Skip to content

Changelog

Generated by git-cliff from the commit subjects. Do not edit by hand: every push to main rewrites this file. Fix a wrong entry by fixing the commit message convention, not the file.

0.5.1 - 2026-09-11

Fixes

  • release: Read the image-record header and untagged list reference (#596)

Performance

  • ci: Read the cachix stores in docs, and free two paid jobs (#594)

0.5.0 - 2026-09-11

Features

  • app: C2 BootRoot single root of trust (conf266) (#575)
  • Use new rust compiler for traits (#590)
  • identity: R1 digest-only AssertionDigest (conf266) (#566)
  • agents: Ponytail on by default, and inherited by subagents (#577)
  • conformance: Corpus as files (#350) (#555)
  • mcp: Honor peer cancellation (#553)
  • conformance: Compile packs behind a default-off feature (#549)
  • release: Export portable provenance bundles (#505)
  • domain: One answer's legs decide identity the same way, or it is refused (#484)
  • gates: Needle-substring lint in check-expect-thresholds (#497)
  • Jscpd copy/paste gate (issue #474) (#483)
  • federation: The shipped engine executes a leg, so a published build answers two sources (#441)
  • ci: Three OSS-readiness scans, and two badges held against what they claim (#422)
  • xtask: A worktree's state is its own, held by a gate (#417)
  • xtask: An absence a doc comment claims, read against the code (#406)
  • nix: The artifact/sweep pairing is held by a gate, not review (#368)
  • xtask: A venue a job reaches, whose run nobody has seen - and what a Reached by may get away with (#396)
  • xtask: The causality gate reads its base and its manifests (#384)
  • The conformance suite's own coverage - a gate and its cost (#375)
  • docs: The site build joins validate, and a dead href is a gate (#361)
  • xtask: An example no test reaches for is a directory of prose (#294)
  • datahub: The deployment-defined property, measured against a real DataHub - and the closedness claim gated (#256)
  • identity: Serve attaches the exchanging broker, and the expiry floor lands (#284)
  • xtask: The compose tier's one bounded wait is held by a gate (#280)
  • xtask: The boot order the pre-flight relies on is a gate (#251)
  • xtask: The acceptance job's five properties are asserted, not configured (#255)
  • dev: Keycloak as a nix-native tier, provisioned without a human (#250)
  • xtask: The identity venue map is held by a gate, not by recall (#254)
  • xtask: A just task a failure prints is resolved by a gate (#253)
  • dev: Every discoverable service declares its CI venue (#239)
  • cli: The agent surface refuses a table the dataset does not hold (#236)
  • cli: Open a BigQuery dataset behind a default-off feature (#230)
  • cli: Open the data system the deployment declared (#229)
  • dev: A provisioned DataHub tier behind a compose profile (#227)
  • example: The DataHub multi-player shape, and its fixture proof (#211)
  • metadata: A DataHub metric carries a whole certified metric (#210)
  • serve: A table the dataset does not hold stops the boot (#212)
  • xtask: No first-party Deref, and no Borrow at all (#203)
  • xtask: A transport cannot declare the port it calls (#201)
  • xtask: An adapter cannot reach an adapter of its own kind (#200)
  • xtask: A refusal variant nothing provokes is a failure (#199)
  • clippy: Ban the one call that lets a credential out (#198)
  • xtask: Gate serde against a newtype's own constructor (#197)
  • cli: Serve the MCP agent surface over stdio via sutura mcp (#189)
  • catalog: DataHub as the first declaring SemanticCatalog (#195)

