docs: 0.1.2 is live on npm — SECURITY.md, CHANGELOG.md, and the published-bytes verification - #37
Merged
Merged
Conversation
Stop your AI coding agent before it touches something it shouldn't. A local guardrail for Claude Code, Cursor, Gemini CLI and more: it blocks out-of-scope writes, .env reads, rm -rf and force pushes, with no API key and zero tokens. It is not a firewall and not a sandbox. It intercepts what an agent DECLARES it is about to do, through that agent's own hook system, and does not sit in the kernel. An adversarial read of the earlier wording found that claim the first thing to attack and the first thing to lose (DECISIONS.md D-095). This is a single-commit history by design. The tool was built over eleven verified phases in a private repository whose commits contain the build machine's absolute paths and internal notes; publishing a rewritten version of that history would leave the original blobs fetchable by SHA. The engineering record it would have carried is published instead as DECISIONS.md and the artifacts under verification/, both of which are checked by scripts/pre-public-scan.sh before every push.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
0.1.2 is published.
npm view usewarden dist-tagsreportslatest: 0.1.2, agreed by the registry JSON.This updates the two documents a user reads when deciding whether to upgrade, now that there is something to upgrade to.
What changed
SECURITY.md— the known-issues table now leads withnpm install usewarden@latestand states that 0.1.2 is live and carries SLSA provenance. It also records that all 55 wrapped forms were re-run on the bytes downloaded from the registry after release, checksum-matched first: 44 of 55 allowed on 0.1.1, 0 of 55 on 0.1.2.CHANGELOG.md— 0.1.2 dated rather than marked unreleased.verification/release-0.1.2/— the full post-release evidence.Verified against the registry, not against HEAD
.github/workflows/release.ymlonrefs/heads/mainfrom source commitd7795f4e77— the merge of #35 — invocation34224649687, the stage run that was approvednpm audit signatures: verified registry signature, verified attestationnpm install usewardeninto an empty project with a brand-new cache → 0.1.2, integrity matching the registry's sha512CHANGELOG.mdbefore releaseusewarden policy --driftruns out of the published tarball and exits 1 when the policy is weakerOne finding worth keeping
The first three clean installs took 0.1.1, with an empty cache, while the registry said
latest: 0.1.2. The cause was this repository's own.npmrc:min-release-age=7refuses any version published less than seven days ago — a deliberate supply-chain defence, doing its job, scoped to anything run inside the repo and to nobody else's machine.Recorded because "npm install gave me the old version" is exactly the shape of a botched publish, and it was not one.
🤖 Generated with Claude Code
https://claude.ai/code/session_01To6RJknDDPxY3nihw4t64k