What's Changed

• fix(ci-templates): default install command to shipper, not shipper-cli by @EffortlessSteven in #151
• docs(readme): rewrite the four user-facing READMEs as a coherent family by @EffortlessSteven in #152
• feat(profile): thread PublishRegime through preflight to publish (#106 PR 1) by @EffortlessSteven in #154
• feat(narrate): live retry countdown in CLI (#103 PR 1) by @EffortlessSteven in #155
• docs: add agents guidance coverage by @EffortlessSteven in #157
• feat(ergonomics): MVP — rich --version, error hints, in-help examples (#108) by @EffortlessSteven in #156
• feat(preflight): --preflight-only flag (#100) by @EffortlessSteven in #153
• docs(agents): sync module guidance files by @EffortlessSteven in #159
• ci(codecov): complete Codecov integration by @EffortlessSteven in #168
• docs(policy): map Rust 1.95 and 0.4.0 quality rollout by @EffortlessSteven in #169
• chore(msrv): probe Rust 1.95 compatibility by @EffortlessSteven in #170
• chore(msrv): raise MSRV 1.92 → 1.95, add rust-toolchain.toml and clippy.toml by @EffortlessSteven in #171
• ci(droid): replace #164 with BYOK-safe Factory Droid rollout by @EffortlessSteven in #172
• ci(droid): allow Dependabot to trigger Droid Auto Review by @EffortlessSteven in #174
• fix(plan,cargo-failure): build publish graph from manifest deps; classify dep-resolution failures as permanent (#173) by @EffortlessSteven in #175
• deps(deps): bump assert_cmd from 2.2.0 to 2.2.2 in the dev-deps group across 1 directory by @dependabot[bot] in #160
• deps(deps): bump serde_with from 3.18.0 to 3.20.0 in the serde group across 1 directory by @dependabot[bot] in #165
• deps(deps): bump clap from 4.6.0 to 4.6.1 by @dependabot[bot] in #162
• deps(deps): bump clap_complete from 4.6.1 to 4.6.4 by @dependabot[bot] in #188
• deps(deps): bump tokio from 1.51.1 to 1.52.3 in the tokio group across 1 directory by @dependabot[bot] in #161
• deps(deps): bump reqwest from 0.13.2 to 0.13.3 by @dependabot[bot] in #167
• ci(deps): bump actions/checkout from 5.0.1 to 6.0.2 by @dependabot[bot] in #185
• docs(policy): clarify non-Rust allowlist rollout status (#201, rollout PR 1/12) by @EffortlessSteven in #213
• chore(policy): add non-Rust policy allowlist ledgers (#202, rollout PR 2/12) by @EffortlessSteven in #214
• chore(policy): receipt high-risk non-Rust surfaces (#203, rollout PR 3/12) by @EffortlessSteven in #215
• feat(xtask): add non-Rust inventory command (#212, rollout PR 4/12) by @EffortlessSteven in #216
• feat(policy): check non-Rust file allowlist (#204, rollout PR 5/12) by @EffortlessSteven in #217
• feat(policy): propose non-Rust allowlist entries (#205, rollout PR 6/12) by @EffortlessSteven in #218
• feat(policy): check generated, executable, and dependency surfaces (#206, rollout PR 7/12) by @EffortlessSteven in #219
• feat(policy): check workflow, process, and network surfaces (#207, rollout PR 8/12) by @EffortlessSteven in #220
• feat(policy): add unified policy-report (#208, rollout PR 9/12) by @EffortlessSteven in #221
• ci(policy): run file policy checks advisory (#209, rollout PR 10/12) by @EffortlessSteven in #222
• ci(policy): require non-Rust file policy allowlist (#210, rollout PR 11/12) by @EffortlessSteven in #223
