v0.1.2

Changelog

• 165a903: fix(release): resolve tag to commit via API instead of trusting targetCommitish (#179) (@Reederey87)
• 20a7aad: fix(release): stable-smoke needs write access to see a still-draft release (#178) (@Reederey87)

---

Built with GoReleaser. Verify downloads against checksums.txt, or install via
brew install Reederey87/devstrap/devstrap or the scripts/install.sh one-liner.
checksums.txt is keylessly signed with cosign (Fulcio cert + Rekor log) and every
archive ships an SPDX SBOM — see "Verify a download" in the README.

v0.1.2-rc.1

Changelog

• 330d779: chore(ci): bump Go to 1.26.5 (clear GO-2026-5856) (#146) (@Reederey87)
• ba00dcb: chore(deps): bump golang.org/x/crypto v0.52.0, golang.org/x/net v0.55.0 (#147) (@Reederey87)
• b084e33: chore(release): gate macOS notarization on all five MACOS_* secrets (0-or-5) + Gatekeeper smoke step (P7-QUAL-03) (#150) (@Reederey87)
• bd24f9b: ci(release): stage-then-promote stable releases (P7-QUAL-01) (#173) (@Reederey87)
• 29b2808: docs(audit): seventh design & implementation pass (P7) (#144) (@Reederey87)
• b07e791: docs(audits): Pass-6 closure banner + ledger truth-up + multi-device wave direction (#130) (@Reederey87)
• 9c7331f: docs(product): commercialization spec, website plan, README + AGENTS (#145) (@Reederey87)
• 6b68367: docs(spec/19): §F.3 multi-device completeness dogfood runbook (#135) (@Reederey87)
• 3675e82: feat(agent): Linux Landlock fallback sandbox for agent run (P4-GIT-03 slice 3) (#123) (@Reederey87)
• f355315: feat(agent): Linux bubblewrap sandbox for agent run (P4-GIT-03 slice 2) (#121) (@Reederey87)
• 37d023d: feat(agent): sandbox.violation telemetry for agent runs (P4-GIT-03 slice 5) (#127) (@Reederey87)
• b227205: feat(agent): seccomp syscall denylist for the Linux sandbox (P4-GIT-03 slice 4) (#125) (@Reederey87)
• ed615c0: feat(agent): tighter read confinement for the OS sandbox (P4-GIT-03 slice 6) (#128) (@Reederey87)
• e29389b: feat(devices): self-healing WCK rotation after revoke (#134) (#137) (@Reederey87)
• c49e090: feat(devices): synced device-trust propagation (TRUST-01) (#132) (@Reederey87)
• 3a6c266: feat(env): cross-device env-profile exchange (ENV-SYNC-01) (#131) (@Reederey87)
• 48ff4c0: feat(service): devstrap service install|uninstall|status (P4-PROD-04) (#139) (@Reederey87)
• b326c56: feat(worktree): cleanup reaps squash/rebase-merged worktrees (P4-GIT-04) (#138) (@Reederey87)
• db84441: fix(agent): Seatbelt credential-deny symlink-leaf parity (P4-GIT-03 residual) (#124) (@Reederey87)
• 723924c: fix(agent): bubblewrap credential masks fail closed on resolution errors (P4-GIT-03 follow-up) (#122) (@Reederey87)
• ccea683: fix(agent): fail closed on explicit read-confine + credential-overlapping read-allow (P4-GIT-03 review follow-up) (#129) (@Reederey87)
• 5ed3b6a: fix(agent): grant the linked worktree's git dirs to the OS sandbox (P7-SANDBOX-01) (#142) (@Reederey87)
• d777390: fix(cli): P7-CLI-01 review follow-ups — human missing-blob list + custody-warning test (#155) (@Reederey87)
• 8301647: fix(cli): P7-XP-02 review follow-ups — pre-init override bake, corrupt-custody refusal, warn ordering, reload-message accuracy (#171) (@Reederey87)
• 71c89c2: fix(cli): PID-reuse guard for repo locks and the agent-run sweep (P7-GIT-03) (#157) (@Reederey87)
• aab5bbd: fix(cli): db backup --full enumerates blob refs from the snapshot; missing blob fatal (P7-DATA-03) (#162) (@Reederey87)
• 33436df: fix(cli): db backup/restore --json emit a single clean JSON document (P7-CLI-01) (#154) (@Reederey87)
• 22035aa: fix(cli): journaled all-or-nothing restore promotion + maintenance lock (P7-DATA-05) (#165) (@Reederey87)
• 3b555bd: fix(cli): key-custody gate at service install (P7-XP-02) (#170) (@Reederey87)
• cc51f5d: fix(cli): versioned backup manifest + fail-closed restore verification (P7-DATA-04) (#163) (@Reederey87)
• c61324f: fix(cli,platform): stable service ExecPath + missing-ExecPath detection (P7-XP-01, P7-XP-05) (#167) (@Reederey87)
• 33fd056: fix(devices): transactional revoke-containment marker + sync resume (P7-SEC-02) (#151) (@Reederey87)
• 03d99a3: fix(hub): atomic temp+fsync+rename writes for mutable carrier objects (P7-HUB-05) (#149) (@Reederey87)
• aa1deb9: fix(hub): fsLock owner identity + nonce-verified break/release (P7-QUAL-07) (#160) (@Reederey87)
• 8a74b21: fix(hub): git-carrier head-continuity guard (P7-HUB-02) (#158) (@Reederey87)
• 23f5926: fix(hub): os.Root-confined carrier file access (P7-SEC-04) (#164) (@Reederey87)
• 6d12f7b: fix(ignore): NFC-normalized matching + documented case sensitivity (P7-XP-04, P7-XP-06) (#169) (@Reederey87)
• 74584e5: fix(platform): headless systemd service uninstall (P7-XP-03) (#166) (@Reederey87)
• 133bfaf: fix(release): install.sh verifies the cosign bundle + SLSA provenance it ships (P7-QUAL-02) (#168) (@Reederey87)
• a2f4c42: fix(sandbox): deny-list gains .git-credentials, .config/gcloud, .azure (P7-SEC-01) (#152) (@Reederey87)
• a0fb0a5: fix(state): migration 00023 rollback fails closed on populated env LWW coordinates (P7-DATA-07) (#161) (@Reederey87)
• 5b582ab: fix(sync): carry terminal device-trust in snapshot.v2 (P7-SYNC-01) (#148) (@Reederey87)
• 249b7ef: fix(sync): deterministic draft-snapshot latest/prune tiebreak (P7-SYNC-03) (#159) (@Reederey87)
• 89aad55: fix(sync): draft-snapshot apply quarantines instead of aborting the pull batch (#133) (#136) (@Reederey87)
• a74cf9f: fix(sync): every device that learns of a revoke owes the WCK rotation (P7-SYNC-04) (#153) (@Reederey87)
• bb6220f: fix(worktree): cleanup holds the repo lock, checks running agent runs, rejects stray args (P7-GIT-01/02, P7-CLI-02) (#156) (@Reederey87)

