Provenance CLI cli-v0.1.0-alpha.2

CLI distribution

• Platforms: Linux amd64, macOS amd64/arm64, Windows amd64; all cross-compiled with CGO disabled on Linux amd64
• Native credential storage: Linux Secret Service and Windows Credential Manager; macOS cross-compiled builds have no Keychain backend and fail closed; no plaintext fallback
• Requires an explicitly trusted HTTPS platform origin and verification keys
• Release-time native acceptance is Linux only; macOS/Windows binaries are not notarized or Authenticode-signed; no live platform or browser confirmation claimed
• Separate CLI release; existing contract release assets are unchanged

What's Changed

• fix(action): bound waiting at grant expiry and warn when timeout-ms exceeds it by @bwmp in #103
• feat(cli): macOS/Windows cross-compiled release artifacts and hosted native CI (WP-07D) by @bwmp in #104
• feat(contracts): register project API token operations (WP-07D) by @bwmp in #105
• fix(deps): override vulnerable transitive brace-expansion and fast-uri by @bwmp in #108
• ci: bump checkout, setup-node, setup-go and setup-python to v7 by @bwmp in #110
• build(deps): bump log4j-core 2.26.1, junit-bom 6.1.3 and Gradle 9.8.0 by @bwmp in #109
• chore(dependabot): ignore paper-api >= 1.21, snakeyaml-engine 3 and TypeScript 7 by @bwmp in #111
• fix(cli): report verify failure reasons and cover hosted v2 envelopes (#116) by @bwmp in #117

Full Changelog: v0.1.0-alpha.36...cli-v0.1.0-alpha.2

Provenance contracts v0.1.0-alpha.36

Compatibility declaration

• Configuration schema: v1
• Attestation schema: v1
• Public OpenAPI: v1
• Paper metadata schema: v1
• Paper metadata inspector: 0.1.0-alpha.36
• Runner protocol: v1
• CLI: not released
• GitHub Action: not released
• TypeScript SDK client: 0.1.0-alpha.36
• TypeScript SDK facade: 0.1.0-alpha.36 (archive-only; no npm publication)

What's Changed

• Add public verification discovery and proof contracts by @bwmp in #99
• WP-09F: accept publication gate events in Action by @bwmp in #100
• feat(contracts): add project GitHub connection read (IFC-033) by @bwmp in #101

Full Changelog: v0.1.0-alpha.35...v0.1.0-alpha.36

Provenance contracts v0.1.0-alpha.35

Compatibility declaration

• Configuration schema: v1
• Attestation schema: v1
• Public OpenAPI: v1
• Paper metadata schema: v1
• Paper metadata inspector: 0.1.0-alpha.35
• Runner protocol: v1
• CLI: not released
• GitHub Action: not released
• TypeScript SDK client: 0.1.0-alpha.35
• TypeScript SDK facade: 0.1.0-alpha.35 (archive-only; no npm publication)

What's Changed

• test: add explicit fixed-destination network canary by @bwmp in #92
• fix: submit v2 configurations through the versioned snapshot API by @bwmp in #93
• fix: use stable DNS destination for network canary by @bwmp in #94
• docs: use shared Provenance private security reporting by @bwmp in #95
• fix(attestation): preserve v2 configuration identity in signed proofs by @bwmp in #96

Full Changelog: v0.1.0-alpha.34...v0.1.0-alpha.35

Provenance contracts v0.1.0-alpha.34

Compatibility declaration

• Configuration schema: v1
• Attestation schema: v1
• Public OpenAPI: v1
• Paper metadata schema: v1
• Paper metadata inspector: 0.1.0-alpha.34
• Runner protocol: v1
• CLI: not released
• GitHub Action: not released
• TypeScript SDK client: 0.1.0-alpha.34
• TypeScript SDK facade: 0.1.0-alpha.34 (archive-only; no npm publication)

What's Changed

• feat(protocol): fresh job-scoped network authority observations by @bwmp in #90

