Skip to content

v1.4.13

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 04:28
· 281 commits to main since this release
v1.4.13
dd24913
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

nSelf CLI v1.4.13

Channel: stable

Changelog

[1.4.13] - 2026-10-10

  • fix(compose): pull MinIO from the maintained pgsty fork (#476)
  • feat(ssl): served-stack primitives for the TLS path (P7-LIVE-25) (#477)
  • feat(doctor): served-certificate check in nself doctor (P7-LIVE-16) (#478)
  • fix(plugin): stop sending PLUGIN_INTERNAL_SECRET to ping.nself.org (P7-PLUG-67) (#479)
  • fix(doctor): send PLUGIN_INTERNAL_SECRET only to a local ai daemon, never via a proxy (P7-PLUG-73) (#480)
  • fix(scripts): admin-merge restores the full protection snapshot and GET-verifies it (P7-HYG-40) (#482)
  • feat(compat): NSELF_V15 gate helper and dual-mode test harness (P7-REG-11) (#483)
  • feat(ssl): CLI-owned ACME over DNS-01 with certbot adoption (P7-LIVE-15) (#481)
  • feat(registry): add internal/canon and internal/cmdregistry (P7-REG-03) (#489)
  • feat(errs): exit class per error code, sentinel table, E400-E404, Describe (P7-REG-01) (#486)
  • fix(deps): raise brace-expansion to 1.1.21 / 5.0.12 in the TS SDK lockfiles (GHSA-q2hr-2g5m-vwhr) (#491)
  • fix(nginx): route served nginx/ssl dir call sites through nginxtopo (P7-LIVE-02) (#492)
  • feat(reconcile): change-plan model, artifact diff, classification and env class (P7-LIVE-01) (#490)
  • feat(docs): guide command checker for documented nself commands (P7-TRUTH-20) (#495)
  • feat(canon): classify every command in canon.yaml (P7-REG-04) (#493)
  • fix(scripts): branch-protection-toggle compares writable fields only and reports empty repos as n/a (P7-HYG-48) (#497)
  • fix(doctor): port check ignores ports owned by the project's own stack (P7-PROD-30) (#500)
  • fix(ci): endpoint-auth-checker fails closed, workflow gates only cli (P7-HYG-31) (#498)
  • feat(output): v1 envelope writer, error envelope and human error renderer (P7-REG-02) (#499)
  • fix(sdk): rename sdk/go/license to licensing so the /v2 module zip builds (P7-SURF-34) (#503)
  • feat(sdk): Go SDK tag form sdk/go/v2.M.P with local resolve proof (P7-SURF-18) (#504)
  • feat(sdk): sdk/go/compat ADR 0021 rule for plugin modules (P7-CI-49) (#505)
  • feat(cli): global --json flag with invocation decorator (P7-REG-05) (#509)
  • feat(build): URL-encoded password variables for compose interpolation (P7-PROD-31) (#510)
  • feat(ci): app-pinned nself-ci protection tooling and checks-aware toggle (P7-CI-60) (#508)
  • feat(ci): per-package coverage floors as data, checked by tools/covfloor (P7-GUARD-06) (#512)
  • feat(perfbench): cold-start, time-to-healthy and A/B harness (P7-GUARD-07) (#511)
  • fix(db): migrate up --migration-dir --dry-run applies nothing; down --migration-dir (P7-PROD-77) (#507)
  • feat(license): verify the cache against ping's signature, decode plugins_allowed and jwt (P7-PLUG-63, part 1) (#506)
  • feat(cli): exit classes, JSON error envelope and coded error block in main (P7-REG-06) (#513)
  • fix(db): migrate up --dry-run read-only locally; remote dry-run refused unless proven (P7-PROD-84) (#514)
