v0.2.2

Patch release

Fixed

• Preserved the advisory Copilot CLI PowerShell hook’s documented zero exit status when it runs under a strict PowerShell caller, while retaining status output on stderr.
• Excluded local virtual environments and generated build directories from source distributions.

Added

• Added Windows-only regression coverage that runs the published PowerShell hook against a synthetic Git change and verifies the resulting Change Passport.

Security

• Updated the pinned CodeQL action revision used for Python security analysis.

Verification

The tag-triggered release workflow passed the complete quality gate, source/wheel build, metadata and manifest validation, clean-install wheel smoke test, digest generation, provenance attestation, and GitHub Release upload.

This release provides direct PowerShell-hook compatibility evidence only. It does not claim GitHub Copilot CLI sessionEnd event-dispatch validation, semantic correctness, external adoption, or PyPI publication.

Full Changelog: v0.2.1...v0.2.2

PatchWitness v0.2.1 — Clean-room committed-PR fix

PatchWitness v0.2.1

This patch release fixes the v0.2.0 clean-room failure when a committed pull-request diff is applied in a disposable worktree. The release removes the invalid positional - argument from the git apply invocation and adds regression coverage for committed base-to-HEAD gating, Change Passport generation, and offline verification.

The GitHub Actions guide now requires repository-specific dependency setup and uses PatchWitness's real .[dev] path for its own example. No new runtime dependencies, integrations, or CLI features are included.

Validation completed before release: full tests with coverage gate, Ruff, mypy, Demo, package build and Twine validation, clean install, committed-PR clean-room gate, minimal and recommended profiles, plus strict protected-workflow blocking with PW003 and offline evidence verification.

PyPI publication is intentionally not part of this release.

PatchWitness v0.2.0 — From install to evidence in one command

PatchWitness v0.2.0 - From install to evidence in one command

PatchWitness v0.2.0 removes the largest first-use obstacle: a developer can now install the CLI,
enter an existing Git repository, and produce a real Change Passport with patchwitness scan.
There is no configuration file to write before seeing the tool work.

What changed

• patchwitness scan selects the useful comparison automatically: HEAD for working-tree changes,
  or HEAD^ for the latest commit in a clean repository.
• Deterministic, local detection recognizes conventional test commands for Python, Node.js, Go,
  Rust, .NET, Maven, Ruby, PHP, and Make projects.
• Existing .patchwitness.toml policies are reused. Without one, the scan is clearly identified as
  an auto-detected-preview and the next step explains how to persist a trusted policy.
• patchwitness init uses the same detector instead of assuming pytest, supports explicit
  --check ID=COMMAND overrides, and can generate a structural-only policy with --no-detect.
• patchwitness doctor now shows the repository profile, exact detected commands, missing tools,
  contract state, and the recommended next command.
• Check execution automatically prefers the repository's .venv, so a globally isolated CLI can
  still use local test dependencies.

Try it

pipx install "https://github.com/pangxueyuan2-creator/patchwitness/releases/download/v0.2.0/patchwitness-0.2.0-py3-none-any.whl"
cd your-repository
patchwitness doctor
patchwitness scan

The output is a portable, offline-verifiable Change Passport under .patchwitness/evidence/.

Security boundary

Project detection is read-only: it does not run project code, contact a network service, or ask an
LLM to choose a command. The detected checks themselves do execute repository code with the current
user's permissions. Inspect an untrusted repository with patchwitness doctor, or use
patchwitness scan --no-checks for structural analysis only.

The auto-detected policy is intentionally a preview. A CI gate should still use a reviewed,
committed .patchwitness.toml loaded from the immutable base revision with --policy-ref.

Compatibility

• Evidence schema remains patchwitness.dev/evidence/v1.
• No runtime dependencies were added.
• Existing contracts, CLI commands, SDK calls, MCP tools, reports, and Change Passports remain
  compatible.

Release validation

• 51 tests passed on Windows with Python 3.14.5.
• Measured test coverage was 82.15%, above the enforced 80% floor.
• Ruff, strict mypy, CLI help, doctor, and a real self-scan passed.
• The self-scan ran all three repository checks and wrote a verified Change Passport.
• The wheel and source archive built successfully; the wheel installed without dependencies into a
  fresh virtual environment.
• That clean installation detected a separate Python repository, used its local .venv, ran its real
  pytest suite, produced a passing Change Passport, and verified the passport offline.
• Both archives had safe paths, no sensitive filenames, local maintainer paths, or private-key
  markers. One token-shaped string was reviewed and confirmed as an intentionally synthetic
  redaction-test fixture.

