v0.2.0-alpha.4

What's Changed

• chore(docs): bump v0.1.3 → v0.1.4 user-facing version strings by @tyvsmith in #53
• chore: pin Rust toolchain to 1.95 by @tyvsmith in #54
• feat(cli): facelock hyprlock subcommand + omarchy integration scripts by @tyvsmith in #55
• chore(deps): update minor and patch dependencies by @renovate[bot] in #56
• chore(deps): update minor and patch dependencies by @renovate[bot] in #57
• security: add cargo-audit supply-chain scanning in CI (Plan 00) by @tyvsmith in #81
• security: make require_ir load-bearing and passive anti-spoof honest (Plan 01) by @tyvsmith in #82
• security: scope polkit face auth to an allowlist and fail closed on unresolved user (Plan 03) by @tyvsmith in #84
• security: harden the PAM trust boundary (Plan 05) by @tyvsmith in #86
• security: harden the D-Bus and daemon surface (Plan 06) by @tyvsmith in #87
• security: Phase 3 systemd hardening for facelock-daemon.service (Plan 07) by @tyvsmith in #88
• chore(deps): update actions/checkout action to v7 by @renovate[bot] in #58
• fix(deps): bump event-listener to 5.4.2 (RUSTSEC-2026-0221) by @tyvsmith in #97
• fix(test): harden container pamtester download, host-network builds, model preflight by @tyvsmith in #91
• fix(enroll): D-Bus timeout above server deadline + failure breakdown + direct-mode unification by @tyvsmith in #92
• feat(setup): manage facelock group membership + actionable AccessDenied hint by @tyvsmith in #93
• fix(direct): unify direct-mode auth with the daemon implementation by @tyvsmith in #94
• chore(test): daemon uses the shared schema-fault helper by @tyvsmith in #134
• fix(test): pin a non-IR camera for the require_ir refusal test by @tyvsmith in #135
• Land the verified post-review remediation stack by @tyvsmith in #136
• fix(pam): build zbus without default features (C1) by @tyvsmith in #107
• fix(security): close similarity hill-climbing oracle (N12/N13) by @tyvsmith in #108
• refactor(auth): unify oneshot on daemon pre_check; TPM in direct loader; hardcode auth_bin (N7/N8/N9, D11) by @tyvsmith in #109
• fix(camera): derive IR classification from device evidence; anchor quirk patterns (#98, #99) by @tyvsmith in #110
• refactor: simplify state layout — remove private/ and relocation machinery (DEC-3/4/5) by @tyvsmith in #111
• feat(setup): offer omarchy-lock-face as an opt-in PAM candidate by @tyvsmith in #146
• fix(packaging): remove pam_facelock.so from every service on uninstall by @tyvsmith in #147
• Camera lifecycle: hold only after failure, cancellable auth, one-shot hygiene (ADR 008) by @tyvsmith in #145
• ci: gate on translation catalog freshness by @tyvsmith in #142
• feat(cli): add devices --json; retarget oneshot IR test to it by @tyvsmith in #143
• fix(markers): converge enrollment markers outside setup (#137) by @tyvsmith in #144
• feat(setup): add --if-present to PAM removal by @tyvsmith in #151
• fix(cli): keep --json parseable, and let the one-shot clear a stale enrollment marker by @tyvsmith in #154
• test: make three silent gates actually check by @tyvsmith in #156
• test: add just link-models to populate models/ in a fresh worktree by @tyvsmith in #157
• feat(camera): NV12/Y16 decode + skip undecodable devices in auto-detection by @tyvsmith in #90
• fix(deps): update minor and patch dependencies by @renovate[bot] in #59
• ci: run the CI workflow on pull requests against any base branch by @tyvsmith in #177
• fix(test): Restore device_id after the ADR 008 forged-id window by @tyvsmith in #176
• refactor(cli): Share arg structs and pin flag spelling with a conformance test by @tyvsmith in #178
• refactor(cli): Route setup output through the sink and add quiet verbosity by @tyvsmith in #179
• feat(cli): Add facelock pam add|remove|status, aliasing setup --pam by @tyvsmith in #180