  • feat(cli): help --json publishes the command registry (P7-REG-07) (#520)
  • fix(ci): quarterly benchmark harness measures time to healthy (P7-TRUTH-22) (#523)
  • feat(cli): project operation lock taken by the invocation decorator (P7-LIVE-13) (#524)
  • feat(schemas): generated JSON Schemas + golden contract tests (P7-REG-08) (#526)
  • feat(ci): cold-start A/B gate, p95 ceiling, real base build for size gate (P7-GUARD-08) (#525)
  • feat(config): CS_N v2 keys (depends_on, networks, Dockerfile, target, command, ancestor context) (#516)
  • feat(backup): schedule runs in the real project with the running binary; stream heartbeat (#522)
  • refactor(build): Sink/Effects seam with in-memory plan mode (P7-LIVE-21) (#527)
  • feat(output): v1 envelope pilot on status, doctor, config (P7-REG-09) (#531)
  • feat(remote): one SSH exec funnel with path validation and pinned host keys (P7-NODE-04) (#528)
  • feat(plugin): manifest v2 types, schema and v1 normalizer (P7-PLUG-01) (#530)
  • feat(portable): bundle library, contract cli.portable-export v1 (P7-ADOPT-23) (#529)
  • feat(ssl): HTTP-01 ACME challenge on every port-80 server block (P7-LIVE-24) (#532)
  • feat(backup): destination interface with path:// and host:// (P7-PROD-06) (#533)
  • feat(remote): ParseHostSpec, one deploy host grammar (P7-DEPL-23) (#534)
  • feat(sdk): boot-time plugin migrations, contract plugin.boot-migrations v1 (P7-PLUG-14) (#535)
  • feat(catalog): one generator for registry, catalog and counts (P7-PLUG-07) (#536)
  • feat(plugin): refuse install when required postgres extensions are missing (P7-ADOPT-06) (#538)
  • feat(plugin): migration readiness wait and doctor checks, E118-E120 (P7-PLUG-59) (#540)
  • feat(backup): off-box status from heartbeats and remote drill (P7-PROD-07) (#537)
  • feat(sdk): sdk/go/output envelope, error, exit-class and stream helpers (P7-SURF-28) (#541)
  • feat(canon): canon data in per-domain fragments with mode views (P7-CANON-02) (#542)
  • feat(config): nself.yaml JSON Schema and config validate, E435/E436 (P7-SURF-07) (#548)
  • feat(plugin): manifestv2migrate -targets prints every installer binary (P7-PLUG-55) (#549)
  • feat(sdk): simharness Docker sshd fleets, cli controlplane/sim delegates (P7-NODE-21) (#553)
  • feat(canon): canon engine, generated move table, v1.5 tree relocation, hub validators (P7-CANON-21) (#551)
  • feat(db): plugin seed hook, db seed --plugin and --all-plugins (P7-PLUG-32) (#554)
  • feat(backup): zero-config encryption identity, key-loss docs, advisory doctor hint (P7-PROD-08) (#547)
  • feat(drill): two-command drill (P7-CANON-16) (#556)
  • fix(deploy): deploy only the named env, inventory envs are targets (P7-DEPL-12) (#545)
  • feat(canon): generators build the v1.5 surface, canon page, moved-command stubs, registry-based golden path (P7-CANON-22) (#557)
  • feat(sdk): signing package, Ed25519 verification with purposes and DSSE (P7-CACHE-06) (#555)
  • feat(build): build --plan, --yes and --plan-id (P7-LIVE-03) (#552)
  • perf(db): migrate --migration-dir one ledger read per run (P7-LIVE-11) (#558)
  • feat(compose): one generated image lock for every image reference (P7-LIVE-17) (#496)