Fixes

  • exec-bigquery: Source_refused from the transport's own refusal split (#579)
  • sql: Bound the parenthesis the pinned parser never closes (#146) (#592)
  • ci: Create target/ before the privileged cache restore (#591)
  • refusal: G4 per-variant witness keyed by domain code (conf266) (#573)
  • exec: A data-source refusal is a non-retryable class, distinct from transient (#574)
  • fuzz: Bound non-ASCII in SQL and repair the question_body dictionary (#146) (#582)
  • xtask: Refuse pub modules no first-party crate references (#131) (#581)
  • api: Public re-exports carry their docs (#470) (#580)
  • gates: Refuse intent-to-add source gaps (#578)
  • keycloak: Preserve status code contract (#576)
  • ci: Preserve pending BigQuery acceptance jobs (#567)
  • identity: Mask at the parse boundary, not at render (#388) (#572)
  • ci: State the pruning fallback cost (#556)
  • cli: A remedy naming variables that are not set (#435)
  • docs: Remove unresolved generated self link (#558)
  • xtask: Falsifier guard for the hygiene gates (closes #371 guard step) (#554)
  • docs: Point the backoff note at a public item (#550)
  • security: Typed ceilings on caller input, and the token hashed at parse (#547)
  • http,mcp: Caller-chosen values no longer reach a log or a body (#546)
  • domain: One refusal code the transports both read (#545)
  • dev: Preserve foreign keycloak claims (#548)
  • gates: Anchor the jscpd drift check, and hold its thresholds to the declared set (#542)
  • ci: Generate the attribution document instead of committing it (#536)
  • gates: Check binary-only rustdoc links (#504)
  • xtask: Name both missing advisory causes (#544)
  • config: Carry each key's layer origin into the refusal it is about (#543)
  • domain: Restate the limit UnsupportedAggregate cannot reach (#540)
  • identity: Mask opaque principal suffixes (#541)
  • xtask: A gate that cannot be switched off, and a file it cannot read (#534)
  • gates: Share the jscpd ignore config (#529)
  • xtask: An escaped backtick is prose, and a citation needs a test (#537)
  • http: Keep raw paths out of warnings (#523)
  • identity: Mask principals in diagnostic output (#530)
  • xtask: The witness counts the subjects the check reached (#516)
  • domain: Bind re-aggregated leaves to their tree (#524)
  • nix: The keycloak tier's start guard is the process, its status the records (#434)
  • xtask: Enrol NotValidated, and make the enrolled count a witness (#507)
  • xtask: A gate's inner walk reaches every subject it was offered (#509)
  • jscpd: Hygiene follow-ups — temp-dir leak and single-owner ignore set (#502)
  • gates: Enforce literal task filter parity (#503)
  • dev: A tier reads and writes only its own entry, and derives its own state (#454)
  • config: Retain file layers in startup failures (#493)
  • gates: The changed-package recipe sources the stable helper (#491)
  • Include enums in serde constructor coverage (#489)
  • gates: Refuse an unconfigured local Rust toolchain (#481)
  • xtask: Cover startup refusal names (#479)
  • bigquery: Distinguish unreadable inventories from absences (#475)
  • ci: Drop the publication-refusal witness, publishing is the success condition (#476)
  • xtask,serve: The guard takes the lock, the site cannot skip a join (#460)
  • bigquery: Redact session-user debug output (#473)
  • ci: Measure causality on the pull request head (#469)
  • ci: The publication the badge needs, and a witness that it landed (#456)
  • xtask: Distinguish venue commands and check named credential cleanup (#433)
  • exec-postgres: A fixture credential is configured, or it refuses (#461)
  • release: Every published byte is signed, sidecars included (#465)
  • ci: Preserve a failed check without an offline retry (#467)
  • bigquery: A listing short of its own total is unaccounted for, not absent (#439)
  • xtask: A green run over a revert the tests cannot reach is INCONCLUSIVE (#399)
  • xtask: A census reads its own subjects, and its sealed types hand out nothing (#438)
  • xtask: The #[ignore] line itself is not a run this venue reaches (#420)
  • domain: A violated many_to_one is refused at boot, not answered twice (#354) (#427)
  • docs: Fifteen unresolved intra-doc links, and the lint that keeps them fixed (#408)
  • Two intermittent test failures - the compose lock's release, and the serve harness's drain (#407)
  • xtask: A shipped-set value the gate cannot compare is a verdict (#373)
  • dev: Every devenv shell body is discovered, not matched by a needle (#409)
  • xtask: Ordinary CI is every file it calls, not one file name (#403)
  • devenv: ShellCheck reads every script body, and a gate keeps every body inside it (#395)
  • xtask: Check-examples resolves a line to the test around it, and to disk (#393)
  • docs: The guided path installs a published binary, not a toolchain (#385)
  • dev: The postgres tier is ephemeral, and heals a directory it wedged on (#379)
  • docs: ADR records that no longer describe the tree, held by a gate (#369)
  • serve: A refusal may not send an operator after a feature that does not exist (#367)
  • xtask: Check-arrow reads its allowlist on a single-major tree too (#374)
  • bounds: One process builds one Admission, and the reply is bounded (#364)
  • xtask: What the causality gate believes about its own diff (#359)
  • xtask: What a causality verdict may claim - the exit code and the sentence (#344)
  • federation: A null fact key, a colliding label and the null order (#331)
  • mcp: A question takes an execution slot, and its worker keeps it (#342)
  • nix: An inherited build root is regenerated, not required (#330)
  • Five gates that reported more coverage than they had (#322)
  • dev: One record for the tier's state, and a failed stop keeps it (#316)
  • xtask: A #[cfg(test)] helper is test code, and a verdict says how much it measured (#306)
  • xtask: A fence, a constant and a file, derived not believed (#309)
  • domain: The catalog's authored content is parsed and reconciled (#282)
  • dev: The unprovisioned remedy derives its venue in both arms (#268)
  • xtask: A causality verdict names the test it measured, and the name is a key (#279)
  • mcp: The prose setting reaches both halves of the catalog reply (#277)
  • bigquery: The listing's own total is decoded, so the cross-check has something to check (#272)
  • cli: The query command records the outcome it prints (#276)
  • domain: A leaf column's numeric type is established before any aggregate reads it (#270)
  • xtask: Six properties of the acceptance job read a line where a shape was meant (#269)
  • xtask: A daemon wedging mid-run fails dev-up rather than hanging it (#273)
  • xtask: A wedged daemon fails a gate rather than hanging it (#262)
  • xtask: The remedy a claim prints is checked, not trusted (#246)
  • xtask: A gated count that no page states is not a gate (#237)
  • dev: A stopped Postgres tier stops claiming to be there (#231)
  • Agentt guardrails and skills (#228)
  • http: The catalog body honours catalog_prose: omitted (#128) (#207)
  • ci: Prune pull request caches on close (#205)
  • ci: Prune unreachable caches daily (#191)

