From 4cd9a56fdce459780b49957a19c602597d597ff3 Mon Sep 17 00:00:00 2001 From: Binay <150876063+bkd-dotcom@users.noreply.github.com> Date: Tue, 1 Sep 2026 10:22:42 -0400 Subject: [PATCH] =?UTF-8?q?release:=20v0.8.0=20=E2=80=94=20receipt=20spec,?= =?UTF-8?q?=20policy=20registry,=20open=20core?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rolls the Unreleased section into 0.8.0 and bumps pyproject to match, which is what the Release workflow verifies before it will cut anything. Three corrections came out of doing it, all of them cases of a version claim that had stopped being true: - install.sh still defaulted to 0.6.0, two releases behind, while its own comment promised "the latest hardened tag". The one-line installer was quietly handing people older code than every other install path on the project advertised. It escaped the pin sweep because it interpolates v${VERSION} rather than spelling the version out. - docs/RELEASING.md told you to `git push origin main --tags`. main is protected and requires its status checks, so that step cannot succeed — the documented release process did not work. It now goes through a PR, and it says to move the CHANGELOG heading, which the old text omitted even though the release notes are extracted from it (a release cut without that step silently ships fallback text). - CONTRIBUTING.md never mentioned policies, so the registry this release ships had no contribution path pointing at it. Adding one is a single YAML file with no test to write, because tests/test_policy_registry.py is parametrized over every entry. The 15 core@v0.7.0 pins move to v0.8.0. The `@v0.5.3 or later` and `@v0.1.3+` floors are deliberately left alone — those state a minimum, not the current release. --- CHANGELOG.md | 2 +- CONTRIBUTING.md | 8 ++++++++ README.md | 4 ++-- SECURITY.md | 2 +- docs/INTEGRATIONS.md | 4 ++-- docs/LAUNCH.md | 4 ++-- docs/RELEASING.md | 24 +++++++++++++++++------- docs/site/index.md | 2 +- docs/site/quickstart.md | 2 +- docs/site/scan-quickstart.md | 2 +- install.sh | 2 +- integrations/git-hooks/pre-push | 2 +- integrations/github-action/action.yml | 2 +- pyproject.toml | 2 +- signetry_core/mcp_server.py | 4 ++-- uv.lock | 2 +- 16 files changed, 43 insertions(+), 25 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a1281fd..a4ee4b8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ All notable changes to **signetry-core** are documented here. The format follows [Semantic Versioning](https://semver.org/). Until `1.0.0` the public API may change between minor versions. -## [Unreleased] +## [0.8.0] — 2026-09-01 ### Added — the receipt format is now a published, independently testable spec diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5e83760..ffce7a2 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -42,6 +42,14 @@ CI should be green. and [Discussions](https://github.com/Signetry/signetry/discussions). Well-scoped areas in this repo: +- **A policy for the registry** — the most approachable change here: one YAML file in + `signetry_core/policies/` describing a stack's safe blast radius. No Python required, + and no test to write — `tests/test_policy_registry.py` is parametrized over every + entry, so your file is checked the moment it lands (metadata complete, declared blocks + actually blocked, declared allows actually allowed, no overlap between them). + `signetry policies` lists what exists and + [docs/site/policy-registry.md](docs/site/policy-registry.md) explains the fields; a + policy installs byte-for-byte, so what you write is exactly what an adopter gets. - **A new detection rule** — add a vuln class or language to `signetry_core/pipeline/findings/` with a test in `tests/test_findings_engine.py`. - **An executor adapter** — wire a new coding agent behind the `Executor` protocol diff --git a/README.md b/README.md index ef967a3..b3f5749 100644 --- a/README.md +++ b/README.md @@ -58,12 +58,12 @@ One core (`run_admission`), five checkpoints an agent's change must pass through ```bash # Not on PyPI — install from the source repo: -pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0" +pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0" ``` | Surface | Governs | Command | |---|---|---| -| **Source install** | anything you script | `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"` | +| **Source install** | anything you script | `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"` | | **CLI + git hook** | the agent on your machine | `signetry admit . --mission "..." --agent