v0.6.0

This release adds the foundation for search in Cairn: a lexical search index that is built as artifacts are created, plus self-hosting fixes.

Features

• Build the lexical search index that search will run on (SPEC-002) (b633163)

Fixes

• Ship Garage so both compose paths pull again (3f520ea)

Maintenance

• 3 dependency updates (goldmark, garage docker tag)

Full changelog: v0.5.0...v0.6.0

v0.5.0

Cairn v0.5.0 ships artifact relations and trace context end to end: the core model, the create-path flags and their surfaces in the CLI, MCP and viewer, so the cairn CLI now reads and comments without an MCP server.

Features

• give the CLI read and comment, so cairn needs no MCP server (23c7f55)
• artifact relations and trace context (SPEC-0024 slice 1) (a1d22f2)
• artifact relations surfaces: MCP, CLI and viewer (SPEC-0024 slice 2) (1d3b835)

Fixes

• record an unopenable subscription as a failed delivery (28f4d16)
• rebuild runtime apk layer fresh so Trivy never scans stale (bb49107)
• bump build-push-action to v6 so no-cache-filter renders (a458c8d)
• forward the GitHub sign-in env in the guide's compose (3af5ff5)

Docs

• design records for native artifact assignee + artifact.assigned (ADR-0032, SPEC-0025) (d987c4b)

Maintenance

• 4 dependency updates (client_golang, x/term, minio-go, md2a2ui)

Full changelog: v0.4.0...v0.5.0

v0.4.0

What am I downloading?

• cairn_<version>_<os>_<arch>: the cairn binary — everything in
  one. Use it as the CLI from a terminal or script, or run the server with
  cairn serve. Most self-hosters use the container image instead:
  ghcr.io/stump-wtf/cairn:0.4.0.

Each archive holds its one binary plus LICENSE. checksums.txt covers it.

Changelog

Features

• f8b929a feat(auth): static API tokens act only as an operator's user (#391)
• fc3932c feat: operator profile — CAIRN_OPERATORS, console, suspension that offboards, audit (#389)
• 8fb6a08 feat: owned outbound subscriptions replace CAIRN_OUTBOUND_WEBHOOK_URLS (#396)
• ce2bd2d feat: owner columns and backfill, owners and authors become user ids (#384)

cairn v0.3.0

cairn v0.3.0 — one binary: the CLI and the server are now a single cairn executable, and the server is cairn serve.

Highlights

• One binary: the server is now cairn serve. There is no separate cairnd anymore — the same cairn you use at the terminal runs the server (fbbac9c, d65498b).
• Users and identities. Sign-ins now resolve to real user records, and sessions carry user ids, so shares and audit trails are tied to people rather than raw identities (890f32d, b91dc6f).
• Actionable validation errors. Invalid input now comes back with typed, structured violations — which field, why, and what to do — instead of a bare error string, across the CLI, the API, and MCP tool errors (ae94068, e195ec7, c2676ac, a82dacf, 0469009).
• Secret redaction on ingest. cairn ingest --redact=mask masks secret-looking content before it is stored, warns when masked content appears, and rejects over-redacted records (433e2e4).
• Artifact scanning. Artifact and bundle bodies are now scanned before they are stored, so malicious content is caught at intake rather than at delivery (e8084d0).

Upgrading from v0.1.0

• cairnd is gone: run the server with cairn serve. The flags and environment variables are the same ones cairnd took — only the command name changed.
• The container image keeps a cairnd shim for now, so existing container deployments keep working unchanged.
• Binaries now publish here (stump.wtf/cairn) rather than from the old stump-wtf/cairn-cli repository, and there is exactly one cairn archive per platform.
• v0.2.0 was tagged but never published — its release job failed, so there is nothing to upgrade through. Jump straight to v0.3.0.

Features

• One cairn binary; the server is cairn serve (fbbac9c, d65498b).
• Users and identities: sign-ins resolve to users, sessions carry user ids, keyed on (issuer, subject) (890f32d, b91dc6f).
• Actionable, typed validation violations across the CLI and HTTP API, including TTL and tag migrations (ae94068).
• Typed violations for annotations, runs and hooks (e195ec7), and for the remaining create-path validators (c2676ac).
• MCP tool errors carry structured violations (a82dacf).
• CLI renders validation violations and folds tag case (0469009).
• Ingest secret redaction: --redact=mask, masked-content warning and rejection of over-redacted records (433e2e4).
• Artifact and bundle bodies are scanned before they are stored (e8084d0).

Fixes

• Webhook hub fan-out is now delivered in sequence order, so subscribers see events in the order they happened (34c1afc).
• Comment bodies are rendered through the markdown pipeline, with comment-scale headings, images and tables (d3c5981, eb680a4).
• The release job no longer runs on a dirty tree: go.sum is tidied (66b83b6).

Install / upgrade

Homebrew (from the stump-wtf tap):

brew install stump-wtf/tap/cairn
brew upgrade cairn

Direct download — one cairn binary plus LICENSE per archive, for darwin and linux, amd64 and arm64 (windows too). Check it against checksums.txt:

curl -sLO https://github.com/stump-wtf/cairn/releases/download/v0.3.0/checksums.txt
shasum -a 256 -c checksums.txt --ignore-missing

Or run the container image, which keeps a cairnd shim as its default entrypoint:

docker pull ghcr.io/stump-wtf/cairn:0.3.0

Full changelog: v0.1.0...v0.3.0

---

Executed via scheduled Harness using Qwen3.8-27B in Crush