Maskura v0.6.0

This release makes the local, inspectable Maskura path a first-class release surface.

Highlights

• S3-compatible local storage: run one container with a durable volume—no MinIO, database, cloud account, or sign-up required. Local staged multipart uploads include encrypted artifacts, a durable journal, fencing, and restart recovery.
• Bring your own Wasm pipeline: import, enable, disable, and reorder components through the live API without rebuilding the gateway. The built-in PII filter remains available as the default path.
• Recoverable encrypted PII: the CLI, Python client, and TypeScript client support the shipped X25519 + ML-KEM-768 hybrid envelope while the private key stays with the client.
• Executable evidence: just proof checks S3 interoperability and redaction, runtime Wasm import, and a Python encrypted round trip against the published image.
• Hardened delivery: dependency audits, CodeQL, pinned build inputs, checksums, an SPDX SBOM, and build-provenance attestations are enforced by the release path.

Artifact coverage

• Multi-architecture container image: Linux AMD64 and Linux ARM64.
• Native CLI and MCP binaries: Linux AMD64, Linux ARM64, and Apple Silicon.
• Canonical Python and TypeScript SDK archives, with legacy-name compatibility archives during the rename transition.

Verify it

docker buildx imagetools inspect ghcr.io/231self/maskura/maskura:v0.6.0
gh release download v0.6.0 --repo 231self/maskura
sha256sum --check SHA256SUMS --ignore-missing
gh attestation verify --repo 231self/maskura ./maskura-linux-amd64
cat IMAGE_DIGESTS

MASKURA_PROOF_IMAGE=ghcr.io/231self/maskura/maskura:v0.6.0 just proof

The threat model, guarantees, and explicit non-goals remain documented in docs/security.md and docs/proofs.md.