claude-code` | | **Detection scan** | find vulns in any repo (7 languages) + govern the fix | `signetry scan . --sarif` · `signetry scan . --fix` | | **GitHub Action** | **every** agent's PR (Claude Code, Codex, Cursor, Copilot, Devin) | [Marketplace: Signetry Admission](https://github.com/marketplace/actions/signetry-admission) · [`@v1`](https://github.com/Signetry/action) | diff --git a/SECURITY.md b/SECURITY.md index 962070b..0eeeafb 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -20,7 +20,7 @@ dev-key verification trust, and — in the companion GitHub Action `< v0.1.3` workflow script-injection sink). `0.5.1+` adds bring-your-own-key credential redaction for `--fix`. Pin the Action to `@v1` (which moves forward) or `@v0.1.3+`, and install `signetry-core` from source at `@v0.5.3` or later -(`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"`). +(`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"`). ## Reporting a vulnerability diff --git a/docs/INTEGRATIONS.md b/docs/INTEGRATIONS.md index 1258b2e..389ec4c 100644 --- a/docs/INTEGRATIONS.md +++ b/docs/INTEGRATIONS.md @@ -14,7 +14,7 @@ Codex, Cursor, Copilot, Devin, or a human, identically. ```bash # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source -pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0" +pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0" ``` ```python @@ -75,7 +75,7 @@ status check* in branch protection and nothing merges without a receipt. ## 4. MCP server (agents call governance themselves) ```bash -pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0" +pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.8.0" python -m signetry_core.mcp_server # stdio transport ``` diff --git a/docs/LAUNCH.md b/docs/LAUNCH.md index 9f6547b..01e2600 100644 --- a/docs/LAUNCH.md +++ b/docs/LAUNCH.md @@ -35,7 +35,7 @@ provenance. Make it a required status check and nothing merges without a receipt Agent-agnostic; **open core** — the engine is source-available under BUSL-1.1 (Apache-2.0 on 2030-08-31) and every integration is Apache-2.0 — installed from -source (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"`). +source (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"`). On the GitHub Marketplace: https://github.com/marketplace/actions/signetry-admission @@ -97,7 +97,7 @@ jobs: Live demo — a permitted change passes, a forbidden `deploy.yml` edit is blocked: https://github.com/Signetry/autofix-demo/pulls -Also usable as a CLI (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"` +Also usable as a CLI (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"` → `signetry admit`), a git pre-push hook, an MCP server, or a Python library. Open core: the engine is source-available under BUSL-1.1 (Apache-2.0 on 2030-08-31) and every integration around it is Apache-2.0. diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 1ef3dec..8c0002e 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -5,7 +5,7 @@ Apache-2.0 on 2030-08-31) and is **not published to PyPI** — it is distributed installed **from source by tag**: ```bash -pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0" +pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0" ``` Pushing a version tag runs [`.github/workflows/release.yml`](../.github/workflows/release.yml), @@ -15,14 +15,24 @@ as all prior PyPI releases were yanked). ## Cutting a release -1. Bump the version in [`pyproject.toml`](../pyproject.toml) (`[project].version`). -2. Commit: `git commit -am "release: v0.5.3"`. -3. Tag and push: +1. Move `## [Unreleased]` in [`CHANGELOG.md`](../CHANGELOG.md) to `## [X.Y.Z] — `. + The release notes are extracted from that heading, so a release cut without it + ships the fallback text instead of its own changelog. +2. Bump the version in [`pyproject.toml`](../pyproject.toml) (`[project].version`) to + match. The workflow fails the release if the two disagree. +3. Update every `core@vX.Y.Z` pin that names the current release — the README, the + docs, `install.sh`, and the bundled integrations all print an install command a + user copies. `grep -rn 'core@v'` finds them; leave the `@v0.5.3 or later`-style + floors alone. +4. Open a PR with those changes and merge it. `main` is protected and requires its + status checks, so a release cannot be pushed straight to it. +5. Tag the merged commit and push the tag alone: ```bash - git tag v0.5.3 - git push origin main --tags + git checkout main && git pull + git tag vX.Y.Z + git push origin vX.Y.Z ``` -4. The `Release` workflow will: +6. The `Release` workflow will: - verify the tag matches `pyproject.toml`, - run `ruff` + `pytest`, - build sdist + wheel and run `twine check`, diff --git a/docs/site/index.md b/docs/site/index.md index 99f00e4..efb4d45 100644 --- a/docs/site/index.md +++ b/docs/site/index.md @@ -35,7 +35,7 @@ false — a human merges. ```bash # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source -pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0" +pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0" ``` - Source (install from here): diff --git a/docs/site/quickstart.md b/docs/site/quickstart.md index ca4e81c..68cd21f 100644 --- a/docs/site/quickstart.md +++ b/docs/site/quickstart.md @@ -4,7 +4,7 @@ ```bash # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source -pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0" +pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0" signetry completion zsh >> ~/.zshrc # optional: shell completion (bash | zsh | fish) ``` diff --git a/docs/site/scan-quickstart.md b/docs/site/scan-quickstart.md index 0e385f6..ad7e26d 100644 --- a/docs/site/scan-quickstart.md +++ b/docs/site/scan-quickstart.md @@ -10,7 +10,7 @@ proving it — start at [Quickstart](quickstart.md). ```bash # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source -pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0" +pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0" ``` ## Scan diff --git a/install.sh b/install.sh index 7ab1b9b..f9afa6c 100755 --- a/install.sh +++ b/install.sh @@ -20,7 +20,7 @@ set -eu # optional: SIGNETRY_VERSION=0.5.3 sh install.sh (defaults to the latest hardened tag) -VERSION="${SIGNETRY_VERSION:-0.6.0}" +VERSION="${SIGNETRY_VERSION:-0.8.0}" SPEC="signetry-core @ git+https://github.com/Signetry/core@v${VERSION}" say() { printf ' %s\n' "$1"; } diff --git a/integrations/git-hooks/pre-push b/integrations/git-hooks/pre-push index 4eb9256..538db7b 100755 --- a/integrations/git-hooks/pre-push +++ b/integrations/git-hooks/pre-push @@ -20,7 +20,7 @@ if [[ "${SIGNETRY_SKIP:-0}" == "1" ]]; then fi if ! command -v signetry >/dev/null 2>&1; then - echo "signetry: CLI not found — install from source with 'pip install \"signetry-core @ git+https://github.com/Signetry/core@v0.7.0\"'." >&2 + echo "signetry: CLI not found — install from source with 'pip install \"signetry-core @ git+https://github.com/Signetry/core@v0.8.0\"'." >&2 echo "signetry: skipping the governance gate (not installed)." >&2 exit 0 fi diff --git a/integrations/github-action/action.yml b/integrations/github-action/action.yml index c4dad8a..945a447 100644 --- a/integrations/github-action/action.yml +++ b/integrations/github-action/action.yml @@ -46,7 +46,7 @@ runs: - name: Install signetry-core shell: bash # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source. - run: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0" + run: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0" - name: Stage the PR change as a working-tree diff id: stage diff --git a/pyproject.toml b/pyproject.toml index 3c3783e..f7850dc 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "signetry-core" -version = "0.7.0" +version = "0.8.0" description = "An agent-agnostic change-control plane for coding agents. Governs Codex, Claude Code, Cursor, or any agent behind one admission pipeline and proves every change with a signed receipt." readme = "README.md" requires-python = ">=3.11" diff --git a/signetry_core/mcp_server.py b/signetry_core/mcp_server.py index 86fb652..9ad24ff 100644 --- a/signetry_core/mcp_server.py +++ b/signetry_core/mcp_server.py @@ -7,7 +7,7 @@ receipt; the verdict is produced outside the model. Run it: - pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0" + pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.8.0" python -m signetry_core.mcp_server # stdio transport Register it with an MCP client (e.g. Claude Code) pointing at this command. @@ -106,7 +106,7 @@ def build_server(): # pragma: no cover - exercised only when mcp is installed except ImportError as exc: # noqa: F841 raise SystemExit( "The MCP server needs the optional dependency: pip install " - "'signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0'" + "'signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.8.0'" ) from None mcp = FastMCP("signetry-core") diff --git a/uv.lock b/uv.lock index d3967ef..9abe44b 100644 --- a/uv.lock +++ b/uv.lock @@ -1258,7 +1258,7 @@ wheels = [ [[package]] name = "signetry-core" -version = "0.7.0" +version = "0.8.0" source = { editable = "." } dependencies = [ { name = "cryptography" },