0.5.4 - 2026-10-01

Release Notes

Changed

• Dependencies updated: jsonschema 0.29 → 0.58 (ACV010 still names the same violation:
  the one 0.29 reported first), sha2 0.10 → 0.11, base64 0.22 → 0.23, thiserror 2.0.21,
  and the pinned crate-ci/typos action to v1.50.3. Output is unchanged; deny.toml now allows
  the Zlib license (foldhash, through jsonschema).
• Workflows grant write permissions per job instead of workflow-wide: release.yml gives
  contents: write only to the jobs that create and upload the release, and attest.yml and
  conformance-release.yml give id-token and attestations write only to their signing job.

Install agent-change-control 0.5.4

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/noru-tech/agent-change-control/releases/download/v0.5.4/agent-change-control-installer.sh | sh

Install prebuilt binaries via Homebrew

brew install noru-tech/tap/acc

Download agent-change-control 0.5.4

File	Platform	Checksum
agent-change-control-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
agent-change-control-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
agent-change-control-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
agent-change-control-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo noru-tech/agent-change-control

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> --repo noru-tech/agent-change-control