v0.1.0-beta.2 — credential-safe ingestion

A security and usability update for the public beta. Recommended for beta.1 users. This is a prerelease, with no stable API guarantee.

Changes

• Reject recognizable credentials before library, CLI and MCP ingestion or embedding calls. Batches fail atomically and errors do not echo matched values.
• Require explicit OPEN_WHY_ALLOW_REMOTE_CLONE=1 for URL indexing; prefer local repositories.
• Bound MCP input frames and request IDs, reject credential-bearing clone URLs, and protect managed Git caches with owner-only permissions.
• Add redacted, checksum-pinned Gitleaks history scanning to required CI.
• Simplify onboarding, integration documentation and contributor guidance; update locked Clap/Rustix dependencies.

Install and upgrade

cargo install --locked --git https://github.com/cogitod/open-why \
  --tag v0.1.0-beta.2 --bin why --no-default-features
why --version

Back up and verify existing stores before upgrading. Stop old daemon processes, replace the executable, and reconnect MCP clients. Store identity, schema, named contracts and Rust MSRV 1.88 are unchanged. Keep a verified pre-upgrade snapshot and the old executable until a restored-copy trial succeeds. Add --force only when deliberately replacing an existing Cargo installation.

Lexical binary archives support Apple Silicon/macOS 14 and Ubuntu 24.04 x86-64 (glibc 2.39 required). Older GNU/Linux systems should install from source. Omit --no-default-features for local embedding support; pinned model inputs are fetched separately. Source installation needs native build tools. Archives include dependency license notices; platform checksum manifests, SBOMs and build records accompany them.

Security boundaries and limitations

Credential detection is a conservative pattern check, not a confidentiality classifier. Unknown or obfuscated secrets and arbitrary confidential prose may still be stored. Existing databases, backups and Git clones are not scanned or scrubbed by upgrading. Storage remains plaintext; connected clients and configured remote embedding providers receive relevant text. Do not use an unauthenticated shared service for mutually untrusted users.

Default ONNX builds need a compatible C++ runtime and have a known Debian 12 ARM64 limitation; lexical builds avoid ONNX. Windows/musl are unsupported. Independent human first-use and broader MCP client coverage remain open. The earlier bounded Codex CLI check does not establish universal client compatibility.

Release verification

• Reviewed source: 4bf657547822c14bd76887912fb6682b250caa92, merged through PR #52. Signed annotated tag: v0.1.0-beta.2 (Ed25519 fingerprint SHA256:FtT/eGN9OoMmdvFdRPf4Y3MddxO1+6of+VgHDxCl9Tw).
• PR CI passed Linux/macOS, stable/MSRV, default/lexical tests, pinned-model evaluation, dependency audits and history scanning. Ordinary test runs explicitly ignore two opt-in model checks and one manual diagnostic; the model checks run separately.
• The documented public-tag source install passed in an isolated macOS ARM64 install root. A beta.1-created store was backed up and restored using beta.2 with identity/evidence preserved; capture, credential refusal/non-persistence, MCP initialization and a new verified backup passed.
• All five jobs in the signed-tag release-candidate workflow passed. Native macOS ARM64 and Linux x86-64 archives each passed fresh source installation, version, demo, index/retrieval, capture, MCP initialization, backup verification, restore and credential rejection/non-persistence.
• Both platform checksum manifests passed. Every file's GitHub attestation was verified against the exact repository, source commit, tag, release workflow and hosted-runner requirement. The source archives are byte-identical across builders. These are the exact validated bytes, without repackaging.
• After publication, all nine assets were downloaded anonymously from their public release URLs. Both checksum manifests passed, and every downloaded file matched the attested candidate bytes exactly.
• The public macOS ARM64 binary passed an isolated beta.1 backup -> beta.2 restore trial, preserved identity and evidence, accepted a safe new record, rejected a synthetic credential without echoing or persisting it, initialized MCP with version beta.2, and created a new verified backup. Linux artifact execution passed natively in the hosted Ubuntu 24.04 job; no local Linux execution is claimed.
• Verification environment: local macOS ARM64; source installs used a fresh checkout/archive with Cargo caches available. Hosted artifact builders used Rust 1.88.0 on macOS 14 and Ubuntu 24.04. The initial local attempt used symlinked /tmp and was correctly refused by backup path safety; a canonical temporary path passed. All stores contained synthetic data; no user database was changed.

Check SHA256SUMS and GitHub provenance against the full source commit above, refs/tags/v0.1.0-beta.2, and .github/workflows/release-candidate.yml, requiring a GitHub-hosted runner. See verification instructions. Checksums alone do not authenticate the publisher.