v0.6.0

[0.6.0] - 2026-09-27

Added

• Add scoped authority foundation(790d788)
• Connect scoped support workflow(d8d8416)
• policy: Add pinned authority manifests(a17eeb6)
• Export verifiable scope evidence(0ff3de0)
• ax: Correlate retained action outcomes(1a14acd)
• scope: Bind operator TLS trust roots(180e66f)
• scope: Govern GitHub staging workflow dispatch through scoped authority (#136)(2109af7)

Documentation

• Register scoped authority public page(513ab63)
• Explain uncertain agent writes(5477664)
• Link the Harborlight quickstart (#109)(bcb3b7e)

Fixed

• test: Stop timed-out package process groups(27b0d67)
• scope: Bind grants to provider credential(672c01b)
• mcp: List only served tools; name the failing field in validation errors (#135)(6589927)
• cli: Connect writes a working MCP config; presets stop teaching phantom syntax (#137)(9bf925a)
• sandbox: Probe Landlock for real and restrict the child, not the wrapper (#140)(08fcab9)
• test: Drain peer connections at shutdown (#89)(56126cf)

Miscellaneous

• license: Relicense the public core to Apache-2.0 with CC BY 4.0 documentation (#141)(551fa8c)

Testing

• scope: Qualify authority recovery failures(69c495f)
• scope: Qualify review failure boundaries(c935b68)
• Qualify scoped authority failure paths(350b7ea)
• evidence: Cover unsafe stopped exports(bef40f0)

v0.5.0

[0.5.0] - 2026-09-17

CI/CD

• Adopt nextest, consolidate cargo caches, cancel superseded PR runs(f023c14)
• Run the counted-allowance capacity race with the machine to itself(fa68192)
• Auto-sync the Homebrew tap on every published release(b922d48)

Documentation

• Add the evaluation guide and publish the compliance pages(b2aa1a8)

Fixed

• Regenerate embedded-policy example lockfile after v0.4.0 bump(52887a9)
• fuzz: Resync fuzz/Cargo.lock with the v0.4.0 release lockfile(d42214d)
• Stop the cargo-audit round-trip test from tripping the no-skips CI gate(ca8a872)
• Follow the repository transfer to the opaque-dev organization(e54da03)

Miscellaneous

• The Homebrew tap moved to opaque-dev too(c14e720)

v0.4.0

[0.4.0] - 2026-09-15

Added

• Capture private dogfooding workspace(f69fae6)
• Prepare private milestone validation(daa3624)
• Unify bounded work and Vault SSH(f8a2858)
• demo: Add verified human approvals(1da0ab0)
• brand: Explore Oleander/ArcBox/Antigravity-inspired motion direction (#23)(8c68d3e)
• opaque-providers: Feature-gate the 10 credential providers(908bf97)
• demo: Capture optional pilot requests(ad59106)
• Add governed workflows and shared dashboard(f699d05)
• Add reviewer, bounded outputs and evidence(8446069)
• Complete integrations and stateful CI(2078299)
• release: Embed cargo-auditable dependency manifests, add verification gate(ccba335)

CI/CD

• Expose required validation checks(f8182a2)
• Retrigger checks (GITHUB_TOKEN pushes don't fire workflows)(dfa4d47)
• Attach signed CycloneDX SBOMs to every release(2656b8a)
• Unpin Python to 3.12 so macOS arm64 runners resolve an available patch(1fc32e3)

