v0.1.6

Changelog

• 16582fb: Merge branch 'main' into feat/skill-quality-predicates-batch1 (@ivanpaghubasan)
• 72330c8: Merge branch 'main' into feat/telemetry (@ericksondelacruz)
• 2a1a6aa: Merge branch 'main' of https://github.com/trustabl/trustabl into cf/sharp-curie-ae4b0a (@jhumel-code)
• 9519100: Merge branch 'trustabl:main' into main (@ivanpaghubasan)
• 49adf72: Merge pull request #73 from trustabl/chore/genesis-floor-production (@jhumel-code)
• 1877a1e: Merge pull request #74 from trustabl/add-downloads-badge (@sairenchristianbuerano)
• 86ed137: Merge pull request #75 from trustabl/add-attestation (@sairenchristianbuerano)
• 44a06fc: Merge pull request #77 from trustabl/tr-325-flip-default (@trustabl)
• ff17436: Merge pull request #79 from trustabl/fix-download-history-workflow (@sairenchristianbuerano)
• 3e392e5: Merge pull request #83 from trustabl/fix-cosign-v3-notlog (@sairenchristianbuerano)
• aecd2e0: Merge pull request #84 from trustabl/feat/telemetry (@trustabl)
• f754fb8: Merge pull request #85 from trustabl/chore/download-history (@sairenchristianbuerano)
• 9eba1bb: Merge pull request #86 from trustabl/cf/sharp-curie-ae4b0a (@jhumel-code)
• b6da377: Merge pull request #87 from AL-DN/feat/langsmith-trace-enrichment (@trustabl)
• 45785f0: Merge pull request #88 from trustabl/docs/update-discord-link (@trustabl)
• 652357f: Merge pull request #89 from trustabl/licenses-and-secrets-detection (@trustabl)
• a85f280: Merge pull request #91 from trustabl/chore/download-history (@sairenchristianbuerano)
• 02fdfdc: Merge pull request #92 from trustabl/feat/crash-report (@trustabl)
• bd7d707: Merge pull request #93 from ivanpaghubasan/feat/skill-quality-predicates-batch1 (@sairenchristianbuerano)
• dde1efb: TR-324 Arm production genesis floor at first published statement version (@jhumel-code)
• 3af253d: TR-325 Flip default rules source to the signed production channel (@jhumel-code)
• d69528d: chore(rules): bump SupportedSchemaVersion to 13 (@ivanpaghubasan)
• 2350473: chore(status): restore download-history (@ivanpaghubasan)
• 9d3d0f3: ci(attest): install cosign directly in e2e matrix (installer 404s on v3 .sig) (@sairenchristianbuerano)
• 9496fe2: ci: add weekly download-history workflow + seed JSON (@sairenchristianbuerano)
• d037332: ci: land download-history snapshot via PR instead of pushing to protected main (@sairenchristianbuerano)
• be3d436: docs(readme): add keyless attestation walkthrough to usage example (@sairenchristianbuerano)
• 047e29b: docs(readme): document --license-scan, --secret-scan, and BOM license output (@moisesdelacruz-tr)
• becf87a: feat(analysis): extract SPDX license from dependency manifests (@moisesdelacruz-tr)
• 7ebcce9: feat(attest): scan-result attestation via cosign (attest/verify + scan --attest) (@sairenchristianbuerano)
• b36d9b7: feat(crash): add local-first crash reporting (@ericksondelacruz)
• da0e615: feat(crash): embed scrubbed report in GitHub issue URL (@ericksondelacruz)
• 3c55510: feat(enrich): ground tool findings in LangSmith runtime traces (--langsmith) (@AL-DN)
• 7593952: feat(predicates): add skill_has_description predicate (@ivanpaghubasan)
• 222044f: feat(predicates): add skill_is_agent_specific (@ivanpaghubasan)
• 1094324: feat(scanner): add license and secret scan implementations (@moisesdelacruz-tr)
• 6ab53cc: feat(scanner): wire --license-scan and --secret-scan flags (@moisesdelacruz-tr)
