0.1.22

Central Vault Sync 0.1.22

Community-review compatibility release with artifact attestations temporarily omitted.

• Retains all sync behavior from 0.1.21 unchanged.
• Retains lightweight tags, unique per-release asset digests, reproducible source builds, exact asset/source byte comparison, and fail-closed release checks.
• Temporarily omits GitHub artifact attestations because Obsidian's current scorecard rejects newly issued attestations—including v3 and v4 bundles that GitHub verifies successfully—as hard errors.
• Missing attestations are represented by the Community scorecard as a non-blocking disclosure rather than an invalid-signature risk.

This is limited to the Community-review 0.x release. Stable-release provenance remains an acceptance requirement and will be restored after verifier compatibility is established.

Verification: lint, typecheck, 31 tests, production build, policy checks, lightweight tag, exact release/source bytes, and published SHA-256 digests.

0.1.21

Central Vault Sync 0.1.21

Obsidian Community attestation compatibility release.

• Pins actions/attest-build-provenance to the exact v3 commit used by Community releases whose scorecards show verified GitHub artifact attestations.
• Uses one v3 provenance statement covering main.js, manifest.json, and styles.css, matching the accepted release shape.
• Retains the lightweight tag, unique per-release digests, exact source/tag identity, and fail-closed annotated-tag check.
• Retains all sync runtime behavior from 0.1.20 unchanged.

Investigation established a version boundary: current releases generated with actions/attest-build-provenance v4 fail the Community scorecard across multiple repositories, while v2/v3-generated releases verify successfully. GitHub's verifier accepts both formats; this release targets the Community-compatible v3 format without weakening repository, workflow, source, or hosted-runner identity checks.

Verification: lint, typecheck, 31 tests, production build, policy checks, lightweight tag, exact release/source bytes, and strict GitHub SLSA verification.

0.1.20

Central Vault Sync 0.1.20

Release-provenance tag correction for the Obsidian Community scanner.

• Publishes from a lightweight Git tag so the GitHub tag ref points directly to the same commit digest recorded in SLSA provenance.
• Release CI now fails closed if a future release tag is annotated.
• Retains 0.1.19's unique asset digests and one single-subject provenance statement per main.js, manifest.json, and styles.css.
• Retains the 0.1.17 stale-parent bootstrap fix and all 0.1.16 performance/progress behavior unchanged.

Earlier review releases used annotated tags. GitHub CLI dereferenced those tags and verified the artifact statements, but third-party SLSA verifiers can compare the tag-object digest with the provenance commit digest and reject them. This release removes that ambiguity.

Verification: lint, typecheck, 31 tests, production build, policy checks, lightweight-tag API type, exact release/source bytes, unique digests, one subject per statement, and strict GitHub SLSA verification.

0.1.19

Central Vault Sync 0.1.19

Release-provenance compatibility correction for the Obsidian Community scanner.

• Emits one dedicated SLSA provenance statement per distributed asset instead of one multi-subject statement.
• Gives main.js and styles.css release-specific digests, preventing provenance lookup from mixing identical bytes attested by older tags.
• Attests main.js, manifest.json, and styles.css independently in the same GitHub-hosted build/release job.
• Adds policy checks that the bundle and stylesheet release markers match manifest.json.
• Retains the 0.1.17 stale-parent bootstrap fix and all 0.1.16 performance/progress behavior unchanged.

Verification: lint, typecheck, 31 tests, production build, policy checks, unique asset digests, release asset/source byte comparison, and strict per-asset GitHub SLSA verification.

0.1.18

Central Vault Sync 0.1.18

Release-integrity correction for the Obsidian Community review.

• Uses GitHub's dedicated actions/attest-build-provenance@v4 action for release provenance.
• Attests all distributed plugin assets: main.js, manifest.json, and styles.css.
• Release assets are built, attested, and uploaded in the same GitHub Actions job from this repository and exact tag.
• Retains the 0.1.17 stale-parent bootstrap fix and all 0.1.16 performance/progress improvements unchanged.

Verification: lint, typecheck, 31 tests, production build, policy checks, release asset/source byte comparison, and GitHub CLI SLSA provenance verification.

0.1.17

Central Vault Sync 0.1.17

Fixes an HTTP 500 observed during a real large, deeply nested vault bootstrap.

Fix

• A directory marker can change while descendant files are being uploaded.
• The plugin now keeps every descendant marker durable until that exact parent marker has been safely prepared.
• On retry it publishes the parent directory before its child files.
• No note operation or content is discarded; interrupted work remains resumable.