---

Built with GoReleaser. Verify downloads against checksums.txt, or install via
brew install Reederey87/devstrap/devstrap or the scripts/install.sh one-liner.
checksums.txt is keylessly signed with cosign (Fulcio cert + Rekor log) and every
archive ships an SPDX SBOM — see "Verify a download" in the README.

v0.1.1

Changelog

• 45c380c: chore(community): Discussions link, starter issues, AGENTS.md maintainer reframe (AD-8) (#114) (@Reederey87)
• 7d81415: feat(ci): make the spec-drift/work-log gate advisory on fork PRs (AD-8) (#116) (@Reederey87)
• b4a684d: feat(release): SLSA v1 build provenance for release artifacts (P4-SEC-05 / P4-QUAL-05) (#117) (@Reederey87)
• 987c8e7: feat(release): cosign keyless signing + per-archive SBOMs (P4-SEC-05 / P4-QUAL-05) (#115) (@Reederey87)
• eb73e94: feat(release): dormant Apple notarization config + enrollment runbook (P4-SEC-05 remainder) (#119) (@Reederey87)

---

Built with GoReleaser. Verify downloads against checksums.txt, or install via
brew install Reederey87/devstrap/devstrap or the scripts/install.sh one-liner.
checksums.txt is keylessly signed with cosign (Fulcio cert + Rekor log) and every
archive ships an SPDX SBOM — see "Verify a download" in the README.

