# Changelog

## 0.2.0 (VaultMesh-grade artifact)

- Safety boundary: `--dry-run` plans + `vmc apply` execution
- Per-server lockfiles with `--force`
- Receipts:
  - canonical hashing (BLAKE3 + SHA256)
  - `prev_blake3` chaining and `HEAD.json`
  - optional operator signatures (Ed25519) without altering canonical hashes
- Verification:
  - `vmc verify receipt ...`
  - `vmc verify chain ...`
- Merkle receipts:
  - `vmc merkle receipts` outputs a root commitment file