Tags give the ability to mark specific points in history as being important
-
v0.6.1
Release: v0.6.1: a control reporting satisfied over a document saying otherwise83bac1d4 · ·v0.6.1: a control reporting satisfied over a document saying otherwise `container_image_signed` returned satisfied for any non-empty boe/supply-chain/signatures/, and the only file in that directory stated that release images are not yet signed. The control now asserts signature material by file shape, at any depth, and a regression test plants a README-only directory and requires other-than-satisfied. The SBOM check has carried the same guard since its own version of this bug. Downstream: container's SR-4 goes other-than-satisfied on the signature control as well as the provenance one, so the gap its README, its pipeline comment and scenario 07 all advertise now fires. The model declares that half of the gap and its disposition, so the board reports it as a demonstration rather than a defect. The posture mirror: the merge-state column is read from the single merge request, which is what makes GitLab compute it, instead of publishing the `unchecked` placeholder the list endpoint returns. The status-check table speaks GitLab's vocabulary and the control tables speak 800-53A's, each labelled, so a passed check beside an other-than-satisfied control no longer reads as a contradiction. The OSCAL artifacts: the POA&M carries the declared dispositions for the internal controls the line cannot measure, marked as declared and scoped to the projects they are open on, and its metadata states what the document covers. The component-definition is dated by the catalog release it declares rather than by an assessment date that preceded it. Consumers: every catalog station runs the corrected conformance check, so all six components move factory_ref to this tag.
-
v0.6.0
Release: v0.6.0: the generated pages are a header, tables, and legendsf479630c · ·v0.6.0: the generated pages are a header, tables, and legends posture-snapshot.md and control-allocation.md are marked GENERATED and carried an essay around their tables anyway. Each page now opens on what it is, when it regenerates, and one link into the claims ledger, then prints its tables with the legends they need. Nothing load-bearing is orphaned. The twelve-hour internal-control scan moved to scenario 05 beside the external-control ping, so the freshness story reads in one place, and the identifier-versus-mechanism collision joined the two collisions the ledger already names. The counting paragraph's hand-written comparison of the two pages' totals is replaced by the relationship itself, many-to-many, with the numbers left where they are computed. `factory walk` keeps its beat order and its LIVE / PARTIAL / PLANNED badges and loses the prose around them, including three hand-written counts that drift with the asset. Consumers: the six catalog stations render none of this, so their factory_ref stays where it is. gitlab-profile's pull-evidence job is the one pin that moves.
-
v0.5.1
Release: v0.5.1: the test suite cannot reach a live GitLabe7fab137 · ·v0.5.1: the test suite cannot reach a live GitLab conftest scrubs the driver's credential names and refuses outbound TCP for every test. The guard sits at the socket, below respx, so mocked requests still work and anything genuinely leaving the machine fails loudly. CI exports a group-level FACTORY_TOKEN, and v0.5.0's new doctor check had started reading the live catalog from inside two unit tests. The doctor pin chain is now exercised over a mocked catalog rather than a stubbed seam, which corrected the DRIFT message: it names the version the components actually declare instead of repeating the pinned ref.
-
v0.5.0
50ce0b2d · ·v0.5.0: export pull mode, the full pin chain, warn posture `factory export --source pull` manufactures a consumer's OSCAL assessment-results and POA&M from the station reports of its latest pipeline, whatever that pipeline's status. The export station runs in .pipeline-policy-post, which a failed .pipeline-policy-pre stage never reaches, so a red consumer published no evidence at all. Pull output is byte-identical to `--source reports` on identical inputs, which lets the station and the driver write the same committed path. `factory doctor` now asserts the whole pin chain: factory.yaml's catalog_ref, the injected stage file's ref, and every provides.yml version at that ref. Checking only the first two let all six components sit a release behind the plane while doctor reported agreement. Framework display names and OSCAL document titles use a colon in place of an em-dash. The Posture enum's `review` is now `warn`.
-
v0.4.0
5048a9f3 · ·v0.4.0 -- OSCAL export, fixed-version pin discipline, allocate --what-if factory export emits deterministic OSCAL 1.1.3 assessment-results and POA&M documents from the station reports; doctor validates every OSCAL document the group publishes; catalog-guard counts only @<release|SHA> as pinned; absolve is renamed allocate --what-if; provision syncs consumer content through git.
-
v0.2.0
9f8954cc · ·factory 0.2.0 Adds two ways to read a control set: factory allocate who answers for each control on the line a project already runs factory absolve what stops being yours if you adopt a given catalog item Also asserts two pins that had drifted or never existed: the catalog pin must agree between the model and the injected policy content, and every catalog component must install this driver from a released tag rather than main.