v0.1.4

Verifiable artifacts

npm: @decionis/agent-safe-pipeline@0.1.4

shasum -a 256 -c SHA256SUMS
gh attestation verify decionis-agent-safe-pipeline-0.1.4.tgz \
  --repo decionis/agent-safe-pipeline \
  --bundle agent-safe-pipeline-0.1.4.provenance.sigstore.json \
  --custom-trusted-root trusted_root.jsonl

The annotated release tag is keylessly signed by the protected deploy workflow. See release tag signing for identity-bound verification commands.

The CycloneDX SBOM was generated from the extracted npm tarball and contains at least five dependency components. Raw in-toto statements and their signed Sigstore bundles are attached for mirrors and offline verification.

What's Changed

• ci: verify Zenodo release metadata by @decionis-bot[bot] in #85
• Bump the production-dependencies group with 2 updates by @dependabot[bot] in #86
• Model auditable provider outcomes and publish maintenance policy by @ocularminds in #89
• Conform to the Decionis execution contract, isolate shadow mode, and add a wire-contract harness by @ocularminds in #100
• fix: bound larger GitHub compare responses by @decionis-bot[bot] in #101
• Add managed Presence escalation and evidence demos by @ocularminds in #102
• docs: fix managed Presence demo commands by @decionis-bot[bot] in #103
• feat: local Presence escalation testing and a truthful fixture ledger by @decionis-bot[bot] in #104
• feat: house the CommerceGate MCP (@decionis/commerce) in packages/com... by @decionis-bot[bot] in #105
• chore: release commerce MCP 0.1.3 by @decionis-bot[bot] in #106
• feat(commerce-mcp): prepare directory bundles by @decionis-bot[bot] in #108
• release: prepare v0.1.4 by @decionis-bot[bot] in #107

Full Changelog: v0.1.3...v0.1.4