Dependencies

• deps: Bump softprops/action-gh-release from 2 to 3(fc3d259)
• deps: Bump dtolnay/rust-toolchain from 1.95.0 to 1.120.0(9485107)
• deps: Bump libc from 0.2.181 to 0.2.189(2ef7241)
• deps: Bump serde from 1.0.228 to 1.0.229(dc0e77b)
• deps: Bump tokio from 1.49.0 to 1.50.0(c8b93e3)
• deps: Bump getrandom from 0.4.1 to 0.4.3(910025e)
• deps: Merge getrandom upgrade(d52ecf4)
• deps: Bump uuid from 1.20.0 to 1.26.0(901176c)
• deps: Bump actions/upload-pages-artifact from 4 to 5(21615a9)
• deps: Bump ossf/scorecard-action from 2.4.3 to 2.4.4(7662f1f)
• deps: Bump peter-evans/create-pull-request from 7 to 8(af2a62a)
• deps: Bump clap from 4.5.58 to 4.5.60 (#66)(ae30ee8)
• deps: Bump actions/setup-python from 6 to 7 (#65)(54645ba)
• deps: Bump actions/dependency-review-action from 4 to 5 (#72)(a069fd7)
• deps: Bump indicatif from 0.17.11 to 0.18.6 (#73)(3c27d63)
• deps: Bump tracing-subscriber from 0.3.22 to 0.3.23 (#70)(e976366)
• deps: Bump tokio from 1.50.0 to 1.53.1 (#68)(bf74259)
• deps: Bump tokio-rustls from 0.26.4 to 0.26.5 (#71)(4e7fb5a)

Documentation

• Record staging artifact validation(605ea26)
• Record verified production deployments(ff29064)
• Record combined deployment smoke test(0637630)
• Record pilot contact deployment(bd86c34)
• Align docs with bounded-work product direction(f17d48b)
• Recover an unmerged security review from an abandoned worktree(e4b6277)
• Record the three-repo split decision (demo / core / dogfood)(9b488c4)
• Name the audience across all external surfaces(0557a4e)
• Rewrite external copy in the reference-site register, sweep em-dashes(9c9a5bf)
• Drop the headcount from the audience frame(ed47cbe)
• Focus product story and verification (#82)(5e2899d)
• Annotate the security assessment with verified finding statuses(97d247a)
• Add compliance control mapping, roadmap, hardening guide and FIPS assessment(ff16314)
• Re-verify compliance citations against the public tree(a9a884f)
• Re-verify FIPS citations against the rebased main (#87)(93193e1)

Fixed

• Harden providers and refresh demo access(8511a3a)
• release: Drop the tag's v prefix from archive filenames(7a9955b)
• ci: Pin valid actions and resolve upgrades(7b53a69)
• Prove native review and prepare staging(9681a7b)
• demo: Keep OAuth callback free of analytics(68b039d)
• Close reliability and quality gaps(0dab7ef)
• demo: Reduce idle polling and storage writes(7628278)
• mcp: Drain in-flight tool calls on stdin EOF instead of dropping them(fc568be)
• mcp: Allow authenticated catalog discovery(5608011)
• audit: Acquire writer before reading(92c854f)
• Validate delivery and legacy audit upgrades(2d3b954)
• deps: Upgrade vulnerable XML parser(0f0509b)
• ci: Qualify docs and select nightly(bbad650)
• Update embedded identity example(b45a3cf)
• ci: Select available macOS Python build(b59b008)
• ci: Preserve split-user profile access(467e5f0)
• Dis...

