# Changelog

All notable changes to MoonSeal are documented in this file.

## 0.2.1 — 2026-08-10

### Added

- Add a review-ready acceptance checklist with reproducible evidence commands.
- Add dedicated testing, architecture-decision, release, and third-party notices.
- Add GitHub issue forms and a pull request template for future maintenance.
- Record package contents and coverage output as CI artifacts.

### Fixed

- Exclude competition application files and agent metadata from Mooncakes
  publication archives so personal information cannot be published by mistake.
- Upgrade `moonbitlang/async` from 0.20.2 to 0.20.4 for compatibility with the
  current MoonBit and Mooncakes release pipeline.
- Expand README installation, runnable examples, scope, maintenance, and
  acceptance documentation.

## 0.2.0 — 2026-07-30

### Added

- Add JSON repository policies with release gates for score, source size,
  warnings, dependencies, licenses, required files, CI, changelog, security
  policy, and dependency pinning.
- Export SARIF 2.1.0 reports for GitHub Code Scanning and compatible tools.
- Analyze Mooncakes dependency coordinates, semantic versions, duplicates,
  conflicts, namespaces, and reproducibility.
- Compare audit reports and render added, resolved, changed, and unchanged
  findings as text, JSON, or Markdown.
- Generate in-toto Statement v1 documents with SLSA Provenance v1 predicates.
- Add `dependencies` and `policy` CLI commands plus `scan --sarif`.
- Expand the regression suite to 145 MoonBit tests.

### Changed

- Expand SPDX identifiers, exceptions, and license-text detection.
- Add Markdown audit summaries and repository URL validation.
- Document a reproducible MVP and checked-in release policy.

## 0.1.0 — 2026-07-29

### Added

- Parse current `moon.mod` and legacy `moon.mod.json` manifests.
- Discover Mooncakes dependencies and versions.
- Validate common SPDX license identifiers and compound expressions.
- Detect Apache-2.0, MIT, BSD, MPL, GPL, AGPL, and ISC license texts.
- Audit README, LICENSE, repository metadata, CI, changelog, and MoonBit source presence.
- Detect mismatches between declared and detected licenses.
- Generate deterministic CycloneDX 1.6 SBOM documents.
- Produce human-readable and JSON audit reports.
- Provide `scan`, `check`, and `sbom` CLI commands.
- Add unit, integration, and self-scan tests.