Performance

  • ci: Compute the full cross matrix only for a release (#587)
  • ci: Fix a no-op cache, read every store we write, and gate what made it invisible (#586)
  • ci: Close #560 + #561 + #562 + #564 — the CI-caching improvement batch (#571)
  • ci: Persist the writable causality target across runs (#563)
  • nix: A deps-only build states whether it compiles test targets (#510)

Refactoring

  • domain: Typed result labels, and a truthful failure (#432)
  • xtask: A gate's witness is minted by the walk, not by its own loop (#419)
  • Five files off the 1000-line cap, each at a named seam (#345)
  • xtask: What the acceptance job must hold is its own module (#323)
  • domain: The re-aggregation above the legs is its own module (#318)
  • ci: The cross link check is its own reusable workflow (#289)
  • bigquery: A resource name's position is a variant (#220)

Documentation

  • gates: State accounting witness limits (#570)
  • adr: Close both CodeQL next steps with a measurement (#535)
  • git: Clarify published-branch rewrite authority (#501)
  • adr: Why a CodeQL Rust SQL-taint job is not shippable yet (#464) (#480)
  • build: Distinguish Cargo relocation from baked files (#488)
  • identity: Record startup refusal evidence limits (#482)
  • Surface the issue tracker and steer security reports to SECURITY.md (#478)
  • adr: The re-measurement is the argument for not acting (#471)
  • The tree stated both branch styles, and argued a refusal from the wrong one (#436)
  • Three corpora of already-false claims, and where the reader is blind (#442)
  • adr: Where a per-request principal reaches the agent surface (#380)
  • adr: 0017 said acceptance.rs still needed splitting, and #323 split it (#326)
  • Five prose corrections in the README (#315)
  • site: The implementation plans stop being published pages (#292)
  • adr: Which half of the DataHub property a deployment owns (#234)
  • skills: Name what stays advisory, and what the gates miss (#208)

Tests

  • bigquery: Preserve qualifiers in isolated fixture naming (#498)
  • federation: Exercise the remaining compile-time refusals (#500)
  • security: Fuzz the SQL and JSON parsers that read untrusted input (#494)
  • bigquery: One workload identity, exchanged per subject, against SESSION_USER() (#382)
  • Allow complete mutation runs through nextest profiles (#466)
  • serve: The four startup refusals, held on the binary that makes them (#444)
  • Assertions that read text where they meant a value (blocked on #394) (#397)
  • conformance: Postgres is bound, and an absent tier is not a pass (#398)
  • xtask: Every registered hygiene gate, run against a tree it must refuse (#390)
  • Slice C - the splitter, two executions and the combiner, joined (#355)
  • conformance: The packs crate, and two adapters held to it from their own crates (#352)
  • B0 - one typed comparison policy, and the reformatting golden compares two inputs (#333)
  • cli: Every command the pages print is run, or named as skipped (#293)
  • bigquery: The two-principal cell, and the half it cannot establish (#286)
  • bigquery: Make the acceptance leg re-entrant with per-run table names (#283)
  • bigquery: A real listing reaches the boot decision, and the soft edge names its status (#257)
  • identity: The exchange chain, joined through the transport (#252)
  • identity: Leg 1 on the composed binary, over a published key set (#238)
  • bigquery: A real dataset answers the pre-flight's listing (#221)
  • e2e: Ask the served deployment a question (#117) (#192)
  • identity: A mock issuer in the sandbox, provable every run (#193)

