Skip to content

NarrowsLink v0.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Jul 18:52
v0.1.0
a9d6c6b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

NarrowsLink v0.1.0

NarrowsLink v0.1.0 is the first maintainer-authorized local operator release. It packages the production mission-timeline workspace, authenticated UDP bridge, deterministic Harbor relay fixture, and offline evidence receiver into one dependency-free distribution.

Install

Download all four release assets into one directory:

  • narrowslink-0.1.0.tgz
  • narrowslink-0.1.0.release.json
  • narrowslink-0.1.0.cdx.json
  • SHA256SUMS

Verify and install the exact published bytes:

shasum -a 256 -c SHA256SUMS
npm install --global ./narrowslink-0.1.0.tgz --ignore-scripts
narrowslink version --json
narrowslink serve

Node.js 20.19 or newer and a local browser are required. A repository checkout, Vite, and project dependencies are not.

Release evidence

The release gate builds the package twice from separate staging directories and requires byte-identical archives. It then installs and unpacks the archive outside the repository and exercises a real loopback UDP capture through replay, an operator-authored incident, .nlb export, and verification by the receiver CLI shipped in those same release bytes. The external manifest records the exact version, commit, source tree, build epoch, toolchain, lockfile, and packaged payload hashes. The package, external manifest, and normalized CycloneDX SBOM are covered by SHA256SUMS.

The v0.1 tag, release assets, and same-channel checksum file are unsigned. Checksum verification establishes internal byte consistency, not publisher or build-environment authenticity; confirm the expected tag and commit through a separately trusted channel when that distinction matters.

Compatibility and data

The v0.1 release accepts unchanged session format v1 and v2 files and verifies evidence bundle format v3. Saved sessions, markers, notes, and authored ranges remain in browser storage at the stable http://127.0.0.1:47890 origin when the package is upgraded or uninstalled. Exported .nlsession and .nlb files are never removed by package operations.

Evidence bundles remain unsigned. A passing receiver report establishes internal consistency and describes available capture and provenance evidence; it does not establish author or source-channel authenticity.

See the tagged CHANGELOG for the complete v0.1.0 change record and README for operation, upgrade, removal, formats, and current limits.

Assets 6
Loading