v2

What's Changed

• fix: bump tract-onnx to 0.21.17, patches CVE-2026-55832 by @karanshukla in #11
• docs: fix incorrect MIT-license claim on recognition model by @karanshukla in #12
• docs: add hardware compatibility table, borrowed from Visage by @karanshukla in #13
• Resync onto upstream authFace and replay fork features by @karanshukla in #37
• Repo hardening: cargo-deny, clippy, pinned actions, Dependabot, guard, SECURITY.md by @karanshukla in #38
• docs(CLAUDE.md): fix stale commands and claims after the resync by @karanshukla in #42
• Take Dependabot's cargo and actions updates (supersedes #40, #39) by @karanshukla in #43
• chore(deps): bump thiserror from 2.0.18 to 2.0.20 in the cargo group by @dependabot[bot] in #45
• Set-group-ID face-auth so the KDE lock screen and swaylock can match by @karanshukla in #44
• docs: cut README to a quick start and index, move the rest to docs/ by @karanshukla in #49
• Pin the NPU compile cache to a root-owned directory by @karanshukla in #51
• feat: only authenticate the user who owns the active seat0 session by @karanshukla in #56
• docs(pam): what face login does to KWallet, oo7 and GNOME Keyring by @karanshukla in #54
• fix(deploy): insert face-auth above the first authenticator, not the header by @karanshukla in #53
• feat: skip the scan under SSH or with the lid closed by @karanshukla in #55
• Minimum face size gate (min_face_size_ratio) by @karanshukla in #57
• face-similarity-check: batch genuine/impostor mode with TAR/FAR and sweep by @karanshukla in #58
• feat: provision OpenVINO with ovfetch, warm the NPU cache on deploy by @karanshukla in #59
• feat: track the latest ovfetch in CI; require 0.2.2 by @karanshukla in #60
• feat(deploy): compact, sectioned installer output by @karanshukla in #61
• Start delay for screen lockers (fixes manual-lock re-unlock) by @karanshukla in #62
• fix(deploy): stop a cached openvino-sys linking a stale ovfetch path by @karanshukla in #64
• feat(tray): KDE tray icon replacing the GTK GUI by @karanshukla in #63
• fix(tray): themed icons, left-click menu; deploy.sh progress bars by @karanshukla in #66
• fix(storage): vet embeddings.bin before parsing it by @karanshukla in #67
• fix(storage): finish #25 store hardening by @karanshukla in #68
• feat: bash completion for face-enroll by @karanshukla in #69
• docs: add the MIT license text by @karanshukla in #71
• feat: confirm a face match with Enter for sudo, su and polkit by @karanshukla in #70
• feat(deploy): COSMIC and Plasma login PAM targets by @karanshukla in #72
• docs(readme): state the immutable-distro and IR-only niche by @karanshukla in #73
• feat(prompt): terminal placeholder while scanning; smaller tray icon by @karanshukla in #74
• test(seat): pin the text-console session case by @karanshukla in #75
• feat: rename commands to vinoauthface; add install.sh by @karanshukla in #77
• deploy: honest build progress bar, restart stale tray by @karanshukla in #78
• feat(deploy): zsh and fish completions by @karanshukla in #80
• Seal templates to the TPM via user-scoped systemd-creds by @karanshukla in #79
• deploy.sh: skip SELinux policy step when SELinux is not enabled by @karanshukla in #85
• uninstall.sh: keep a vendor PAM copy the user edited after deploy by @karanshukla in #86
• Add vinoauthface doctor subcommand by @karanshukla in #87
• Add update.sh: rebuild and swap only the binaries by @karanshukla in #89
• Liveness: compare the face patch, require non-rigid motion (#17) by @karanshukla in #88
• Liveness: default the residual check off until calibrated (#17) by @karanshukla in #91
• Liveness: block-local residual with quarter-pixel alignment (#17) by @karanshukla in #92
• Liveness: extend the scan once when a match is held back (#17) by @karanshukla in #94
• vinoauthface-auth: keep RUST_LOG for root --verify by @karanshukla in #95
• docs: record printed photos as an accepted risk (#17) by @karanshukla in #97
• doctor: check backend, templates' model tag, and a missing camera (#18) by @karanshukla in #101
• storage tests: plant files 0640 whatever the umask by @karanshukla in #100
• Liveness: measure total motion across a 1 s window (#96) by @karanshukla in #99
• Show the scan prompt on lock screens via pam_exec stdout (#20) by @karanshukla in #102
• deploy: default NPU builds to the r50 model by @karanshukla in #105
• doctor: verify installed models against shared SHA-256 pins (#18) by @karanshukla in #104
• Consecutive release tags: scripts/release.sh, versioned builds (#98) by @karanshukla in #106
• Bind templates to the enrolling camera's USB ID by @karanshukla in #103
• SCRFD detector and 5-point alignment before encoding (#27) by @karanshukla in #108
• Group config settings and add a liveness preset by @karanshukla in #110

Full Changelog: v0.0.1...v2