chore(release): 0.1.2 — workflow-driven releases + artifact attestations + package.json description alignment

Three things bundled:

1. Release workflow at .github/workflows/release.yml fires on every 3-digit-semver tag push. Builds main.js + styles.css in a clean Ubuntu runner, signs all three release assets via actions/attest-build-provenance@v1 (sigstore-backed via OIDC), creates the GitHub Release with notes pulled from release-notes/<tag>.md. Identical to the workflow landing across cite-wide, image-gin, metafetch as a family-wide pattern.

2. release-notes/0.1.2.md authored in marketing-shape per content-farm/context-v/skills/changelog-conventions/SKILL.md "These are marketing artifacts" section.

3. package.json description aligned with manifest.json. Previous package.json text "A plugin for Obsidian that allows you to generate source-cited content..." still contained the bot-flagged "Obsidian" + self-reference patterns that we'd already fixed in manifest.json; this synchronises the two so anything reading from npm-style metadata gets the same active-voice description users see in the directory listing.

Version bumped 0.1.1 → 0.1.2 across manifest.json / package.json / versions.json. No source-code changes — Directory Templates, the four shipped templates, the first-run seeder, the Claude integration, the wide modals all behave identically to 0.1.1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -0,0 +1,88 @@
+name: Release plugin
+
+# Fires when a 3-digit-semver tag is pushed (e.g. 0.1.6). Builds the plugin
+# in a clean Ubuntu runner, signs the produced main.js / manifest.json /
+# styles.css with GitHub's artifact-attestation (sigstore-backed), and
+# creates the GitHub Release with those three files attached. Anyone
+# installing can verify provenance with `gh attestation verify <file>
+# --repo lossless-group/metafetch`.
+#
+# Release notes: if release-notes/<tag>.md exists in the repo at the tagged
+# commit, it's used verbatim as the release body. Otherwise the workflow
+# falls back to GitHub's --generate-notes. The convention going forward is
+# to author the marketing-shape notes in release-notes/<version>.md before
+# tagging (per content-farm/context-v/skills/changelog-conventions/SKILL.md
+# "These are marketing artifacts" section — every release page is a
+# four-audience marketing surface, not a commit-message recap).
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+
+permissions:
+  contents: write       # gh release create / asset upload
+  id-token: write       # OIDC token for sigstore signing
+  attestations: write   # write the attestation to GitHub's attestation API
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out tagged commit
+        uses: actions/checkout@v4
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+          run_install: false
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build plugin
+        run: pnpm build
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: |
+            main.js
+            manifest.json
+            styles.css
+
+      - name: Pick release-notes source
+        id: notes
+        run: |
+          NOTES_FILE="release-notes/${GITHUB_REF_NAME}.md"
+          if [ -f "$NOTES_FILE" ]; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+            echo "path=$NOTES_FILE" >> "$GITHUB_OUTPUT"
+            echo "Using release-notes/${GITHUB_REF_NAME}.md as release body"
+          else
+            echo "found=false" >> "$GITHUB_OUTPUT"
+            echo "No release-notes/${GITHUB_REF_NAME}.md found — falling back to --generate-notes"
+          fi
+
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [ "${{ steps.notes.outputs.found }}" = "true" ]; then
+            gh release create "$GITHUB_REF_NAME" \
+              --title "$GITHUB_REF_NAME" \
+              --notes-file "${{ steps.notes.outputs.path }}" \
+              main.js manifest.json styles.css
+          else
+            gh release create "$GITHUB_REF_NAME" \
+              --title "$GITHUB_REF_NAME" \
+              --generate-notes \
+              main.js manifest.json styles.css
+          fi

manifest.json

@@ -1,7 +1,7 @@
 {
 	"id": "perplexed",
 	"name": "Perplexed",
-	"version": "0.1.1",
+	"version": "0.1.2",
 	"minAppVersion": "1.8.10",
 	"description": "Generate source-cited research content from Perplexity, Anthropic Claude, Perplexica, or local LM Studio — directly into your notes.",
 	"author": "The Lossless Group",

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "perplexed",
-	"version": "0.1.1",
-	"description": "A plugin for Obsidian that allows you to generate source-cited content using AI using Perplexity and Perplexica.",
+	"version": "0.1.2",
+	"description": "Generate source-cited research content from Perplexity, Anthropic Claude, Perplexica, or local LM Studio — directly into your notes.",
 	"main": "main.js",
 	"scripts": {
 		"dev": "node esbuild.config.mjs",