Full Changelog: v0.1.0-alpha.33...v0.1.0-alpha.34

Provenance contracts v0.1.0-alpha.33

Compatibility declaration

• Configuration schema: v1
• Attestation schema: v1
• Public OpenAPI: v1
• Paper metadata schema: v1
• Paper metadata inspector: 0.1.0-alpha.33
• Runner protocol: v1
• CLI: not released
• GitHub Action: not released
• TypeScript SDK client: 0.1.0-alpha.33
• TypeScript SDK facade: 0.1.0-alpha.33 (archive-only; no npm publication)

What's Changed

• fix(cli): preserve create-only artifact upload precondition by @bwmp in #86
• feat(cli): reuse a verified artifact for a new test configuration by @bwmp in #87
• fix(fixtures): emit synthetic secret through actual Paper log carrier by @bwmp in #88
• feat(protocol): carry actual complete-log redaction metadata by @bwmp in #89

Full Changelog: v0.1.0-alpha.32...v0.1.0-alpha.33

Provenance contracts v0.1.0-alpha.32

Compatibility declaration

• Configuration schema: v1
• Attestation schema: v1
• Public OpenAPI: v1
• Paper metadata schema: v1
• Paper metadata inspector: 0.1.0-alpha.32
• Runner protocol: v1
• CLI: not released
• GitHub Action: not released
• TypeScript SDK client: 0.1.0-alpha.32
• TypeScript SDK facade: 0.1.0-alpha.32 (archive-only; no npm publication)

What's Changed

• feat(contracts): add versioned tenant network policy administration by @bwmp in #85

Full Changelog: v0.1.0-alpha.31...v0.1.0-alpha.32

Provenance contracts v0.1.0-alpha.31

Compatibility declaration

• Configuration schema: v1
• Attestation schema: v1
• Public OpenAPI: v1
• Paper metadata schema: v1
• Paper metadata inspector: 0.1.0-alpha.31
• Runner protocol: v1
• CLI: not released
• GitHub Action: not released
• TypeScript SDK client: 0.1.0-alpha.31
• TypeScript SDK facade: 0.1.0-alpha.31 (archive-only; no npm publication)

What's Changed

• feat(contracts): explicit configuration v2 HTTP boundaries by @bwmp in #84

Full Changelog: v0.1.0-alpha.30...v0.1.0-alpha.31

Provenance contracts v0.1.0-alpha.30

Compatibility declaration

• Configuration schema: v1
• Attestation schema: v1
• Public OpenAPI: v1
• Paper metadata schema: v1
• Paper metadata inspector: 0.1.0-alpha.30
• Runner protocol: v1
• CLI: not released
• GitHub Action: not released
• TypeScript SDK client: 0.1.0-alpha.30
• TypeScript SDK facade: 0.1.0-alpha.30 (archive-only; no npm publication)

What's Changed

• feat(protocol): negotiate explicit network policy v2 by @bwmp in #81
• feat(config): add explicit v2 network permission requests by @bwmp in #82
• test(protocol): bind full v2 effective policy identity by @bwmp in #83

Full Changelog: v0.1.0-alpha.29...v0.1.0-alpha.30

Provenance contracts v0.1.0-alpha.29

Compatibility declaration

• Configuration schema: v1
• Attestation schema: v1
• Public OpenAPI: v1
• Paper metadata schema: v1
• Paper metadata inspector: 0.1.0-alpha.29
• Runner protocol: v1
• CLI: not released
• GitHub Action: not released
• TypeScript SDK client: 0.1.0-alpha.29
• TypeScript SDK facade: 0.1.0-alpha.29 (archive-only; no npm publication)

What's Changed

• feat: add explicit durable rejection while preserving legacy contracts (IFC-029) by @bwmp in #80

Full Changelog: v0.1.0-alpha.28...v0.1.0-alpha.29

Provenance contracts v0.1.0-alpha.28

Compatibility declaration

• Configuration schema: v1
• Attestation schema: v1
• Public OpenAPI: v1
• Paper metadata schema: v1
• Paper metadata inspector: 0.1.0-alpha.28
• Runner protocol: v1
• CLI: not released
• GitHub Action: not released
• TypeScript SDK client: 0.1.0-alpha.28
• TypeScript SDK facade: 0.1.0-alpha.28 (archive-only; no npm publication)

What's Changed

• fix(release): include execution evidence schema dependencies by @bwmp in #79

Full Changelog: v0.1.0-alpha.27...v0.1.0-alpha.28