reVault CLI 0.6.0

Release all
CLI: 0.6.0
Bindings: 0.6.0

• Use a private directory for nested Vault lock regression
• [release candidate] Prepare all release: CLI 0.6.0, bindings 0.6.0
• Complete CLI exchange coverage and create safe Vault parents
• [release candidate] Prepare all release: CLI 0.6.0, bindings 0.6.0
• Complete binding lint and source package release checks
• Format reciprocal exchange C# facade for release lint
• [release candidate] Prepare all release: CLI 0.6.0, bindings 0.6.0
• Build candidate WebAssembly packages from current source
• Fix format-4 exporter Windows build and candidate regressions
• [release candidate] Prepare all release: CLI 0.6.0, bindings 0.6.0
• Record qualified migration dependency publication
• Publish format-2 recovery exporter contract and correct migration gates
• [release candidate] Prepare all release: CLI 0.6.0, bindings 0.6.0
• Include protocol throughout Rust binding packaging and publication
• [release candidate] Prepare all release: CLI 0.6.0, bindings 0.6.0
• Publish protocol before dependent Vault crate
• [release candidate] Prepare all release: CLI 0.6.0, bindings 0.6.0
• Record migration dependency publication and private advisory review
• Record packaged format-4 migration qualification
• Prepare security release notes and include format-4 exporter bootstrap
• Update doctor and future-format regressions for format 5
• Complete exchange binding conformance and dependency locks
• Harden Profile backup buffers and cover security boundaries
• Record original #226 history after current-main integration
• Fix #226: integrate full reciprocal exchange across CLI and bindings
• Record completed branch audit and intentional holdbacks
• Merge #322 headless documentation and retained validation evidence
• Merge already-integrated fix branch histories
• Record local 0.6.0 integration validation
• Record local integration in security release checklist
• Merge format-5 descriptions and security work
• Merge plaintext read-only binding support
• Merge October dependency updates
• Expose plaintext read-only archive opening across bindings
• Update Cargo dependencies for October 2026
• Fix #4142: expose unencrypted read-only lockboxes to Java
• Merge #324 mutation regression into main
• Document #324 historical storage fix boundary
• Fix #324: retain mutation regressions and verify deleted files
• Merge #324 historical fix documentation
• Document #324 historical storage fix boundary
• Merge #324 mutation regression into format-5 work
• Fix #324: retain mutation regressions and verify deleted files
• Implement #333: native item descriptions in format 5
• Merge branch 'security/advisory-fixes-2026-10' into issue-333-descriptions
• Document security release and disclosure checklist
• Merge branch 'security/advisory-fixes-2026-10' into issue-333-descriptions
• Fix #333: add multiline descriptions to variables and forms
• Harden key sharing and Vault I/O boundaries
• Fix Swift read-only signing key disposal in conformance
• Fix Dart conformance formatting after Vault merge
• Merge branch 'issue-334-readonly-vault-credentials'
• Merge branch 'fix-clippy-ci-gate'
• Fix Rust Clippy warnings in recovery commands
• Fix #334: test reader locks in Android native conformance
• Fix #334: isolate lock timeouts in process tests
• Fix #334: run reader lock tests on desktop CI
• Fix #334: test read-only Vault locks across processes
• Fix #334: allow credential reads from read-only vaults
• Improve helper guidance and invalid path diagnostics
• Recover verified files and preserve partial ranges with diagnostics
• Add revault-tool install command
• Compile Android acceptance runners before emulator startup
• Use executable DCli SDK for Android release jobs
• Fix Android release setup and candidate test fixtures
• [release candidate] Prepare Dart 0.5.2
• Add Android support for Dart and native C/C++ bindings
• fix: report newer lockbox formats across language bindings
• Repair binding publication retries and preserve tag-triggered releases [skip ci]
• Fix Rust-compatible resolution for terminal crate releases [skip ci]
• Fix #322: bound D-Bus credential and connection waits
• Fix #322: remove native D-Bus dependency from Linux CLI
• Fix #226: add reciprocal invitation-scoped key exchange
• Update standalone Rust binding lockfile for x25519 3
• Merge fa17c69 into 689a2bc
• fix(release): normalize Windows package paths
• ci: scope Dart releases to Dart conformance
• fix(release): avoid Windows evidence stack overflow
• fix(windows): avoid Rust TLS during DLL teardown
• style: format Dart conformance with CI SDK
• docs: allow mechanical release metadata changes
• docs: define efficient release monitoring
• release: prepare Dart revault_api 0.3.2
• release: publish Dart revault_api 0.3.1
• ci: add Dart-only release tags
• feat: prepare Dart 0.3 API and standalone vaults
• feat(cli): replace sync with mirror projects
• Add explicit sync rule inspection and clearing
• Clarify sync safeguards and stored rules
• Document target-first sync usage
• Refine sync metadata naming and help
• Fix #267: add safe directory synchronization
• fix native last-error conformance
• fix PHP release conformance
• fix(windows): retry named-pipe reconnect gaps
• fix(lua): decode signed FlatBuffer vtable offsets
• fix(lua): decode signed FlatBuffer vtable offsets
• fix(windows): retry transient agent probes
• fix(kotlin): install Gradle 8.13 on JDK 22
• fix(kotlin): align conformance Gradle version
• fix(windows): clear stale mutex error state
• fix(windows): clear stale mutex error state
• fix(windows): enforce a single session agent
• test(windows): persist native phase output
• fix(dart): match stored profile email in conformance
• test(native): isolate and time conformance phases
• fix(dart): use public package entry point in conformance
• fix(conformance): dispatch Windows agent child
• fix(conformance): dispatch Windows agent child
• test(conformance): bound Windows agent shutdown
• fix(conformance): preserve all moved form values
• fix(release): normalize Windows conformance workspace
• fix(release): support MSVC C conformance build
• fix(release): normalize Windows CMake paths
• fix(release): validate C conformance artifact paths