• refactor(cli): Spell machine output --json and write the rule down by @tyvsmith in #181
• feat(cli): Add facelock capabilities, a machine-readable feature probe by @tyvsmith in #182
• docs(cli): Sync the CLI reference and man page with what ships by @tyvsmith in #184
• docs(adr): Accept ADR 009 on the CLI verb/noun shape by @tyvsmith in #183
• fix(cli): Require root for tpm status and pcr-baseline by @tyvsmith in #190
• feat(cli)!: Nest restart, encrypt, decrypt and reseal in their groups by @tyvsmith in #185
• polish(cli): Give --quiet one implementation via a payload sink by @tyvsmith in #193
• fix(cli): Harden the PAM writer's confirm, confinement and quiet paths by @tyvsmith in #194
• refactor(cli): Give the setup --pam aliases the pam engine's interface by @tyvsmith in #195
• refactor(cli): Move the conformance suites out of main.rs by @tyvsmith in #196
• docs(cli): Announce the CLI cycle and trim the contracts document by @tyvsmith in #197
• docs(contracts): Name all eight gated PAM services and pin the list by @tyvsmith in #198
• build(deps): Bump h2 to 0.4.16 for RUSTSEC-2026-0258 by @tyvsmith in #205
• fix(cli): Default the CLI to warn and add -v by @tyvsmith in #199
• fix(pam): Resolve service files through the vendor directories by @tyvsmith in #201
• feat(setup): Accept --if-present on setup --pam, not only on --remove by @tyvsmith in #202
• feat(pam): Report every configured PAM service in status by @tyvsmith in #203
• feat(status): Add --json to facelock status by @tyvsmith in #204
• docs(changelog): Record the PAM resolution and setup UX cycle by @tyvsmith in #208
• fix(cli): Configure the daemon before enrolling in setup by @tyvsmith in #200
• ci: Add Claude Code Action workflows for @claude and PR review by @tyvsmith in #210
• feat(dbus)!: open Authenticate to every local user and retire the facelock group by @tyvsmith in #215
• docs(agents): Scope path-specific rules to .claude/rules by @tyvsmith in #158
• docs(skills): Add release and packaging-test project skills by @tyvsmith in #160
• ci(docs): Check that agent docs still describe the tree by @tyvsmith in #222
• build(release): define prerelease versions and the supported distro matrix by @tyvsmith in #240
• test(daemon): make authz matrix guard syntax-aware by @tyvsmith in #238
• fix(camera): require IR-typical quirk evidence by @tyvsmith in #237
• fix(pam): preserve logical service file rules by @tyvsmith in #239
• fix(setup): reject undecodable IR cameras by @tyvsmith in #242
• fix(pam): preserve backup provenance by @tyvsmith in #247
• fix(pam): remove owned service edits transactionally by @tyvsmith in #248
• fix(pam): retire unchanged vendor overrides by @tyvsmith in #249
• fix(setup): require explicit sensitive authorization by @tyvsmith in #250
• test(pam): freeze line placement contract by @tyvsmith in #251
• build(packaging): integrate supported distro packages by @tyvsmith in #252
• fix(packaging): preserve system asset lifecycle by @tyvsmith in #254
• docs(packaging): freeze removal ownership semantics by @tyvsmith in #241
• fix(daemon): harden authentication ingress by @tyvsmith in #243
• fix(daemon): bind remote checks to caller process by @tyvsmith in #253
• fix(camera): require verified y16 texture scale by @tyvsmith in #244
• ci: pin every GitHub Action to a commit SHA and stop automerging bumps by @tyvsmith in #260
• fix(cli): run the root check before the shared config load by @tyvsmith in #264
• fix(i18n): flag multi-line msgids as python-brace-format by @tyvsmith in #261
• docs(gpu): drop the nonexistent onnxruntime-opt-openvino package by @tyvsmith in #259
• docs(security): correct the TPM PCR binding heading by @tyvsmith in #258
