nativesoul 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -15,6 +15,24 @@ product after ADR-045; there is no Free/Pro split.
 ### Product
 - _Nothing yet._
 
+## [0.1.1] — 2026-07-01
+
+### Product
+- EPIC-021 Work items/board is complete: migration 6, local work item status
+  machine, `nativesoul work` CLI, `life_work_item_*` MCP tools, audit timeline,
+  forward `metadata.run_id`, and reverse `runs.evidence_json.work_item_id`
+  linkage.
+- EPIC-022 started with dashboard schema v2 and static viewer expansion:
+  read-only `work`, `approvals`, and `cost` sections plus Work Board, Pending
+  Approvals, honest Cost cards, and `dashboard data --section work|approvals|cost`
+  with graceful degradation and no server.
+- EPIC-023 started with host-reported-only `RunCost` capture: optional heartbeat
+  cost metadata is redacted, normalized, stored in existing `runs.cost_json`, and
+  estimated/malformed values are treated as not reported.
+
+### Quality
+- Test suite at release: 381 tests across 50 files.
+
 ## [0.1.0] — 2026-06-23
 
 Initial pre-1.0 (`@beta`) baseline. Local-first continuity layer for coding
@@ -35,8 +53,9 @@ telemetry, never copies credentials.
 - Approval gate: approval domain, CLI, MCP tools, standing-order auto-approval,
   and audit events while preserving side-effect-free policy evaluation.
   (EPIC-020 Done.)
-- Closed npm distribution remains in launch prep under EPIC-024; this beta
-  package uses minified runtime entrypoints and release audit/provenance gates.
+- Closed npm distribution is live: private source repo, minified npm artifact,
+  boot gate, release audit/provenance gates, and `nativesoul@0.1.0` published
+  to npm (`beta` and npm-created `latest` dist-tags).
 
 <!-- Version links omitted intentionally: NativeSoul is proprietary and closed
      (ADR-045), not a public OSS repo — compare/release URLs would not resolve for

package/README.md

@@ -59,7 +59,7 @@ It runs entirely on your machine (`~/.nativesoul/`), keeps **no background proce
 
 ## Quick Start
 
-> **Note on distribution.** NativeSoul is a proprietary, **closed** package (minified `dist/`, private repo) published to npm as a **paid** product. The public `npm publish` is pending, so today you install via the **host prompt** (recommended) or a **local tarball** (for testing). `npm install -g nativesoul` will be the path once published — usage requires an activated license (`nativesoul license activate <key>`).
+> **Note on distribution.** NativeSoul is a proprietary, **closed** package (minified `dist/`, private repo) published to npm as a **paid** product. Install the beta with `npm install -g nativesoul@beta` (currently `0.1.0`). Usage requires an activated license (`nativesoul license activate <key>`).
 
 ### Option A — Host-first install (recommended)
 
@@ -342,7 +342,7 @@ npm test            # build + non-e2e suite
 npm run test:e2e
 ```
 
-Release gates (no real publish, tokens, or signing keys):
+Release gates (tokens and signing keys stay outside the repo):
 
 ```sh
 npm run package:local            # local tarball + provenance manifest
@@ -351,7 +351,7 @@ npm run release:security:audit   # lint + typecheck + policy + tests + build + s
 npm run release:provenance:dry-run
 ```
 
-`npm publish` remains blocked until package visibility and npm authentication are explicitly approved (handled by @devops; see [`docs/guides/npm-beta-release-rollback.md`](docs/guides/npm-beta-release-rollback.md)). The security audit does not read npm tokens, sign with real keys, or claim public SLSA/registry attestation.
+`nativesoul@0.1.0` has been published to npm. Future publish/dist-tag operations remain @devops-only (see [`docs/guides/npm-beta-release-rollback.md`](docs/guides/npm-beta-release-rollback.md)). The security audit does not read npm tokens, sign with real keys, or claim public SLSA/registry attestation.
 
 ---