Releases
v0.5.0, the first release
commitwork was built in a private repository from 2026-06-24, carrying a version on every commit and cutting no release. The public repository starts with its own root commit rather than that history, and v0.5.0 is the first release tagged on it. This page lists the versions so far and the milestones behind them.
A version on every commit
| Version | From | What it means |
|---|---|---|
0.1.0 | 2026-06-24 | The version package.json carried from the first commit for three months, while the work was not versioned. |
0.1108 | 2026-08-27 | One interim tag, numbered by counting commits, so that the releases feed had an entry. The scheme is retired: the count changes when history is rewritten, and the public repository starts from a new first commit. |
0.1.1 | 2026-09-26 | The first commit to move the patch version. Since then every commit moves it by one, and a minor or major version is set by hand. |
0.1.171 | 2026-10-03 | main today. The release that ends the 0.1 line is 0.2.0, tagged v0.2.0. |
From a local CI runner to 80 checks
The commits that made something possible, grouped into seven periods. Checks is the number in the security baseline’s manifest at that commit. Until 2026-09-26 work also ran on a second machine, whose line merged that day, so a count can fall between one row and the next.
| Date | Version | Checks | What became possible |
|---|---|---|---|
| Local CI runner, from 2026-06-24 | |||
| 2026-06-24 | 0.1.0 | 0 | A repository’s CI runs on the developer’s own machine. |
| 2026-06-24 | 0.1.0 | 5 | scan: a security baseline over many repositories, with reports. |
| The fleet monitor and its surfaces, from 2026-07-06 | |||
| 2026-07-06 | 0.1.0 | 14 | A monitor sweeps repositories on a schedule and rolls up the results. |
| 2026-07-07 | 0.1.0 | 15 | Runtime checks: DAST, TLS, API fuzzing and object-level authorisation. The admin panel shows the monitor live and starts a sweep. |
| 2026-07-18 | 0.1.0 | 22 | A sweep runs every scanner and records which ran. |
| 2026-07-20 | 0.1.0 | 22 | CRA readiness and SOC 2 evidence packets with signed evidence. The MCP server, for agents. |
| Declared areas, issues and its own CI, from 2026-07-26 | |||
| 2026-08-01 | 0.1.0 | 23 | Every repository belongs to a declared area, and commitwork scans itself. |
| 2026-08-02 | 0.1.0 | 28 | An issue tracker that closes an item only on evidence of the fix. |
| 2026-08-03 | 0.1.0 | 31 | A local model can triage a finding. What it says is recorded as evidence, never as a verdict. |
| 2026-08-09 | 0.1.0 | 33 | commitwork’s own GitHub Actions CI. |
| Auditing its own results, from 2026-08-11 | |||
| 2026-08-22 | 0.1.0 | 38 | A severity audit traced most published criticals to one upstream detector defect; such results are now reported apart from findings. |
| 2026-08-23 | 0.1.0 | 43 | A failure taxonomy, with a queryable database and a renderer. |
| 2026-08-25 | 0.1.0 | 52 | A commit can no longer reference a file the commit does not contain. |
| Durable records and safe commits, from 2026-08-27 | |||
| 2026-08-27 | 0.1.0 | 53 | Private records move to a separate private store: the start of the publication boundary. |
| 2026-08-27 | 0.1108 | 54 | The interim tag, and a docsite whose publishing stays a person’s act. |
| 2026-08-30 | 0.1.0 | 56 | Commits land through a per-session index and a compare-and-swap, so concurrent sessions cannot take each other’s work. |
| 2026-09-01 | 0.1.0 | 63 | Scan canaries: a clean and a dirty fixture each sweep, so a silent lane is told from a clean one. |
| 2026-09-04 | 0.1.0 | 68 | A Windows CI job, and a symbol graph of commitwork’s own modules built by two independent extractors. |
| The publication boundary and new lanes, from 2026-09-07 | |||
| 2026-09-09 | 0.1.0 | 68 | The publication boundary written down: the public repository starts from a reviewed snapshot. |
| 2026-09-15 | 0.1.0 | 70 | Lanes for what agents read and run: instruction files, agent configuration, model artefacts and commit provenance. |
| 2026-09-18 | 0.1.0 | 79 | Three optional COBOL lanes from cobolwork, which record a skip when it is not installed. |
| Versions, pins and fixtures, from 2026-09-23 | |||
| 2026-09-25 | 0.1.0 | 69 | Remediation for cobolwork findings: a local model drafts an edit, and cobolwork gate checks it. |
| 2026-09-26 | 0.1.1 | 79 | Every commit moves the patch version. |
| 2026-09-27 | 0.1.51 | 79 | cobolwork installed from the release commitwork pins, checked against its sha256. |
| 2026-09-30 | 0.1.152 | 80 | A lane fixture is accepted only when the lane’s parser counts the real tool’s output. |
| 2026-10-03 | 0.1.167 | 80 | A daily remediation report for each complete sweep. |
Commits, checks and tests over time
| Month | Commits | Checks at its end |
|---|---|---|
| June 2026 | 3 | 5 |
| July 2026 | 142 | 23 |
| August 2026 | 1,178 | 56 |
| September 2026 | 1,007 | 80 |
| October 1–3 | 27 | 80 |
| Date | Tests | Recorded by |
|---|---|---|
| 2026-08-03 | 1,297 | a commit message |
| 2026-08-19 | 2,427 | a commit message |
| 2026-08-29 | 5,790 | a commit message, 9 failing |
| 2026-09-26 | 9,898 | a commit message, on a checkout with no private records |
| 2026-10-03 | 11,232 | CI, 2 failing |
Lanes measured against a golden fixture: 10 of 71 on 2026-09-30, 53 of 71 on 2026-10-03. Figures are from commitwork's git history and its check manifest at each date, and from its CI.