chore: bump version to 0.2.5, include hushd in homebrew, update README (#173)

- Bump all crate, npm, PyPI, and config versions from 0.2.4 to 0.2.5
- Fix homebrew formula: include hushd in release tarball and formula install
- Release workflow now builds hushd alongside hush-cli in build-binaries job
- Update README "What Clawdstrike Is" with Swarm C2 and Swarm Trace layers

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: bb-connor

.github/workflows/release.yml

@@ -626,8 +626,10 @@ jobs:
         with:
           targets: ${{ matrix.target }}
 
-      - name: Build release binary
-        run: cargo build --release --target ${{ matrix.target }} -p hush-cli
+      - name: Build release binaries
+        run: |
+          cargo build --release --target ${{ matrix.target }} -p hush-cli
+          cargo build --release --target ${{ matrix.target }} -p hushd
 
       - name: Rename binary (Unix)
         if: runner.os != 'Windows'
@@ -650,6 +652,7 @@ jobs:
           mkdir -p _archive
           cp target/${{ matrix.target }}/release/hush _archive/
           cp target/${{ matrix.target }}/release/clawdstrike _archive/
+          cp target/${{ matrix.target }}/release/hushd _archive/
           tar -czf ${{ matrix.archive }}.tar.gz -C _archive .
 
       - name: Upload release archive
@@ -906,10 +909,12 @@ jobs:
             def install
               bin.install "hush"
               bin.install "clawdstrike"
+              bin.install "hushd"
             end
 
             test do
               assert_match version.to_s, shell_output("#{bin}/hush --version")
+              assert_match "hushd", shell_output("#{bin}/hushd --version")
             end
           end
           RUBY

Cargo.lock

@@ -43,7 +43,7 @@ exclude = [
 ]
 
 [workspace.package]
-version = "0.2.4"
+version = "0.2.5"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/backbay-labs/clawdstrike"
@@ -152,17 +152,17 @@ md-5 = "0.10"
 jsonwebtoken = { version = "10", default-features = false, features = ["aws_lc_rs", "use_pem"] }
 
 # Internal crates
-hush-core = { path = "crates/libs/hush-core", version = "0.2.4" }
-hush-proxy = { path = "crates/libs/hush-proxy", version = "0.2.4" }
-clawdstrike = { path = "crates/libs/clawdstrike", version = "0.2.4", default-features = false }
-hush-certification = { path = "crates/libs/hush-certification", version = "0.2.4" }
-spine = { package = "hush-spine", path = "crates/libs/spine", version = "0.2.4" }
-bridge-runtime = { path = "crates/libs/bridge-runtime", version = "0.2.4" }
-hunt-scan = { path = "crates/libs/hunt-scan", version = "0.2.4" }
-hunt-query = { path = "crates/libs/hunt-query", version = "0.2.4" }
-hunt-correlate = { path = "crates/libs/hunt-correlate", version = "0.2.4" }
-clawdstrike-ocsf = { path = "crates/libs/clawdstrike-ocsf", version = "0.2.4" }
-clawdstrike-policy-event = { path = "crates/libs/clawdstrike-policy-event", version = "0.2.4", default-features = false }
+hush-core = { path = "crates/libs/hush-core", version = "0.2.5" }
+hush-proxy = { path = "crates/libs/hush-proxy", version = "0.2.5" }
+clawdstrike = { path = "crates/libs/clawdstrike", version = "0.2.5", default-features = false }
+hush-certification = { path = "crates/libs/hush-certification", version = "0.2.5" }
+spine = { package = "hush-spine", path = "crates/libs/spine", version = "0.2.5" }
+bridge-runtime = { path = "crates/libs/bridge-runtime", version = "0.2.5" }
+hunt-scan = { path = "crates/libs/hunt-scan", version = "0.2.5" }
+hunt-query = { path = "crates/libs/hunt-query", version = "0.2.5" }
+hunt-correlate = { path = "crates/libs/hunt-correlate", version = "0.2.5" }
+clawdstrike-ocsf = { path = "crates/libs/clawdstrike-ocsf", version = "0.2.5" }
+clawdstrike-policy-event = { path = "crates/libs/clawdstrike-policy-event", version = "0.2.5", default-features = false }
 
 [profile.release]
 lto = true

Cargo.toml

@@ -92,6 +92,14 @@ flowchart LR
     H -.-> I[Control API + Control Console]
 ```
 
+Three layers, one system:
+
+| Layer | What It Does |
+| ----- | ------------ |
+| **Guard Stack** | 13 composable guards at the tool boundary: path access, egress, secrets, shell commands, MCP tools, jailbreak detection, prompt injection, CUA controls, Spider-Sense threat screening. Every verdict is Ed25519-signed into a non-repudiable receipt. |
+| **Swarm C2** | An operational control plane for managing agent fleets in production. Durable, replayable fleet transport over NATS JetStream, policy flow coordination via Spine, enrollment and credential provisioning, posture commands with request/reply acknowledgements, and a Proofs API + Control Console for verification and SOC workflows. |
+| **Swarm Trace** | Prevention + hunting at the agent tool boundary. Hunt across signed receipts, kernel telemetry (Tetragon, auditd), and network flows (Hubble), build timelines, run natural-language and structured queries, correlate against detection rules, and ship OCSF-formatted findings straight into your SIEM. |
+
 ---
 
 ## Why This Matters

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "clawdstrike-agent"
-version = "0.2.4"
+version = "0.2.5"
 description = "Clawdstrike Agent - Security enforcement runtime for AI coding tools"
 edition = "2021"
 rust-version = "1.80"

apps/agent/src-tauri/Cargo.toml

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Clawdstrike Agent",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "identifier": "dev.clawdstrike.agent",
   "build": {
     "beforeDevCommand": "sh scripts/prepare-bundled-hushd.sh dev",

apps/agent/src-tauri/tauri.conf.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawdstrike/wasm",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "WebAssembly bindings for clawdstrike cryptographic verification",
   "main": "hush_wasm.js",
   "types": "hush_wasm.d.ts",