v0.1.0

What's Changed

• Show the real-app round trips by @matchalatteguy in #10
• Add community files and finish the security and contributing guides by @matchalatteguy in #11
• Say exactly what results mean; report the version; evidence manifest by @matchalatteguy in #12
• Harden CI and the release workflow; pin bundled launchers by @matchalatteguy in #13
• Add check --deep: undo flips and rotations, then name suspects by @matchalatteguy in #16
• Make deep-check candidates honest; JSON usage errors; fix the publish job order by @matchalatteguy in #18
• Forge the test id into a genuinely different picture by @matchalatteguy in #19
• Keep Dependabot off the deliberate onnxruntime and mcp caps by @matchalatteguy in #17
• Make the ladder resize real covers and the colluder test deterministic by @matchalatteguy in #20
• Make the registry check exact, reap the smoke test, keep Dependabot to the lockfile by @matchalatteguy in #21
• Complete the CLI and core contracts by @matchalatteguy in #22
• Name a missing file the same way on both surfaces by @matchalatteguy in #24
• Keep the stub's deep checks to the flip so they cannot depend on the id by @matchalatteguy in #25
• Give agents worked examples and the measured caveats by @matchalatteguy in #23
• Point uv publish's duplicate check at the index root by @matchalatteguy in #27
• Keep a single-table JPEG's quantization, refuse CMYK, show stored warnings in list by @matchalatteguy in #26
• Refuse a foreign version-0 registry, bound the model download, keep README links portable by @matchalatteguy in #28
• Survive a cancelled MCP call and remove its half-written copies by @matchalatteguy in #29
• Follow JPEG component selectors; warn on the 65500px preflight limit; cancel checks; state the input contract by @matchalatteguy in #30
• Keep every component's quantization table; tag warnings with the copy id; name files cleanup could not remove by @matchalatteguy in #31

Full Changelog: evidence-2026-10-07...v0.1.0

Real-app round trips, 7 October 2026

Three source photos (an iPhone scene, a CC0 portrait, a CC0 sunset) marked with FaintMark 0.1.0, sent through real apps at default photo quality on 7 October 2026, and checked on what came back. The zip holds the originals, every received file, the phone screenshots (with the app frame, for provenance) and the crops of those screenshots that were checked. forged-sunset-with-whatsapp-scene-id.jpg is the WhatsApp scene's id transplanted into the sunset photo, which check flags with same_image: false.

Expected ids and results per file are in docs/evidence-2026-10-07.json in the repository. On a machine without the issuing registry, received files return unregistered with that id; the originals, the uncropped screenshots and the Tinder crop return not_detected.

Result: 17 of 18 rows matched, each with same_image: true; the Tinder profile card (a heavy crop) did not decode.