Build

  • Bump rmcp from 3.1.4 to 3.2.0 (#426)
  • Bump the patch-level group with 3 updates (#425)
  • xtask: Gate the hygiene classification, not its count (#247)
  • devenv: Upgrade the pinned stax to 0.110.0 (#194)

CI

  • fuzz: Drop the per-push leg, run the fuzzer at a release (#146) (#593)
  • Category filter over the workspace, named by adapter crate (#552)
  • cache: PRs publish to sutura-prs behind a PR-gated read (#551)
  • cache: Publish the cross, connector and fuzz closures to per-consumer caches (#539)
  • Make the host-utilisation numbers quotable from a job log (#531)
  • Fold every CI refinement into one change, and trust one binary cache (#520)
  • Retire the inert third-party binary cache and gate its return (#508)
  • gates: Anchor the event-scoped cross matrix in check-workflows (#496)
  • Chain doctest onto the nextest artifacts to drop a workspace recompile (#495)
  • Restore the Actions cache everywhere, write it only from main (#490)
  • Event-scoped cross matrix (PR 2/main 4/release 4) + binary-cache backstop (#472) (#477)
  • The shipped feature set gets a lint gate in CI too (#258)
  • The shipped feature set's tests are run by a gate, not compiled by one (#271)
  • cross: The documented feature-on source build is linked, not assumed (#259)

0.4.1 - 2026-09-01

Fixes

  • release: Create the licence artifact directory (#188)

0.4.0 - 2026-09-01

Features

  • catalog: Compose N metadata sources into one bundle (#115) (#181)

Fixes

  • release: Authenticate the early stale check with Git (#187)
  • release: Authenticate the stale-dispatch fetch on version-bump (#186)
  • ci: Reserve release builds for tags (#185)
  • release: Use one approved main release path (#184)

0.3.0 - 2026-09-01

Features

  • xtask: Ban #[expect] on count-threshold lints (#107)
  • catalog: Let a deployment declare several catalogs
  • catalog: Declare a catalog kind and dispatch it in the server
  • identity: Grant the two principals jobUser+dataViewer and record the cell state in ADR 0017
  • test-infra: Run Pulumi through pixi, drop requirements.txt/venv
  • test-infra: Google identity E2E scaffold, config-driven Pulumi
  • Answer every file's licence mechanically, per the REUSE specification (#101)
  • ci: A curated licence review, with the config written here rather than cloned (#102)
  • release: The SBOM comes out of the binary, not out of Cargo.lock (#98)
  • federation: Execute a two-source question end to end (#89)
  • bigquery: A BigQuery source executes as the asking subject (issue 87) (#93)
  • serve: Register the BigQuery adapter so a deployment can serve kind: bigquery (#88)
  • identity: A credential the compiler refuses to print (#86)
  • catalog: A model may name a table outside its connection's dataset (#83) (#84)
  • bigquery: The wire, and the client decision that had to come first (#80)
  • postgres: A Warehouse adapter over Postgres, on a static credential (#78)
  • federation: Split, combine and serve a two-source question (#72) (#76)
  • catalog: Split the catalog matrix by adapter kind (#77)
  • bigquery: The fourth dialect, the adapter, and what a test runs against (#64)
  • xtask: Clean-branches, because --merged cannot see a squash merge (#74)
  • catalog: A metadata adapter says what it cannot supply (#59)
  • identity: A credential per leg, so nothing runs as the process (#58)
  • dev: The compose tier gets a reader, and the tier came up (#56)
  • config: A source registry, a declared posture, and two boot checks (#48)
  • surface: One tool set for two transports, gated by scope (#49)
  • identity: Leg 1, so a caller can prove who it is (#45)
  • domain: The two leg shapes, rendered and pinned before a combiner (#47)
  • dev: One service instance per worktree, on ports docker allocates (#34)
  • bounds: The engine gets a memory pool, and exhaustion becomes a refusal (#38)
  • identity: The principal chain, while both tail positions are still absent (#37)
  • mcp: The agent surface, one tool, schema generated not written (#35)
  • domain: A new aggregate cannot compile without saying how it federates (#33)
  • catalog: The knowledge layer, and an escape hatch for authored SQL (#23)
  • One catalog, CRAP delta control, and three CI holes (#21)
  • The query path - a catalog compiles to a plan, and the plan executes (#19)

