feat: ship ContextFence 0.2.0

.github/FUNDING.yml

@@ -1,2 +1,2 @@
 custom:
-  - https://www.devector.io/contact
+  - https://devectorio.github.io/contextfence/#assessment

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -14,7 +14,7 @@ body:
     attributes:
       label: ContextFence version
       description: Run `contextfence --version`, or provide the commit SHA.
-      placeholder: 0.1.0
+      placeholder: 0.2.0
     validations:
       required: true
 

.github/workflows/release.yml

@@ -58,6 +58,18 @@ jobs:
             sha256sum "$filename" > "$filename.sha256"
           )
 
+      - name: Stage reviewed release notes
+        env:
+          RELEASE_VERSION: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          notes="docs/releases/${RELEASE_VERSION}.md"
+          [[ -f "$notes" ]] || {
+            echo "::error::Missing reviewed release notes: $notes"
+            exit 1
+          }
+          cp "$notes" release/RELEASE_NOTES.md
+
       - name: Smoke-test the packed CLI
         shell: bash
         run: |
@@ -78,6 +90,7 @@ jobs:
           path: |
             release/*.tgz
             release/*.sha256
+            release/RELEASE_NOTES.md
           if-no-files-found: error
           retention-days: 7
 
@@ -150,11 +163,12 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           TARBALL: ${{ steps.candidate.outputs.tarball }}
           CHECKSUM: ${{ steps.candidate.outputs.checksum }}
+          NOTES: release/RELEASE_NOTES.md
         run: >-
           gh release create "${{ github.ref_name }}"
           "$TARBALL"
           "$CHECKSUM"
-          --generate-notes
+          --notes-file "$NOTES"
           --title "ContextFence ${{ github.ref_name }}"
           --verify-tag
           --repo "${{ github.repository }}"

CHANGELOG.md

@@ -6,10 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-07-18
+
 ### Added
 
 - Declarative `matrix` block that expands an authorization model (identities, sources, per-source `allow` lists, and canaries) into the full identity × source grid of deterministic probes: a critical deny probe for every unauthorized identity and a positive control for every authorized one. Generated probes compile down to ordinary v1 probes and report against their source line. Includes `examples/contracts/matrix.boundary.yaml` and `examples/contracts/matrix-leak.boundary.yaml`.
 - `contextfence generate` command that turns a connector-neutral access manifest (identities, sources, and per-source `allow` lists) into a matrix boundary contract, deriving probe keys and canaries deterministically and emitting environment placeholders for target and identity credentials. Includes `examples/manifests/northstar-access.yaml`.
+- A clearer interactive lab path: one cache-isolation failure by default, scroll-to-result behavior, published npm and GitHub Action quick starts, and an explicit Boundary Baseline implementation offering.
+- `CITATION.cff`, a sitemap, and expanded social metadata for discovery and research use.
+
+### Changed
+
+- The package homepage now leads to the Devector ContextFence product page; funding links lead to the public assessment scope rather than a generic contact endpoint.
 
 ## [0.1.0] - 2026-07-11
 
@@ -33,5 +41,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - Machine-readable reports minimize request headers and support safe, synthetic reproduction workflows.
 - Release automation uses short-lived OIDC credentials instead of a long-lived npm publishing token after the one-time package bootstrap.
 
-[Unreleased]: https://github.com/devectorio/contextfence/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/devectorio/contextfence/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/devectorio/contextfence/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/devectorio/contextfence/releases/tag/v0.1.0

CITATION.cff

@@ -0,0 +1,11 @@
+cff-version: 1.2.0
+message: "If ContextFence supports your work, please cite this software."
+type: software
+title: "ContextFence"
+version: 0.2.0
+date-released: 2026-07-18
+authors:
+  - name: "Devector Consulting Ltd"
+repository-code: "https://github.com/devectorio/contextfence"
+url: "https://www.devector.io/labs/contextfence"
+license: Apache-2.0

README.md

@@ -6,7 +6,7 @@ ContextFence is an open-source regression harness for proving that people, teams
 
 Write an identity boundary as YAML, run it against an OpenAI-compatible RAG endpoint, and fail CI when a response or citation crosses the line. ContextFence uses deterministic assertions over observable content and source IDs; it does not ask one model to judge another model's safety.
 
