TOML or a Codex restart.

Install and activate the current repository

version=0.1.0-alpha.4
base_url="https://github.com/burkan2/hSUM/releases/download/v$version"
curl -fsSLO "$base_url/install-hsum.sh"
curl -fsSLO "$base_url/SHA256SUMS"
grep ' install-hsum.sh$' SHA256SUMS | shasum -a 256 -c -
bash install-hsum.sh --activate . --confirm

On macOS arm64, this alpha is not Developer ID-signed or notarized. After verifying the checksum and reading the warning, add --allow-unnotarized-alpha to the final command.

The installer:

• installs the pinned binary without sudo;
• registers hSUM through Codex's supported mcp add/get CLI;
• installs bounded, managed agent guidance in the effective user-global Codex instructions;
• activates only the exact current Git repository;
• verifies all four read-only tools and a search-to-citation round trip;
• preserves existing user instructions and is idempotent.

Start a new Codex task after installation so the client discovers the new MCP registration.

Many repositories

Authorize a projects directory once:

hsum integration authorize-workspace codex --path ~/Projects --confirm

hSUM does not recursively scan or combine that directory. The first hSUM tool call in each child Git repository initializes only that exact repository. Every repository retains a separate trust binding, index, generation, and citation namespace.

Managed repositories attempt one bounded refresh before the first evidence search or citation read in each MCP task. Unsafe, busy, or deletion-refused refreshes keep the last good generation and report freshness state.

Boundaries

Retrieval remains local exact/quoted/BM25 lexical search. There is no embedding model, vector search, corpus upload, account, telemetry, daemon, or HTTP transport. A cloud-backed agent may forward returned passages to its own model provider under that client's policy.

Alpha.2 and alpha.3 indexes and citations remain compatible. Restart in-flight MCP pagination after upgrading because cursors and retrieval fingerprints are release-bound.

Verification

This prerelease was built from a GPG-signed annotated tag on protected main. Both supported targets passed release checks, reproducible builds, first-user and installer smokes, network-denied smokes, and published alpha.1 recovery. The archives, SPDX SBOMs, Cargo license inventory, and installer are covered by SHA256SUMS; each archive also has a GitHub SBOM attestation.

• Alpha.4 documentation
• Connect Codex and manage many repositories
• Pull request #4
• Full changelog

hSUM v0.1.0-alpha.3

What's Changed

• release: close alpha.2 launch-readiness gaps by @burkan2 in #2
• release: prepare v0.1.0-alpha.3 by @burkan2 in #3

Full Changelog: v0.1.0-alpha.2...v0.1.0-alpha.3

hSUM v0.1.0-alpha.2

What's Changed

• Prepare hSUM 0.1.0-alpha.2 by @burkan2 in #1

Full Changelog: v0.1.0-alpha.1...v0.1.0-alpha.2

Release verification

• Signed annotated tag: v0.1.0-alpha.2
• Release commit: ef547587aacb663c235f8a546856c73353ef675e
• Release workflow: https://github.com/burkan2/hSUM/actions/runs/30187380449
• Linux x86_64 archive SHA-256: ba8debb89130d1dbf12be1b68c22c77e65d2d7c6f3d1f41e35fe0a001195bff9
• macOS arm64 archive SHA-256: 5a2ea3b5c4ea339158d049a089664112a52c8f7c7860d469d6207e2006a86a34

Both hosted builds passed cargo xtask check, an isolated byte-for-byte rebuild,
the release smoke, the no-network smoke, and the checksum-pinned alpha.1 recovery
smoke. Both archives have GitHub SPDX SBOM attestations. After publication, all
seven assets were downloaded and their aggregate and per-asset checksums verified.
The downloaded macOS archive also passed the release, no-network, and alpha.1
recovery smoke scripts.

macOS alpha note

The macOS binary is not Developer ID signed or notarized. The Apple linker adds
an ad-hoc signature, but it contains no publisher identity (TeamIdentifier is not
set) and Gatekeeper rejects it. Verify the checksum and GitHub attestation before
clearing quarantine or using Open from Finder's context menu.

hSUM v0.1.0-alpha.1

Full Changelog: https://github.com/burkan2/hSUM/commits/v0.1.0-alpha.1