Changelog

First public release

• Signed binaries published for Linux and macOS on amd64 and arm64: mezhub, mezd, msh, mezctl
• Release provenance: keyless Sigstore (cosign) signature over the SHA-256 checksums, plus an ed25519-signed manifest.json and its public key
• msh ships as a Homebrew cask — brew install leonardaustin/tap/msh — which links the client only, never a server
• Certificate-based SSH with a User CA and a Host CA (ECDSA P-256), short-lived certificates, and automatic CA initialisation on first boot
• Label-based RBAC with deny-overrides-allow, per-role max session TTL, and template variables
• Session recording (node-sync by default) with playback via msh play, to local filesystem or S3
• SSO via OIDC, SAML 2.0, LDAP/Active Directory and GitHub, with TOTP and WebAuthn MFA
• Access requests with time-bound grants, agent identity via mezd identity, and trusted clusters for cross-cluster SSH
• PostgreSQL or SQLite for state, config and audit