irreversible-command-gate v0.1.71

Release v0.1.71

Built from commit: f6b43e7

Provenance note (2026-09-26): this release was published by hand while the
icg-ci queue was mutex-starved, and its original notes were corrupted with
spliced shell output (recorded on bead irrevers-bfbdf8f4). Since then:

• icg-packs.tar.gz was rebuilt from this tag's own packs/ directory in the
  root-level layout the icg updater requires, proven byte-identical per
  member to the original archive's contents, and verified against
  pack-manifest.json (SHA-256 + size per pack). The pack bytes are
  unchanged; only the envelope was wrong.
• The icg binary and rule-pack.json assets are unchanged from the original
  hand publish: rule-pack.json is byte-identical to v0.1.70's CI build, and
  the binary was not CI-built. The Layer 1 gates did not run on this commit
  in CI. The next CI-cut release is the first fully gated one after the
  queue drains.

irreversible-command-gate v0.1.70

irreversible-command-gate v0.1.70

Built from commit: 4363c42
Cut by the icg-ci workflow (gates passed on that commit); tag pushed to Forgejo.

Release Integrity: This release was gated against the actual pack bytes
included in icg-packs.tar.gz. The pack-manifest.json provides cryptographic
verification (SHA-256 + size per pack) of all released packs.

Asset repair record (irrevers-64f7633e, 2026-09-25): the initial
icg-packs.tar.gz asset was packaged with the historical nested layout
(packs/<name>.json entries plus a non-JSON ride-along), which the icg update contract rejects — no release before this fix was ever
updater-installable. The asset envelope was rebuilt with the fixed root-level
packager (tar -C packs -czf ... ./*.json) and re-uploaded. The 11 pack
manifests are byte-identical to the gated bytes: both the tag's packs/ and
the repaired archive's extracted contents verify against this release's own
pack-manifest.json (pack-manifest --verify, 11/11). The icg binary and
rule-pack.json assets are the originals uploaded by the CI run.

Binaries:

• icg: Main guard binary (supports: hook, wrapper, and admin subcommands)
• icg-packs.tar.gz: Complete modular pack directory for production icg hook (root-level layout, updater-consumable)
• rule-pack.json: Legacy merged compatibility artifact (for legacy single-file installs)
• pack-manifest.json: Deterministic manifest with SHA-256 hashes of all packs

irreversible-command-gate v0.1.68

Release v0.1.68

Built from commit: 08e5502

Self-Referential Protection: This release was built using icg PATH-wrapper
protection in Argo Workflows. The guard protecting everything else is itself
protected.

Release Integrity: This release was gated against the actual pack bytes
included in icg-packs.tar.gz, not static fixtures. The pack-manifest.json
provides cryptographic verification (SHA-256) of all released packs.

Binaries:

• icg: Main guard binary (supports: hook, wrapper, and admin subcommands)
• icg-packs.tar.gz: Complete modular pack directory for production {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}
• rule-pack.json: Legacy merged compatibility artifact (for legacy 🔄 icg update started
  📁 Trust pointer: /etc/icg/trust-pointer.json
  📁 Pack directory: /etc/icg/packs)
• pack-manifest.json: Deterministic manifest with SHA-256 hashes of all packs

irreversible-command-gate v0.1.67

Release v0.1.67

Built from commit: 918f9d3

Self-Referential Protection: This release was built using icg PATH-wrapper
protection in Argo Workflows. The guard protecting everything else is itself
protected.

Release Integrity: This release was gated against the actual pack bytes
included in icg-packs.tar.gz, not static fixtures. The pack-manifest.json
provides cryptographic verification (SHA-256) of all released packs.

Binaries:

• icg: Main guard binary (supports: hook, wrapper, and admin subcommands)
• icg-packs.tar.gz: Complete modular pack directory for production {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}
• rule-pack.json: Legacy merged compatibility artifact (for legacy 🔄 icg update started
  📁 Trust pointer: /etc/icg/trust-pointer.json
  📁 Pack directory: /etc/icg/packs)
• pack-manifest.json: Deterministic manifest with SHA-256 hashes of all packs

irreversible-command-gate v0.1.65

Release v0.1.65

Built from commit: dcc8f11

Self-Referential Protection: This release was built using icg PATH-wrapper
protection in Argo Workflows. The guard protecting everything else is itself
protected.

Release Integrity: This release was gated against the actual pack bytes
included in icg-packs.tar.gz, not static fixtures. The pack-manifest.json
provides cryptographic verification (SHA-256) of all released packs.