-[Try the synthetic regression lab](https://devectorio.github.io/contextfence/) · [Read the Action guide](https://github.com/devectorio/contextfence/blob/main/docs/github-action.md) · [Explore the architecture](https://github.com/devectorio/contextfence/blob/main/docs/architecture.md)
+[Try the synthetic regression lab](https://devectorio.github.io/contextfence/) · [Read the Action guide](https://github.com/devectorio/contextfence/blob/main/docs/github-action.md) · [Scope a Boundary Baseline](https://github.com/devectorio/contextfence/blob/main/docs/boundary-baseline.md) · [Explore the architecture](https://github.com/devectorio/contextfence/blob/main/docs/architecture.md)
 
 ![ContextFence — prove restricted context stays restricted](https://devectorio.github.io/contextfence/og.svg)
 
@@ -25,7 +25,7 @@ A final answer can look correctly redacted after the system has already crossed
 
 These failures span identity, ingestion, retrieval, ranking, caching, citations, and generation. Unit-testing any single layer is not enough. ContextFence makes the end-to-end boundary reviewable, repeatable, and portable across CI, scheduled staging checks, and incident reproduction.
 
-## What is in v0.1.0
+## What is in v0.2.0
 
 | Capability | Status |
 | --- | --- |
@@ -38,13 +38,13 @@ These failures span identity, ingestion, retrieval, ranking, caching, citations,
 | OpenAI-compatible black-box target adapter | Shipped |
 | Pretty, JSON, JUnit, SARIF, and portable HTML reports | Shipped |
 | Severity thresholds, bounded concurrency, aggregate probe timeouts, and explicit exit codes | Shipped |
-| Reusable exact-version GitHub Action (`devectorio/contextfence@v0.1.0`) | Shipped |
+| Reusable exact-version GitHub Action (`devectorio/contextfence@v0.2.0`) | Shipped |
 | Interactive vulnerable/remediated browser lab | Shipped |
 | Non-root production container and GitHub Pages deployment | Shipped |
 | Framework-specific evidence adapters and connector fixtures | Roadmap |
 | Hosted scheduling, history, alerts, and private control plane | Commercial direction |
 
-The `contextfence` package is published on npm, the `devectorio/contextfence@v0.1.0` Action resolves against the `v0.1.0` tag, and the demo container is on GHCR. ContextFence is an early release: the v1 contract is versioned, but backward-compatibility guarantees will firm up before `1.0.0`. The [release runbook](https://github.com/devectorio/contextfence/blob/main/docs/releasing.md) records how releases are built and attested.
+The `contextfence` package is published on npm, the `devectorio/contextfence@v0.2.0` Action resolves against the `v0.2.0` tag, and the demo container is on GHCR. ContextFence is an early release: the v1 contract is versioned, but backward-compatibility guarantees will firm up before `1.0.0`. The [release runbook](https://github.com/devectorio/contextfence/blob/main/docs/releasing.md) records how releases are built and attested.
 
 ## Quick start
 
@@ -53,17 +53,17 @@ Requirements: Node.js 22.14 or newer.
 Install the CLI, fetch the network-free example suite, and run it:
 
 ```bash
-npm install -g contextfence@0.1.0
+npm install -g contextfence@0.2.0
 contextfence --version
 
-curl -fsSLO https://raw.githubusercontent.com/devectorio/contextfence/v0.1.0/examples/contracts/mock.boundary.yaml
+curl -fsSLO https://raw.githubusercontent.com/devectorio/contextfence/v0.2.0/examples/contracts/mock.boundary.yaml
 contextfence test mock.boundary.yaml
 ```
 
 The intentionally vulnerable cache-replay example shows a real failing report:
 
 ```bash
-curl -fsSLO https://raw.githubusercontent.com/devectorio/contextfence/v0.1.0/examples/contracts/vulnerable-cache.boundary.yaml
+curl -fsSLO https://raw.githubusercontent.com/devectorio/contextfence/v0.2.0/examples/contracts/vulnerable-cache.boundary.yaml
 contextfence test vulnerable-cache.boundary.yaml
 # exits 1 after reporting critical boundary violations
 ```
@@ -239,10 +239,12 @@ contextfence generate <access-manifest.yaml> [options]
 ```
 