• fix(cli): make daemon run's root check scripted, not interactive by @tyvsmith in #262
• test(i18n): serialize locale readers against the mutator by @tyvsmith in #268
• build(deb): gate release archives on error-severity lintian tags by @tyvsmith in #270
• build(release): validate packit config in a pinned fedora container by @tyvsmith in #285
• test(deb): stop the harness from hiding declared dependencies by @tyvsmith in #294
• fix(daemon): wipe decrypted embeddings on preview and bench paths by @tyvsmith in #263
• test(cli): run the C6 rows unprivileged under a root test runner by @tyvsmith in #272
• test(docs): guard package names, pam_facelock.8, and doc pairs by @tyvsmith in #278
• build(packaging): install locale catalogs from every path by @tyvsmith in #266
• test(rpm): add fedora 43 and 45 lanes and pin config(noreplace) by @tyvsmith in #279
• feat(core): add the fixed-root purge traversal engine by @tyvsmith in #271
• feat(cli): hold an exclusive lifecycle lease during purge by @tyvsmith in #274
• feat(cli): add facelock data purge by @tyvsmith in #282
• fix(auth): give each oneshot rejection class its own exit code by @tyvsmith in #265
• fix(pam): map oneshot exit classes to the daemon transport codes by @tyvsmith in #273
• test: split the camera-free assertions out of the two E2E tiers by @tyvsmith in #280
• test(arch): build and install the real dist/PKGBUILD by @tyvsmith in #296
• fix(arch): declare onnxruntime in facelock-git and pin the source digest by @tyvsmith in #298
• fix(preview): resolve the wayland socket from the invoking uid by @tyvsmith in #299
• fix(face): resolve symlinked ORT trust roots before validation by @tyvsmith in #300
• test(cli): pin enroll's root gate and stop skipping under root by @tyvsmith in #301
• fix(security): wipe remaining decrypted embedding paths by @tyvsmith in #304
• ci(packaging): gate every package lane in ci by @tyvsmith in #302
• fix(test): install the main arch package, not the debug split by @tyvsmith in #322
• fix(enroll): persist an enrollment in one store transaction by @tyvsmith in #315
• fix(binding): reject serial-less unit enrollment by @tyvsmith in #317
• fix(apt): keep the v0.1.4 main and legacy suites published until 0.3.0 by @tyvsmith in #320
• fix(ci): require a trusted author to start the claude.yml job by @tyvsmith in #319
• fix(binding): fail closed without device AAD by @tyvsmith in #318
• fix(setup): refuse systemd setup under a config override by @tyvsmith in #316
• fix(release): reject model-skipped packaging evidence by @tyvsmith in #321
• fix(daemon): refuse a replacement key over encrypted rows by @tyvsmith in #326
• test(rpm): require a copr lifecycle lane per fedora target by @tyvsmith in #323
• fix(ci): stop git auto maintenance racing the packaging context by @tyvsmith in #328
• test(upgrade): prove v0.1.4 state survives upgrade and rollback by @tyvsmith in #327
• ci(release): guard staging publication config by @tyvsmith in #324
• ci(release): publish the release exactly once after validation by @tyvsmith in #325
• fix(test): pin the release contract fixture to its own baseline by @tyvsmith in #329
• fix(dist): compute a correctly ranked version for facelock-git builds by @tyvsmith in #331
• fix(test): compare the arch package version in one spelling by @tyvsmith in #335
• ci(release): claim the provisioned staging copr project by @tyvsmith in #334
• ci(release): fail a release whose COPR build never lands by @tyvsmith in #336
• fix(ci): trust the workspace checkout in the release deb job by @tyvsmith in #339
• ci(release): Run container release steps under the shell they are written in by @tyvsmith in #342
• fix(release): Expect the asset names GitHub stores, not the ones uploaded by @tyvsmith in #343

Full Changelog: v0.1.4...v0.2.0-alpha.4