chore(release): prepare v0.1.3

CHANGELOG.md

@@ -6,6 +6,15 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-06-22
+
+### Added
+
+- Signed releases: the minisign signing key is provisioned and its public key is
+  pinned in the installer, so `curl | sh` verifies `SHA256SUMS.minisig` against a
+  known key (set `PALISADE_REQUIRE_SIGNATURE` to fail closed when a signature is
+  missing).
+
 ## [0.1.2] - 2026-06-22
 
 ### Added
@@ -74,7 +83,8 @@ Initial release.
 - **Demo**: one-command `make demo` full stack with a seeded org and a live
   agent loop against a fake-vulnerable target.
 
-[Unreleased]: https://github.com/kenlacroix/palisade/compare/v0.1.2...HEAD
+[Unreleased]: https://github.com/kenlacroix/palisade/compare/v0.1.3...HEAD
+[0.1.3]: https://github.com/kenlacroix/palisade/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/kenlacroix/palisade/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/kenlacroix/palisade/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/kenlacroix/palisade/releases/tag/v0.1.0

agent/cmd/palisade/main.go

@@ -25,7 +25,7 @@ import (
 )
 
 // version is the reported agent version.
-const version = "0.1.2"
+const version = "0.1.3"
 
 func main() {
 	log.SetFlags(log.LstdFlags | log.Lmsgprefix)

site/public/install

@@ -14,7 +14,7 @@ REPO="kenlacroix/palisade"
 BIN="palisade"
 # Pinned to a known-good release by default; the published installer is updated
 # on each release. Override with PALISADE_VERSION=latest to track the newest.
-VERSION="${PALISADE_VERSION:-v0.1.2}"
+VERSION="${PALISADE_VERSION:-v0.1.3}"
 
 # Pinned minisign public key for release SHA256SUMS. The installer verifies the
 # signature on SHA256SUMS before trusting any checksum (see docs/release-signing.md).

web/package.json

@@ -1,7 +1,7 @@
 {
   "name": "palisade-web",
   "private": true,
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "scripts": {
     "dev": "vite",