  • fix(sdk/ts): override proxy-addr to 2.0.8 (dependabot #40) (#561)
  • feat: daily availability probe for every image in the lock (#560)
  • fix(images): re-resolve python:3.12-slim lock after upstream digest was removed (#575)
  • feat(canon): config domain moves - env, secrets, oauth, telemetry, trust under config (P7-CANON-03) (#563)
  • feat(canon): move account commands under license (P7-CANON-04) (#577)
  • feat(canon): migrate data commands to canonical homes (P7-CANON-06) (#576)
  • feat(canon): move lifecycle deploy and services commands (P7-CANON-07) (#579)
  • feat(cli): mount installed plugin commands (P7-CANON-01) (#578)
  • feat(canon): move extension verbs to add and remove (P7-CANON-08) (#581)
  • feat(cli): canonicalize observe commands and add next step (P7-CANON-05) (#580)
  • feat(mirror): lock-driven image mirror tool (P7-PROD-73) (#571)
  • feat(admin): mount builtin command family (P7-CANON-19) (#582)
  • fix(deps): Go 1.26.9 and x/net v0.60.0 for GO-2026-6599..6617 (#587)
  • fix(deps): pin handlebars >=4.7.10 in the TS SDK lockfiles (#588)
  • feat(init): keep .nself/ci.yaml committable in new projects (P7-CI-58) (#589)
  • feat(db): stream Hasura metadata across remote envs (P7-LIVE-12) (#584)
  • feat(plugin): adopt licensed vocabulary and search alias (P7-PLUG-11) (#586)
  • feat: expose registry surface declarations (P7-SURF-30) (#590)
  • feat(deploy): add tiered targets and strict host keys (P7-DEPL-13) (#585)
  • feat(proxy): model generated routes and publish contract (P7-DEPL-01) (#591)
  • feat(images): diagnose pulls and use digest mirror (P7-LIVE-18) (#592)
  • feat: reconcile plugin and bundle changes (P7-LIVE-06) (#594)
  • feat(output): isolate envelope stdout and add conversion gates (P7-SURF-09) (#593)
  • feat(doctor): reconcile generated drift and allow safe fixes (P7-LIVE-07) (#596)
  • feat(deploy): target inventory access and ops profile (P7-DEPL-14) (#595)
  • feat(config): enforce CLI minimum version diagnostics (P7-TRUTH-12) (#598)
  • feat(hasura): expose schema and permissions snapshots (P7-SURF-32) (#599)
  • feat(build): publish compose env file manifest (P7-DEPL-26) (#600)
  • feat(deploy): refuse images missing host architecture (P7-DEPL-18) (#601)
  • feat(bundle): install-state ledger bundles.json v1 (P7-PLUG-18) (#603)
  • fix(ci): make the offload gate green on a clean main (D-0286) (#611)
  • feat(config): bind flags to env keys once and add config explain (P7-SURF-06) (#613)
  • feat(images): weekly reviewed image pin bump PR (P7-HYG-34) (#615)
  • feat(nginx): read plugin snippets and hand-managed conf.d into the route model (P7-DEPL-22) (#604)
  • feat(build): v1 envelope for reset, clean, uninstall and confirm rows for the build fragment (P7-SURF-26) (#614)
  • feat(data): v1 envelopes for db, backup, init template and update project (P7-SURF-14) (#612)
  • feat(invoke): machine request to argv to self-exec core and machineRegistry (P7-SURF-24) (#605)
  • feat(bundle): bundle install reaches app-ready, ledger moves to the plugin dir, doctor reports ledger drift (P7-PLUG-19) (#618)
  • feat(deploy): rolling restart through the compose manifest with a per-kind health gate (P7-DEPL-16) (#606)

