OKF Workbench 0.3.0 release record

OKF Workbench 0.3.0 was released on 2026-08-03 from signed tag v0.3.0. This record binds the publication and post-publication checks to the exact revisions and artifacts below; it does not qualify later source changes.

Scope

The release adds OKF v0.2 metadata semantics and Attested Computation support while retaining a guarded v0.1 compatibility fallback. It also adds an explicit, previewed v0.1-to-v0.2 extension migration workflow and the preview-only okf migrate --check CLI command.

Qualified inputs

• Immutable packaged-input revision: 802e400c5bfec9174131b44e42fab6db3ee2fec0.
• Reviewed, documentation-only tagged revision: 3ca746d75538d656d894d8e768b143a078e420a6.
• CI run 30803984331 and CodeQL run 30803982896 passed for the packaged inputs.
• Compatibility run 30804352708 passed acceptance/Webview checks and all seven editor/OS lifecycle lanes using the published v0.2.1 universal VSIX as predecessor.
• Package smoke run 30804007918 passed the browser boundary, all four target packages, and aggregate package-set consistency.
• A genuine headed VS Code 1.129.1 capture passed QR-002 at 873 ms p95 across 20 samples, selected d3 for QR-003, and recorded zero remote HTTP(S)/WS or other-scheme Webview requests.

Publication

• Signed tag: v0.3.0 on 3ca746d75538d656d894d8e768b143a078e420a6; local SSH signature verification passed.
• Release workflow 30806349131 passed all eight jobs.
• GitHub Release published 18 assets: the universal and four target VSIX packages, four native CLI archives, and nine checksum files.
• Open VSX published the universal, macOS arm64/x64, Linux x64, and Windows x64 packages. Downloads of all five matched the corresponding GitHub Release sizes and SHA-256 digests.
• The universal VSIX is 1,309,227 bytes with SHA-256 d96aa19cc3ada5d4e34618d41bedc4195efa368e2b51b8ff8977984e815caf57.

Post-publication verification

• The published Open VSX macOS arm64 VSIX is 2,344,646 bytes with SHA-256 371e63303d460006f35d614355b80e0d438f1a21cf86df1e6a634be238feda9e.
• VSCodium 1.121.03429 on macOS arm64 passed clean install, offline activation, untrusted workspace behavior, upgrade from 0.2.1, uninstall, settings preservation, and workspace preservation. The extension host exposed all seven commands and refused all five write commands while the workspace was untrusted.
• koizumikento/stray-tools commit e7bf5b9d20001e0f104326bbaa3c4d4b7d8c5c3e contains matching Homebrew and Scoop manifests.
• A clean Homebrew install returned CLI/core 0.3.0, the formula test passed, and the formula was uninstalled afterward.

Outstanding checks

• A clean Scoop install and okf version check still require a Windows environment. The manifest and tagged publication job passed, but those facts are not a substitute for the runtime check.
• Release-credential revocation or retained-credential ownership, scope, storage, and rotation date have not been recorded.

Rollback

Open VSX versions are immutable. Preserve the artifacts and evidence and fix forward with a higher SemVer version for a defective non-security release. For a security, privacy, credential, or licensing incident, revoke credentials, use the private security route, contact Open VSX for the exact version, and publish clear update or uninstall guidance.