BeforeDone v1.0.2

Security patch release. Expands best-effort redaction before persistence to cover PEM private-key blocks, common GitHub/Slack/Google credential prefixes, AWS access key IDs, credential-bearing URIs, and unquoted assignment values containing spaces. Adds persisted check-log regression coverage. Redaction remains best effort; review artifacts before sharing. Built manually from commit 9e0e976 with GitHub Actions disabled. The release contains six static CGO-disabled archives, checksums, SPDX SBOMs, and Homebrew/Scoop manifests. This manual build has no GitHub OIDC provenance.

BeforeDone v1.0.1

BeforeDone v1.0.1

This is a small correctness and release-quality update. It keeps BeforeDone's
scope unchanged: prevent a normal coding agent from claiming completion with
missing or stale evidence; do not attempt to defend against a malicious process
with the same operating-system access.

Correctness fixes

• Fail closed when a declared relevant-file scope touches a Git submodule or
  gitlink whose complete working state cannot be fingerprinted safely.
• Include unresolved Git index stages in fingerprint decisions.
• Disable repository Git hooks only while BeforeDone creates its internal
  replay worktree; explicitly configured verifiers keep their normal behavior.
• Reject a signed Receipt whose embedded check ID does not match the requested
  latest-<check>.json alias, preventing one check's PASS from satisfying
  another required check.
• Lock receipt/log deletion and replacement behavior with regression tests.

Usability and distribution

• Add practical guidance and copyable Codex prompts for choosing credible
  checks and reporting uncovered acceptance criteria as unverified.
• Clarify that a Receipt is bound to the declared relevant-file scope; it does
  not prove that the verifier covers every natural-language requirement.
• Harden verification of the Skills-only OpenAI Directory bundle.
• Include Go runtime and linked-dependency notices in every release archive and
  expose the same list through beforedone licenses.

The release contains six platform archives, six SPDX SBOMs, checksums,
Homebrew/Scoop manifests, and the Skills-only Directory ZIP plus its SHA-256
sidecar. This manual release does not claim GitHub OIDC build provenance.

Native runtime testing of macOS, Linux, and Windows arm64 archives remains an
explicit environment exception; all six artifacts were cross-built and
inspected, and Windows amd64 was executed locally.

BeforeDone v1.0.0

BeforeDone v1.0.0

BeforeDone is a local evidence gate and incident replay toolkit for coding agents. It requires fresh verifier receipts bound to the current relevant files before a completion claim is accepted.

What ships

• A cross-platform Go CLI for Windows, macOS, and Linux on amd64 and arm64.
• A Codex Git Marketplace Plugin with a fail-closed Stop Gate and two bundled skills.
• A standalone Skills Pack and a separate Skills-only OpenAI Public Plugins Directory bundle.
• File-bound PASS, FAIL, and INCONCLUSIVE receipts with bounded output capture and redaction.
• Evidence-only incident reports and deterministic replay analysis, with explicit execution required for verifier reruns.
• Local storage, no telemetry, no cloud account, and an Apache-2.0 license.

Install

With Go installed:

go install github.com/rrrrrredy/beforedone/cmd/beforedone@v1.0.0
beforedone version

Or download the archive for your platform below, verify it against checksums.txt, and place the executable on PATH.

Verification boundary

This manual no-Actions release contains six archives, SHA-256 checksums, six SPDX SBOMs, generated Homebrew and Scoop manifests, and the Skills-only Directory bundle. The Windows amd64 archive was extracted and exercised against the adapter fixtures before upload.

Because this release was produced locally with repository Actions disabled, it does not claim GitHub OIDC build provenance. The embedded Go build metadata is clean and points to source commit b0b17adc083e34607d51cffec0f2a37bcdd3f346.

Documentation

• Product site
• Complete guide
• Source
• Security boundary