chore(release): prepare GhostAPI 0.2.0

.github/release-signers

@@ -0,0 +1 @@
+ilyaantonievich@gmail.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKahT4jyO69Vc8ZAAplYvbOTFNSl01ioCBAobQnMQ11t

.github/workflows/ghostapi-pr-safety.yml

@@ -11,7 +11,7 @@ on:
 permissions: {}
 
 env:
-  GHOSTAPI_VERSION: "0.1.8"
+  GHOSTAPI_VERSION: "0.2.0"
 
 jobs:
   safety:

.github/workflows/release.yml

@@ -24,6 +24,8 @@ jobs:
           node-version: 24
           cache: npm
           registry-url: https://registry.npmjs.org
+      - name: Configure release tag verification
+        run: git config gpg.ssh.allowedSignersFile "$GITHUB_WORKSPACE/.github/release-signers"
       - run: node scripts/release-verify.mjs "$GITHUB_REF_NAME"
       - run: npm ci
       - run: npm run lint
@@ -56,4 +58,5 @@ jobs:
         run: |
           tarball="$(find release -maxdepth 1 -name '*.tgz' -type f -print -quit)"
           test -n "$tarball"
-          gh release create "$GITHUB_REF_NAME" "$tarball" release/SHA256SUMS release/sbom.cdx.json --verify-tag --generate-notes
+          release_version="${GITHUB_REF_NAME#v}"
+          gh release create "$GITHUB_REF_NAME" "$tarball" release/SHA256SUMS release/sbom.cdx.json --verify-tag --title "GhostAPI $release_version: Local SDK Compatibility and Release Evidence" --generate-notes

CHANGELOG.md

@@ -6,6 +6,8 @@ The format follows the spirit of [Keep a Changelog](https://keepachangelog.com/e
 
 ## Unreleased
 
+## 0.2.0 - 2026-09-01
+
 ### Security
 
 - Corrected evidence semantics so unmeasured production-egress attempt counts are reported as `not measured` instead of a fabricated zero.
@@ -18,6 +20,7 @@ The format follows the spirit of [Keep a Changelog](https://keepachangelog.com/e
 
 - Repositioned GhostAPI as an AI-assisted local API simulation experiment with explicit non-goals and no customer-validation claims.
 - Added project provenance, contribution authorship guidance, full-tree formatting, and type-aware ESLint parsing.
+- Corrected 36 pre-0.2 Git author and committer identities from an accidental local tool identity to the contributing maintainer while preserving file trees, messages, and dates.
 - Removed fundraising, commercial, design-partner, community-operations, and enterprise-roadmap material from the public tree and npm package.
 - Added a release workflow for signed annotated tags, exact-tarball smoke testing, checksums, SBOM generation, build attestations, npm provenance, and post-publish `gitHead` verification.
 - Centered the README hero and dashboard product identity, and added responsive navigation and request/detail layouts for mobile screens.

PROVENANCE.md

@@ -4,8 +4,10 @@ GhostAPI is maintained by Yiaany.
 
 AI-assisted development tools, including OpenCode, were used for code generation, review, test generation, documentation drafting, and refactoring. The maintainer selected the architecture, defined product and security boundaries, reviewed and modified generated changes, ran verification, and accepts responsibility for the published code.
 
-Commits authored as `OpenCode <opencode@localhost>` represent AI-assisted working sessions, not an independent human contributor. No claim is made that every line was typed manually.
+AI assistance does not imply independent authorship. No claim is made that every line was typed manually.
 
 Security-sensitive changes require maintainer review, tests, and release evidence from the exact published commit.
 
