Skip to content

v0.1.1 — the slimmed keep

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Sep 04:28
· 407 commits to master since this release
v0.1.1
f3b7765
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Ashlar v0.1.1 — "the slimmed keep." The first release published to nuget.org.

A governed, certified, self-extending AI-app runtime: every artifact passes a real admission gate (analyzer fence → witness → mutation → determinism), everything admitted is Ed25519-signed and content-hashed, the audit trail refuses tampering on the execution path, and nodes federate hub-less with each receiver re-deciding trust under its own root.

Install

dotnet add package Ashlar.Hosting.Bundle --version 0.1.1

dotnet tool install -g Ashlar.CLI --version 0.1.1

Or run the node image: ghcr.io/ianfrelinger/nexo-cli:0.1.1 (multi-arch; see deploy/node.yml). Start with docs/GettingStarted.md and consumer-template/CONSUMING.md.

Since v0.1.0

  • First nuget.org publish — the full Ashlar.* graph (22 packages) plus the ashlar CLI tool, published via Trusted Publishing (OIDC, no long-lived keys) with SPDX SBOMs per package attached below.
  • The open-core boundary got teeth — LICENSING.md now carries seven published covenants (verify-free-forever, one-way ratchet, architectural walls, buyer-based placement, no commercial trust exceptions, no telemetry in open packages, data freedom); the commercial evaluation grant is in force; apps/release-manager and apps/runtime-studio graduated commercial → open.
  • The native-responsibility slim — the repository now carries the runtime and its own fleet tier only; vertical products (game, spatial/AR, physical-atom, provenance-graph) moved out, preserved intact on archive/verticals-2026-08-31 for their own repositories.
  • Documentation audited against source — every documented path, command, env var, and claim verified against the tree; the docs are gated by CI the same way the kernel is.

Verify

Every package carries a .sha256.txt sidecar and an SPDX SBOM (assets below). Images are pinned by digest in deploy/node.yml. Anything Ashlar signs verifies offline with the Apache-2.0 tooling — that is covenant 1, and it is load-bearing.

— Workflow run: https://github.com/IanFrelinger/Nexo/actions/runs/33466312501

Assets 52
Loading