v0.0.11

Tapid 0.0.11 release notes

Status: unreleased. These notes describe the planned next release and its checked-in behavior. They do not establish successful public installation, upgrade, website deployment, or registry publication.

Tapid 0.0.11 makes the installers and default upgrade command use the same release record through tapid.dev. It also corrects upgrade output when the installed binary already matches the release or discovery uses recovery data.

Package installation and dependency commands

• Add add, remove, and update, with outdated reporting and atomic managed-tree prune. Dependency lifecycle scripts remain suppressed.
• Support npm aliases in manifest dependencies and package arguments. Preserve the target package identity and local import name during installation and frozen/offline replay.
• Add scoped private npm registry routing and explicit credentials configuration as a development feature.
• Resolve direct-root peer dependencies, preserve peer metadata, and expand npm semver range compatibility.
• Add workspace discovery and local-source lockfile models. Workspace linking and complete npm workspace behavior remain unsupported.
• Harden registry-origin canonicalization, store markers, Windows shim collision checks, and dependency validation before store recovery.

Root-script execution

Linux Restricted execution now uses Landlock and seccomp. Targeted Ubuntu validation and hosted CI cover the implementation; the broader platform probe matrix remains incomplete. macOS retains its experimental Restricted backend. Windows native containment, ManagedTree, and resource-limit profiles remain unsupported. See [platform validation](../platform-validation.md) for evidence and limits.

Installation and upgrades

• Discover the latest release through https://tapid.dev/releases/v1/latest.tsv, with explicit versions available through vVERSION.tsv. GitHub remains the initial archive host; clients follow archive URLs from the record without using its API.
• Validate the record, compressed archive size, SHA-256, and archive contents before staged executable replacement.
• Report an already-up-to-date result and preserve the executable when its bytes already match the verified release.
• Report that the latest release could not be checked when unavailable discovery uses last-known-good recovery. Invalid received metadata and mismatched downloads fail.
• Remove signed endpoint probes and GitHub fallback from default discovery. Explicit --endpoint retains the historical signed protocol. --release-url and TAPID_RELEASE_RECORD_URL select the new record protocol.
• Preserve explicit installation of historical versions through 0.0.10 using their GitHub archives and SHA256SUMS, unless a record override is provided. Released 0.0.10 clients can reach 0.0.11 through their existing GitHub fallback after publication.

Release operation and verification

• Use non-expiring Ed25519 sidecars for immutable release records. Preserve signature, digest, future-creation and rollback checks; reject time-limited sidecars. The legacy --endpoint protocol keeps its expiry rules.
• Install without Python by using the native release verifier. Release CI generates installers with bootstrap archive checksums pinned before any downloaded binary executes.
• Generate tapid-release-v1.tsv and its signed .sig sidecar from the same six archives as SHA256SUMS, and publish both as the eighth and ninth assets in the existing reviewed draft.
• Keep ordinary releases independent of website redeployment. Static owned-domain routes select the provider's latest or versioned record.
• Preserve tagged installer provenance checks and separately test installation through the public website scripts.
• Add previous-version upgrade and repeated-upgrade checks on Linux, macOS, and Windows release runs. Compare resulting binaries with an independently installed latest release and require unchanged bytes on the repeated upgrade. Daily scheduled coverage is Linux only.
• Keep published validation evidence separate from reviewed source expectations. The first release requires the coordinated website cutover described in the [runbook](../release-distribution.md).

Limits

The release record is independently authenticated by its Ed25519 sidecar; HTTPS and SHA-256 still provide transport and byte integrity for the record and archives, not platform code signing or provenance verification. Local rollback state does not resist hostile local modification.

The release adds the Linux Restricted backend and the npm compatibility improvements listed above. It does not establish complete npm compatibility or broader platform acceptance.

Changed package versions

This matrix compares the workspace with the latest published crates.io packages. The remaining six crates retain their published versions. The historical signed-manifest v1 contract remains unchanged.