v0.1.0

Added

• Scoring jobs from a model registry batch descriptor. A scoring section
  names the signed descriptor, the trusted registry keys and the .onnx
  artifact. Kako verifies both signatures and the artifact digest before
  the run, and again on the staged copy. It generates the scoring program
  from the descriptor's binding and output fields and runs it with ONNX
  Runtime in the Python sandbox. Receipts gain model (registry version,
  artifact and descriptor digests). The Python lockfile adds ONNX Runtime
  (#54).
• kako replay re-runs a pipeline's steps at pinned input, code, engine
  and Python runtime image versions into a branch directory. It checks
  every pin before anything runs, reports each step that cannot be
  reproduced instead of substituting a version, refuses main, and
  writes per-step receipts plus replay.json with reproduced or
  diverged output digests
  (ADR 0016,
  #53).
• Sekai adapter live claim transport over the published runtime-claim
  client. Input snapshots page to exhaustion, cap retained row/cell/byte
  size, and renew the claim lease after each non-empty page. The live
  lease uses the plane's 300s cap (JobSource has no execute-time
  heartbeat). Isolated JobSpec omits program bytes; live claims take
  proto sql or KAKO_SEKAI_CODE. Write-back refuses an expired job
  credential. A claimed transform that cannot be prepared is reported as
  a runner failure under the fence. A plane-quarantined write-back is not
  a successful complete and ends the held claim. Ignored tests cover a local-plane
  join+agg (two datasets, receipt lineage) and stale-fence write-back.
  Offline cargo test stays green. Prerequisites: KAKO_SEKAI_TARGET,
  KAKO_SEKAI_NAMESPACE, KAKO_SEKAI_CODE, and a claimable
  isolated-process transform
  (#35).

Security

• Job claims may carry a wrapped tenant DEK. The runner unwraps it in
  process, seals each published output as KAKOSEAL, and drops the DEK
  when the run ends. A revoked key fails the job (Failure::KeyRevoked)
  and writes a receipt with key_state: "revoked". Key bytes never appear
  on the receipt, in the scratch tree, or in the sandbox environment
  (#50,
  ADR 0015).

• The runner refuses a job whose credentials do not cover its inputs'
  markings, and refuses an output whose declared markings omit the
  required union unless the job source supplies a declassify decision
  (ADR 0014). SQL jobs propagate
  labels per column through mizuchi; Python and DuckDB jobs use the
  table-level union.

• The sandboxed worker gets only the environment variables kako sets for it.
  It no longer inherits the runner's environment, which user code could read
  through /proc/self/environ.

• Remote job sources mint one short-lived credential per claimed job, scoped
  to that job's inputs and outputs. The runner process holds it, revokes it
  when the claim ends, and refuses a broader or longer-lived credential
  (ADR 0013). The Sekai
  ClaimTransport gains mint_credential and revoke_credential, and
  write_outputs takes the credential.

Changed

• Receipt JSON is receipt_version 6: optional key_ids and key_state
  for encrypted runs. Unencrypted jobs omit both. The mizuchi pin is
  1c2e13030bfd94f2cdea6ac8aec277f651391a47 (table-file encryption).
  sekai-keys is a git pin until it is on crates.io.

• Receipt JSON is receipt_version 5: input_markings and
  output_markings list labels by name, and optional declassify
  records an audited drop. Schema 4's credential_scope is unchanged.
  The mizuchi pin is c4ae4a06e6275686173bcf1be44bdf328b22d5e5
  (column-level propagation).

• Receipt JSON is receipt_version 4: optional credential_scope names the
  job-scoped credential used for write-back, never its secret. Local file
  jobs omit it.

• Isolated-process jobs key quotas on the submitting transform owner from
  TransformWork.tenant_id when present, and keep the namespace key for
  community work with no owner. The optional sekai-client pin is
  dccc1e704adf21057bcaa435aef90660db0e9c52.

• The workspace splits into kako-core, kako-sandbox, engine crates,
  kako-worker, and kako (ADR 0010).
  kako:: module paths stay. Sandbox functions take IsolationTier and
  return kako usage values instead of kekkai types. Job schema, receipts,
  isolation policy, and the kekkai pin are unchanged.

• kekkai pin moves to 73e24f580ed6223b7e8395793e6f2317eb8edfd9 (includes the
  userspace guest adapter). Default jobs still select linux_native. Jobs
  that require userspace spawn through the guest helper, or fail closed
  when guest health cannot be applied.