-Published history is not rewritten to obscure prior AI-assisted authorship. New changes should use a human author and may include an `Assisted-by: OpenCode` trailer when the assistance was substantial.
+On September 1, 2026, the pre-0.2 history was rewritten to correct 36 commits accidentally recorded under the local `OpenCode <opencode@localhost>` identity to `hizyyo <kapolol2266@gmail.com>`. The reviewed replacement preserved every file tree, commit message, author date, and committer date; PR #20 records the validation and application procedure. This metadata correction does not remove this disclosure of AI-assisted development.
+
+New changes should use a human author and may include an `Assisted-by: OpenCode` trailer when the assistance was substantial.

README.md

@@ -177,7 +177,7 @@ Generic MCP configuration:
   "mcpServers": {
     "ghostapi": {
       "command": "npx",
-      "args": ["-y", "@yiaany/ghostapi@0.1.9", "mcp"]
+      "args": ["-y", "@yiaany/ghostapi@0.2.0", "mcp"]
     }
   }
 }

docs/ci.md

@@ -12,7 +12,7 @@ Set `GHOSTAPI_DATA_DIR` to an ephemeral CI directory and use one immutable Ghost
 set -u
 
 export GHOSTAPI_DATA_DIR="$CI_WORKSPACE/.ghostapi-ci"
-export GHOSTAPI_VERSION="0.1.8"
+export GHOSTAPI_VERSION="0.2.0"
 npm install --global "@yiaany/ghostapi@$GHOSTAPI_VERSION"
 
 run_status=0

docs/github-actions.md

@@ -6,7 +6,7 @@ The repository workflow at [`.github/workflows/ghostapi-pr-safety.yml`](../.gith
 
 ```yaml
 env:
-  GHOSTAPI_VERSION: "0.1.8"
+  GHOSTAPI_VERSION: "0.2.0"
 
 - name: Install pinned GhostAPI
   run: npm install --global "@yiaany/ghostapi@$GHOSTAPI_VERSION"

docs/mcp.md

@@ -15,7 +15,7 @@ npx @yiaany/ghostapi mcp
   "mcpServers": {
     "ghostapi": {
       "command": "npx",
-      "args": ["-y", "@yiaany/ghostapi@0.1.9", "mcp"]
+      "args": ["-y", "@yiaany/ghostapi@0.2.0", "mcp"]
     }
   }
 }

docs/releases/README.md

@@ -10,4 +10,4 @@ For each release, verify:
 - the tarball has a GitHub build-provenance attestation;
 - npm shows provenance and its `gitHead` matches the tagged commit.
 
-Historical `0.1.x` artifacts may not satisfy this complete chain. Do not rewrite their Git history. The first release intended to use the complete workflow is `v0.2.0`.
+Historical `0.1.x` artifacts may not satisfy this complete chain and retain their immutable original npm `gitHead` metadata. A reviewed metadata-only history correction was applied before `v0.2.0`; PR #20 records the unchanged trees, messages, and dates. The first release intended to use the complete workflow is `v0.2.0`.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yiaany/ghostapi",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "description": "Local API simulation and test evidence for AI-assisted development.",
   "type": "module",
   "repository": {

test/githubWorkflow.test.ts

@@ -29,7 +29,7 @@ describe("GhostAPI PR safety workflow", () => {
   it("uses immutable actions, enforced execution, sanitized evidence, and safe comment boundaries", async () => {
     const workflow = await readWorkflow(workflowPath);
 
-    expect(workflow).toContain('GHOSTAPI_VERSION: "0.1.8"');
+    expect(workflow).toContain('GHOSTAPI_VERSION: "0.2.0"');
     expect(workflow).toContain(
       "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683",
     );

test/setupGenerator.test.ts

@@ -56,7 +56,7 @@ describe("repo setup generator", () => {
     ).toContain('"command": "npx"');
     expect(
       setup.files.find((file) => file.path === ".cursor/mcp.json")?.content,
-    ).toContain('"@yiaany/ghostapi@0.1.8"');
+    ).toContain('"@yiaany/ghostapi@0.2.0"');
     expect(
       setup.files.find((file) => file.path === "AGENTS.md")?.content,
     ).toContain("do not run it manually in a terminal");