Fixes

  • ci: One merge_group key; fix(release): push as the App, not the bot (#178)
  • release: Push the release commit under a dedicated App token (#172)
  • domain: Re-land the two-bound too-much-data refusal lost in the dev restructure (#91 / #158) (#165)
  • ci: Reuse warmed artifacts and skip needless cleanup (#162)
  • mcp: Honour catalog_prose: omitted on the describe tool, and share the injection corpus
  • licence: Attribute vendored crates, and check the licence values
  • mcp: The agent text half can no longer be forged by a cell or a description
  • sql: State null placement in ORDER BY so the dialects agree (#92) (#95)
  • xtask: A lock file naming no holder is not PID 0, and it is never visibly empty (#68)
  • identity: The anchor door was a shape check, not an authority (#61)
  • identity: A broker's answer was trusted, and now it is checked (#62)
  • tooling: A rebase could push a tree nothing had compiled (#55)
  • dev: Ship-check could not run, because cargo nextest has no -q (#57)
  • tooling: A green just check was read as a green tree (#52)
  • Main did not compile after seven parallel merges (#40)
  • xtask: A test appended to an existing test module is not a production change (#36)
  • docs: Publish a version per release, so the dropdown has versions

Refactoring

  • serve: Split catalog opening out of main to hold the line limit
  • ci: Share the workflow lint sequence, and gate its references
  • test-infra: Hoist Pulumi tasks into the top-level justfile as infra-*

Documentation

  • justfile: Describe BigQuery acceptance accurately (#164)
  • plan: Reconcile the stack, hand the backlog to the tracker (#157)
  • adr: Untrusted content, and what marks it
  • contributing: Restack with stax, never hand-rebase a branch in a stack
  • test-infra: Fix stale just gl citation to infra-gl in setup
  • adr: Settle where each identity claim is proven, per issue 81 (#103)
  • The exact-order comparison is measured now, not predicted (#100)
  • adr: DataHub carries part of a model, and declares the rest (#53)
  • agents: The dev shell follows cargo into other repos and breaks builds there (#46)
  • plan: The table says which steps shipped, because six of them did not (#44)
  • plan: BigQuery leads the stack, and cheap-first is a tiebreak (#43)
  • The records catch up with what the merges actually shipped (#41)
  • adr: The metrics endpoint, the pool policy, and a finding withdrawn (#29)
  • adr: Two false claims and seven stale cross-references from the final review (#27)
  • The architecture of record for federation and impersonation, and the plan (#26)

Tests

  • mcp: Share the single-cell answer fixture between the two forgery tests
  • google: Pulumi-only bootstrapping - enable APIs and RLS in-program
  • google: Configure the stack from the machine env automatically
  • google: Make pulumi preview actually run against the pinned SDK
  • google: Local file backend, no pulumi cloud, CI stack postfix
  • google: Workload identity pool (jwt), env-driven config, e2e-gcp workflow
  • bigquery: The corpus acceptance leg, and the importer it needed (#90)
  • sql: Prove and cover the week grain's Monday semantics (#67) (#75)
  • golden: A value in double quotes was stripped before we looked (#51)
  • startup: The source refusals both binaries make and neither proved (#31)

Build

  • licence: Ship a committed, signed attribution document (#161) (#170)
  • release: Publish sutura-serve as a second artefact (#167)
  • licence: An attribution document, and a signed licence report
  • Refresh dependencies (#65)
  • tooling: The Google Cloud CLI, as a container not a package (#54)
  • xtask: One Arrow major per lock file, or an explained exception (#30)
  • nix: Stax 0.108.0, pinned upstream because nixpkgs has 0.102.2 (#25)

CI

  • Answer the merge_group event, and gate cross on the event (#109)
  • Run required checks for merge queue
  • secrets: Allowlist the KEY_ALG_RSA_2048 GCP enum in the test-infra pulumi program
  • e2e-gcp: Install pulumi at the pixi-locked version, no third-party action (address review r3897537270)
  • e2e-gcp: Take the pulumi CLI version from pixi.lock, not a float
  • A dev trunk, and a release on every promotion to main (#104)
  • release: Sign and attest every published artefact (#97)
  • Run all workflows on the rust-mcp larger runner (#96)
  • docs: A text-only citation gate, so a prose-only PR stops paying 15m45s (#32)