Commits since previous release

  • feat(db): generate vector-search k-NN function and track it through Hasura (P7-ADOPT-07) (#623) (dd24913)
  • chore(release): bump version to 1.4.13 (#626) (2e89da8)
  • fix(compose): keep default images pinned after a weekly pin bump (#628) (a7f9d65)
  • feat(bundle): refcounted bundle remove, --delete-data confirmation, remove refuses a bundle member (P7-PLUG-20) (#625) (a668dcb)
  • feat(invoke): confirmation gate, machine audit log, machine token and mcp --host (P7-SURF-25) (#622) (c0b7779)
  • fix(compose): emit optional-service secrets as ${VAR} references, never literals (D-0266) (#627) (27d98a5)
  • feat(observe): v1 envelopes for status urls, status health, doctor heal, doctor images, help topics, version (P7-SURF-11) (#610) (5dc4317)
  • fix(build): honest envelopes for clean, reset and uninstall failures (P7-SURF-26 follow-up) (#624) (357ad44)
  • fix(nginx): route model honours nginx phase order, HTTP/1.1 websockets, safe ssl dirs and closed access scopes (P7-DEPL-22 follow-up) (#620) (2f3c740)
  • fix(config): explain names the ENV cascade selector and parses its options properly (P7-SURF-06 follow-up) (#621) (6271316)
  • feat(cli): opt-in once-per-24h update hint on stderr (P7-ADOPT-08) (#609) (7fda103)
  • feat(deploy): rolling restart through the compose manifest with a per-kind health gate (P7-DEPL-16) (#606) (5424e5a)
  • feat(bundle): bundle install reaches app-ready, ledger moves to the plugin dir, doctor reports ledger drift (P7-PLUG-19) (#618) (e31b987)
  • feat(invoke): machine request to argv to self-exec core and machineRegistry (P7-SURF-24) (#605) (4a0a306)
  • feat(data): v1 envelopes for db, backup, init template and update project (P7-SURF-14) (#612) (c06d04b)
  • feat(build): v1 envelope for reset, clean, uninstall and confirm rows for the build fragment (P7-SURF-26) (#614) (9aa984b)
  • feat(nginx): read plugin snippets and hand-managed conf.d into the route model (P7-DEPL-22) (#604) (77c35e1)
  • feat(images): weekly reviewed image pin bump PR (P7-HYG-34) (#615) (1edb7ef)
  • feat(config): bind flags to env keys once and add config explain (P7-SURF-06) (#613) (eb4dc6e)
  • fix(ci): make the offload gate green on a clean main (D-0286) (#611) (89089f5)
  • feat(bundle): install-state ledger bundles.json v1 (P7-PLUG-18) (#603) (0380f27)
  • feat(deploy): refuse images missing host architecture (P7-DEPL-18) (#601) (165953e)
  • feat(build): publish compose env file manifest (P7-DEPL-26) (#600) (b1242e6)
  • feat(hasura): expose schema and permissions snapshots (P7-SURF-32) (#599) (9241d44)
  • feat(config): enforce CLI minimum version diagnostics (P7-TRUTH-12) (#598) (f9e56ad)
  • docs: generate command wiki facts from registry (P7-TRUTH-01) (#597) (5cb8be2)
  • feat(deploy): target inventory access and ops profile (P7-DEPL-14) (#595) (6575544)
  • feat(doctor): reconcile generated drift and allow safe fixes (P7-LIVE-07) (#596) (00f048c)
  • feat(output): isolate envelope stdout and add conversion gates (P7-SURF-09) (#593) (5f4533a)
  • feat: reconcile plugin and bundle changes (P7-LIVE-06) (#594) (0c3ace5)
  • feat(images): diagnose pulls and use digest mirror (P7-LIVE-18) (#592) (f07ecf7)
  • feat(proxy): model generated routes and publish contract (P7-DEPL-01) (#591) (aecf3c2)
  • feat(deploy): add tiered targets and strict host keys (P7-DEPL-13) (#585) (0c91123)
  • feat: expose registry surface declarations (P7-SURF-30) (#590) (9bb2052)
  • feat(plugin): adopt licensed vocabulary and search alias (P7-PLUG-11) (#586) (6bcce7e)
  • feat(db): stream Hasura metadata across remote envs (P7-LIVE-12) (#584) (391dcee)
  • feat(init): keep .nself/ci.yaml committable in new projects (P7-CI-58) (#589) (3223ae1)
