v0.5.0

0.5.0 (2026-06-05)

Features

• attestation: add sign_event for arbitrary payloads (da94de2)
• cli: add hash-chained JWS attestation log and verify-chain command (#30) (30ea04e)
• cli: add status subcommand (15d822b)
• cli: add verify-artifact subcommand (a555d02)
• engine: add reload_rules atomic-swap method (b0de100)
• engine: add ruleset_hash property (abbffe9)
• go-sdk: commit generated gRPC stubs at proto/ (87b887b)
• grpc: real SubscribeChanges + drop vestigial type:temporal (264672c)
• grpc: real SubscribeChanges + drop vestigial type:temporal (4c1c7b5)
• integrations: add GET /v1/status endpoint (78d789c)
• integrations: add gRPC Reload RPC handler (78db0e6)
• integrations: add POST /v1/rules/reload endpoint (bde48ac)
• integrations: add ruleset_sig verifier (4732bb7)
• integrations: bootstrap ruleset pubkey from env (fefe183)
• proto: add Reload RPC to FathomService (fda11b4)
• release-sig: pure-Python minisign verifier (f3c8d10)
• release: add sign_release.sh wrapper for minisign (8150345)
• release: commit minisign release-signing public key (21e43c6)
• rule-packs: add ssvc modules yaml (c016e75)
• rule-packs: add ssvc rules yaml (597887c)
• rule-packs: add ssvc templates yaml (dfdf98e)
• rule-packs: archive CISA PDF + enumerate published branches (72becfd)
• rule-packs: scaffold ssvc pack (01e6949)

Bug Fixes

• ci: also monkey-patch typer's _get_rich_console to pin width (f283cfa)
• ci: clear pre-existing ruff/mypy violations (67a5965)
• ci: docs.yml needs full git history for gomarkdoc + check_doc_sources (136af23)
• ci: fetch full git history for the docs workflow (a1f3cd8)
• ci: hermetic typedoc invocation + always-run required checks (#26) (ed1cdd1)
• ci: ignore pkg.go.dev fathom-go landing page in lychee (27ab5f8)
• ci: make changelog.json + CLI doc regen deterministic across machines (875d19b)
• ci: pass explicit --repository.* flags to gomarkdoc so source links survive CI (c5a99cb)
• ci: pin CLI doc width to 80 cols + regen committed copies (f2867a4)
• ci: pin CLI doc width via CliRunner.terminal_width, not COLUMNS env (c87e3a8)
• ci: pin Typer's Rich console width via rich_utils.MAX_WIDTH (34bd4da)
• ci: replace flaky arduino/setup-protoc@v3 with direct download (344e989)
• ci: resolve CI + docs-drift failures across all PRs (6a53a50)
• ci: resolve CI + docs-drift failures across all PRs (9f43694)
• ci: retire cross-machine SDK doc determinism gate, keep regen-vs-regen (1898225)
• ci: retire literal version asserts, plug ANSI leak in CLI doc generator, refresh changelog.json (d118428)
• ci: ruff SIM105 in grpc_server + regen docs drift (9e66b61)
• ci: stash .minisig out of dist/ before PyPI upload (e75c93a)
• ci: tame stylistic markdownlint rules and replace flaky setup-protoc in docs-deploy (d4f341c)
• ci: tame stylistic markdownlint rules and replace flaky setup-protoc in docs-deploy (2c95700)
• ci: teach doc-source drift gate to honor .git-blame-ignore-revs (dde1753)
• ci: unbreak main + auto dependency upgrades + release automation (#18) (6c91ef1)
• cli: verify-artifact defaults --sig to <path>.minisig (e244ee1)
• docs: exclude external symbols from TS SDK reference (#27) (d170876)
• docs: make doc generators reproducible across environments (611ccbc)
• docs: regenerate grpc/{fathom.md,fathom.proto} with ReloadRequest/Response (4d2270b)
• docs: regenerate openapi.json for 0.3.2 version bump (49317b4)
• docs: strip ANSI from generated CLI docs after capture (43dcb4c)
• release: drop component prefix from release tags (#31) (d6ba36c)
• release: sign_release.sh uses minisign default .minisig extension (e994bae)
• version: bump version to 0.3.2 to match pyproject.toml (9c3e779)

Documentation

• adr: audit fleet modules for direct _env reads (c81af5b)
• adr: defer SubscribeChanges mid-stream reload (02cffbd)
• clean up stale roadmap markers and placeholder files (fc300de)
• fix codespell — invokable → invocable (0673f47)
• how-to: hot-reload operator guide (c988a0c)
• how-to: release-signing install + custody policy (e26ec78)
• readme: drop stale go_package blocker note (6fdb0a7)
• regenerate llms-full.txt after invokable→invocable fix (3670d78)
• rubber-stamp last_verified to 2026-04-27 (no content review) (3d17571)
• rubber-stamp last_verified to 2026-05-01 + drop dangling design.md citations (4abce2c)
• rule-packs: regenerate with SSVC included (8832f6e)