release-notes/0.1.2.md

@@ -0,0 +1,66 @@
+**Perplexed turns Obsidian into a per-directory research workflow with Claude, Perplexity, Perplexica, and LM Studio — and starting with 0.1.2, every release asset is cryptographically attested back to the source code that built it.**
+
+## Why care?
+
+Knowledge vaults with thousands of stub files — concept notes, tool profiles, vocabulary entries — never get filled in one at a time. You stub them, you mean to come back, you never do. Eventually the vault has 1,600 nearly-empty profile files in `Tooling/` and hundreds of concepts waiting in `concepts/`.
+
+Perplexed lets you drop **one template into a directory** describing how its files should be filled in — what to research, what tone to take, what frontmatter to stamp, where the sources footer goes — and then runs source-cited research across every file in that directory in one pass. Pick your provider:
+
+| Provider | Endpoint | Cost | Best for |
+|---|---|---|---|
+| **Perplexity** | api.perplexity.ai | Paid | Source-cited research with consistent citation formatting |
+| **Anthropic Claude** | api.anthropic.com | Paid | Longer-form reasoning with `web_search` and adaptive thinking |
+| **Perplexica / Vane** | localhost:3030 (self-hosted) | Free | Privacy-sensitive research; runs entirely on your machine |
+| **LM Studio** | localhost:1234 (local) | Free | Local-only inference, no network |
+
+The streaming response lands directly in your notes with citations intact. Then Cite-Wide picks up the numeric citations and converts them to stable hex identifiers. The two plugins compose: Perplexed generates, Cite-Wide canonicalises.
+
+Open Obsidian → **Settings → Community Plugins → Browse → "Perplexed" → Install → Enable**.
+
+## What 0.1.2 brings
+
+**Cryptographic provenance on every release asset.** Every `main.js`, `manifest.json`, and `styles.css` in this release is signed via GitHub's [artifact attestation system](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations) (sigstore-backed, OIDC-verified) at build time. The bytes you install can be traced back to the exact commit and GitHub Actions workflow run that produced them.
+
+Verify any release asset before you enable the plugin in your vault:
+
+```bash
+gh attestation verify main.js --repo lossless-group/perplexed-plugin
+```
+
+Exit code 0 means the file came out of a legitimate build of the source repo. Anything tampered with mid-flight fails the verification.
+
+This matters more for Perplexed than most plugins: the plugin handles your API keys (Perplexity, Anthropic, etc.) and the research it generates may include sensitive prompts about your work. Verifiable provenance answers "is the plugin I installed the plugin I think I installed?" with cryptography rather than faith.
+
+## What it changes for users
+
+**Installing from inside Obsidian:** nothing visible. The Community Plugins directory pulls the latest release the same way it always has.
+
+**Auditing before manual install:** verify before you drop files into `<vault>/.obsidian/plugins/perplexed/`. Same `gh attestation verify` command as above.
+
+## How the build pipeline works now
+
+A GitHub Actions workflow (`.github/workflows/release.yml`) fires on every 3-digit-semver tag push. In a clean Ubuntu runner it checks out the tagged commit, runs `pnpm build`, signs the three release assets via [`actions/attest-build-provenance@v1`](https://github.com/actions/attest-build-provenance), and creates the GitHub Release with marketing-shape notes pulled from `release-notes/<tag>.md` in the repo.
+
+Provenance is enforced by infrastructure, not maintainer discipline. Manual `gh release create` from a developer's machine is no longer the path — every release goes through the workflow.
+
+## The Lossless Group plugin family
+
+Perplexed sits alongside three sibling plugins, all by [The Lossless Group](https://lossless.group):
+
+| Plugin | What it does |
+|---|---|
+| [**Cite Wide**](https://community.obsidian.md/plugins/cite-wide) | Stable hex-identifier citations + URL-based dedupe + LLM-paste research conversion |
+| [**Image Gin**](https://community.obsidian.md/plugins/image-gin) | Recraft + Ideogram image generation, Magnific stock search, ImageKit CDN, drag-gate |
+| **Perplexed** *(this release)* | Source-cited research from Perplexity, Claude, Perplexica, or LM Studio + per-directory templates |
+| [**Metafetch**](https://community.obsidian.md/plugins/metafetch) | Pull OpenGraph metadata into note frontmatter via OpenGraph.io or Microlink |
+
+Together they form a research-to-publication pipeline: Perplexed generates the source-cited prose with numeric citations, Cite Wide rewrites them to stable hex identifiers, Metafetch fills the URL frontmatter with OG metadata, Image Gin generates the matching imagery. Each is independent; together they compound.
+
+If Perplexed saves you time, [buy us a coffee](https://buymeacoffee.com/losslessgroup). The plugins are free; the coffee keeps the next one coming.
+
+## Under the hood — what shipped in this commit
+
+- `.github/workflows/release.yml` — the build-attest-release workflow described above. Identical structure to the workflows landing across cite-wide, image-gin, metafetch as a family-wide pattern
+- `release-notes/0.1.2.md` (this file) — the convention going forward: each release's marketing-shape body lives in the repo at this path before the tag is pushed
+- Version bumped 0.1.1 → 0.1.2 across `manifest.json`, `package.json`, `versions.json`
+- No source-code changes — Directory Templates, the four shipped templates (concept / vocabulary / source / toolkit), the first-run seeder, the Claude provider integration, the wide modals, all behave identically to 0.1.1

versions.json

@@ -1,4 +1,5 @@
 {
 	"0.1.0": "0.15.0",
-	"0.1.1": "1.8.10"
-}
+	"0.1.1": "1.8.10",
+	"0.1.2": "1.8.10"
+}