Versioning and the v0.1 boundary

v0.1 is a historical local product-readiness boundary for the TrustPlane Auth runtime. It records the local v0.1 readiness line; it is not the canonical current artifact matrix and is not a deployment, publication, or operations boundary. For current availability, use Current and future scope and Releases and artifact status. The v0.1 contract gate is make v01-acceptance — it validates the frozen v0.1 local compatibility contract, not the full current release.

A green make v01-acceptance says the local TrustPlane Auth runtime contract is ready for review. It does not authorize release tags, image/package publishing, wiki sync, hosted rollout, or cluster deployment.

Included in v0.1

Local broker over a Unix domain socket
transcript-v1 proof binding
Atomic replay protection on accepted presentations
Route key-binding policy
Bundle freshness evaluation (incl. local fail-closed stale-bundle behavior)
Provenance and context policy hooks
SPIFFE workload source for the documented attested_workload profile
CLI signing via the TrustPlane Auth trustplane CLI
Transcript conformance across checked languages
Audit event schema for v0.1 deny/decision events
A documented non-Kubernetes EC2/JWKS-style software source boundary
make v01-acceptance as the canonical local readiness gate

CLI scope (exactly these)

trustplane gen-key
trustplane issue
trustplane sign
trustplane verify
trustplane bundle build
trustplane bundle merge-source
trustplane bundle remove-source
trustplane bundle sign
trustplane bundle verify
trustplane broker issue
trustplane up
trustplane demo

Outside the v0.1 local boundary

Provider-specific cloud deployment · managed policy distribution · hardware/KMS signer production path · wiki sync · publish automation · release tagging · enroll · onboard · list-keys · blindfold · gateway-call · cloud IID proof flows · managed tenant/provider/principal/policy administration · managed bundle publish/sign/distribute.

Some availability changed after this local readiness boundary. The Go, TypeScript (Node.js-only), and Python SDKs are now released packages for caller-side request signing (pin the exact versions in Install and artifacts). trustplane enroll is available in CLI v0.2.1 and later (current release v0.2.2) for Control Trust Anchor enrollment — see OIDC JWKS enrollment runbook. See Current and future scope for the canonical current status.

The EC2/non-Kubernetes source is `software`, not `attested_workload`

The v0.1 non-Kubernetes JWKS path proves caller support without API keys through software signing policy — but it does not verify cloud instance identity documents, enclave identity, hardware-bound signing, cloud IAM identity, or SPIRE-on-VM SVIDs. Those are not currently supported.

Reviewer checklist (before any later tag/deploy)

make boundaries
scripts/check-boundaries.sh
make transcript-conformance
make v01-acceptance
go test ./internal/... ./pkg/... ./spec ./cmd/... ./examples/...
make test
scripts/public-release-scan.sh
git diff --check

Plus: README, ROADMAP, and docs/auth-plane-parity.md describe v0.1 as local readiness, not deployment readiness; and the diff contains no deploy, release, publish, or wiki work.

Status note (durability)

The v0.1 acceptance artifacts exist and pass: full test suite green, a real acceptance gate, a real release-boundary doc, conformance, and audit schema. One current limitation: CI runs make test + make boundaries but not make v01-acceptance or make transcript-conformance — so the gate is currently manual. Wiring those two into CI is the recommended step to keep v0.1 from silently regressing.