Server-side defense

Updated WebObsidian servers validate create/mkdir parents and return canonical invalid_request instead of exposing a filesystem ENOENT as HTTP 500. The server never invents unrevisioned implicit directories.

Verification

• Added a regression that first proves stale parent work blocks its child, then proves retry commits parent → child.
• Plugin check passes 31 tests plus lint, typecheck, build, and policy checks.
• WebObsidian passes 94 server tests plus the full core/web/headless suites, typecheck, build, and API/docs lint.

Users affected by a revoked/failed pairing should update to 0.1.17, choose Unpair locally, generate a new code for the same intended server vault, and pair again. Existing accepted server revisions are preserved and the new pairing converges the remaining local paths.

0.1.16

Central Vault Sync 0.1.16

This review release makes initial pairing of large local vaults substantially faster and shows live aggregate progress.

Performance

• Scans and persists local reconciliation work in bounded checkpoints instead of rewriting state per path.
• Uses at most four concurrent blob uploads.
• Publishes up to 100 ordered operations per request when the server advertises safe stop-after-failure batching; older servers automatically remain at one operation per request.
• Removes acknowledged terminal operation batches atomically while preserving idempotent crash replay.
• Deterministic 10,000-file full-plugin benchmark: 403.6s → 8.7s median (46.24×), 10,000 → 100 operation requests, and 50,002 → 302 plugin-state writes.

Progress and recovery

• Status bar and Settings show aggregate recovering, manifest, scanning, uploading, publishing, applying, and finalizing progress.
• Reports item/byte counts, operation/blob request counts, elapsed time, and resumed retries.
• Progress never includes note content, private paths, credentials, or raw errors.
• Scan, upload, checkpoint, stale-marker, retry, and concurrent Sync-now paths preserve durable work.

Safety

• Local paths are scanned and checkpointed before manifest materialization.
• Pending paths and queued operations remain protected from remote replacement.
• Operations stay revisioned, ordered, vault-bound, and idempotent.
• Server rejection stops later batch rows so retained client sequences remain retryable.

Requires WebObsidian with ordered-batch-stop-v1 for batched publication. Older Protocol 1.0 servers remain compatible through the safe one-request fallback.

0.1.15

Central Vault Sync 0.1.15

Vault-binding clarity and rate-limit diagnostics update.

Changed

• Plugin settings now show the bound server vaultId after pairing.
• Unpaired settings explicitly require selecting or creating the intended server vault in WebObsidian before generating a code.
• Pairing-code help clarifies that a device name never creates a vault; the code binds the local vault to the server vault displayed by WebObsidian.
• Rate-limit errors now include the server-advertised retry delay when available.

Safety

• Pairing remains one-use, vault-bound, revocable, and stored through Obsidian SecretStorage.
• Revision-aware writes, durable queues/apply intents, SHA-256 verification, conflict copies, and unsaved-editor protection are unchanged.

This is a normal GitHub release for Community directory review.

0.1.14

Central Vault Sync 0.1.14

Community review compatibility update.

Changed

• Use Obsidian activeDocument and activeWindow for visibility/focus handling so synchronization resumes correctly in popout windows.
• Publish as a normal GitHub release for Community directory scanning.

Retained safety

• Revision-aware writes, durable queues/apply intents, SHA-256 verification, conflict copies, offline recovery, and unsaved-editor protection are unchanged.
• Startup enumeration and explicit write-only redacted-diagnostics clipboard behavior remain documented.
• No telemetry, ads, dynamic code loading, or clipboard reads.

Use a backed-up non-production vault while Community review and cross-platform validation are in progress.

0.1.13

Central Vault Sync 0.1.13

Community review metadata update. Runtime synchronization behavior and Protocol 1.0 are unchanged from 0.1.12.

Changed

• Point authorUrl to the Picassio organization profile as required by the Community directory.
• Document why startup reconciliation enumerates vault files.
• Clarify that clipboard access is write-only, user-triggered, and limited to redacted diagnostics.
• Add release notes for Community review and users.

Safety

• Revision-aware writes, durable queues/apply intents, SHA-256 verification, conflict copies, offline recovery, and unsaved-editor protection remain unchanged.
• No telemetry, ads, dynamic code loading, or clipboard reads.

Use a backed-up non-production vault while Community review and cross-platform validation are in progress.