Infra

  • google: Add infra-down and infra-set operator recipes
  • google: Move provisioning out of CI; CI consumes the bq-test environment
  • google: Export a CI service account key and CI dataset/table for the bq-test environment
  • google: Make up run as the developer ADC and fix three resource validations
  • google: Give the GCP provider a concrete region+zone so it stops enumerating compute regions
  • google: Bootstrap the Service Usage API itself, first, from pulumi
  • google: Env-driven stack name and a pulumi CLI/SDK version-parity gate
  • google: Pin the pixi pulumi SDK to the nix CLI version (both 3.255.0)
  • google: Pin the pulumi CLI via nix (devenv + flake), drop the web installer

Merge

  • Bring main's direct merges back into dev, keeping one licence implementation

0.2.4 - 2026-08-25

Fixes

  • ci: The prune's own display line failed the workflow

Performance

  • ci: A profile for the link check, tuned for compile speed

CI

  • Delete the caches of closed pull requests, weekly
  • release: Cut releases on request, not on every push

0.2.3 - 2026-08-25

Documentation

  • The end-user pages stop routing contributors
  • release: The notes are tables, and nothing else

0.2.2 - 2026-08-25

Documentation

  • release: Notes are the changelog, the binaries and the images

0.2.1 - 2026-08-25

Fixes

  • api-docs: Drop the version, and wire the writer through nix

Documentation

  • Compress the prose, and make "Where to start" end-user only

0.2.0 - 2026-08-25

Features

  • Mimalloc 3.5.0 via nix, generated API docs, new identity mark

Fixes

  • release: Take the image digest from the push, not from RepoDigests

Refactoring

  • Move repo-only config into devco/

Documentation

  • One mark on the front page, not two
  • agents: Cite a just task, never a raw command
  • agents: Let CONTRIBUTING.md own the procedure
  • agents: Cut what the file already says elsewhere

CI

  • Check every arch on the pull request, as a matrix
  • Build the shipped artifacts on main, not on every branch
  • hooks: Run the tests at commit, not at push
  • release: Cache the release path, and split it into a matrix

0.1.0 - 2026-08-25

Features

  • Musl artifacts with mimalloc, plus a contributing guide
  • Mkdocs-material docs, FHS dev container, one pin per tool
  • Typed newtypes, structured errors, and an honest hexagon
  • Secrets gate, dev CLI, justfile, changelog automation
  • gates: Check-guidance, skills lock, and one dispatch table
  • skills: Import 20 library-tier skills, enforce provenance
  • agents: Cross-agent skill wiring, ponytail, PR and issue templates
  • Stacked-branches skill, repo-local stax config, generated-file exemption
  • skills: Add ms-rust, regenerated from current upstream
  • agents: Skills tree, causality gate, and the checks that keep them honest
  • gates: Max-lines 1000, unused-deps, and a stricter lint table
  • M0 walking skeleton — toolchain, gates, and a binary that runs
  • Initial

Fixes

  • xtask: A check that could not run must not report a finding
  • xtask: A pointer file is not a newline violation
  • dev: Clear build-users-group so the container can build derivations
  • ci: Catch a missing flake output and a vendored leak locally
  • dev: Pass a token through only when it exists, and keep nix on PATH
  • Unbreak CI on main, and make the hooks work outside the dev shell
  • dev: Doctor catches uninstalled hooks - they were never installed
  • ci: A moved file no longer skips its own area
  • Ship one binary, one hygiene list, CRLF for every text file
  • Nextest everywhere, doctests in CI, and three things I got wrong
  • ci: Compare against the whole branch, and stop passing on a base that never built
  • deny: Allow only the licences in use, and fail if that stops being true
  • security: Act on the review - publish paths, supply chain, betterleaks
  • gates: Skip crane's .cargo-home, drop four lint allows, ASCII output
  • ci: Make the Nix path actually work, and stop rebuilding Rust four times

Documentation

  • The brand slots are filled, not empty
  • skills: St sync does not restack, st refresh does
  • Trim getting-started and enterprise-mirrors

Build

  • Bump sha2 from 0.10.9 to 0.11.0

CI

  • Remove every third-party action, add the weekly security audit
  • Classify changes, inline the remote hooks, --all-features everywhere
  • Drop devenv from CI, add the opt-in performance release

Review

  • 1.98, rustfmt 130, drop the hook, cross-built releases, cranelift dev-only