revault-api-v0.6.0

Ruby packaging notice

The six Ruby 0.6.0 platform gems omit the binding implementation and native libraries and cannot be loaded. A corrected 0.6.1 bindings release is being validated. Ruby users should wait for that correction. This packaging defect is specific to the Ruby gems.

Full Changelog: revault-api-v0.5.1...revault-api-v0.6.0

reVault CLI 0.5.1

reVault 0.5.1 preserves the archive and Vault compatibility of 0.5.0 and fixes historical migrations.

• lbx doctor now identifies an outdated local Vault and recommends lbx doctor migrate all --replace to upgrade the Vault and its known Lockboxes.
• Historical migrations use three consolidated packages: revault_migrate_v1, revault_migrate_v2, and revault_migrate_v3. Each supplies archive and Vault exporters for its source container version.
• Vault migration preserves credentials, aliases, historical signing keys, and other stored records. Format-2 recovery supports separate output and a read-only dry run.
• Explicit read-only opens work with recipient credentials without requiring the owner's signing key.
• The secure-memory helper is now named revault_secure_memory. Superseded reader and exporter packages are retired separately; historical versions remain available.

CLI and public language bindings use the 0.5.x compatibility line. Internal helper package versions are independent of archive format numbers.

Releases now come from main. Release qualification installs the exact published migration exporters and verifies persisted migration results. Promotion reuses the validated candidate artifacts; broad performance observation campaigns run when relevant changes require them.

revault-api-v0.5.1

reVault 0.5.1 preserves the archive and Vault compatibility of 0.5.0 and fixes historical migrations.

• lbx doctor now identifies an outdated local Vault and recommends lbx doctor migrate all --replace to upgrade the Vault and its known Lockboxes.
• Historical migrations use three consolidated packages: revault_migrate_v1, revault_migrate_v2, and revault_migrate_v3. Each supplies archive and Vault exporters for its source container version.
• Vault migration preserves credentials, aliases, historical signing keys, and other stored records. Format-2 recovery supports separate output and a read-only dry run.
• Explicit read-only opens work with recipient credentials without requiring the owner's signing key.
• The secure-memory helper is now named revault_secure_memory. Superseded reader and exporter packages are retired separately; historical versions remain available.

CLI and public language bindings use the 0.5.x compatibility line. Internal helper package versions are independent of archive format numbers.

Releases now come from main. Release qualification installs the exact published migration exporters and verifies persisted migration results. Promotion reuses the validated candidate artifacts; broad performance observation campaigns run when relevant changes require them.

Full Changelog: revault-api-v0.5.0...revault-api-v0.5.1

Full Changelog: revault-api-v0.5.0...revault-api-v0.5.1

reVault CLI 0.5.0

Publication status: CLI archives are available. Package-registry publication and final postpublication checks are still in progress.

reVault 0.5 introduces archive format 4 and the 0.5 compatibility line, with authenticated archive metadata and durable transaction recovery. Password-based access, Session Agent transport and compression-buffer ownership have been hardened. Extraction restores stored permissions by default.

Upgrade matching CLI and binding/native-carrier packages together. Migrate the Vault first, then older archives; signed v2/v3 migration requires the established owner key. Keep originals until migrated data is independently checked. The 0.4 line cannot read format-4 archives or Vault containers.

