v1.3.5

v1.3.5 - 2026-04-17

Changed

• Clippy + dead_code cleanup -- removed 2 crate-level #![allow(...)] suppressions, replaced with targeted item-level #[allow(...)] with justification comments where suppression is still needed.

Workflow MCP v1.3.4

v1.3.4 — Documentation Refresh + Skills Cleanup

Fixed

• skills/workflow.md + skills/workflow/skill.md — repaired 69 UTF-8 mojibake sequences (48 em-dashes, 21 arrows) that were double-encoded. Rendered text unchanged; source bytes now clean.

Changed

• README: added What's New section leading with v1.3.4, older releases in collapsible <details>, updated download links to releases page
• Skills: removed internal metadata and path references, cleaned descriptions
• Docs: updated getting-started.md binary references to v1.3.4, cleaned per_machine_setup.md
• Cargo.toml: cleaned description field

Binaries

Architecture	File	SHA256
ARM64	workflow_v1.3.4_windows_arm64.exe	CB6FB3AE9954D6258E2503E01E50FB818223C8688B2E31CE25D76B5D3B6B5F2A
x64	workflow_v1.3.4_windows_x64.exe	04BB515BB899EE33D10350CCC7995030823AB101D67B2738D42C9373505EC245

No functional changes. Documentation-only patch.

workflow v1.3.3 — metadata cleanup

Patch release adding license, repository, and description fields to Cargo.toml. No functional changes. Caught in pre-Stage-F audit.

workflow v1.3.2 — HTTP dashboard endpoint (port 9103)

What's new

• GET /api/status on port 9103 (env: CPC_DASHBOARD_PORT_WORKFLOW): credentials (names only, never values), TOTP entries, API patterns, flows with last run, active watches
• CORS headers, +5 port fallback, graceful degradation if all ports fail
• Credential values/secrets/tokens are never included in status responses
• Also includes DPAPI→keyring migration improvements from v1.3.1

Binary

• ARM64 Windows (aarch64-pc-windows-msvc)
• SHA256: 4948bc50c33b5ed861bc2730da5fcc09abd70384e90277b391a46c8e963de81f

v1.3.1 — Two-Entry Sentinel Probe

What's Changed

Two-Entry Sentinel Probe

keyring_store::probe() now uses a two-Entry sentinel: writes a timestamped value via one Entry instance, drops it, then reads via a fresh Entry with the same service+user. Unique per-invocation target (probe_{nanos}) prevents parallel test collisions. Detects mock backends that pass single-Entry round-trips but don't persist across instances — replacing the comment-only defense that warned about the windows-native feature flag requirement.

Two-Tier Storage Documentation

docs/per_machine_setup.md — new Two-Tier Storage section documenting the metadata/secrets split, startup probe behavior, and per-machine setup steps.

License

MIT → Apache-2.0 (backport to match other CPC repos).

Tests

• Added test_keyring_probe_succeeds — two-Entry persistence round-trip on live backend.
• Run with --test-threads=1 (totp tests share keyring state).
• 26/26 pass.

Also includes (Stage C2, previously unreleased)

• storage.rs — legacy-fallback path resolution: existing C:\CPC\workflows\ continues to work; new installs resolve via cpc_paths::data_path("workflow").

Binary

• workflow_arm64.exe — ARM64 Windows (aarch64-pc-windows-msvc)

v1.3.0 — Cross-Platform OS Keyring + DPAPI Migration

v1.3.0 — Cross-Platform OS Keyring + DPAPI Migration Tool

What's New

Cross-platform OS keyring storage — Credentials and TOTP secrets now stored in Windows Credential Manager, macOS Keychain, or Linux Secret Service via the keyring crate. Never stored as plaintext in JSON files.

migrate_dpapi_to_keyring tool — Idempotent migration from legacy Windows DPAPI storage to OS keyring. Reports {migrated_credentials, migrated_totp, errors:[]}. One-time operation after upgrading.

Linux headless guard — On startup, probes keyring availability. If unavailable and CPC_WORKFLOW_DISABLE_SECRETS=1 is set, credential/TOTP tools disable gracefully. Otherwise exits with clear error message.

cpc-paths v0.1.0 dependency — Added as diagnostic dep for Stage C cpc-paths integration pass.

Changed

• credential.rs — New entries use keyring only; reads fall back to DPAPI for legacy entries. CredentialMeta.encrypted_value is now Option<String>.
• totp.rs — Same keyring migration. TotpEntry.encrypted_secret is now Option<String>.
• All 11 tool descriptions updated: "Windows DPAPI" → "OS-native secret store (Windows Credential Manager, macOS Keychain, Linux Secret Service)".

Backward Compatibility

Existing DPAPI-encrypted credentials and TOTP secrets continue to work via transparent fallback. Run workflow:migrate_dpapi_to_keyring to opt-in to migration.

Tests

22 tests pass: 16 RFC algorithm + 3 keyring roundtrip + 6 new (probe, hash verification, migration idempotency).

Note: keyring v3 requires features = ["windows-native"] — default features use an in-memory mock backend.

---

Binaries attached in Stage F. Source-only release.

v1.2.5 — TOTP DPAPI Fix + Monorepo Sync

v1.2.5 — TOTP DPAPI Fix + Monorepo Sync

Pre-CI baseline release. No binaries attached.

Changes since v1.2.2

Fixed

• TOTP DPAPI roundtrip — strips null bytes after DPAPI decrypt; adds explicit errors on encrypt/decrypt failure; pipeline tracing. Fixes TOTP codes failing silently on some Windows builds.
• credential.rs — hardened error propagation for get/store/refresh paths

Changed

• All 9 source files updated from monorepo HEAD
• Cargo.toml: version 0.1.0 → 1.2.5
• frontmatter.rs removed (not needed in public distribution)

v1.2.2 - Documentation

Documentation release

Adds /docs/getting-started.md — an SEO-optimized getting started guide covering 36 tools for API discovery, DPAPI credential vault, flow recording, watches, data piping, and TOTP/2FA — and /skills/workflow-getting-started/SKILL.md.

Binaries unchanged from v1.2.1 — download from https://github.com/josephwander-arch/workflow/releases/tag/v1.2.1

v1.2.1 - Phase C Fix3

Changes

Fixed

• Meta-tool dispatch fixes — inline atomic rewrites replace nested dispatch pattern that caused double-execution in flow replay
• Credential round-trip — DPAPI null-byte stripping and explicit error messages on decrypt failure

Added

• TOTP module — totp_register, totp_register_from_uri, totp_generate, totp_list, totp_delete, hotp_generate. HMAC-based one-time passwords with DPAPI-encrypted secret storage.

Binaries

• workflow_arm64_windows.exe — ARM64 native (5.5 MB)
• workflow_x64_windows.exe — x64 native (6.4 MB)

v1.1.1

First public release of CPC workflow MCP server.

Included binaries:

• workflow_arm64_windows.exe - Windows ARM64
• workflow_x64_windows.exe - Windows x64

See README.md for install instructions and Compatible With section for supported MCP clients.

macOS builds planned for a follow-up release.