diff --git a/.github/workflows/module-release.yaml b/.github/workflows/module-release.yaml
index 5c4439d..99bb1b4 100644
--- a/.github/workflows/module-release.yaml
+++ b/.github/workflows/module-release.yaml
@@ -10,6 +10,8 @@ on:
 
 permissions:
     contents: write
+    id-token: write
+    attestations: write
 
 jobs:
     release:
@@ -27,6 +29,11 @@ jobs:
             - name: Release
               run: forge release
 
+            - name: Attest build provenance
+              uses: actions/attest-build-provenance@v4
+              with:
+                  subject-path: build/*.tar.gz
+
             - name: Create GitHub release
               env:
                   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.specstory/.project.json b/.specstory/.project.json
new file mode 100644
index 0000000..d65135b
--- /dev/null
+++ b/.specstory/.project.json
@@ -0,0 +1,7 @@
+{
+  "workspace_id": "6730-3607-3022-91ee",
+  "workspace_id_at": "2026-06-23T20:10:10Z",
+  "git_id": "3abe-a224-929e-b796",
+  "git_id_at": "2026-06-23T20:10:10Z",
+  "project_name": "forge-cli"
+}
\ No newline at end of file
diff --git a/.specstory/cli/config.toml b/.specstory/cli/config.toml
new file mode 100644
index 0000000..5619638
--- /dev/null
+++ b/.specstory/cli/config.toml
@@ -0,0 +1,82 @@
+# SpecStory CLI Configuration
+#
+# This is the project-level config file for SpecStory CLI.
+# All settings here apply to this project unless overridden by CLI flags.
+#
+# Uncomment (remove the #) the line and edit any setting below to change the default behavior.
+# For more information, see: https://docs.specstory.com/integrations/terminal-coding-agents/usage
+
+[local_sync]
+# Write markdown files locally. (default: true)
+# enabled = false # equivalent to --only-cloud-sync
+
+# Custom output directory for markdown files.
+# Default: ./.specstory/history (relative to the project directory)
+# output_dir = "~/.specstory/history" # equivalent to --output-dir "~/.specstory/history"
+
+# Use local timezone for file name and content timestamps (default: false, UTC)
+# local_time_zone = true # equivalent to --local-time-zone
+
+[cloud_sync]
+# Sync session data to SpecStory Cloud. (default: true, when logged in to SpecStory Cloud)
+# enabled = false # equivalent to --no-cloud-sync
+
+[logging]
+# Write logs to .specstory/debug/debug.log (default: false)
+# log = true # equivalent to --log
+
+# Debug-level output, requires console or log (default: false)
+# debug = true # equivalent to --debug
+
+# Custom output directory for debug data.
+# Default: ./.specstory/debug (relative to the project directory)
+# debug_dir = "~/.specstory/debug" # equivalent to --debug-dir "~/.specstory/debug"
+
+# Error/warn/info output to stdout (default: false)
+# console = true # equivalent to --console
+
+# Suppress all non-error output (default: false)
+# silent = true	# equivalent to --silent
+
+[version_check]
+# Check for new versions of the CLI on startup.
+# Default: true
+# enabled = false # equivalent to --no-version-check
+
+[analytics]
+# Send anonymous product usage analytics to help improve SpecStory.
+# Default: true
+# enabled = false # equivalent to --no-usage-analytics
+
+[telemetry]
+# OTLP gRPC collector endpoint (e.g., "localhost:4317" or "http://localhost:4317")
+# endpoint = "localhost:4317"
+
+# Override the default service name (default: "specstory-cli")
+# service_name = "my-service-name"
+
+# Include user prompt text in telemetry spans (default: true)
+# prompts = false
+
+[providers]
+# Agent execution commands by provider (used by specstory run)
+# Pass custom flags (e.g. claude_cmd = "claude --allow-dangerously-skip-permissions")
+# Use of these is equivalent to -c "custom command"
+
+# Claude Code command
+# claude_cmd = "claude"
+
+# Codex CLI command
+# codex_cmd = "codex"
+
+# Cursor CLI command
+# cursor_cmd = "cursor-agent"
+
+# Droid CLI command
+# droid_cmd = "droid"
+
+# Gemini CLI command
+# gemini_cmd = "gemini"
+
+# DeepSeek TUI command
+# deepseek_cmd = "deepseek"