From 234b80b5e1070859fca846ca7334349f6e0838f1 Mon Sep 17 00:00:00 2001
From: Kenneth Lacroix <contact@kennethlacroix.me>
Date: Mon, 22 Jun 2026 18:12:04 -0600
Subject: [PATCH] chore(release): prepare v0.1.3

First signed release: bump agent version, installer pin, and web package to
0.1.3, and record signed-release support in the changelog.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md               | 12 +++++++++++-
 agent/cmd/palisade/main.go |  2 +-
 site/public/install        |  2 +-
 web/package-lock.json      |  4 ++--
 web/package.json           |  2 +-
 5 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6bc0ae6..5ec3d86 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,15 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-06-22
+
+### Added
+
+- Signed releases: the minisign signing key is provisioned and its public key is
+  pinned in the installer, so `curl | sh` verifies `SHA256SUMS.minisig` against a
+  known key (set `PALISADE_REQUIRE_SIGNATURE` to fail closed when a signature is
+  missing).
+
 ## [0.1.2] - 2026-06-22
 
 ### Added
@@ -74,7 +83,8 @@ Initial release.
 - **Demo**: one-command `make demo` full stack with a seeded org and a live
   agent loop against a fake-vulnerable target.
 
-[Unreleased]: https://github.com/kenlacroix/palisade/compare/v0.1.2...HEAD
+[Unreleased]: https://github.com/kenlacroix/palisade/compare/v0.1.3...HEAD
+[0.1.3]: https://github.com/kenlacroix/palisade/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/kenlacroix/palisade/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/kenlacroix/palisade/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/kenlacroix/palisade/releases/tag/v0.1.0
diff --git a/agent/cmd/palisade/main.go b/agent/cmd/palisade/main.go
index 35f472f..3889901 100644
--- a/agent/cmd/palisade/main.go
+++ b/agent/cmd/palisade/main.go
@@ -25,7 +25,7 @@ import (
 )
 
 // version is the reported agent version.
-const version = "0.1.2"
+const version = "0.1.3"
 
 func main() {
 	log.SetFlags(log.LstdFlags | log.Lmsgprefix)
diff --git a/site/public/install b/site/public/install
index 3855a48..e875183 100644
--- a/site/public/install
+++ b/site/public/install
@@ -14,7 +14,7 @@ REPO="kenlacroix/palisade"
 BIN="palisade"
 # Pinned to a known-good release by default; the published installer is updated
 # on each release. Override with PALISADE_VERSION=latest to track the newest.
-VERSION="${PALISADE_VERSION:-v0.1.2}"
+VERSION="${PALISADE_VERSION:-v0.1.3}"
 
 # Pinned minisign public key for release SHA256SUMS. The installer verifies the
 # signature on SHA256SUMS before trusting any checksum (see docs/release-signing.md).
diff --git a/web/package-lock.json b/web/package-lock.json
index 8defc23..3a5a537 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "palisade-web",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "palisade-web",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "dependencies": {
         "react": "^18.3.1",
         "react-dom": "^18.3.1"
diff --git a/web/package.json b/web/package.json
index 1d0cb7f..d74ea8c 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "palisade-web",
   "private": true,
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "scripts": {
     "dev": "vite",