Binaries:

• icg: Main guard binary (supports: hook, wrapper, and admin subcommands)
• icg-packs.tar.gz: Complete modular pack directory for production {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}
• rule-pack.json: Legacy merged compatibility artifact (for legacy 🔄 icg update started
  📁 Trust pointer: /etc/icg/trust-pointer.json
  📁 Pack directory: /etc/icg/packs)
• pack-manifest.json: Deterministic manifest with SHA-256 hashes of all packs

irreversible-command-gate v0.1.64

Release v0.1.64

Built from commit: 560a5ac

Self-Referential Protection: This release was built using icg PATH-wrapper
protection in Argo Workflows. The guard protecting everything else is itself
protected.

Release Integrity: This release was gated against the actual pack bytes
included in icg-packs.tar.gz, not static fixtures. The pack-manifest.json
provides cryptographic verification (SHA-256) of all released packs.

Binaries:

• icg: Main guard binary (supports: hook, wrapper, and admin subcommands)
• icg-packs.tar.gz: Complete modular pack directory for production {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}
• rule-pack.json: Legacy merged compatibility artifact (for legacy 🔄 icg update started
  📁 Trust pointer: /etc/icg/trust-pointer.json
  📁 Pack directory: /etc/icg/packs)
• pack-manifest.json: Deterministic manifest with SHA-256 hashes of all packs

irreversible-command-gate v0.1.63

Release v0.1.63

Built from commit: 1820cec

Self-Referential Protection: This release was built using icg PATH-wrapper
protection in Argo Workflows. The guard protecting everything else is itself
protected.

Release Integrity: This release was gated against the actual pack bytes
included in icg-packs.tar.gz, not static fixtures. The pack-manifest.json
provides cryptographic verification (SHA-256) of all released packs.

Binaries:

• icg: Main guard binary (supports: hook, wrapper, and admin subcommands)
• icg-packs.tar.gz: Complete modular pack directory for production {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}
• rule-pack.json: Legacy merged compatibility artifact (for legacy 🔄 icg update started
  📁 Trust pointer: /etc/icg/trust-pointer.json
  📁 Pack directory: /etc/icg/packs)
• pack-manifest.json: Deterministic manifest with SHA-256 hashes of all packs

irreversible-command-gate v0.1.62

Release v0.1.62

Built from commit: 52e3a26

Self-Referential Protection: This release was built using icg PATH-wrapper
protection in Argo Workflows. The guard protecting everything else is itself
protected.

Release Integrity: This release was gated against the actual pack bytes
included in icg-packs.tar.gz, not static fixtures. The pack-manifest.json
provides cryptographic verification (SHA-256) of all released packs.

Binaries:

• icg: Main guard binary (supports: hook, wrapper, and admin subcommands)
• icg-packs.tar.gz: Complete modular pack directory for production {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}
• rule-pack.json: Legacy merged compatibility artifact (for legacy 🔄 icg update started
  📁 Trust pointer: /etc/icg/trust-pointer.json
  📁 Pack directory: /etc/icg/packs)
• pack-manifest.json: Deterministic manifest with SHA-256 hashes of all packs

irreversible-command-gate v0.1.61

Release v0.1.61

Built from commit: 9f7041f

Self-Referential Protection: This release was built using icg PATH-wrapper
protection in Argo Workflows. The guard protecting everything else is itself
protected.

Release Integrity: This release was gated against the actual pack bytes
included in icg-packs.tar.gz, not static fixtures. The pack-manifest.json
provides cryptographic verification (SHA-256) of all released packs.

Binaries:

• icg: Main guard binary (supports: hook, wrapper, and admin subcommands)
• icg-packs.tar.gz: Complete modular pack directory for production {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}
• rule-pack.json: Legacy merged compatibility artifact (for legacy 🔄 icg update started
  📁 Trust pointer: /etc/icg/trust-pointer.json
  📁 Artifact path: /etc/icg/rule-pack.json)
• pack-manifest.json: Deterministic manifest with SHA-256 hashes of all packs

irreversible-command-gate v0.1.60

Release v0.1.60

Built from commit: a544b1a

Self-Referential Protection: This release was built using icg PATH-wrapper
protection in Argo Workflows. The guard protecting everything else is itself
protected.

Release Integrity: This release was gated against the actual pack bytes
included in icg-packs.tar.gz, not static fixtures. The pack-manifest.json
provides cryptographic verification (SHA-256) of all released packs.

Binaries:

• icg: Main guard binary (supports: hook, wrapper, and admin subcommands)
• icg-packs.tar.gz: Complete modular pack directory for production {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}
• rule-pack.json: Legacy merged compatibility artifact (for legacy 🔄 icg update started
  📁 Trust pointer: /etc/icg/trust-pointer.json
  📁 Artifact path: /etc/icg/rule-pack.json)
• pack-manifest.json: Deterministic manifest with SHA-256 hashes of all packs