• 57c0a2c: feat(telemetry): add CI provider detection and repo ID hash (@ericksondelacruz)
• ab2ff6c: feat(telemetry): add Client with opt-out, anonymous ID, and first-run notice (@ericksondelacruz)
• a103e5e: feat(telemetry): add PostHog sink implementation (@ericksondelacruz)
• 0ee8fa6: feat(telemetry): add Sink interface, NullSink, and RecordingSink (@ericksondelacruz)
• f973a9c: feat(telemetry): add config load/save for telemetry.json (@ericksondelacruz)
• 17927f3: feat(telemetry): add trustabl telemetry on/off/status subcommand (@ericksondelacruz)
• 3f99e22: feat(telemetry): emit command.run for all non-scan commands (@ericksondelacruz)
• 377cbde: feat(telemetry): instrument scan with scan.started, scan.completed, scan.failed (@ericksondelacruz)
• b317df9: feat(telemetry): wire PostHog API key into release pipeline (@ericksondelacruz)
• c32989f: feat(telemetry): wire telemetry client into all commands (@ericksondelacruz)
• 02a29be: feat: add cosign path error (@sairenchristianbuerano)
• 88fb817: fix(analysis): strip == prefix from pinned Pipfile versions (@moisesdelacruz-tr)
• a0268e4: fix(attest): support cosign v3 for offline --no-tlog signing (@sairenchristianbuerano)
• c01d46b: fix(crash): add anonymous label for sending crash report (@ericksondelacruz)
• e9ed533: fix(rules): 2026-07-07 audit corrections across packs, ADK discovery, and docs (@jhumel-code)
• 0a4efc3: fix(rules): recalibrate CSKILL-001 to high/0.9 with accurate allowed-tools framing (@jhumel-code)
• 44d9b22: fix(rules): skip the reserved mappings/ pack subtree in the loader and sync check (@jhumel-code)
• 8fd941d: fix(telemetry): add parse_error category and nil guard on scan.started (@ericksondelacruz)
• 8a5a5d5: fix(telemetry): do not persist ephemeral CI anonymous ID (@ericksondelacruz)
• 7ea34cb: fix(telemetry): flush before os.Exit, fix vulndb name, minor cleanups (@ericksondelacruz)
• 3b323be: fix(telemetry): promote posthog-go to direct dependency in go.mod (@ericksondelacruz)
• 056c69f: fix(telemetry): remove leftover interface{} param from newLLMCommand (@ericksondelacruz)
• 9b601dc: fix(telemetry): restore inline comments removed during main.go rewrite (@ericksondelacruz)
• 6067687: fix: update README telemetry section to opt-in; add exit_code to scan.failed (@ericksondelacruz)
• 30e089c: refactor(telemetry): remove llm.* command tracking (@ericksondelacruz)
• b63a7de: telemetry: add first-run opt-in prompt with PromptMode() (@ericksondelacruz)
• c9c392f: telemetry: add minimal mode filtering in Track() (@ericksondelacruz)
• 3ff35cb: telemetry: add minimal/full CLI subcommands and update docs to opt-in (@ericksondelacruz)
• 98fcb67: telemetry: enrich scan.failed with phase, rules_sha, schema_version (@ericksondelacruz)
• 4a2c1df: telemetry: reorder first-run prompt options (Minimal, Full, Disabled) (@ericksondelacruz)
• 22b5f91: telemetry: replace Enabled bool with Mode string, CI defaults to disabled (@ericksondelacruz)
• 3af186c: test(corpus): add skill-agent-specific fixture for CSKILL-071 (@ivanpaghubasan)
• 5a49c40: test(corpus): add skill-duplicate-tool-refs fixture for CSKILL-061 (@ivanpaghubasan)
• 1d3c986: test(corpus): add skill-missing-description fixture for CSKILL-070 (@ivanpaghubasan)
• ee47720: test(llm): skip the POSIX file-permission assertion on Windows (@jhumel-code)