GitHub CI repeats the cross-platform matrix, and release assets receive GitHub build-provenance
attestations.

PatchWitness v0.1.1 - Verifiable releases, tighter automation

PatchWitness v0.1.1 - Verifiable releases, tighter automation

PatchWitness v0.1.1 is a security-hardening release. It does not change the evidence schema or the
core gate contract; it strengthens how the project itself is built, reviewed, and released.

Security improvements

• Every third-party GitHub Action is pinned to a full, immutable commit SHA.
• Read-only jobs discard the checkout credential instead of leaving it in the local Git config.
• Pull requests receive a dependency review that rejects newly introduced
  moderate-or-higher-severity vulnerabilities.
• The release workflow rejects a tag that does not match the package version.
• Release wheel and source archives receive GitHub build-provenance attestations before upload.
• Common local credential and signing-key files are ignored, with regression tests guarding these
  repository invariants.

PatchWitness now also uses one version source for its CLI, MCP server, package metadata, and Change
Passport, preventing release metadata from drifting between interfaces.

Install

pipx install "https://github.com/pangxueyuan2-creator/patchwitness/releases/download/v0.1.1/patchwitness-0.1.1-py3-none-any.whl"

Verify an artifact

After downloading a v0.1.1 asset, verify its GitHub-hosted provenance:

gh attestation verify patchwitness-0.1.1-py3-none-any.whl \
  --repo pangxueyuan2-creator/patchwitness

Compatibility

• Evidence schema remains patchwitness.dev/evidence/v1.
• No runtime dependencies were added.
• Existing contracts, CLI commands, SDK calls, MCP tools, and reports remain compatible.

Local release validation

• 32 tests passed on Windows with Python 3.14.5.
• Measured test coverage: 82.76%, above the enforced 80% floor.
• Ruff and strict mypy passed.
• The wheel and source archive were built from the release candidate, followed by a clean wheel
  installation and CLI smoke test.

GitHub CI repeats the test matrix across Linux, Windows, macOS, and Python 3.11-3.14.

PatchWitness v0.1.0 - Proof before merge

PatchWitness v0.1.0 - Proof before merge

The first public release introduces an independent trust layer for AI-generated code changes.

This release was materially accelerated by OpenAI Codex in ChatGPT. Its ability to understand a
repository, implement features, run tests, inspect failures, and iterate across engineering and
documentation work made it possible to develop PatchWitness as a coherent platform rather than a
thin demo. That experience reinforces the project's premise: powerful coding agents and strong,
independent verification are complementary parts of the same future.

Try the real risk demo

git clone https://github.com/pangxueyuan2-creator/patchwitness.git
cd patchwitness
python demo/run_demo.py

Install the release wheel with pipx:

pipx install "https://github.com/pangxueyuan2-creator/patchwitness/releases/download/v0.1.0/patchwitness-0.1.0-py3-none-any.whl"

Highlights

• Launch companion demo on main: a correct, test-passing feature is blocked because the agent also makes CI
  failures non-blocking; the exact terminal transcript and verified Change Passport are committed.
• Base-authoritative contracts: load policy from an immutable trusted Git SHA so a PR cannot
  weaken its own gate.
• Portable Change Passports: offline-verifiable JSON plus Markdown, SARIF, and GitHub output.
• Real verification evidence: command exit codes, timing, redacted excerpts, and output hashes.
• Impact-aware review: cached Python/JavaScript/TypeScript downstream dependency analysis.
• Safer execution: disposable hook-disabled clean-room worktrees and high-confidence secret
  findings that never retain the value.
• Platform surface: CLI, Python SDK, analyzer plugins, stdio MCP tools, Docker, and a composite
  GitHub Action.

Validation

• The v0.1.0 artifacts passed the original 27-test suite; current main adds an end-to-end
  reproduction of the public risk demo for 28 tests total.
• Ruff and strict mypy pass.
• Real package build and wheel smoke test.
• Windows benchmark raw data is committed under benchmarks/results/.

Important limitations

This is a public alpha. Clean-room worktrees are not a kernel sandbox, SHA-256 does not authenticate
producer identity, and passing checks do not prove semantic correctness. Read SECURITY.md,
PROJECT_STATUS.md, and docs/threat-model.md before high-assurance deployment.

PatchWitness is independent and is not affiliated with or endorsed by OpenAI.