v0.2.0

[0.2.0] - 2026-09-09

Added

• v2: Add audit FTS5 query and harden 1Password refs(3a4a3d4)
• v2: Ship GitLab CI variable sync across daemon, CLI, MCP(90ba605)
• vault: Add vault ref resolver and kv client(0240fe8)
• agent: Add session list and revoke flow(74bdc58)
• agent: Add bulk session revoke for wrapped sessions(262eb1c)
• opaqued: Audit agent session lifecycle methods(b9e1d58)
• vault: Add lease-aware dynamic secret caching(cd2e437)
• vault: Revoke expired leases on cache refresh(d5fccab)
• web: Add opaque-web live dashboard with demo mode(ac5848a)
• Add v2/v3 cloud providers, device pairing, and iOS companion app(2974808)
• cli: Default to safe-demo preset on init and add next-steps guide(bcd44b1)
• dist: Add install script, Homebrew formula, and crate descriptions(a3fd6d3)
• aws: Wire up AWS provider with STS, Secrets Manager, and SSM operations(a038339)
• cli: Add quickstart command for one-step onboarding(992bbc5)
• ci: Add OpenSSF scorecard, dependency review, cargo-deny, and release signing(9c49e6c)
• ux: Add actionable error hints for common failure modes(5a60233)
• cli: Smart welcome screen, auto-start daemon, Codex connect + preset(d88e2fb)
• mcp: Add sandbox exec, profile listing, and secrets status tools(4723219)
• sandbox: Layered Linux sandbox with Landlock, seccomp, and bubblewrap(86af03a)
• sandbox: Add execve policy hook for external sandbox integration(46b9b46)
• agent: Secure-by-default env for opaque agent run(aec1ebf)
• New-project reliability improvements(93c6c56)
• Resolve critical blockers, harden daemon, and overhaul CLI UX(f1638c8)
• Re-found the core security invariant (Phase 0)(e42ad50)
• Detect audit-log tail truncation via an in-DB head anchor(6aa38c8)
• identity: Principal model, roles, and signed delegation tokens (Phase 1 core)(cf0410d)
• identity: Principal context on requests + identity policy dimension(fd58d16)
• cli: Opaque login/logout + identity subcommands + whoami identity section(43cf431)
• identity: Daemon identity foundation — OIDC login, store, principals (Stage B)(6b9610e)
• audit: Approver identity + principal snapshots in the tamper-evident chain(9773dde)
• identity: On-behalf-of delegation minting + per-request enforcement (Stage C)(b5ee2de)
• identity: Approver identity through the approval gate + segregation of duties (Stage D)(9b67cfd)
• trust-domain: Service-account split + keyed config seal (S1+S2)(435caec)
• approval: Factor verifier registry + signature-bound second-device approvals (S3a+S3b)(ada6774)
• approval: FIDO2/passkey factor with daemon-side verification (S3c)(f565216)
• sandbox: Actually apply Landlock + seccomp to exec children (C5, S4)(f90caea)
• deploy: Container trust-domain split — compose + k8s, smoke-verified (S5)(d8508e8)
• federation: Signed policy bundles + org/team namespaces (F1+F2)(a5c0bd7)
• export: Stream the audit chain to SIEM — spool, webhook, syslog (F3)(279d9e4)
• attest: Continuous posture attestation + verify-before-trust key release (F4)(791e68d)

CI/CD

• Fix flaky gcp tests and clear cargo-deny advisory(87f5f8d)
• Linux verification harness for the trust-domain work(2f51ed1)
• Run the federation e2e before the root-gated suites(42309a1)

Dependencies

• deps: Bump ossf/scorecard-action from 2.4.0 to 2.4.3 (#42)(1953cad)
• deps: Bump actions/setup-python from 5 to 6 (#44)(7411c25)
• deps: Bump getrandom from 0.3.4 to 0.4.1 (#46)(858ca77)
• deps: Bump actions/download-artifact from 4 to 8 (#47)(ab9c4c7)
• deps: Land the dependabot backlog in one pass(0626b6b)

Documentation

• Add landing page, launch post, enterprise architecture, and supply chain config(299c133)
• Remove windows and wsl support references(b579f8d)
• Complete GitHub Pages setup and markdown link cleanup(d66c585)
• README features + changelog for the trust-domain phase(7db6378)
• Onboarding tutorial + Phase 2 site — and the three provider bugs it found (#59)(1c49b37)

Fixed

• security: Sanitize audit detail fields to prevent secret leakage(9dfcdfe)
• web: Remove permissive CORS and add local auth token(51665d3)
• policy: Fail-closed workspace verification(f2ee068)
• audit: Add dropped event accounting with AtomicU64(4e06cb7)
• daemon: Enforce sealed config in production mode(27744bb)
• install: Fail-closed on missing checksum verification([5e8ef8e](https://github.com/kcirtapfromspace/opaque/commi...

v0.1.0

Full Changelog: https://github.com/kcirtapfromspace/opaque/commits/v0.1.0