v0.16.1

v0.16.1 — Contract history documentation now matches the shipped Git-backed behavior

Released 2026-07-30.

What changed

Contract digests and version history no longer require unstable paths or a future commit SHA

fix · normal impact

The normative contract now states the behavior the product already implements: a contract digest is computed from contract-root-relative paths plus file-byte hashes, so identical contract trees have the same identity in different checkouts. An id@version lookup walks committed descriptor history and derives the introducing commit from Git rather than expecting a publish event to predict the SHA of its own future commit. The optional event commit field remains readable for legacy and reserved data, but current writers do not populate it and current version resolution does not depend on it. Existing spaces and artifacts require no migration.

Affects: contract digest, contract version history, event/v1 schema metadata

The project front door now explains the work a2ahub makes possible

fix · normal impact

The README no longer opens with implementation vocabulary, copies a command catalogue, or carries two MCP limitations that the product already fixed. It now starts from the coordination failure a2ahub solves, then names the concrete capabilities: readable work chains, computed next moves, versioned consumer-aware contracts, the validated Git write funnel, the local dashboard, notifications, CLI, and MCP. A deterministic release gate keeps the file below its compact size ceiling, requires exits to the canonical documentation, and rejects the known retired guidance; release review still owns the human judgement about clarity and tone.

Affects: README, first-time evaluation, release gate

GitHub Releases now show the authored release notes instead of commit noise

fix · normal impact

The release workflow now renders the same versioned YAML corpus used by a2a whatsnew into a concise GitHub Release page with changes, known issues, actions, install guidance, and verification links. GoReleaser receives that file through its canonical custom-release-notes option and replaces stale bodies on retry. A post-publish assertion byte-compares the visible GitHub body with the rendered SSOT. This removes the generic platform table, raw commit list, and unsafe quarantine-removal advice that previously obscured why a release mattered.

Affects: GitHub Releases, a2a whatsnew, release workflow

Release verification is selected by behavioral impact, not by the size of the version number

policy · normal impact

Full GitHub live verification remains mandatory when an exact public candidate changes runtime, funnel, validator, lifecycle, contract constraints, or space behavior. A targeted cell remains a diagnostic rerun, not proof for a shared-core change. Presentation-only candidates may now omit GitHub live when the exact public diff proves that no executable or protocol behavior moved; they still require the full hermetic gate, release preflight, immutable candidate, and a written reason. v0.16.1 uses that presentation-only tier. The latest full baseline, v0.16.0, passed 50 of 50 declared live cells; that is complete coverage of the declared matrix, not every theoretically possible state.

Affects: release runbook, GitHub Actions usage, release lead time

Known issues

The macOS companion remains ad-hoc signed and may require manual approval

known issue · normal impact

The release cohort authenticates the exact macOS app and ad-hoc signing protects its bundle integrity, but the app is not identified or notarized through a paid Apple Developer account. A quarantined download may require one explicit System Settings → Privacy & Security → Open Anyway decision. Interactive Notification Center, Focus, Login Items, VS Code trust/profile, and remote-window checks remain release-environment evidence rather than claims inferred from hermetic tests.

Affects: macOS notifications, VS Code notifications

Current guidance: Keep Gatekeeper enabled and approve only the A2A Notifier version obtained through the verified a2a release cohort.

Install or update

macOS and Linux:

curl -fsSL https://raw.githubusercontent.com/ydnikolaev/a2ahub/main/scripts/install.sh | sh

Already installed? Run a2a update --yes. Windows archives and manual downloads are in the assets below.

Release artifacts include checksums, per-asset Sigstore bundles, SBOMs, and SLSA provenance. See SECURITY.md for verification commands.