  • fix(deps): pin handlebars >=4.7.10 in the TS SDK lockfiles (#588) (e39a616)
  • Generated-state record and hand-edit policy (P7-LIVE-04) (#569) (5bdff7f)
  • fix(deps): Go 1.26.9 and x/net v0.60.0 for GO-2026-6599..6617 (#587) (35224ac)
  • chore(infra): remove cli terraform/ and dead internal/infra, point docs at the infra plugin (P7-DEPL-10) (#583) (a4a6090)
  • feat(admin): mount builtin command family (P7-CANON-19) (#582) (8705ffb)
  • feat(mirror): lock-driven image mirror tool (P7-PROD-73) (#571) (99e8405)
  • feat(cli): canonicalize observe commands and add next step (P7-CANON-05) (#580) (4c3dfc8)
  • feat(canon): move extension verbs to add and remove (P7-CANON-08) (#581) (861bb1e)
  • feat(cli): mount installed plugin commands (P7-CANON-01) (#578) (5ef35e7)
  • feat(canon): move lifecycle deploy and services commands (P7-CANON-07) (#579) (2316bb1)
  • feat(canon): migrate data commands to canonical homes (P7-CANON-06) (#576) (b3c8eb2)
  • feat(canon): move account commands under license (P7-CANON-04) (#577) (3529548)
  • feat(canon): config domain moves - env, secrets, oauth, telemetry, trust under config (P7-CANON-03) (#563) (cfd0b14)
  • fix(images): re-resolve python:3.12-slim lock after upstream digest was removed (#575) (459f083)
  • chore(deps)(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (#574) (7e1f932)
  • chore(deps)(deps): bump github.com/santhosh-tekuri/jsonschema/v6 (#573) (54c4f93)
  • chore(deps): otel 1.47.0, x/text 0.42.0, jsonschema-go 0.4.3, vendored (#570) (74466d3)
  • feat: daily availability probe for every image in the lock (#560) (3897ea1)
  • fix(sdk/ts): override proxy-addr to 2.0.8 (dependabot #40) (#561) (9a68729)
  • docs(wiki): generate error codes, exit codes and taxonomy reference pages (P7-TRUTH-35) (#559) (4870793)
  • feat(compose): one generated image lock for every image reference (P7-LIVE-17) (#496) (b83cd79)
  • perf(db): migrate --migration-dir one ledger read per run (P7-LIVE-11) (#558) (79b2317)
  • feat(build): build --plan, --yes and --plan-id (P7-LIVE-03) (#552) (347dbf5)
  • feat(sdk): signing package, Ed25519 verification with purposes and DSSE (P7-CACHE-06) (#555) (a962a37)
  • feat(canon): generators build the v1.5 surface, canon page, moved-command stubs, registry-based golden path (P7-CANON-22) (#557) (cfc6a7c)
  • fix(deploy): deploy only the named env, inventory envs are targets (P7-DEPL-12) (#545) (48582f0)
  • feat(drill): two-command drill (P7-CANON-16) (#556) (b73d587)
  • feat(backup): zero-config encryption identity, key-loss docs, advisory doctor hint (P7-PROD-08) (#547) (d0393fb)
  • feat(db): plugin seed hook, db seed --plugin and --all-plugins (P7-PLUG-32) (#554) (efd3abb)
  • feat(canon): canon engine, generated move table, v1.5 tree relocation, hub validators (P7-CANON-21) (#551) (eac0621)
  • feat(sdk): simharness Docker sshd fleets, cli controlplane/sim delegates (P7-NODE-21) (#553) (b066a68)
  • feat(plugin): manifestv2migrate -targets prints every installer binary (P7-PLUG-55) (#549) (dc3a000)
  • feat(config): nself.yaml JSON Schema and config validate, E435/E436 (P7-SURF-07) (#548) (eed7f34)
  • test(repoqa): http.Client and docker exec funnel ratchets (P7-GUARD-02) (#544) (766abfb)
  • test(perfbench): keep the timing verdict out of the order test (D-0250) (#546) (0437beb)
  • feat(canon): canon data in per-domain fragments with mode views (P7-CANON-02) (#542) (d6db370)
  • feat(sdk): sdk/go/output envelope, error, exit-class and stream helpers (P7-SURF-28) (#541) (715dd80)
  • test(repoqa): layer map, import-direction guard and orphan ratchet (P7-GUARD-01) (#543) (8c3dd9a)
  • feat(backup): off-box status from heartbeats and remote drill (P7-PROD-07) (#537) (991c396)
