v0.2.0

Added

• Every release archive now ships an SPDX SBOM beside it, named
  <archive>.sbom.json, listing what went into that binary.
• Every published archive, SBOM, and checksums.txt now carries a GitHub
  build-provenance attestation. Verify a download with
  gh attestation verify <file> --repo svyatov/handrail, which checks the file
  itself rather than the commit the signed tag covers.

Changed

• The release body on GitHub is now this file's section for that version,
  instead of the commit list. A tag whose section is missing fails the release
  before anything is published, and task release-check catches it a step
  earlier, on the pull request.

v0.1.0

First release. One rule file, enforced in Claude Code and in Codex CLI through
each harness's own hook mechanism.

Added

• Rules as markdown files: the matcher in the frontmatter, the message the agent
  reads in the body.
• Three tiers, most specific first: project-personal .handrail/local/,
  project-shared .handrail/, and global ~/.config/handrail/. A rule replaces
  a lower one of the same filename outright, and a stub carrying
  enabled: false switches an inherited rule off.
• handrail check validates every tier and prints the effective ruleset,
  annotated with tier, shadowing, and disabling.
• handrail test <event> dry-runs one synthetic event against the rules and
  exits 2 when the outcome is block.
• handrail sync writes handrail's hook entries into every detected harness.
  Where a harness cannot do what a rule asks, it substitutes the strongest
  action that harness supports and reports the substitution rather than
  degrading the rule silently.
• handrail advise reports which rules also translate into a native harness
  entry, such as a Claude Code permission deny.
• handrail trust grants a repo's committed .handrail/ rules permission to
  take effect.
• handrail import hookify converts hookify rule files into personal rules and
  reports anything the format cannot express.
• handrail doctor diagnoses the install offline.
• handrail version prints the version, commit, and build date.
• handrail hook is the entry point the harnesses call. Sync installs it.
• Plugins for Claude Code and Codex CLI from the repo's own marketplace,
  carrying the add skill. The plugin downloads the pinned binary on the next
  session start, verifies its checksum, and syncs once.
• Prebuilt binaries for macOS and Linux on amd64 and arm64, and a Homebrew cask
  at svyatov/tap/handrail. There is no Windows build.

v0.1.0-rc.1

Changelog

• 765783b feat(release): GoReleaser pipeline, tap cask, and a config check in CI (#34)
• fb10107 feat(doctor): offline diagnostics for a silent install (#33)
• 1d6e415 docs(agents): give CLAUDE.md the commands and the build constraints
• 02180ee chore: go toolchain, linters, and a 95% coverage gate (#32)
• 691d8d8 chore(lint): make golangci-lint clean
• 4581cee feat(import): convert upstream hookify rules into the personal tier
• fe9f498 feat(advise): recommend native entries for the rules that translate
• d188159 feat(codex): enforce rules through Codex CLI as the second harness
• 1a30a6b feat(sync): install Claude Code hook entries per machine
• f5b3a82 feat(hook): evaluate Claude Code events end to end
• 849d244 feat(tiers): merge three tiers with shadowing behind a trust gate
• b13a1c7 feat(test): evaluate matchers and dry-run a synthetic payload
• 94af118 feat(check): validate rules and print the effective ruleset
• 301a47c chore: require Go 1.26.6
• ec72001 docs: move the spec's toolchain line to Go 1.26
• 1e37778 feat: add walking skeleton at the CLI seam
• 0a66c84 docs: update lingering hookify references to handrail
• 55b35f2 docs: assemble the v1 spec from the map's decisions
• d3b42c5 docs: record importer decisions (ADR 0008, glossary)
• 6a4490c docs: record conversation-analysis decisions (ADR 0007, glossary)
• 6a076aa docs: record CLI and plugin surface decisions (ADR 0006, glossary)
• 54963fb docs: record advisor decisions (ADR 0005, glossary)
• c31d789 docs: record tier and precedence decisions (ADR 0004, glossary)
• 13eed42 docs: record rule format decisions (ADR 0003, glossary)
• f2c794d docs: record event model decisions (ADR 0002, glossary)
• 7c4e447 docs: rename project to handrail
• 557bdf1 chore: ignore Claude Code agent worktrees
• d3b16be docs: add domain glossary
• c2039dd chore: add agent skill configuration