0.1.0 - 2026-10-22

Release Notes

The first release: a signed, hash-chained receipt log and the mohar command line tool.

Added

• Receipts: each decision about an agent action is a JSON record signed with Ed25519 over its RFC 8785
  canonical form, and linked to the previous receipt by SHA-256. verify reports the first receipt that
  was edited, removed or reordered, and why (#15).
• A log on disk: a directory with the signing key (owner-only on Unix), the public key and
  receipts.jsonl. Every receipt is synced before append returns, and a log that doesn't verify, or
  whose last line was cut short, is refused rather than extended (#23).
• Signed checkpoints, written every 1,000 receipts and on request, so receipts removed from the end of a
  log are detected (#25).
• The mohar CLI: init, append, log, checkpoint and verify. verify needs only the public
  key, so a log can be checked by someone who can't sign (#23, #25).
• Test vectors for the receipt and checkpoint formats, with an independent Python checker that shares no
  code with the Rust implementation (#27).
• Documentation: design (trust levels, verifiers, escalation, receipts, privacy, threat model),
  integrations, compliance with US and EU rules, and how the project sustains itself.

Security

• CI on Linux, macOS and Windows; CodeQL, OpenSSF Scorecard, gitleaks, cargo-deny, zizmor and an 85%
  line-coverage floor on every pull request; branch protection on main; release tags limited to
  admins; release artefacts carry GitHub build attestations.

Install mohar-cli 0.1.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/harshitwandhare/mohar/releases/download/v0.1.0/mohar-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/harshitwandhare/mohar/releases/download/v0.1.0/mohar-cli-installer.ps1 | iex"

Download mohar-cli 0.1.0

File	Platform	Checksum
mohar-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
mohar-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
mohar-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
mohar-cli-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
mohar-cli-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo harshitwandhare/mohar

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>