  • ci(contracts): make contract-check and Linux contract smoke (P7-REG-10) (#539) (9e961c5)
  • feat(plugin): migration readiness wait and doctor checks, E118-E120 (P7-PLUG-59) (#540) (c6f5c96)
  • feat(plugin): refuse install when required postgres extensions are missing (P7-ADOPT-06) (#538) (776d732)
  • feat(catalog): one generator for registry, catalog and counts (P7-PLUG-07) (#536) (29d171d)
  • feat(sdk): boot-time plugin migrations, contract plugin.boot-migrations v1 (P7-PLUG-14) (#535) (c22935b)
  • feat(remote): ParseHostSpec, one deploy host grammar (P7-DEPL-23) (#534) (c0d3c3b)
  • feat(backup): destination interface with path:// and host:// (P7-PROD-06) (#533) (3a6d094)
  • feat(ssl): HTTP-01 ACME challenge on every port-80 server block (P7-LIVE-24) (#532) (840e1d2)
  • feat(portable): bundle library, contract cli.portable-export v1 (P7-ADOPT-23) (#529) (994d4c1)
  • feat(plugin): manifest v2 types, schema and v1 normalizer (P7-PLUG-01) (#530) (2a8337c)
  • feat(remote): one SSH exec funnel with path validation and pinned host keys (P7-NODE-04) (#528) (2444b98)
  • feat(output): v1 envelope pilot on status, doctor, config (P7-REG-09) (#531) (f991447)
  • chore(deps)(deps-dev): bump typescript-eslint parser and plugin to 8.71.0 in /sdk/ts (#519) (a962938)
  • chore(deps)(deps-dev): bump @typescript-eslint/eslint-plugin from 8.70.0 to 8.70.1 in /sdk/ts (#518) (f116ed2)
  • chore(deps)(deps-dev): bump ts-jest from 29.4.13 to 29.4.14 in /sdk/ts (#517) (c9843d3)
  • refactor(build): Sink/Effects seam with in-memory plan mode (P7-LIVE-21) (#527) (1cfab33)
  • chore(deps)(deps-dev): bump ts-jest in /sdk/ts-sdk (#521) (ae24158)
  • feat(backup): schedule runs in the real project with the running binary; stream heartbeat (#522) (cb14bc0)
  • feat(config): CS_N v2 keys (depends_on, networks, Dockerfile, target, command, ancestor context) (#516) (55225a2)
  • feat(ci): cold-start A/B gate, p95 ceiling, real base build for size gate (P7-GUARD-08) (#525) (e975b72)
  • feat(schemas): generated JSON Schemas + golden contract tests (P7-REG-08) (#526) (bba0140)
  • feat(cli): project operation lock taken by the invocation decorator (P7-LIVE-13) (#524) (e812e39)
  • fix(ci): quarterly benchmark harness measures time to healthy (P7-TRUTH-22) (#523) (a7e7052)
  • feat(cli): help --json publishes the command registry (P7-REG-07) (#520) (300b85d)
  • fix(db): migrate up --dry-run read-only locally; remote dry-run refused unless proven (P7-PROD-84) (#514) (a45e63d)
  • feat(cli): exit classes, JSON error envelope and coded error block in main (P7-REG-06) (#513) (998825d)
  • feat(license): verify the cache against ping's signature, decode plugins_allowed and jwt (P7-PLUG-63, part 1) (#506) (ed88645)
  • ci(perfbench): add coverage floors and de-flake the sha test (#515) (6cf3bfc)
  • fix(db): migrate up --migration-dir --dry-run applies nothing; down --migration-dir (P7-PROD-77) (#507) (34c9670)
  • feat(perfbench): cold-start, time-to-healthy and A/B harness (P7-GUARD-07) (#511) (4f99cbe)
  • feat(ci): per-package coverage floors as data, checked by tools/covfloor (P7-GUARD-06) (#512) (452f5bb)
  • feat(ci): app-pinned nself-ci protection tooling and checks-aware toggle (P7-CI-60) (#508) (2bc1324)
  • feat(build): URL-encoded password variables for compose interpolation (P7-PROD-31) (#510) (a5c6600)
  • feat(cli): global --json flag with invocation decorator (P7-REG-05) (#509) (55ee978)
  • feat(sdk): sdk/go/compat ADR 0021 rule for plugin modules (P7-CI-49) (#505) (806c0b8)
  • feat(sdk): Go SDK tag form sdk/go/v2.M.P with local resolve proof (P7-SURF-18) (#504) (437da3b)
  • test(start): stub docker on PATH in start-command tests (P7-HYG-18) (#501) (129972d)
  • fix(sdk): rename sdk/go/license to licensing so the /v2 module zip builds (P7-SURF-34) (#503) (48737a7)
