# Reckon Graph 0.4.1 release notes

Reckon Graph 0.4.1 is the publishable patch release of the 0.4 line. It contains
all functionality described in the 0.4.0 release notes plus a fail-closed
release-verification compatibility fix.

## Release verification fix

- The workflow now verifies signed provenance and the CycloneDX SBOM using the
  exact certificate identity together with repository, source digest, source
  ref, predicate type, and GitHub Actions OIDC issuer constraints accepted by
  the current GitHub CLI.
- The release-attestation CLI test double now runs with `set -eu`, ensuring an
  assertion mismatch actually fails the test instead of continuing to a later
  successful command.

## Why 0.4.0 was not published

The immutable `v0.4.0` tag reached the signed-evidence stage, then failed closed
before npm or Artifactory publication because the installed GitHub CLI rejects
combining `--cert-identity` with `--signer-workflow`. The tag remains unchanged
for auditability and 0.4.0 was not published to any package channel. This patch
release contains the corrected workflow rather than rewriting the existing
tag.

As with every release, version preparation alone does not certify distribution.
Certification requires the tag workflow and byte-for-byte verification across
npm, Docusign Artifactory, GitHub SaaS, GHES, and Homebrew.