From 6d175c7bf9a4b1a47eef4ebcc298ab9477459bc5 Mon Sep 17 00:00:00 2001 From: Aaron Stannard Date: Sun, 9 Aug 2026 09:15:04 +0000 Subject: [PATCH] Prepare 0.3.0-alpha.2 release --- Directory.Build.props | 2 +- IMPLEMENTATION_PLAN.md | 4 ++++ RELEASE_NOTES.md | 28 ++++++++++++++++++++++++++++ 3 files changed, 33 insertions(+), 1 deletion(-) diff --git a/Directory.Build.props b/Directory.Build.props index d47a3e0..5cade44 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -8,7 +8,7 @@ enable true 0.3.0 - alpha.1 + alpha.2 diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md index 46e0cba..a9aa1d3 100644 --- a/IMPLEMENTATION_PLAN.md +++ b/IMPLEMENTATION_PLAN.md @@ -528,6 +528,10 @@ priorities. Linux and Windows PR validation passed. It carries the bounded Bash heredoc, command-resolution mutation, and here-string slices merged after the first alpha without changing the public API. +- [ ] Publish `0.3.0-alpha.2` for the Netclaw PowerShell policy matrix after + Linux and Windows validate the reviewed proved-data receiver slice. The + package must include exact module-qualified-looking alias and canonical + alias-target shadowing defenses without changing the public API. - [x] Replace the pre-alpha consumer preview with the v0.3 occurrence-based authorization loop and separate syntax-display guidance. Document exact, finite, pattern, unknown, joined-cwd, redirect, incomplete-result, diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index b00746f..f7525d8 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -12,6 +12,34 @@ results require a consumer-owned, versioned DTO or explicit serializer mapping that fails closed on unknown node and enum values. +#### 0.3.0-alpha.2 2026-08-09 #### + +This prerelease completes the stable-v0.3 boundary between PowerShell script +blocks proved to be data and blocks that may execute. It does not change the +public v0.3 API surface, and the conservative v0.2 projection remains +available. + +## Added + +- Keep script blocks passed to a proved `Write-Output` receiver opaque under a + constrained PowerShell baseline instead of inventing nested command + occurrences. +- Preserve unknown script-block receivers as visible, incomplete execution + regions, and expose proved local `Invoke-Command` bodies as synchronous + command occurrences. + +## Security and compatibility + +- Require bounded command-resolution proof before classifying a script block as + data. Default runspace state remains conservative. +- Track exact command mutations through authored and canonical alias identities. + This prevents exact module-qualified-looking aliases and `echo` alias chains + from hiding an executable script block. +- Preserve unrelated-name precision and reset runspace-local mutations at fresh + parallel child-runspace boundaries without clearing process-wide uncertainty. +- Expand the generated PowerShell corpus to 422 entries, all validated against + the live PowerShell parser and the PII audit. + #### 0.3.0-alpha.1 2026-08-09 #### This prerelease refreshes the Netclaw validation package with the Bash