v0.1.1 — Offline auditor fixes

v0.1.1 — offline auditor fixes

This patch ships the reviewed repository-boundary/bootstrap fixes (#113) and lossless human uncertainty summaries (#114), with native release metadata prepared in #115. Scope remains offline audit, saved reports and conditional bootstrap dry-run; no new execution feature is admitted.

Changes and limits

• Nested repositories with their own .git entry are excluded before descent; explicitly selected roots and ordinary nested packages remain auditable. Copies without markers are not silently excluded.
• Root bootstrap proposals remain conservative: an excluded repository at the proposed destination or an ancestor still blocks the draft.
• Human output groups exact rule/explanation records without removing scoped evidence. Counts are records, not confirmed defects. JSON-v1, exit meanings and UNKNOWN semantics are unchanged.

Tested native downloads

Choose your actual OS/architecture, verify the ZIP against SHA256SUMS, extract it and run ci-trust --version (ci-trust.exe on Windows). Expected output: ci-trust "0.1.1".

These are the exact archives retained by successful final-main native CI, not locally reconstructed cross-builds:

Archive	SHA-256	Actual Go compiler / native job
ci-trust_0.1.1_windows_amd64.zip	adb4e501aa86531efd57b7913e986bc2d325c48edf8523a83f6dbfc73b2a7ff2	go1.26.8 / native receipt
ci-trust_0.1.1_linux_amd64.zip	637d7cd683f4ae74029218857b3a1ebf399fb1b4a4c68ad0fb38d87dd43a8b6f	go1.26.9 / native receipt
ci-trust_0.1.1_darwin_arm64.zip	356716d3ed0696819ff01b7dcd44cdba7165b6c2ab8b02d700994eacdab80868	go1.26.9 / native receipt

Source: 9bdb1d81270a8e9366ea7d3f0bc0342d0d9336ac. Final main native CI: run 39303361041, attempt 1. Successful owned Go/public-CLI tests, vet and native retention were checked on Linux, Windows and macOS; archive/source/run/log/binary/hash/license bindings were inspected. These checks exercise CI Trust, not the workflows it audits.

Archives include MIT project source licensing, third-party notices, upstream license texts and RELEASE.json compiler/platform/provenance metadata. No Node.js, npm, ESLint or container image is bundled. Binaries are unsigned and not notarized; checksums detect byte differences, not independent publisher identity.

Still deferred

Controlled lint verification and #9 remain experimental/incomplete and are not this offline release's acceptance gate. No accepted real CLEAN → expected FAULT diagnostic → RESTORED sequence, audited-CI execution, validator efficacy, complete coverage or required-check enforcement is claimed. Audit/report/bootstrap dry-run do not execute target code or apply changes; exit 0 may include findings, FAIL, UNKNOWN and conditional proposals. Runtime consent/isolation controls are unchanged.

Full patch notes · Previous release v0.1.0

v0.1.0 — Offline CI auditor MVP

v0.1.0 — Offline CI auditor MVP

First release of the offline, read-only auditor: audit, saved report rendering, and conditional bootstrap --dry-run. No repository scripts are executed, no dependencies are installed and no workflow changes are applied by these commands.

Download and use

Choose the OS/architecture archive below, verify it against the attached SHA256SUMS, and extract it. Windows uses ci-trust.exe; macOS ARM64 is Apple Silicon. Other architectures can build from source.

./ci-trust --version
./ci-trust audit PATH --format json > audit.json
./ci-trust report --input audit.json --format human
./ci-trust bootstrap PATH --dry-run

Versioned binaries print ci-trust "0.1.0". Ordinary source builds still default to dev unless the documented build-time version override is supplied.

Actual native verification

Source: b16b7cbff841239d493e308802849f02395bef56. Prepared and integrated through PR #112.
Final main run: https://github.com/dnlrsls/ci-trust/actions/runs/39193971349. All three native hosts passed owned tests, public version/help/audit/report/dry-run/cold-verify/refusal/immutability checks and vet before uploading these archives. The exact tested binaries were packaged in CI; no local cross-build reconstruction is distributed. Downloaded archive/binary hashes, source/run identities and all ten upstream license texts were verified before publication.

Archive	Compiler	Native job
ci-trust_0.1.0_linux_amd64.zip	go1.26.9	Passed
ci-trust_0.1.0_windows_amd64.zip	go1.26.8	Passed
ci-trust_0.1.0_darwin_arm64.zip	go1.26.9	Passed

Each ZIP includes the tested binary, RELEASE.json, project LICENSE, THIRD_PARTY_NOTICES.md and LICENSES/. SHA256SUMS covers the three ZIPs. Checksums detect byte differences; they are not independent publisher signatures. Binaries are unsigned, with no Windows signing or macOS notarization claim.

Scope and limitations

• Configuration is not observed CI execution, validator efficacy or required-check enforcement. No aggregate trust score is provided. Exit 0 may include findings, FAIL, UNKNOWN or a conditional proposal.
• This is the explicitly narrowed offline MVP, not completion of the earlier execution-verification scope. Issue #9 remains open; executable ESLint verification is experimental/unvalidated. Ordinary verify --check lint remains UNVERIFIABLE; its valid-report exit 0 is not a lint PASS. Existing opt-in protected-route consent/preflight controls remain unchanged.
• No Node.js, npm, ESLint, container image or lint candidate is bundled. No new controlled runtime attempt was made for this release. Earlier failed reconstruction/profile attempts were discarded, not treated as proof.
• Project source is MIT, copyright (c) 2026 dnlrsls. Third-party software retains the terms included in the archive.

See release scope and CLI limits.