v0.16.1

[0.16.1] - 2026-09-25

Fixed

• A release whose changelog section is too long for a GitHub release body
  now publishes with that section's entry headlines instead of failing
  (ADR-0086, amendment 2026-09-25). The v0.16.0 tag published its images, then
  its release job failed at gh release create with "body is too long (maximum
  is 125000 characters)": the 0.16.0 section alone is 165,435 characters, so
  v0.16.0 has no GitHub Release. publish-images.yml now measures the composed
  notes against a 120,000-byte budget. Over it, the section keeps its headings
  and each entry's bold headline, followed by a link to the full section in the
  tagged CHANGELOG.md; the generated pull request list and the downloads text
  are unchanged. If the notes still do not fit, the job fails with both sizes
  before it creates the Release.

What's Changed

• fix(release): fit the release notes within GitHub's body limit by @pmoust in #2006
• chore(release): prepare 0.16.1 by @pmoust in #2007

Full Changelog: v0.16.0...v0.16.1

Downloads

The attached binaries were extracted unmodified from the signed container
images this release published, so each one is byte-identical to the file inside
the image you can pull. They are glibc-dynamic, built against Debian 12
(the runtime image is gcr.io/distroless/cc-debian12), so they need glibc 2.36
or newer. On an older distribution, run the container image instead:

docker pull ghcr.io/nofireai/ravel-server:0.16.1

One binary per platform, named <binary>-<os>-<arch>:

• ravel-server-linux-amd64, ravel-server-linux-arm64
• ravel-cli-linux-amd64, ravel-cli-linux-arm64
• ravel-operator-linux-amd64, ravel-operator-linux-arm64
• ravel-ingest-router-linux-amd64, ravel-ingest-router-linux-arm64

Verifying the downloads

SHA256SUMS covers every attached binary and symbol archive. Check the files
you downloaded, then verify SHA256SUMS itself against the signature and
certificate beside it. The signature is keyless, bound to this release
workflow's identity, so there is no key to obtain:

sha256sum --check --ignore-missing SHA256SUMS

cosign verify-blob \
  --certificate SHA256SUMS.pem \
  --signature SHA256SUMS.sig \
  --certificate-identity 'https://github.com/NOFireAI/ravel/.github/workflows/publish-images.yml@refs/tags/v0.16.1' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  SHA256SUMS

Debug symbols

The shipped binaries are stripped of debug info but keep their symbol table,
so a backtrace resolves function names with nothing extra installed. Line
numbers come from the matching symbols archive. Each binary records the
basename of its symbol file, so unpacking the archive next to the binary is
enough and no symbol-file step is needed:

tar -xzf ravel-debug-symbols-linux-amd64.tar.gz
gdb ./ravel-server-linux-amd64

gdb looks for ravel-server.debug in the same directory (and in
.debug/), which is the name inside the archive. Do not rename the extracted
.debug files.