 ```bash
-contextfence generate examples/manifests/northstar-access.yaml --output boundary.yaml
+curl -fsSLO https://raw.githubusercontent.com/devectorio/contextfence/v0.2.0/examples/manifests/northstar-access.yaml
+contextfence generate northstar-access.yaml --adapter mock --output boundary.yaml
+contextfence test boundary.yaml --dry-run
 ```
 
-A manifest lists identities and, for each source, an `allow` list of the identities permitted to see it. Probe keys and canaries are derived deterministically when omitted, and the generated contract emits environment placeholders for target and identity credentials so no secret is written to disk. The output is an ordinary boundary contract—review it, seed each canary into a disposable test index, then run it with `contextfence test`. Live connector imports remain a commercial concern, but the manifest they would produce is a stable, portable seam.
+A manifest lists identities and, for each source, an `allow` list of the identities permitted to see it. Probe keys and canaries are derived deterministically when omitted, and the generated contract emits environment placeholders for target and identity credentials so no secret is written to disk. The command above uses `--adapter mock` so a global install can validate the generated contract without a live target. Change the adapter, add target settings, seed each canary into a disposable test index, and review the result before a live `contextfence test`. Live connector imports remain a commercial concern, but the manifest they would produce is a stable, portable seam.
 
 ## GitHub Actions
 
@@ -254,10 +256,10 @@ permissions:
 
 steps:
   - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-  - uses: devectorio/contextfence@v0.1.0
+  - uses: devectorio/contextfence@v0.2.0
     with:
       contract: examples/contracts/mock.boundary.yaml
-      version: 0.1.0
+      version: 0.2.0
       format: json
       output: reports/contextfence.json
 ```
@@ -294,7 +296,7 @@ Open [http://localhost:5173](http://localhost:5173).
 The demo builds as a non-root static container on port `8080` and versioned images are published to GHCR:
 
 ```bash
-docker run --rm --read-only --tmpfs /tmp -p 8080:8080 ghcr.io/devectorio/contextfence:0.1.0
+docker run --rm --read-only --tmpfs /tmp -p 8080:8080 ghcr.io/devectorio/contextfence:0.2.0
 ```
 
 To build the exact source locally instead:
@@ -361,7 +363,7 @@ A sustainable paid layer can coordinate the enterprise work around that open cor
 | Repository workflow | Slack/Teams alerts, SSO/SCIM, approvals, and private runners |
 | Public examples and docs | Support, implementation help, and managed upgrades |
 
-[Devector](https://www.devector.io/) can also deliver fixed-scope RAG boundary assessments using the same public contract format: map identities and sources, seed synthetic canaries, reproduce failures, verify remediation, and leave the customer with executable regression coverage.
+[Devector](https://www.devector.io/) can also deliver a fixed-scope [ContextFence Boundary Baseline](https://github.com/devectorio/contextfence/blob/main/docs/boundary-baseline.md) using the same public contract format: map identities and sources, seed synthetic canaries, reproduce failures, verify remediation, and leave the customer with executable regression coverage.
 
 That creates three complementary routes to revenue—hosted developer tooling, enterprise control plane, and expert assessments—without withholding the useful local core.
 

SUPPORT.md

@@ -2,7 +2,7 @@
 
 ## Community support
 
-Use the repository issue forms for reproducible bugs, feature proposals, and new synthetic threat fixtures. Include the ContextFence version, operating system, Node.js version, a minimal redacted contract, the command you ran, and the observed exit code.
+Use GitHub Discussions for questions, implementation patterns, and early design ideas. Use the repository issue forms for reproducible bugs, feature proposals, and new synthetic threat fixtures. Include the ContextFence version, operating system, Node.js version, a minimal redacted contract, the command you ran, and the observed exit code.
 
 Do not attach live credentials, confidential prompts, raw target responses, or sensitive reports. Report suspected vulnerabilities privately through the process in [SECURITY.md](SECURITY.md).
 

action.yml

@@ -46,7 +46,7 @@ inputs:
   version:
     description: Exact ContextFence npm package version to execute.
     required: false
-    default: 0.1.0
+    default: 0.2.0
 
 outputs:
   report:

docs/architecture.md

@@ -21,7 +21,7 @@ flowchart LR
     Simulator[Synthetic UI simulator] --> Lab[Interactive regression lab]
 ```
 
-The CLI and interactive lab share a problem domain, but they have different execution paths in `v0.1.0`:
+The CLI and interactive lab share a problem domain, but they have different execution paths in the current release:
 
 - The CLI loads YAML contracts and invokes mock or OpenAI-compatible targets.
 - The browser lab runs typed, deterministic scenarios entirely in the client. It does not receive target credentials and does not call the CLI.
@@ -143,7 +143,7 @@ secret store -> process environment -> contract interpolation -> request headers
 target response -> normalized evidence -> findings -> selected reporter -> artifact retention
 ```
 
