v0.2.1

This is a patch release focused on supply-chain hardening, provenance plumbing, and release automation.

No schema or CLI interface changes (report/score schemas remain as in v0.2.0).

Supply chain

• Cosign keyless signing by digest for GHCR images (signs image@sha256:..., not tags).
• SPDX SBOM published as a cosign attestation alongside the same image digest.
• Workflow emits a digest + signature-reference summary on tag builds.

Published CPU image (immutable):

• Digest: ghcr.io/omniscoder/crispr-gpu-cpu@sha256:c7e1cb3504f50b0b709179ee245a6093138c27828140f425d726b5983365035e
• Signature ref: ghcr.io/omniscoder/crispr-gpu-cpu:sha256-c7e1cb3504f50b0b709179ee245a6093138c27828140f425d726b5983365035e.sig

Provenance

• report.json captures container digest + build metadata via CRISPR_GPU_* environment variables.
• Images bake build metadata so provenance is not “best effort” when run in-container.

Verification and citation rules

• Verification instructions: docs/supply_chain.md
• Do not cite :latest. For anything citeable/reproducible, cite a release tag (e.g. :v0.2.1) or (preferred) the immutable digest.

Canonical verification example (copy/paste digest format):

IMAGE_WITH_DIGEST="ghcr.io/omniscoder/crispr-gpu-cpu@sha256:c7e1cb3504f50b0b709179ee245a6093138c27828140f425d726b5983365035e"

cosign verify \
  --certificate-identity-regexp '^https://github.com/omniscoder/crispr-gpu/.github/workflows/docker-publish\.yml@refs/tags/v0\.2\.1$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  "${IMAGE_WITH_DIGEST}"

cosign verify-attestation \
  --type spdxjson \
  --certificate-identity-regexp '^https://github.com/omniscoder/crispr-gpu/.github/workflows/docker-publish\.yml@refs/tags/v0\.2\.1$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  "${IMAGE_WITH_DIGEST}"

Release surface

• Release assets auto-attached: report.json, report.md, score_cpu.json, bench_synthetic.jsonl, plus the sample bundle tarball.
• README includes a one-liner to run the demo and validate schemas via scripts/validate_artifacts.py.

v0.2.0

v0.2.0: report.v1 + score_result.v1 frozen

v0.2.0-fm-baseline

FM backend baseline: per-contig FM, parity-tested vs brute, synthetic…

v0.1.3

Bench: persistent GPU engine, batch scoring, refreshed CGCT baseline

v0.1.2

conda: make CPU-only recipe to avoid unsatisfiable CUDA pins in CI

v0.1.0-bench

Benchmark baseline: synthetic CGCT + microbench