chore(release): cut v0.1.0

.github/workflows/release.yml

@@ -1,6 +1,7 @@
 name: release
 
-# Build and publish a multi-arch pasu-egress image to GHCR on version tags.
+# Build and publish the multi-arch pasu images to GHCR on version tags:
+# pasu-egress (kernel eBPF guard) and pasu-proxy (unprivileged LLM-API guard).
 on:
   push:
     tags: ["v*"]
@@ -11,8 +12,16 @@ permissions:
 
 jobs:
   image:
-    name: ghcr image (amd64 + arm64)
+    name: ghcr ${{ matrix.image }} (amd64 + arm64)
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: pasu-egress
+            dockerfile: deploy/Dockerfile
+          - image: pasu-proxy
+            dockerfile: deploy/proxy/Dockerfile
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-qemu-action@v3
@@ -25,15 +34,15 @@ jobs:
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images: ghcr.io/${{ github.repository_owner }}/pasu-egress
+          images: ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=sha
       - uses: docker/build-push-action@v6
         with:
           context: .
-          file: deploy/Dockerfile
+          file: ${{ matrix.dockerfile }}
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}

CHANGELOG.md

@@ -1,12 +1,16 @@
 # Changelog
 
 All notable changes to pasu are documented here. The format follows
-[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project aims
-for [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once it reaches
-its first tagged release.
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project follows
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.0] - 2026-07-22
+
+First tagged release — the two-layer guard (LLM-API proxy + eBPF kernel egress)
+with policy, HITL UI, audit, containers, and verified deploy paths.
+
 ### Added
 - **Podman deployment notes (verified)** — `docs/deployment.md` documents running
   the eBPF egress guard under Podman (cgroup-v2-native, daemonless), **verified on

crates/pasu-audit/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pasu-audit"
-version = "0.0.0"
+version = "0.1.0"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

crates/pasu-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pasu-core"
-version = "0.0.0"
+version = "0.1.0"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

crates/pasu-rules/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pasu-rules"
-version = "0.0.0"
+version = "0.1.0"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

crates/pasu-ui/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "pasu-ui"
-version = "0.0.0"
+version = "0.1.0"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true