v1.12.0

kb v1.12.0

v1.12.0 completes the map-related audit backlog #353-#367 while retaining
Go 1.26.5 exactly.

Board and editor behavior

• Dirty card editors require the advertised uppercase D to discard edits.
  Lowercase d leaves the confirmation open. The mouse Discard button still works.
• ADR editor cursors remain visible with CJK and emoji text. ADR, card, import,
  and settings inputs share the same terminal-cell viewport rule.
• Markdown images display their labels without fetching remote resources in
  cards, details, or previews.
• Web AI skill requests use the existing four-minute forge deadline and respect
  shorter request deadlines and cancellation.

CLI behavior

Task JSON includes zero-valued fields and empty arrays. Scripts can distinguish
exit codes 1 for operational failures, 2 for usage, 3 for missing entities,
and 4 for ambiguous, conflicting, or refused operations. Successful commands
and help return 0. The README documents each command's JSON shape.

kb restore accepts only cancelled tasks. Use kb move <id> todo to reopen
another state. Link and unlink errors identify the missing task separately from
a missing edge. kb comment add --author sets the comment author without
changing the board namespace.

Forge and MCP behavior

Forge failures retain useful HTTP status, stop writing request errors into the
TUI, and report oversized responses and first-page rate limits. AI drift-summary
failures remain visible while preserving the drift result. Authenticated HTTP
is refused except for localhost and numeric loopback addresses.

MCP rejects task titles, descriptions, and comment bodies larger than 1 MiB
before writing. Updating another field preserves an omitted existing value.
Startup reuses the common local-store lifecycle and warning policy. Signal
cancellation closes the store; the POSIX SIGTERM regression runs on Linux and
macOS, with normal startup checks retained on Windows.

Build and release checks

The real-browser smoke covers board load, creation, movement, native SSE updates,
and persistence after reload. A separate privacy regression checks that remote
images cause no network requests. CI checks committed CSS against its Tailwind
source, verifies the CLI download hashes for all supported build targets, and
selects TUI performance checks for rendering changes.

Pointer fixtures fail instead of silently skipping when their assumptions drift.
Theme contrast logging accompanies visibility assertions. Targeted error tests
verify persisted state after rejection. The existing full-mode 96.4% coverage
threshold remains enforced; no coverage threshold was lowered.

The release workflow binds downloaded binaries and SHA256SUMS to hashes of the
actual locally built upload assets, then attests and verifies all six files.
With the GitHub CLI, verify a downloaded binary using:

gh attestation verify kb-linux-amd64 --repo RandomCodeSpace/kb --signer-workflow RandomCodeSpace/kb/.github/workflows/release.yml

Use your asset's filename, or SHA256SUMS. Add --source-digest and the full
release commit SHA to require a particular source revision. Build attestations
are available from this release onward.

Go version and remaining work

Go 1.26.5 is a hard restriction. The maintainer explicitly accepts vulnerabilities
caused by this standard-library version. The pinned govulncheck v1.8.0 gate
reports those findings and rejects reachable third-party vulnerabilities,
scanner failures, and unexpected toolchains. Accepted risk is not a clean scan.

The seven previously reported reachable Go findings are GO-2026-5026,
GO-2026-5972, GO-2026-6088, GO-2026-6089, GO-2026-6090, GO-2026-6091,
and GO-2026-6218, with fixes above the permitted Go version.

The default data directory remains ~/.local/share/kb on Linux, macOS, and
Windows, unless KB_DATA or --data overrides it. Make a cold backup of the whole
data directory before upgrading.

The older issues #205, #217, #237, #299, #301, #302, and #304 remain separate
follow-up work. This release does not claim physical-terminal verification.