  • chore(ci): branch protection baseline matches live protection (P7-HYG-14) (#502) (ed2a19c)
  • feat(output): v1 envelope writer, error envelope and human error renderer (P7-REG-02) (#499) (c0d7e34)
  • fix(ci): endpoint-auth-checker fails closed, workflow gates only cli (P7-HYG-31) (#498) (6796bf3)
  • fix(doctor): port check ignores ports owned by the project's own stack (P7-PROD-30) (#500) (9b07851)
  • fix(scripts): branch-protection-toggle compares writable fields only and reports empty repos as n/a (P7-HYG-48) (#497) (2bcce07)
  • feat(canon): classify every command in canon.yaml (P7-REG-04) (#493) (562568c)
  • feat(docs): guide command checker for documented nself commands (P7-TRUTH-20) (#495) (1b7708e)
  • chore(release): retire MASTER-VERSIONS.md readers and writers (P7-TRUTH-34) (#494) (a12380a)
  • feat(reconcile): change-plan model, artifact diff, classification and env class (P7-LIVE-01) (#490) (931a7cd)
  • fix(nginx): route served nginx/ssl dir call sites through nginxtopo (P7-LIVE-02) (#492) (10750db)
  • fix(deps): raise brace-expansion to 1.1.21 / 5.0.12 in the TS SDK lockfiles (GHSA-q2hr-2g5m-vwhr) (#491) (3fc02ed)
  • feat(errs): exit class per error code, sentinel table, E400-E404, Describe (P7-REG-01) (#486) (c87b1f0)
  • ci(docker): publish after a successful Release run, resolve version in a tested script (P7-HYG-06) (#488) (5f7b73c)
  • ci(release): paginate DENY-005, gate publish on the denylist, bound artifact retention (P7-HYG-05) (#487) (ea95c41)
  • feat(registry): add internal/canon and internal/cmdregistry (P7-REG-03) (#489) (8dbda07)
  • feat(ssl): CLI-owned ACME over DNS-01 with certbot adoption (P7-LIVE-15) (#481) (1205592)
  • chore(repo): untrack compiled binaries, add tracked-binary guard and SSRF note (P7-GUARD-09) (#485) (425ac55)
  • docs(wiki): use the RFC 5737 example host in cmd-deploy (P7-HYG-02) (#484) (793a4d6)
  • feat(compat): NSELF_V15 gate helper and dual-mode test harness (P7-REG-11) (#483) (b98bc1f)
  • fix(scripts): admin-merge restores the full protection snapshot and GET-verifies it (P7-HYG-40) (#482) (b4a1e7b)
  • fix(doctor): send PLUGIN_INTERNAL_SECRET only to a local ai daemon, never via a proxy (P7-PLUG-73) (#480) (22ee746)
  • fix(plugin): stop sending PLUGIN_INTERNAL_SECRET to ping.nself.org (P7-PLUG-67) (#479) (0794319)
  • feat(doctor): served-certificate check in nself doctor (P7-LIVE-16) (#478) (d2cd402)
  • feat(ssl): served-stack primitives for the TLS path (P7-LIVE-25) (#477) (240e48e)
  • fix(compose): pull MinIO from the maintained pgsty fork (#476) (f6c45e2)
  • chore(deps)(deps-dev): bump eslint from 10.10.0 to 10.11.0 in /sdk/ts (#475) (6db45e1)
  • chore(deps)(deps-dev): bump @typescript-eslint/parser in /sdk/ts (#474) (53447c6)
  • chore(deps)(deps-dev): bump ts-jest from 29.4.12 to 29.4.13 in /sdk/ts (#473) (ca8edfa)
  • chore(deps)(deps-dev): bump ts-jest in /sdk/ts-sdk (#472) (c3ba19e)

Install

brew install nself-org/nself/nself
# or download a tarball below for your platform

Verify (Sigstore keyless)

cosign verify-blob \
  --bundle <tarball>.tar.gz.sig \
  --certificate-identity-regexp '^https://github.com/nself-org/cli/\.github/workflows/release\.yml@refs/tags/v1.4.13$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  <tarball>.tar.gz

Full signing + verification details: release-signing.md

Artifacts

  • Platform tarballs (linux/darwin × amd64/arm64) + Windows zips (amd64/arm64)
  • checksums.txt — SHA-256 of all tarballs
  • sbom.spdx.json + per-tarball SBOMs — SPDX software bill of materials
  • provenance.intoto.jsonl — SLSA v1.0 provenance attestation
  • *.sig — Sigstore cosign signature bundles for every artifact above
Assets 24
Loading