tula v0.3.3

CHANGELOG.md

@@ -11,6 +11,8 @@ CI and build plumbing, refactors, and doc-only edits — stays in commit message
 
 ## [Unreleased]
 
+## [0.3.3] - 2026-09-22
+
 ### Fixed
 
 - **`brew install hsnice16/tap/tula` works on Homebrew 6 and later.** The formula named `tula-latest` as a conflict, and Homebrew refuses to load a formula from a tap you have not trusted, so the install line failed before downloading anything. To update, name the formula in full — `brew upgrade hsnice16/tap/tula` — since Homebrew refuses the short name for an install it holds no trust for.
@@ -382,7 +384,8 @@ what breaks first.
 - `KeyScope` is tri-state. Kraken exposes no endpoint reporting a key's permissions, and every endpoint gated on trade permission mutates an order, so `canTrade` is `unknown` rather than guessed at. Withdraw scope is provable, and is proven.
 - Kraken margin and open orders are not read yet, so on a margin account this is not a complete Kraken picture.
 
-[Unreleased]: https://github.com/hsnice16/tula/compare/v0.3.2...HEAD
+[Unreleased]: https://github.com/hsnice16/tula/compare/v0.3.3...HEAD
+[0.3.3]: https://github.com/hsnice16/tula/compare/v0.3.2...v0.3.3
 [0.3.2]: https://github.com/hsnice16/tula/compare/v0.3.1...v0.3.2
 [0.3.1]: https://github.com/hsnice16/tula/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/hsnice16/tula/compare/v0.2.0...v0.3.0

README.md

@@ -148,7 +148,7 @@ the sigstore-backed attestation proving this repository's release workflow built
 it wherever the GitHub CLI can — saying so either way. Check one by hand:
 
 ```bash
-gh attestation verify tula-v0.3.2-darwin-arm64.tar.gz --repo hsnice16/tula \
+gh attestation verify tula-v0.3.3-darwin-arm64.tar.gz --repo hsnice16/tula \
   --signer-workflow hsnice16/tula/.github/workflows/release.yml
 ```
 

SECURITY.md

@@ -291,7 +291,7 @@ keyless, so there is no signing key for this project to generate, publish, rotat
 or lose.
 
 ```bash
-gh attestation verify tula-v0.3.2-darwin-arm64.tar.gz --repo hsnice16/tula \
+gh attestation verify tula-v0.3.3-darwin-arm64.tar.gz --repo hsnice16/tula \
   --signer-workflow hsnice16/tula/.github/workflows/release.yml
 ```
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hsnice16/tula",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Your true exposure, what breaks first, and more, across every venue at once.",
   "license": "MIT",
   "type": "module",

site/app/install/page.tsx

@@ -356,7 +356,7 @@ export default function Page() {
         </div>
         <Terminal title="verify">
           {
-            "curl --proto '=https' --tlsv1.2 -fLO https://github.com/hsnice16/tula/releases/download/v0.3.2/tula-v0.3.2-darwin-arm64.tar.gz\ngh attestation verify tula-v0.3.2-darwin-arm64.tar.gz --repo hsnice16/tula --signer-workflow hsnice16/tula/.github/workflows/release.yml"
+            "curl --proto '=https' --tlsv1.2 -fLO https://github.com/hsnice16/tula/releases/download/v0.3.3/tula-v0.3.3-darwin-arm64.tar.gz\ngh attestation verify tula-v0.3.3-darwin-arm64.tar.gz --repo hsnice16/tula --signer-workflow hsnice16/tula/.github/workflows/release.yml"
           }
         </Terminal>
         <p className="mt-4 text-dim">

site/lib/site.ts

@@ -10,7 +10,7 @@ export const NAME = 'tula'
  * the two disagree and `release-cut.sh` bumps this with them: a frame offered
  * as the tool's own output cannot print a release that was never cut.
  */
-export const VERSION = '0.3.2'
+export const VERSION = '0.3.3'
 
 /**
  * GA4, for the site alone. Held here rather than read from `process.env`: an

src/version.ts

@@ -1,5 +1,5 @@
 export const APP_NAME = 'tula'
-export const APP_VERSION = '0.3.2'
+export const APP_VERSION = '0.3.3'
 
 /**
  * SemVer says a hyphen means pre-release, and `release.yml` already reads it