v0.0.2
initnow defaults to a dedicated~/.ssh/hal-vault_ed25519key pair, generated on first use, instead of borrowing~/.ssh/id_ed25519/id_rsa. Rotating your day-to-day SSH keys can no longer lock the vault. Bring an existing key with-r/-i; pick the database directory with-d(unchanged).- New library function
vault.GenerateSSHKeyPair. - Companion agent skill released: ofoxai/hal-vault-skill (
npx skills add ofoxai/hal-vault-skill) — teaches agents the safety contract and workflows, and recommends per-project vaults (.hal-vault/, gitignored, key kept in~/.ssh).
Binaries are built by CI with build provenance attestations: verify with gh attestation verify <archive> --repo ofoxai/hal-vault.