Added

• kako jobs and receipts map onto the Sekai isolated-process JobSpec and
  TransformRun JSON (kako_core::governed). The JobSpec digest uses the
  plane definition_digest algorithm. SQL and Python receipts deserialize
  as that run-receipt shape
  (ADR 0012,
  governed-receipt.md).

• kako serve: /health, /ready, and /version on a long-running
  process; SIGTERM drains (stop claiming, finish the current job or hand it
  back with JobSource::release, then exit). Ready means the process will
  claim work. A local job file is claimed, then the process goes not-ready
  when that one-shot source is empty; without a file it stays not-ready.
  Probe connections are handled off the accept loop so a slow client cannot
  stall /health or /ready. Rollback is the same drain path plus the
  previous GitHub Release binary
  (ADR 0011).

• Optional kako-source-sekai crate: a JobSource adapter that claims
  isolated-process work behind a fenced transport. Default tests use a fake
  client so a lost fence aborts write-back and writes nothing. kako-core
  stays free of Sekai (sekai feature on kako, #8).

• Mizuchi jobs pass write_mode (overwrite or append) through to the
  adapter. COPY SQL writes a new CSV and rejects append; partitioned
  parquet writes honor both modes. Receipt snapshots stay identical across
  repeated runs except timing fields.

• FairSource load test: with N owners and one flood, every other owner's
  first job starts within N−1 slots across repeated run_source trials
  (ADR 0004).

• CI sets KAKO_REQUIRE_PYTHON=1 so Python engine tests cannot skip,
  delegates a cgroup v2 subtree for memory_bytes jobs, and builds the
  Python runtime image twice then runs the Polars and pandas joins inside
  it (scripts/python-runtime-ci.sh).

• Isolation is a job-source floor (isolation on the job, recorded on the
  receipt). Omitted jobs stay linux_native. A stronger floor the host
  cannot meet is a runner failure, with no silent downgrade
  (ADR 0009). Receipt JSON is
  receipt_version 3.

• Jobs with isolation: userspace prepare kekkai Backend::Userspace and
  spawn through kekkai-guest (or KEKKAI_GUEST_HELPER): per-run scratch
  as the workspace, no network, job CPU and wall-clock limits. A missing
  helper or failed guest health is a runner failure with no outputs. Escape
  tests that need the helper are #[ignore] in offline cargo test.

• Tagged GitHub releases package the runner binary, SQL and Python runtime
  images, checksums, and artifact attestations. A v* tag also pushes
  ghcr.io/sannrox/kako:<version> (never latest). deploy/tenkai.toml
  is the Tenkai product entry. Crates stay unpublished while git pins remain
  (ADR 0008).
  bash scripts/release-dry-run.sh --out dist builds the same files
  without creating a release.

• kako run <job.json>: local job source, copied input staging, sandboxed
  DuckDB SQL worker under kekkai linux_native, SHA-256 receipts, and
  scratch cleanup on success, failure, and timeout. Runs fail closed when
  linux_native cannot be applied. User SQL can read and write only the
  per-run scratch directory.

• kako doctor: reports the kekkai backend the host can enforce.

• Receipt JSON (receipt_version 1): input and code digests, engine version,
  output digests, start time, duration.

• Skeleton runner binary and core types: JobSource, Job, Output,
  Receipt, Failure.

• ADR 0002: sandboxed transform runner with pluggable job sources.

• Engine requirements bar (ADR 0003,
  docs/engine-requirements.md): new engines are
  opt-in; scripts/engine-bar/ is the named fixture baseline.

• Opt-in mizuchi SQL engine: "engine": "mizuchi" on a job file. Default
  remains DuckDB.

• Mizuchi receipts include a lineage object (plan, reads after prune,
  writes). DuckDB receipts omit the field.

• Jobs, receipts, and quota keys carry tenant_id and namespace. Receipt
  JSON is receipt_version 2. The local CLI fills local / default
  unless --require-identity is set.

• Per-run optional cpu_time and memory_bytes on jobs. The job source
  owns quotas and fair share (ADR 0004);
  kako enforces the limits it is handed. Receipts include cpu_usec and
  memory_peak_bytes when the sandbox reports them.

• FairSource: round-robin by quota key so one owner's flood does not
  block another owner's first run beyond a few slots. The local CLI stays
  one-shot.

• Opt-in Python engine: "engine": "python" with transform(inputs) over
  staged frames. Packages come from runtime/python/requirements.txt;
  ...