Authoritative project documentation

ApiaryLens Preview 1 (build 0.1.0-preview.6)

Release date: 2026-07-18

Preview 1 is the first public preview of the rebooted ApiaryLens product: the platform core plus the web client/PWA as the primary product surface. This build, 0.1.0-preview.6, is a corrective release that supersedes build 0.1.0-preview.5 under the same public name — a corrective build does not advance the public preview counter (owner naming decision, 2026-07-18). The wire/semver build ordinal only ever increases; tags, manifests, updater ordering, and artifact names carry the build number, and announcements lead with the public name Preview 1.

Why this build supersedes 0.1.0-preview.5

Air-gap install fixed for the containerd image store (#91). The 0.1.0-preview.5 air-gap bundle recorded only the classic-graphdriver form of each image identity (the config-blob digest), but on the containerd image store — the default on current Docker Engine, including the documented Ubuntu 24.04 reference host — docker image inspect reports the OCI manifest digest, so the fail-closed post-load gate refused the bundle's own images and the install aborted (exit 65). The bundle now records both identities, each derived from the bundle's own image archive bytes, and the gate accepts whichever form the host's image store reports. CI now exercises the full load + gate + install path under the containerd image store in addition to the classic store, so a store-dependent regression can no longer pass CI while failing real hosts.
Release source-identity binding fixed (#92). The published 0.1.0-preview.5 artifacts claim source commit 1f348e0 while their bytes were built from 8c43e5f in a dirty local tree, so the identity chain from artifact to source could not be audited. The release workflow now rebinds sourceCommit to the exact tagged commit it builds, verifies that the release manifest, the provenance, and the built bytes all name that same commit, and refuses dirty-worktree or identity-mismatched artifact sets at generation time, at verification time, and again immediately before publication.

The 0.1.0-preview.5 GitHub release remains for the record with a superseded banner; do not install from it. There are no schema or data changes between 0.1.0-preview.5 and 0.1.0-preview.6, and an existing healthy 0.1.0-preview.5 deployment updates to this build through the standard transported-update procedure.

No Windows build in this release

This build ships platform and web artifacts only: the Cloudflare deployment bundle, the Compose deployment bundle, the air-gapped Compose bundle, and their evidence (SBOM, license report, provenance, compatibility manifest, checksums, attestations).

The Windows desktop client is deferred pending a full rewrite (owner decision, 2026-07-18) and was not rebuilt for this release. No Windows Setup is attached to the v0.1.0-preview.6 release. The most recent Windows preview build remains the one attached to the v0.1.0-preview.4 release; it carries the known deferred defect #84 (first launch of the packaged app can skip the mode chooser, and the Sync button is visible in the standalone context) and receives no further preview fixes before the rewrite. The primary supported product surface is the web client/PWA against a Cloudflare or Compose backend.

Unsigned preview

The artifacts in this release are not code signed. They ship under the unsigned-preview conditions of the accepted platform design: SHA-256 checksums are published beside the downloads in SHA256SUMS, and every published subject carries a GitHub (Sigstore) keyless attestation. Release-candidate and stable channels remain fail-closed on real signatures.

Verify before use:

Download the artifact and SHA256SUMS from the v0.1.0-preview.6 GitHub release.
Verify the checksum (sha256sum --check SHA256SUMS on Linux, or Get-FileHash on Windows) against the entry in SHA256SUMS.
Verify the keyless attestation: gh attestation verify <artifact> --repo ApiaryLens/apiarylens
If the hash or attestation does not verify, delete the file and do not use it.

Compatibility

Product: 0.1.0-preview.6
API contract: 1.0
Sync contract: 1
Database migration head: 0004
Deployment-plan contract: 1
Minimum direct upgrade source: 0.1.0-preview.1

Scout Bee is independently versioned; the compatibility manifest published with this release records the exact artifact identities.

Known limitations

No Windows artifact ships in this build; the previously released Windows preview build carries deferred defect #84 and is not maintained pending the rewrite.
winget and Chocolatey submissions are explicitly excluded until the first signed stable release (GV4); draft manifests exist in-repo only.
The extended manual assistive-technology matrix (NVDA, VoiceOver, retail Windows High Contrast, native zoom) remains scheduled beyond the preview.
Native iPhone and Android applications, AI, video, sensors, passkeys, and OIDC federation are post-MVP.