• v0.104.0 143732937a

    v0.104.0
    Some checks failed
    ci / test (push) Successful in 1m1s
    promote / gate-and-promote (push) Successful in 1m39s
    ci / secrets (push) Failing after 2m54s
    ci / lint (push) Successful in 4m3s
    release / release (push) Successful in 2m27s
    Stable

    coilysiren released this 2026-07-21 15:02:55 +00:00 | 89 commits to main since this release

    • feat: alias upstream query parameters (1437329)
    Downloads
  • v0.103.0 9de614246e

    v0.103.0
    All checks were successful
    ci / secrets (push) Successful in 7s
    ci / lint (push) Successful in 50s
    ci / test (push) Successful in 56s
    promote / gate-and-promote (push) Successful in 2m22s
    release / release (push) Successful in 7s
    Stable

    coilysiren released this 2026-07-16 01:14:23 +00:00 | 90 commits to main since this release

    • fix(ci): canonicalize godoc snapshot to linux (9de6142)
    • feat(kdl-specs): allow renamed generated binaries (e020f7e)
    Downloads
  • v0.102.0 6f0ee0740b

    v0.102.0
    All checks were successful
    ci / test (push) Successful in 5m5s
    ci / secrets (push) Successful in 3m56s
    ci / lint (push) Successful in 4m13s
    promote / gate-and-promote (push) Successful in 1m43s
    release / release (push) Successful in 44s
    Stable

    coilysiren released this 2026-07-16 01:00:31 +00:00 | 92 commits to main since this release

    • feat(fleetconfig): accept role display identities (closes #232) (6f0ee07)
    Downloads
  • v0.101.0 16b0b2affc

    v0.101.0
    All checks were successful
    ci / secrets (push) Successful in 13s
    ci / lint (push) Successful in 45s
    ci / test (push) Successful in 58s
    promote / gate-and-promote (push) Successful in 1m8s
    release / release (push) Successful in 10s
    Stable

    coilyco-ops released this 2026-07-15 03:56:41 +00:00 | 93 commits to main since this release

    • Merge pull request 'Move release publishing to draft artifacts plus release retag' (#230) from issue-229 into main (16b0b2a)
    • feat(release): stage draft tags before release (3c8db07)
    Downloads
  • v0.100.0 b28749551c

    v0.100.0
    All checks were successful
    ci / secrets (push) Successful in 7s
    ci / lint (push) Successful in 46s
    ci / test (push) Successful in 59s
    promote / gate-and-promote (push) Successful in 1m11s
    release / release (push) Successful in 12s
    Stable

    coilysiren released this 2026-07-14 09:31:10 +00:00 | 95 commits to main since this release

    • Merge pull request 'sandbox: leak-free placement for the .cliguard exec symlink' (#227) from issue-185-sandbox-leakfree into main (b287495)
    • sandbox: reduce jail setup complexity (97a01cc)
    • ci: tame golangci-lint scratch use (f64e4cc)
    • ci: export Go scratch through runner env (d1057cd)
    • ci: route Go scratch to runner temp (d13a169)
    • sandbox: keep exec symlink off host filesystem (d4bb2a1)
    Downloads
  • v0.99.0 af3306bd63

    v0.99.0
    All checks were successful
    ci / lint (push) Successful in 21s
    ci / secrets (push) Successful in 8s
    ci / test (push) Successful in 57s
    promote / gate-and-promote (push) Successful in 59s
    release / release (push) Successful in 6s
    Stable

    coilyco-ops released this 2026-07-14 09:19:10 +00:00 | 101 commits to main since this release

    • Merge pull request 'MCP KDL: add upstream MCP proxy grants for guarded passthroughs' (#228) from issue-214 into main (af3306b)
    • Add inline MCP proxy grants (ba0a2e2)
    Downloads
  • v0.98.0 99b33bcaa1

    v0.98.0
    All checks were successful
    ci / secrets (push) Successful in 10s
    ci / lint (push) Successful in 34s
    ci / test (push) Successful in 1m5s
    promote / gate-and-promote (push) Successful in 1m9s
    release / release (push) Successful in 5s
    Stable

    coilysiren released this 2026-07-13 23:20:03 +00:00 | 103 commits to main since this release

    • Merge pull request 'Enforce lockdown targets by exec basename across every matching binary' (#226) from issue-225 into main (99b33bc)
    • enforce basename-wide lockdown targets (c5f8e8e)
    Downloads
  • v0.97.0 4ef2eb837a

    v0.97.0
    All checks were successful
    ci / lint (push) Successful in 20s
    ci / secrets (push) Successful in 11s
    ci / test (push) Successful in 1m6s
    promote / gate-and-promote (push) Successful in 1m3s
    release / release (push) Successful in 12s
    Stable

    coilysiren released this 2026-07-13 02:28:37 +00:00 | 105 commits to main since this release

    • feat(release): trust the promote gate - release pushes skip CI (4ef2eb8)
    Downloads
  • v0.96.0 e023958b1d

    v0.96.0
    All checks were successful
    promote / gate-and-promote (push) Successful in 1m10s
    ci / secrets (push) Successful in 16s
    ci / lint (push) Successful in 28s
    ci / test (push) Successful in 1m1s
    release / test (push) Successful in 1m13s
    release / release (push) Successful in 6s
    Stable

    coilysiren released this 2026-07-12 21:44:27 +00:00 | 106 commits to main since this release

    • fix(promote): stop checkout's persisted job token from hijacking the promote push (e023958)
    • feat(release): two-stage release - gate-green main promotes to a queued release branch (c35076c)
    Downloads
  • v0.95.0 97daf76079

    v0.95.0
    All checks were successful
    ci / secrets (push) Successful in 8s
    ci / test (push) Successful in 47s
    ci / lint (push) Successful in 16s
    release / release (push) Successful in 9s
    Stable

    coilysiren released this 2026-07-12 06:40:07 +00:00 | 108 commits to main since this release

    • Merge pull request 'fix(gittree): match the refusal rationale to the cause that fired' (#224) from fix/refusal-names-the-actual-gate into main (97daf76)
    • fix(gittree): match the refusal rationale to the cause that fired (ward#1129) (1456b77)
    Downloads