v0.7.0

0.7.0 (2026-06-17)

Features

• attach registry-config parity — wire HOUBA_REGISTRIES into houba attach (#97) (c320179)
• audit: digest on every coverage outcome + observational --sbom tier (#143) (522b764)
• deploy: default argocd-prod policy to the bundled busybox example (014cb95)
• deploy: default overlays/prod policy to the busybox example (#87) (208bd85)
• deploy: Dependency-Track consumer + XZ (CVE-2024-3094) incident demo for package-level blast-radius (#136) (b1b2034)
• deploy: make argocd-prod + argocd-seed (bring up the full prod App-of-Apps on kind) (59b69f2)
• deploy: make argocd-prod a complete end-to-end mirror on kind (76ac75b)
• deploy: weekly houba-gc CronJob in the reference deployment (#107) (a06d171)
• deploy: Zot demo registry with built-in UI; text logs in Jobs (#92) (21dc7bd)
• domain: stamp OCI image.title and configurable vendor (#134) (1253d70)
• finding-type-aware SARIF mapper (rule evaluations ≠ vulnerabilities) (#102) (3aee05b)
• houba attach --fail-on <severity> CI gate (#86) (f0cf0bc)
• multi-owner ownership (io.houba.owners) (#100) (139f7b1)
• SBOM generation on the rebuild path (package-level blast-radius) (#128) (003f0b8)
• scan-referrer garbage collection (houba gc) (#105) (b9892d6)
• sign the SBOM under houba's identity (trust tier) (#144) (f2fec80)
• signed-coverage audit tier (houba audit --signed) (#98) (3e4336d)
• unify SBOM generation on syft — both paths, SPDX + CycloneDX (#140) (eec9aa2)

Bug Fixes

• .claude: point superpowers at its own marketplace so it loads in ephemeral sessions (#94) (578601d)
• adapters: honor tls_verify on the BuildKit push path (#127) (118ec54)
• ci: update the manifests job for the single Argo app set (#91) (ee1cad9)
• cli: render failed policy with only operation errors (#126) (36efafd)
• demo reference policy/rebuild — busybox tag selection + arch-robust inspect (#139) (51e8bc1)
• deploy: select the OpenBao server pod by name, not a chart label (#88) (16d4c56)
• deps: clear docs-site high/uuid CVEs — bump Docusaurus + pin transitives (a5a9c20)
• deps: update react monorepo to v19 (#138) (1d78def)

Documentation

• add "Why houba" argument page (#104) (0dbffb9)
• add the CLI command reference to the reference section (#125) (786b412)
• docs: mark Now items delivered; renumber signed-coverage ADR to 0026 (#99) (ff5fdea)
• fix the generated reference's in-page TOC anchors (#121) (3cf1ffb)
• generate how-to & explanation section indexes from page front-matter (#147) (b88f452)
• generate policy + config reference from the Pydantic schemas (#108) (f8e52b7)
• generate policy + config reference from the Pydantic schemas (#109) (28651c2)
• order the Reference sidebar — mirror-policy before config (#120) (cb35be0)
• order, label, and flatten the docs-site sidebar (#118) (f7cb370)
• prepare 0.7.0 release — stamp roadmap + getting-started version (2daebf9)
• promote the local walkthrough to a top-level Getting started (#106) (ba91bf9)
• publish the docs site with Docusaurus on GitHub Pages (#115) (3e5eba3)
• record the Dependency-Track boundary (attach = scan provenance, not a store) (#135) (28af8a4)
• refresh README for the delivered mandate, gc, and the docs site (#110) (10a92cb)
• renumber duplicate ADR 0026 → 0030 (multi-owner ownership) (#122) (cab739c)
• restructure docs into Diátaxis sections (step 1 — folders + moves) (#111) (1009b72)
• restructure docs into Diátaxis sections (step 1) (#112) (c0c52cd)
• roadmap — add docs-site item, cut deferred bets, proxycache out of scope (#103) (5685732)
• roadmap: sync Now/Next/Later — the mandate is delivered (#90) (e3de9ad)
• scan attestation max-age freshness contract (admission gate) (#137) (5fc046b)
• spec — Docusaurus docs site published to GitHub Pages (#114) (335d459)
• split the examples mega-doc into how-to + explanation (step 2) (#113) (fbf7db8)
• sync getting-started + architecture overview with shipped state (#101) (04f0669)
• sync README/roadmap/design with shipped SBOM, gc, and docs site (#146) (8e3fc88)