v2.2.0

runtime-image.yml and cargo-runtime-image.yml now upload a V5 source document and import nothing. manifest-path names a repo-relative V5 document (release.mode: source, runtime.kind: native_image); the policy-import step is gone from both workflows.

New outputs on runtime-image-upload and both workflows, read from the finalize response: artifact-digest, source-repository, source-ref, source-commit, source-workflow-identity, binding-revision, revocation-epoch. Publish afterwards with proof liskov application policy publish <app> --file <document> --artifact-digest … --binding-revision … --revocation-epoch … --source-ref … --source-commit … --workflow-identity … --expected-pointer-version <n> --yes, or with a pinned document naming artifact-digest.

Cargo source assurance. cargo-runtime-image.yml gains the optional source-assurance input (default false) and the source-digest and sbom-path outputs. The source-assurance action generates a deterministic CycloneDX SBOM from Cargo.lock when no pnpm-lock.yaml is present; existing pnpm SBOM bytes are unchanged.

Who is affected. Callers of acurast-app.yml@v2, marketplace-ingest.yml@v2 and policy-sync.yml@v2 see no change. A caller of the two runtime-image workflows that still builds from a V4 manifest stays on @v1, which is frozen at v1.3.2; it moves to @v2 together with a V5 document. On the action, authored-digest and release-intent-digest remain as the V4 mode, mutually exclusive with manifest-path, until V4 import closes.

Required server release. The Liskov control plane must carry liskov-rs #1632 (BKLG-20261008-k2hx). It is live in production. Against an older server the V5 mode fails closed at the upload session with domain_mismatch.

Source commit: 2eef49238a02a0a17824abf9c697935aa73f5734 (PR #17 / BKLG-20261008-7dyo and PR #18 / BKLG-20261008-v5rb).

Validation on this exact source: typecheck, 59 TypeScript tests and the Python suites, Python compileall, the regenerated distribution check, and main's build check all passed. No @v2 runtime-image workflow has run against production yet; the first run is the first live proof of the V5 upload arm.

v2.1.0

The encrypted JavaScript loader now embeds @proof-computer/liskov-runtime v0.3.35 from c25fea688d77b78cccaa01a00d4f9fd124c8693f.

The loader reads the current LISKOV job-side names, including LISKOV_BOOTSTRAP, LISKOV_LOCKBOX_BOOTSTRAP, LISKOV_CORE_URL and LISKOV_HOME. Legacy PROOF_SLIPWAY_, PROOF_LISKOV_, PROOF_LOCKBOX_, PROOF_ACURAST_ and SWITCHBOARD_MANAGED_* readers, plus SLIPWAY_HOME, are retired. Deprecated exported bootstrap-name constants may remain as compatibility constants; they do not restore legacy readers.

Existing @v2 callers pick up this rebuilt loader on their next workflow run. Previously uploaded artifacts remain unchanged. The v1 line remains frozen at v1.3.2, and v2 retains the workflow input/secret contract introduced in v2.0.0.

Source commit: 6e5f75a556677dabd1964ddaae4f03f4925de0e8 (PR #16 / BKLG-20261002-399v).

Validation: typecheck, TypeScript and Python tests, Python compileall, regenerated distribution check, and main build CI passed on this exact source.

v2.0.0

The reusable Liskov workflows now use LISKOV configuration names.

Breaking migration:

• Replace the ACURAST_IPFS_URL secret with the ipfs-endpoint workflow input. Endpoints are configuration, not credentials.
• Replace ACURAST_IPFS_API_KEY with the LISKOV_IPFS_API_KEY secret when an API key is required.
• Replace SLIPWAY_ARTIFACT_PIN_URL with LISKOV_ARTIFACT_PIN_URL.
• Move workflow callers and their input/secret declarations to @v2 together.

The v1 major tag is frozen at v1.3.2. Reusable workflows and their internal actions use @v2. The encrypted loader's runtime SDK update follows in v2.1.0 after its separate validated bundle update.

Source: 2745f48 (BKLG-20261002-u1rc).