v0.5.1

Supply-chain transparency

• SBOMs: iris-npm-sbom.spdx.json + iris-docker-sbom.spdx.json (attached below). Both are SPDX 2.3 JSON, cover direct + transitive dependencies.
• SBOM signatures: each SBOM has a companion .cosign.bundle (Sigstore bundle — signature + cert + Rekor entry) attached to this release. Verify with:

  cosign verify-blob \
    --bundle iris-npm-sbom.spdx.json.cosign.bundle \
    --certificate-identity-regexp='https://github.com/iris-eval/mcp-server' \
    --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
    iris-npm-sbom.spdx.json
  

• npm provenance: published with --provenance (verifiable via npm audit signatures or on the package page).
• Docker signature: image signed with cosign keyless (Sigstore). Verify with:

  cosign verify ghcr.io/iris-eval/mcp-server:v0.5.1 \
    --certificate-identity-regexp='https://github.com/iris-eval/mcp-server' \
    --certificate-oidc-issuer='https://token.actions.githubusercontent.com'
  

• Build attestation: both the npm SBOM and Docker image manifest carry GitHub-signed build-provenance attestations. Inspect with gh attestation verify or cosign verify-attestation.

What's Changed

• docs(blog): editor's note on 007 — the corrected example, disclosed by @irparent in #379
• fix(post-release): 40 continuity defects the v0.5.0 surfaces never caught up with by @irparent in #380
• fix(docker): the published image has been dead on arrival since March by @irparent in #381
• docs: the four public surfaces still teaching pre-0.5.0 behaviour by @irparent in #382
• chore(deps): patch the ten npm-audit advisories that turned the exposure gate red by @irparent in #392
• fix(website): the banner contradicted itself and the mockup broke on phones by @irparent in #391
• chore(brand): sweep the surfaces the v0.5.0 tagline never reached by @irparent in #393
• docs(compare): correct the rows the market moved past, re-verify all eight pages by @irparent in #394
• chore(website): make the site's change signals real — dates, feed, titles, H1s by @irparent in #395
• fix(eval): close nine ultrareview findings — the verdict-integrity patch by @irparent in #396
• release: v0.5.1 — the verdict-integrity patch by @irparent in #397

Full Changelog: v0.5.0...v0.5.1