-ContextFence does not persist a central run database in `v0.1.0`. The chosen output file and CI logs are the durable artifacts. The open-source CLI does not need a hosted ContextFence account.
+ContextFence does not persist a central run database. The chosen output file and CI logs are the durable artifacts. The open-source CLI does not need a hosted ContextFence account.
 
 Known configured credentials are redacted, but arbitrary secrets returned by the target cannot be identified reliably. Use synthetic canaries, not real secrets, and configure CI artifact retention deliberately.
 

docs/boundary-baseline.md

@@ -0,0 +1,34 @@
+# ContextFence Boundary Baseline
+
+The ContextFence CLI remains Apache-2.0 open source. A **ContextFence Boundary Baseline** is optional fixed-scope implementation help for teams that need to turn a real RAG permission model into an executable release control.
+
+## Outcome
+
+In one to two weeks, the engagement turns the boundaries that matter most into a small, reviewable CI suite. The team keeps the contracts, canaries, reports, and workflow after the engagement ends.
+
+## Typical scope
+
+1. Map the testable identity × source boundaries, high-risk access changes, and the retrieval/citation evidence the target exposes.
+2. Create disposable identities and synthetic canaries; no production credentials or customer content are needed for the initial work.
+3. Build an initial 20–40 deterministic allow and deny checks using the public ContextFence contract format.
+4. Reproduce the relevant cache, ACL, retrieval, chunking, or citation failure modes in a safe environment.
+5. Add a reviewed CI or scheduled staging gate and hand over JSON, JUnit, SARIF, or HTML evidence.
+6. Run a remediation and handover session with the engineers responsible for the target.
+
+## Deliverables
+
+- an identity × source boundary map;
+- a versioned ContextFence contract and synthetic fixture/canary plan;
+- a CI pull request or equivalent runner configuration;
+- an evidence-backed findings and remediation summary; and
+- an engineer walkthrough for extending the suite as identities and sources change.
+
+The work is a test and implementation engagement, not a security certification, penetration-test authorization, or guarantee that every access path is safe. Live checks are run only against systems the customer owns or is explicitly authorized to test.
+
+## Hosted design partners
+
+Run history, private runners, connector workflows, evidence retention, alerts, and enterprise identity controls are a future hosted direction. There is no hosted ContextFence control plane being sold as available today. Teams that can help shape that direction may discuss a design-partner engagement.
+
+## Enquire safely
+
+Use the [Devector contact form](https://www.devector.io/contact) or email [dev@devector.io](mailto:dev@devector.io?subject=ContextFence%20Boundary%20Baseline). Describe the target architecture and source systems at a high level; do not send credentials, confidential prompts, raw target responses, or customer data through an enquiry form.

docs/deployment.md

@@ -41,21 +41,14 @@ docker build \
   -t contextfence:subpath .
 ```
 
-The GHCR workflow is configured to publish multi-architecture images from `main` and semantic-version tags. The first versioned image does not exist until the npm bootstrap and `v0.1.0` tag are complete; build from source in the meantime:
+The GHCR workflow publishes multi-architecture images from `main` and semantic-version tags. Prefer an immutable versioned image rather than `main`:
 
 ```bash
-docker build -t contextfence:local .
-docker run --rm -p 8080:8080 contextfence:local
-```
-
-After the first release, consume a versioned image rather than `main`:
-
-```bash
-docker pull ghcr.io/devectorio/contextfence:0.1.0
-docker run --rm -p 8080:8080 ghcr.io/devectorio/contextfence:0.1.0
+docker pull ghcr.io/devectorio/contextfence:0.2.0
+docker run --rm -p 8080:8080 ghcr.io/devectorio/contextfence:0.2.0
 ```
 
-GHCR packages are private on first creation in some repository configurations. Make the package public after the first successful push and link it to the repository.
+The public GHCR package is linked to this repository. For reproducible deployments, record the image digest alongside the release and SBOM/provenance artifacts.
 
 ## Runtime posture