v0.2.2

Kranz v0.2.2 contains the server security patch and a corrected, rehearsable release pipeline.

• Streamed non-JSON POST bodies return HTTP 415, including chunked requests without Content-Length.
• GitHub webhook and hook-status authentication exceptions apply only to their registered routes.
• Mutation credentials no longer authenticate through read/WebSocket query strings. The dashboard exchanges a header credential for read authority and cancels stale exchanges.
• kranz serve validates pinned read credentials before binding, printing credentials, or writing token files.
• Release verification prepares Linux containment like regular CI. A manual rehearsal can verify source and build all platform archives before tagging; it cannot publish.
• Existing secret and domain-policy checks remain mandatory. An additional confidentiality word list is optional.

Custom browser clients using mutation tokens in WebSocket URLs must switch to a read token or the header-authenticated /api/read-token exchange. Native header authentication remains supported.

The v0.2.1 source tag is retained. Its publication stopped because the release runner lacked bubblewrap; no v0.2.1 binaries or crates were published. v0.2.2 carries that patch and the workflow correction.

Review scope, regression evidence, and release history. This is a recorded self-review, not an independent security audit.

Install the published CLI with Cargo:

cargo install kranz --version 0.2.2 --locked

The four packages are published at v0.2.2: kranz, kranz-engine, kranz-server, and kranz-slack. Each downloaded registry package matched its local upload and records the tagged source commit. A fresh, isolated, locked crates.io install passed version, live server authentication, embedded dashboard, license, and graceful token-cleanup checks.

Verification: main CI, tag source verification and release build, and native execution of all five tag-built archives passed. Published downloads matched those tested archives; all seven assets passed build-provenance verification, and the checksum manifest covers all six payloads. Local full-workspace regression results were 2,940 passed, zero failed, and 10 existing ignored tests; dashboard tests were 238 passed.