v0.1.1-rc.1

Changelog

• 45c380c: chore(community): Discussions link, starter issues, AGENTS.md maintainer reframe (AD-8) (#114) (@Reederey87)
• 7d81415: feat(ci): make the spec-drift/work-log gate advisory on fork PRs (AD-8) (#116) (@Reederey87)
• b4a684d: feat(release): SLSA v1 build provenance for release artifacts (P4-SEC-05 / P4-QUAL-05) (#117) (@Reederey87)
• 987c8e7: feat(release): cosign keyless signing + per-archive SBOMs (P4-SEC-05 / P4-QUAL-05) (#115) (@Reederey87)
• eb73e94: feat(release): dormant Apple notarization config + enrollment runbook (P4-SEC-05 remainder) (#119) (@Reederey87)

---

Built with GoReleaser. Verify downloads against checksums.txt, or install via
brew install Reederey87/devstrap/devstrap or the scripts/install.sh one-liner.
checksums.txt is keylessly signed with cosign (Fulcio cert + Rekor log) and every
archive ships an SPDX SBOM — see "Verify a download" in the README.

v0.1.0

Changelog

• 87557bd: feat(agent): macOS Seatbelt sandbox for agent run (P4-GIT-03 slice 1) (#107) (@Reederey87)
• 0ae78ac: feat(hub): local-folder / cloud-drive-folder carrier completes AD-1 (#106) (@Reederey87)
• 257b137: fix(agent): fail closed when the sandbox home anchor cannot resolve (#109) (@Reederey87)
• 3249dbc: fix(release): pin GORELEASER_CURRENT_TAG for the rc → stable same-commit flow (#108) (@Reederey87)

---

Built with GoReleaser. Verify downloads against checksums.txt, or install via
brew install Reederey87/devstrap/devstrap or the scripts/install.sh one-liner.

v0.1.0-rc.2

Changelog

• 87557bd: feat(agent): macOS Seatbelt sandbox for agent run (P4-GIT-03 slice 1) (#107) (@Reederey87)
• 0ae78ac: feat(hub): local-folder / cloud-drive-folder carrier completes AD-1 (#106) (@Reederey87)
• 257b137: fix(agent): fail closed when the sandbox home anchor cannot resolve (#109) (@Reederey87)
• 3249dbc: fix(release): pin GORELEASER_CURRENT_TAG for the rc → stable same-commit flow (#108) (@Reederey87)

---

Built with GoReleaser. Verify downloads against checksums.txt, or install via
brew install Reederey87/devstrap/devstrap or the scripts/install.sh one-liner.