• ci(policy): require process and network policy receipts (#211, rollout PR 12/12 — FINAL) by @EffortlessSteven in #224
• feat(policy): Clippy lint ledgers + check-lint-policy / check-clippy-exceptions (#179) by @EffortlessSteven in #225
• feat(harden): Rust 1.95 rustc lint floor in workspace.lints.rust (#198) by @EffortlessSteven in #226
• feat(harden): activate Clippy 1.94/1.95 ratchets (#191) by @EffortlessSteven in #227
• feat(harden): AST-based no-panic baseline detector (#187 PR 8a) by @EffortlessSteven in #228
• feat(harden): no-panic check + release CI gate (#187 PR 8b) by @EffortlessSteven in #229
• feat(ci): advisory ripr lane (#182, thin adoption) by @EffortlessSteven in #230
• feat(ci): ripr wrapper --base + policy-report projection (#182 follow-up) by @EffortlessSteven in #231
• feat(ci): repo-scoped ripr badges (#182 PR 2) by @EffortlessSteven in #232
• feat(ci): mutation PR-time lane + mutants-pr wrapper (#182 PR 3) by @EffortlessSteven in #233
• docs(ci): audit and rewrite test-evidence-lanes (#189, docs-first) by @EffortlessSteven in #234
• fix(no-panic): first burn-down — 3 indexing sites in shipper-core (#190) by @EffortlessSteven in #235
• chore: normalize line endings (LF) and add .gitattributes rules by @EffortlessSteven in #236
• test(shipper-registry): stabilize concurrent_*_checks macOS flake by @EffortlessSteven in #237
• chore(release): bump workspace to 0.4.0-rc.1 (#192) by @EffortlessSteven in #238
• docs: define Shipper source-of-truth model by @EffortlessSteven in #239
• docs: add source-of-truth templates by @EffortlessSteven in #240
• docs(proposal): add source-of-truth and release evidence proposal by @EffortlessSteven in #241
• docs(spec): add source-of-truth stack contract by @EffortlessSteven in #242
• docs(status): add support tiers and claim-proof map by @EffortlessSteven in #243
• test: stabilize concurrent registry version check by @EffortlessSteven in #249
• docs(adr): record claims become checkable state by @EffortlessSteven in #244
• plans: add source-of-truth implementation plan and active goal by @EffortlessSteven in #250
• feat(xtask): add advisory doc-contract checker by @EffortlessSteven in #251
• feat(policy): include doc-contracts in policy report by @EffortlessSteven in #252
• ci(policy): run doc-contracts advisory by @EffortlessSteven in #253
• docs(spec): add release readiness proof contract by @EffortlessSteven in #254
• docs(release): add 0.4.0-rc.1 readiness proof by @EffortlessSteven in #255
• docs(proposal): add registry-truth reconciliation proposal by @EffortlessSteven in #256
• docs(spec): add registry reconciliation contract by @EffortlessSteven in #257
• docs(adr): prefer registry truth over cargo output by @EffortlessSteven in #258
• plans(reconcile): add implementation plan and activate goal by @EffortlessSteven in #259
• Refactor runtime option resolution into focused modules by @EffortlessSteven in #245
• Refactor plan builder into focused modules by @EffortlessSteven in #248
• Refactor publish orchestration into SRP helpers by @EffortlessSteven in #247
• feat(xtask): add package surface report by @EffortlessSteven in #260
• chore(policy): sync no-panic baseline after plan split by @EffortlessSteven in #261
• docs(status): promote reconcile proof by @EffortlessSteven in https://github.com/EffortlessMetr...

