CellFence v0.4.0

0.4.0 - 2026-09-06

• Breaking change: change CellFence findings toward evidence-bound diagnostic explanations instead of remediation recipes, so reports describe the rule, affected cells, paths, and observed basis for the decision without suggesting design fixes.
• Add a reproducible adversarial benchmark harness with task schemas, oracle fixtures, governance profiles, replay fixtures, and result validation for third-party verification.
• Add benchmark coverage for manifest relaxation, private import temptation, undeclared dependency temptation, baseline-waiver escape, and valid public imports.
• Refresh the signed CellFence self-baseline for the new benchmark and diagnostic surface.
• Harden release and CI verification around exact-ref mutation auditing, npm publish workspace discovery, self-check evidence, and benchmark regression tests.

CellFence v0.1.13

CellFence v0.1.13

0.1.13 publishes the existing trusted-publisher package set and freezes the first reproducible evidence-bundle workflow for corpus research. The evidence bundle is a research substrate for labeling and review; it is not a precision result by itself.

Published npm packages

• @cellfence/schema@0.1.13
• @cellfence/plugin-api@0.1.13
• @cellfence/adapter-call-pattern@0.1.13
• @cellfence/adapter-opentelemetry@0.1.13
• @cellfence/plugin-agent-budget@0.1.13
• @cellfence/plugin-blast-radius@0.1.13
• @cellfence/plugin-dependency-sovereignty@0.1.13
• @cellfence/plugin-geo-purity@0.1.13
• @cellfence/plugin-legacy-strangler@0.1.13
• @cellfence/plugin-quants-trend@0.1.13
• @cellfence/reporter-economy-matrix@0.1.13
• @cellfence/engine@0.1.13
• cellfence@0.1.13
• @cellfence/github-action@0.1.13
• @cellfence/trace@0.1.13

@cellfence/mcp-proxy is intentionally not published in this release; first-publish ownership and trusted-publisher bootstrap remain separate.

Verification

• Main CI: https://github.com/pushnanashi2/CellFence/actions/runs/29639912077
• npm publish dry-run: https://github.com/pushnanashi2/CellFence/actions/runs/29640633168
• npm publish: https://github.com/pushnanashi2/CellFence/actions/runs/29641109797
• Registry smoke: publish workflow post-smoke plus fresh local npx cellfence@0.1.13 fixture check
• SBOM asset: sbom.cdx.json
• SBOM SHA-256: 40b66c1f6fb572e3b31403e778dd045515ea647b94f33907f252a40b5d284f6a

CellFence v0.1.12

Summary

CellFence v0.1.12 is the npm-published pre-release hardening build. It keeps workspace package versions in lockstep, adds guarded npm trusted-publishing workflow support, hardens baseline signing documentation, and splits key engine internals without changing the public API.

Published Packages

Published to npm from the protected npm-publish environment using GitHub OIDC trusted publishing. The publish workflow completed successfully for the 15-package publish set. @cellfence/mcp-proxy remains intentionally unpublished until its first-publish ownership and Trusted Publisher path is decided.

Verification

• Commit: 7c4417d8ca53ced8af3654c5b6caaf38e7260fcc
• Main CI: https://github.com/pushnanashi2/CellFence/actions/runs/29633527412
• npm publish workflow: https://github.com/pushnanashi2/CellFence/actions/runs/29634153016
• SBOM: attached CycloneDX JSON (reports/sbom.cdx.json, sha256 7d82f41544c827db11bd43012a799a5ed7010019301552de0d76e28dfeac7702)

Changelog

• Bump all workspace packages and internal @cellfence/* dependency pins from 0.1.11 to 0.1.12.
• Split baseline sealing and ratchet comparison internals out of packages/engine/src/index.ts without changing the public engine API.
• Add npm pre-publish documentation for trusted publishing, provenance, SBOM generation, GitHub Releases, and the local release gate.
• Add safer GitHub Actions examples for asymmetric baseline verification on PRs and approval-scoped baseline signing workflows.
• Reframe the A/B friction study as controlled mechanism validation, not evidence of natural autonomous-agent behavior.
• Add sanitized real-use fixtures for a Cash-style service layout, Python source layout, monorepo package imports, and runtime resource evidence.