v0.1.0-rc.1

Changelog

• 9290890: Bootstrap DevStrap Go workspace (Reederey reederey@Reedereys-Mac-Studio.local)
• 5a4b217: Bump actions/checkout from 5.0.1 to 7.0.0 (#5) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• ea9e8ca: Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 (#9) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• c3c281f: Bump golang.org/x/text from 0.36.0 to 0.38.0 (#6) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• 27502f6: Clarify agent branch workflow (Reederey reederey@Reedereys-Mac-Studio.local)
• e982c05: Implement second-pass audit recommendations (P0 + medium severity) (#4) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• fd5b7e7: Initial commit (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 80c1e5a: chore(deps): Bump golangci/golangci-lint-action (#7) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• 66f40b2: chore(deps): Bump modernc.org/sqlite from 1.50.1 to 1.53.0 (#8) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• 76b98d6: chore(deps): Bump the github-actions group with 2 updates (#14) (dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>)
• 3e54bc0: docs(agents): document the live-R2 dogfood credential convention (#84) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• e535024: docs(agents): rewrite AGENTS.md into concise branch/worktree/PR guidance (#42) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 835dcb3: docs(audit): sixth-pass design & implementation audit (post-PR-#25) + spec recommendations (#28) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 4366cce: docs(audits): Pass-6 status reconciliation — 30 SHIPPED markers, status banner, spec count refresh (#86) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 8927bd5: docs(claude): commit the model-selection policy + Pass 6 field notes (#43) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 36e970d: docs(claude): report-only nudge rule + pre-commit re-diff check for delegated worktrees (#53) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• d0b696a: docs(cli): document the shipped r2:// hub path; stop steering to the file hub (P6-CLI-05) (#47) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 577af16: docs(hub): record the live git-carrier GitHub dogfood run (AD-1, spec/19 F.2) (#98) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 158934a: docs(quickstart): make the git carrier the default hub; demote r2:// to scale-up (AD-1 swap) (#99) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 8ffad5f: docs(spec): accuracy sweep — flip two shipped pass-6 sections, fix the command list, drop a phantom flag (#52) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• d3d1e8a: docs(spec): pass-6 verification + architecture-direction revision of the full spec corpus (#29) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• a6d30d8: feat(agent): gate agent pr on run status + reconcile crash-stuck running rows (P6-GIT-06) (#93) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• d9a8312: feat(cli): ssh-add remedy hint on auth-class exits (#104) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 756992b: feat(db): full backup/restore for the whole workspace secret set (P6-DATA-04) (#83) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• ed6313f: feat(devices): device-key fingerprint + compare-and-confirm on approve (P4-SEC-04 part 1) (#54) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 5541df5: feat(devices): joiner-side founder pinning before first sync (P4-SEC-04 joiner half) (#49) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 9940810: feat(devices): one-paste pairing codes (P4-SEC-04 part 2, closes the residual) (#57) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 5b5728d: feat(dist): Homebrew cask + curl|sh installer + completions packaging (AD-8 / P4-PROD-05) (#105) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• ba83d82: feat(doctor): workspace-id mismatch detection + hub prefix-isolation tests (P4-SEC-07) (#50) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 6e6c8db: feat(hub): bounded errgroup fan-out for R2Hub.Push and referenced-blob pushes (P6-HUB-03) (#88) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 36c0661: feat(hub): devstrap hub init writes the carrier hub into config (AD-1 slice) (#101) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 5cc82fc: feat(hub): hub compact — snapshot production, floor advance, cold-event deletion (P4-HUB-11) (#74) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 4937691: feat(hub): keychain/op:// S3 credential custody + auth error hint (P6-HUB-02) (#45) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• bd3aeed: feat(hub): migrate-events + advisory sweep lock + dedup-PutBlob freshness (P4-HUB-12 residual) (#76) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• d4daa21: feat(hub): wire the live R2/S3 S3 adapter behind hubFromOptions (P5-HUB-01) (#24) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 5711a57: feat(hub): zero-infrastructure private-git-repo carrier (AD-1 first slice) (#96) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 81e0754: feat(init): adopt the founder's workspace id (--workspace-id) (P4-SEC-07) (#48) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 24dccf8: feat(keys): periodic WCK rotation — manual command + age-triggered auto-rotate (P4-SEC-07 remainder) (#56) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• a8fa2ba: feat(run-loop): implement the advertised idempotent scan stage (P6-XP-03) (#82) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 1a13271: feat(scan): compile the prune matcher from the root .devstrapignore (P6-XP-06) (#92) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 68086af: feat(sync): address workspace keys by (epoch, kid) so colliding keys coexist and grants never overwrite (P6-SEC-01b/c + P6-SEC-02) (#33) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• e3cbb56: feat(sync): enc.v2 — bind the full carrier tuple into the AEAD AAD (P6-SYNC-04) (#44) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 8c739b8: feat(sync): envelope-encrypt the namespace-map event log (P4-SEC-02 + P4-SEC-07 foundation) (#25) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• a9440ae: feat(sync): signed per-device sync acks + tombstone GC + revoked-stream cleanup (P6-HUB-04 completion, P4-SYNC-06 narrowed) (#75) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 746fbbf: feat(sync): snapshot + retention wire format and hub snapshot plane (P4-SYNC-02 part 1, P6-HUB-04 format) (#65) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 4b7e0d1: feat(sync): snapshot import + ErrSnapshotRequired recovery (P4-SYNC-02 part 2) (#73) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 2fe8f2c: feat(sync): transport cursor decoupled from HLC — per-device Seq pull plane (P5-SYNC-01) (#59) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 20b1367: feat: implement cloud-sync audit workstreams EAGER/DRAFT/HUB/XP (#16) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• cb824b9: fix(agent): diff agent runs against the recorded base SHA (P6-GIT-02) (#66) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• b804cce: fix(cli): gate scan --adopt on the workspace root (P6-CLI-02) (#40) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• 652326d: fix(cli): make --quiet suppress progress chatter; results and errors still print (P6-CLI-04) (#90) (Artem Matskevych 52060443+Reederey87@users.noreply.github.com)
• e10b41e: fix(cli): wire every usage-error class to exitUsage=10 (P6-CLI-03) (#89) (Artem Matskevych <52060443+...