What's Changed

• docs: align roadmap, add mission/steering docs, Diátaxis reorg, tighten README by @EffortlessSteven in #110
• feat(reconcile): close ambiguous publish outcomes against registry truth (#99) by @EffortlessSteven in #111
• feat(consistency): enforce events-as-truth invariant at end-of-run (#93) by @EffortlessSteven in #112
• feat(narrate): retry visibility — structured events + live CLI narration (#91) by @EffortlessSteven in #113
• feat(dispatch): crates.io-aware backoff for new-crate rate limits (#94) by @EffortlessSteven in #114
• feat(reconcile): resume-path reconciliation for Ambiguous packages (#99 follow-on) by @EffortlessSteven in #115
• feat(preflight): slim workspace-verify event, strip ANSI, write sidecar (#92) by @EffortlessSteven in #116
• docs: demote cargo stdout to hint; registry is authoritative (#99 follow-on) by @EffortlessSteven in #117
• docs: operator-trust pack — not_proven explainer + stalled-run triage + state-files cheat sheet by @EffortlessSteven in #118
• test(reconcile): BDD integration scenarios for ambiguous publish outcomes (#99 follow-on) by @EffortlessSteven in #119
• feat(rehearsal): config + CLI flag plumbing for rehearsal registry (#97 PR 1) by @EffortlessSteven in #120
• feat(recover): synthetic rehearsal test + operator rehearsal playbook (#90) by @EffortlessSteven in #124
• fix(resume): silent-skip event + Failed→Skipped regression test (#125, #126) by @EffortlessSteven in #130
• feat(yank): shipper yank @ (#98 PR 1) by @EffortlessSteven in #121
• feat(rehearse): engine::run_rehearsal + shipper rehearse CLI (#97 PR 2) by @EffortlessSteven in #127
• feat(remediate): plan-yank + compromised-release receipt fields (#98 PR 2) by @EffortlessSteven in #132
• feat(rehearse): hard gate — run_publish requires passing rehearsal (#97 PR 3) by @EffortlessSteven in #133
• feat(remediate): --mark-compromised + shipper fix-forward (#98 PR 3) by @EffortlessSteven in #134
• feat(packaging): unify shipper CLI into the shipper crate (#95) by @EffortlessSteven in #135
• docs: GAPS_CLOSEOUT audit — #90/#97/#98 against main by @EffortlessSteven in #136
• feat(release): Trusted Publishing (OIDC) for crates.io (#96) by @EffortlessSteven in #122
• feat(remediate): plan-yank --starting-crate graph mode (#98 PR 4) by @EffortlessSteven in #138
• feat(rehearse): smoke-install closes #97 Prove tier 2 (#97 PR 4) by @EffortlessSteven in #137
• feat(remediate): shipper yank --plan executes a saved plan (#98 PR 5) by @EffortlessSteven in #139
• feat(packaging): create shipper-core library crate (#95 PR 1) by @EffortlessSteven in #140
• feat(packaging): promote shipper-cli to real library adapter (#95 PR 2) by @EffortlessSteven in #141
• feat(packaging): shrink shipper to install façade (#95 PR 3) by @EffortlessSteven in #142
• docs(packaging): update workspace docs for three-crate split (#95 PR 4) by @EffortlessSteven in #143
• test(reconcile): BDD scenario for Ambiguous → StillUnknown (#99 follow-on) by @EffortlessSteven in #144
• docs(changelog): draft [Unreleased] section for post-rc.1 release cut by @EffortlessSteven in #145
• chore(release): bump workspace to 0.3.0-rc.2 by @EffortlessSteven in #146
• chore(deps): ignore RustCrypto minor bumps until ecosystem stabilizes by @EffortlessSteven in #147
• ci(deps): bump codecov/codecov-action from 5 to 6 by @dependabot[bot] in #39
• ci(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #45
• feat(shipper): gate shipper-cli behind default 'cli' feature by @EffortlessSteven in #149
• ci(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #148
• fix(release): OIDC fallback to token + correct shipper-cli wording by @EffortlessSteven in #150

