v1.0.0

VWH v1 Release Notes

Release date: 2026-02-10

Highlights

• Public inspector (vwh) and core library (vwh-core) are production-ready for v1 artifacts.
• Offline-first verification: signatures are always checked locally.
• Advisory registry with keys.json and ledger-based artifact acknowledgment (ledger.json).
• Clear trust output with ASCII-only markers for reliable rendering in all terminals.

What's Included

• vwh CLI: public inspector for .vwh artifacts
• vwh-core crate: binary format, signing/verification utilities
• Man page for vwh and public documentation (README.md, SPEC.md)

Ledger Model (New)

The registry now uses ledger.json instead of revocations.json. The ledger is the public record of artifact acknowledgment and revocation:

{
  "version": 1,
  "updated_at": "ISO8601",
  "artifacts": [
    {
      "id": "32-char hex",
      "fingerprint": "64-char hex",
      "status": "active|revoked",
      "revoked_at": "ISO8601",
      "reason": "string"
    }
  ]
}

Inspector truth table:

• Sealed + active ledger entry = verified, publicly acknowledged
• Sealed + missing ledger entry = suspicious/unpublished
• Draft + active ledger entry = verified (local state differs)
• Any + revoked ledger entry = revoked

Upgrade Notes

• If you previously used revocations.json, migrate to ledger.json.
• Registry base URL remains the same; endpoints are now keys.json and ledger.json.

Build

cargo build --release

Binary locations:

• macOS/Linux: target/release/vwh
• Windows: target/release/vwh.exe

Release Assets

Prebuilt binaries:

• vwh-linux-amd64 (Linux, x86_64, musl)
• vwh-macos-arm64 (macOS, Apple Silicon)
• vwh-windows-amd64.exe (Windows, x86_64)

Not Included

The private authoring tool (vwh-author) is intentionally not published in this repo, as mentioned in the previous release.