v0.2.0

[0.2.0] - 2026-09-09

Added

• v2: Add audit FTS5 query and harden 1Password refs(3a4a3d4)
• v2: Ship GitLab CI variable sync across daemon, CLI, MCP(90ba605)
• vault: Add vault ref resolver and kv client(0240fe8)
• agent: Add session list and revoke flow(74bdc58)
• agent: Add bulk session revoke for wrapped sessions(262eb1c)
• opaqued: Audit agent session lifecycle methods(b9e1d58)
• vault: Add lease-aware dynamic secret caching(cd2e437)
• vault: Revoke expired leases on cache refresh(d5fccab)
• web: Add opaque-web live dashboard with demo mode(ac5848a)
• Add v2/v3 cloud providers, device pairing, and iOS companion app(2974808)
• cli: Default to safe-demo preset on init and add next-steps guide(bcd44b1)
• dist: Add install script, Homebrew formula, and crate descriptions(a3fd6d3)
• aws: Wire up AWS provider with STS, Secrets Manager, and SSM operations(a038339)
• cli: Add quickstart command for one-step onboarding(992bbc5)
• ci: Add OpenSSF scorecard, dependency review, cargo-deny, and release signing(9c49e6c)
• ux: Add actionable error hints for common failure modes(5a60233)
• cli: Smart welcome screen, auto-start daemon, Codex connect + preset(d88e2fb)
• mcp: Add sandbox exec, profile listing, and secrets status tools(4723219)
• sandbox: Layered Linux sandbox with Landlock, seccomp, and bubblewrap(86af03a)
• sandbox: Add execve policy hook for external sandbox integration(46b9b46)
• agent: Secure-by-default env for opaque agent run(aec1ebf)
• New-project reliability improvements(93c6c56)
• Resolve critical blockers, harden daemon, and overhaul CLI UX(f1638c8)
• Re-found the core security invariant (Phase 0)(e42ad50)
• Detect audit-log tail truncation via an in-DB head anchor(6aa38c8)
• identity: Principal model, roles, and signed delegation tokens (Phase 1 core)(cf0410d)
• identity: Principal context on requests + identity policy dimension(fd58d16)
• cli: Opaque login/logout + identity subcommands + whoami identity section(43cf431)
• identity: Daemon identity foundation — OIDC login, store, principals (Stage B)(6b9610e)
• audit: Approver identity + principal snapshots in the tamper-evident chain(9773dde)
• identity: On-behalf-of delegation minting + per-request enforcement (Stage C)(b5ee2de)
• identity: Approver identity through the approval gate + segregation of duties (Stage D)(9b67cfd)
• trust-domain: Service-account split + keyed config seal (S1+S2)(435caec)
• approval: Factor verifier registry + signature-bound second-device approvals (S3a+S3b)(ada6774)
• approval: FIDO2/passkey factor with daemon-side verification (S3c)(f565216)
• sandbox: Actually apply Landlock + seccomp to exec children (C5, S4)(f90caea)
• deploy: Container trust-domain split — compose + k8s, smoke-verified (S5)(d8508e8)
• federation: Signed policy bundles + org/team namespaces (F1+F2)(a5c0bd7)
• export: Stream the audit chain to SIEM — spool, webhook, syslog (F3)(279d9e4)
• attest: Continuous posture attestation + verify-before-trust key release (F4)(791e68d)

CI/CD

• Fix flaky gcp tests and clear cargo-deny advisory(87f5f8d)
• Linux verification harness for the trust-domain work(2f51ed1)
• Run the federation e2e before the root-gated suites(42309a1)

Dependencies

• deps: Bump ossf/scorecard-action from 2.4.0 to 2.4.3 (#42)(1953cad)
• deps: Bump actions/setup-python from 5 to 6 (#44)(7411c25)
• deps: Bump getrandom from 0.3.4 to 0.4.1 (#46)(858ca77)
• deps: Bump actions/download-artifact from 4 to 8 (#47)(ab9c4c7)
• deps: Land the dependabot backlog in one pass(0626b6b)

Documentation

• Add landing page, launch post, enterprise architecture, and supply chain config(299c133)
• Remove windows and wsl support references(b579f8d)
• Complete GitHub Pages setup and markdown link cleanup(d66c585)
• README features + changelog for the trust-domain phase(7db6378)
• Onboarding tutorial + Phase 2 site — and the three provider bugs it found (#59)(1c49b37)

Fixed

• security: Sanitize audit detail fields to prevent secret leakage(9dfcdfe)
• web: Remove permissive CORS and add local auth token(51665d3)
• policy: Fail-closed workspace verification(f2ee068)
• audit: Add dropped event accounting with AtomicU64(4e06cb7)
• daemon: Enforce sealed config in production mode(27744bb)
• install: Fail-closed on missing checksum verification(5e8ef8e)
• linux: Restore landlock/seccomp compatibility for CI(3653825)
• linux: Import landlock RulesetAttr for handle_access(188ffb5)
• linux: Import RulesetCreatedAttr for add_rule(0aee368)
• ci: Stabilize linux sandbox build and env-dependent tests(2a75a2c)
• security: Patch XSS and timing attack, harden CI for 0.1.0(293f05d)
• ci: Resolve clippy needless-return and missing mkdocs nav entries(eefaad4)
• Resolve all clippy warnings for Rust 1.93 stable(9986e88)
• Collapse remaining nested if statements in service.rs(590d106)
• Use ** glob for known_human_clients exe_path matching(9f81bf4)
• Use restrictive seatbelt profile in sandbox probe and add exit-65 runtime fallback(5415277)
• Classify all CLI/MCP clients as Agent, downgrade sandbox.exec safety(bf7c385)
• Set working directory in execute_direct and include stdout/stderr in response(2fd20b8)
• ci: Clear RUSTSEC advisories + stage e2e daemon binary in traversable path(bc73f60)
• ci: Bump both rand versions past RUSTSEC-2026-0097(71f855a)
• homebrew: Make the advertised install command actually work(b1ae24e)
• Harden providers and refresh demo access (#64)(d02eb8a)
• release: Notarize a zip of the signed binaries, not the .tar.gz(faea406)
• release: Checkout for changelog before downloading artifacts(551921f)

Miscellaneous

• Apply formatting cleanup across remaining crates(cd10293)
• Add CODE_OF_CONDUCT.md, CI-managed CHANGELOG, and git-cliff config(be2e547)
• Remove Windows support references from roadmap and architecture(72f0d26)
• Validate and harden install script, docs, and deny.toml(d6e982a)
• Update Cargo.lock for landlock, seccompiler, and toml_edit deps(c6dffcc)
• Pin toolchain to 1.95.0 and settle fmt/clippy drift(7658895)

Styling

• Run cargo fmt to fix CI formatting check(8998fe2)

Testing

• linux: Skip sandbox exec tests when backends are unavailable(96f0a80)
• ci: Harden linux sandbox and vault lease tests(361b65c)
• Real-world e2e for tamper-evident audit + retention/chain fixes(bc44387)
• identity: Real-daemon OIDC e2e + CLI delegation rendering + docs (Stage E/F)(b04bb06)
• e2e: Split-daemon end-to-end proof + docs — evidence became prevention (S6)(043e5ae)
• federation: End-to-end proof + docs — Phase 2 complete (F5)(928a9d3)

Brand

• Restore the slogan — and write it down so it survives the next redesign (#60)(74e70d9)

Site

• Make opaque.info canonical and build it from this repo (#61)(3aca4d6)
• Deploy opaque.info with wrangler, from the repo (#62)(4b60bb8)