Full Changelog: v0.3.0-rc.1...v0.3.0-rc.2

What's Changed

• feat: implement shipper - reliable Rust workspace publisher by @EffortlessSteven in #1
• feat: Uploaded resume state + evidence redaction by @EffortlessSteven in #2
• fix: stabilize Uploaded, timeouts, and evidence redaction by @EffortlessSteven in #3
• feat: micro backend modules, new crates, and expanded test coverage by @EffortlessSteven in #4
• ci(deps): bump dtolnay/rust-toolchain from 1.92.0 to 1.100.0 in the actions group by @dependabot[bot] in #5
• chore: normalize repository URLs by @EffortlessSteven in #19
• feat: extract domain logic into focused microcrates by @EffortlessSteven in #21
• deps(deps): bump anyhow from 1.0.101 to 1.0.102 by @dependabot[bot] in #13
• deps(deps): bump clap from 4.5.57 to 4.5.60 by @dependabot[bot] in #14
• ci(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #9
• deps(deps): bump predicates from 3.1.3 to 3.1.4 by @dependabot[bot] in #17
• deps(deps): bump the dev-deps group across 1 directory with 2 updates by @dependabot[bot] in #22
• deps(deps): bump gethostname from 0.5.0 to 1.1.0 by @dependabot[bot] in #15
• deps(deps): bump toml from 0.9.11+spec-1.1.0 to 1.0.3+spec-1.1.0 by @dependabot[bot] in #12
• deps(deps): bump dirs from 5.0.1 to 6.0.0 by @dependabot[bot] in #16
• Release v0.3.0-rc.1 by @EffortlessSteven in #23
• deps(deps): bump chrono to 0.4.44, serde_with to 3.17.0, and indicatif to 0.18.4 by @EffortlessSteven in #28
• ci(deps): bump actions/upload-artifact to v7 and actions/download-artifact to v8 by @EffortlessSteven in #29
• fix: resolve security vulnerabilities and normalize tests for CI by @EffortlessSteven in #44
• decrating: Phase 0 — plan doc + architecture-guard CI by @EffortlessSteven in #48
• decrating: Phase 1 — scaffold ops/ and runtime/ layer dirs by @EffortlessSteven in #49
• decrating: absorb shipper-lock into shipper::ops::lock by @EffortlessSteven in #52
• decrating: absorb shipper-policy into shipper::runtime::policy by @EffortlessSteven in #54
• decrating: absorb shipper-process into shipper::ops::process by @EffortlessSteven in #55
• decrating: absorb shipper-store into shipper::state::store by @EffortlessSteven in #57
• decrating: absorb shipper-config-runtime into shipper-config::runtime by @EffortlessSteven in #58
• decrating: introduce state/ layer; absorb events + state into shipper::state::* by @EffortlessSteven in #60
• decrating: fold in-tree registry logic into shipper-registry crate by @EffortlessSteven in #61
• decrating: consolidated CI + docs stale-reference cleanup by @EffortlessSteven in #62
• ci: fix pre-existing coverage and nextest failures by @EffortlessSteven in #66
• decrating: absorb shipper-auth into shipper::ops::auth (full absorption) by @EffortlessSteven in #63
• decrating: Phase 1 (medium batch) — collapse dual implementations for environment/storage/git by @EffortlessSteven in #53
• decrating: absorb shipper-engine-parallel into shipper::engine::parallel by @EffortlessSteven in #64
• fix(engine/parallel): restore imports after PR #64 absorption drift by @EffortlessSteven in #71
• docs(decrating): add §6.A binding process discipline rules by @EffortlessSteven in #72
• decrating: replay PR #56 (plan+levels+chunking absorption) onto main by @EffortlessSteven in #70
• decrating: absorb shipper-execution-core into shipper::runtime::execution by @EffortlessSteven in #69
• decrating: absorb shipper-environment into shipper::runtime::environment by @EffortlessSteven in #65
• decrating: absorb shipper-progress into shipper-cli::output::progress by @EffortlessSteven in #67
• decrating: SPLIT shipper-storage — types to shipper-types, backend to shipper::ops::storage by @EffortlessSteven in #68
• decrating: physical removal of shipper-events and shipper-state by @EffortlessSteven in #73
• decrating: absorb shipper-cargo into shipper::ops::cargo by @EffortlessSteven in #74
• decrating: absorb shipper-git into shipper::ops::git by @EffortlessSteven in #75
• decrating: Phase 3 — drop micro-all default and delete all micro-* features by @EffortlessSteven in #76
• decrating: Phase 6 — schema vs types audit [FOLD] by @EffortlessSteven in #77
• decrating: Phase 7 — path+version deps + workspace.dependencies + default-members by @EffortlessSteven in #78
• decrating: Phase 8 — package-truth validation + topological publish manifest by @EffortlessSteven in #79
• decrating: dogfood Shipper for the release workflow by @EffortlessSteven in #80
• release: fix rustls-webpki audit blocker by @EffortlessSteven in #81
• ci: stabilize nextest across platforms by @EffortlessSteven in #82
• ci: repair fuzz smoke after decrating absorptions by @EffortlessSteven in #83
• ci: fix broken intra-doc links (Documentation lane) by @EffortlessSteven in #84
• ci: architecture-guard .rs filter + drop stale fuzz target by @EffortlessSteven in #85
• ci: isolate CARGO_HOME in preflight snapshot test by @EffortlessSteven in #86
• ci: include .shipper/ hidden dir in release workflow artifact uploads by @EffortlessSteven in #89
• docs: add operator release runbook by @EffortlessSteven in #88
• ci: reduce PR proptest cost, add Ubuntu-only full-strength crypto lane by @EffortlessSteven in #87

New Contributors

• @dependabot[bot] made their first contribution in #5

Full Changelog: https://github.com/EffortlessMetrics/shipper/commits/v0.3.0-rc.1