The exact Linux distribution binary completed a reduced comparison with 450 observations in 67 minutes 24 seconds. Across five measured workloads, unencrypted extraction took 16–55% less time than ZIP; all five paired statistical gates passed. Password-encrypted, owner-signed creation was faster than compression-only ZIP in these workloads. Protected extraction was faster for the larger and many-file workloads, but slower for both 64 MiB workloads. These protected comparisons are descriptive and compare different security capabilities.

The six-case resource screen peaked at a conservative 103.5 MB combined CLI and Session Agent bound. The release ceiling is 104 MB; 100 MB remains the target. The 450-observation comparison peaked at 100.43 MB. These bounds combine process lifetime peaks and do not establish a universal archive-capacity or memory guarantee. Measurements used four workers, verified extracted bytes and permissions, and the unchanged format-4 archive layout. Reusing fixed read archives and reducing redundant observations shortened the campaign; the shorter campaign is not itself a product speedup.

The manual source documents archive and metadata limits. The current reader keeps the complete file index in memory, so memory use grows with entry count, path lengths and chunk descriptors. CLI extraction defaults are 1 GiB per file, 10 GiB total and 100,000 selected entries; numeric overrides are not currently exposed. Practical capacity qualification and CLI overrides are tracked for post-release work in #330 and #331.

Qualified source: b086e6a. Candidate validation and artifact seal completed successfully: 61 jobs passed and 22 conditional jobs were skipped. This includes all twelve platform installed-package jobs and both secure-API configurations. The exact-artifact process admission, six-case resource screen and reduced comparison also passed. The release includes the historical migration decoder correction for RUSTSEC-2026-0344, extraction-memory corrections, and a framed Unix Session Agent reply-race correction. The comparison report and machine-readable results are attached to this release.

revault-api-v0.5.0

Full Changelog: revault-api-v0.4.1...revault-api-v0.5.0

reVault CLI 0.4.1

reVault CLI 0.4.1 remains on the format-3 / Vault-structure-3 compatibility line. Format-4 development is not included in this release.

Changes include:

• Vault-managed Lockbox aliases, automatic alias registration on creation, and consistent alias resolution across CLI archive arguments.
• Plural resource command groups, scripting helpers, and completion installation for all CLI commands.
• Historical Lockbox recovery, improved migration diagnostics, and bulk migration with retained backups.
• Corrected variable moves and renames, Vault container migration, and headless Linux integration.

The release includes the required Rust API and CLI dependency crates. Language bindings are not republished; the existing 0.4.x bindings remain on the same format compatibility line.

Validation includes the release-candidate CI checks and cross-version CLI/Dart archive and Vault compatibility checks.

Full commit history: revault_cli-v0.4.0...revault_cli-v0.4.1

reVault CLI 0.4.0

Release all
CLI: 0.4.0
Bindings: 0.4.1

• Establish the 0.4.x compatibility line for archive format 3; format 4 is excluded.

• Dart 0.4.0 has already shipped; 0.4.1 updates its build-hook dependency and package-version metadata.

• Declare the Swift native-library dependency explicitly on Linux and locate its build products through SwiftPM.

• Fix #310: share verified raw frames with seekable readers

• Fix #310: reduce large-file read copies and redundant wiping

• Fix #310: share decoded pages and benchmark fresh ZIP reads

• Prepare all release: CLI 0.0.18, bindings 0.3.16

• Retain comprehensive migration fixtures and enforce release coverage

• Fix hosted WASM conformance native loader paths

• Prepare all release: CLI 0.0.18, bindings 0.3.16

• Strengthen migration assertions and update format documentation

• Fix header corruption tests for v3 lockboxes

• Prepare all release: CLI 0.0.18, bindings 0.3.16

• Fix release conformance format probe and xtask workflow

• Prepare all release: CLI 0.0.18, bindings 0.3.16

• Hide xtask development tasks behind revault-tool

• Consolidate development commands in revault-tool

revault-api-v0.4.1

Full Changelog: revault_cli-v0.0.17...revault-api-v0.4.1

reVault CLI 0.0.17

Release cli
CLI: 0.0.17
Bindings:

• Fix TypeScript signing key cleanup
• Prepare cli release: CLI 0.0.17, bindings
• Format Dart E2E conformance runner
• Prepare cli release: CLI 0.0.17, bindings
• ignore gitbook created .agents
• Fix native carrier selection across bindings
• Prepare cli release: CLI 0.0.17, bindings
• Fix Clippy warnings in E2E coverage locking
• Prepare cli release: CLI 0.0.17, bindings
• Fix CLI E2E option coverage
• Prepare cli release: CLI 0.0.17, bindings
• Fix vault initialization diagnostic and review new Rust APIs
• Prepare cli release: CLI 0.0.17, bindings
• Add independent lockbox encryption signing and compression options
• Fix tag-triggered Dart publication
• Reduce mirror test delays and reuse package conformance build caches