Skip to content

v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Aug 20:22
· 133 commits to master since this release
v0.6.0
51005c3

Korvun v0.6.0

The sixth release makes Korvun's configuration something you compose by dragging:
the Builder canvas turns the config into a visual node editor — channels, brains
and models as nodes you wire on a canvas — and gives every brain a configurable
persona. No breaking changes: the schema additions are strictly additive, every
existing config runs byte-for-byte as before, and go.mod is untouched.

Highlights

The Builder canvas (ADR-0039, @xyflow/react)

The builder is no longer a form — it is a visual node editor. Once you paste the
admin bearer, the canvas is the face of the builder:

  • A palette you drag from. Three sectioned blocks — Canales / Cerebros /
    Modelos     — with icons and drag-dots, plus the hint "Arrastra un bloque al lienzo y
    conéctalo."     Drop a brain or channel on the canvas to create it; drop a model onto
    a brain     to add it (a model never floats free — it lives inside a brain).
  • Cables that respect the validator. The only manual connection is channel →
    brain     (drawing the cable is creating the route); every invalid pair
    (channel→model, brain→brain, self-connections) is rejected with no mutation — an
    exact mirror of the Go config.Validate rules.
  • Privacy exclusion, made VISIBLE. A private brain wired to a cloud model
    shows a gray dashed cable — the ADR-0015 pre-dispatch privacy rule, on screen:
    that model will never receive the private brain's traffic.
  • Rich nodes. Each node carries a type icon, sensitivity/locality badges
    (privado/público, local/nube) and the policy line — the config at a glance.
  • Delete with a domain cascade. "Eliminar nodo…" (behind a confirmation) removes a
    brain or channel and the routes that named it, so the config never carries a
    dangling route; a route cable is removable with Delete.
  • Discard + a live change counter. The canvas shows "N cambios sin aplicar" and a
    Descartar that reverts to the last applied config; Aplicar cambios POSTs the
    whole config and reloads it hot, reusing the same reload machinery as before.
  • The three channels are editable visually. telegram, discord and webhook
    all have palette blocks and property panels (the webhook block and its field mapping
    included) — the latent single-channel bug in the TS schema mirror is dead.

Persona per brain (Go core)

Every brain can now carry an optional persona — display_name, tone, language
and free-text instructions — composed as a prefix of the system prompt for
both brain kinds (the fan-out Orchestrator and the tool-use AgentBrain). The
persona is additive and bounded (rune caps 80/200/60/4000, with field-path 400s on
overflow); display_name is presentation-only — the brain's name stays the routing
key. A brain without a persona behaves byte-for-byte as before.

Korvun Desktop carries it

Korvun Desktop 0.6.0 embeds the builder canvas from day one: the desktop app shows the
real canvas inside its Builder view, with a single header (the app already
titles the view, so the builder's own bar is hidden when embedded — no double title).
Everything the headless binary serves at /builder, the desktop shows in-window.

Under the hood — CI hardening

Two CI gaps the Builder-canvas batch surfaced and closed:

  • Cross-platform lockfile determinism. The frontends' transitive WASM deps
    (@emnapi/*, via rolldown's optional binding) floated and broke npm ci on Linux
    runners while passing on macOS. Pinned via overrides with a from-scratch,
    optional-inclusive lock regeneration — the lockfile is now deterministic across
    platforms.
  • The embedded builder is exercised for real. The desktop chrome's e2e now builds
    web/builder/dist before the harness, so the /builder/ iframe serves the real
    builder (not the committed placeholder) — the canvas is verified end-to-end against
    the real binary, in dark and light, with a clean-console guardian (zero CSP
    violations, zero 404s).

Compatibility

No breaking changes. Every schema addition is strictly additive: the persona
block on a brain and the visual-only affordances change nothing for an existing
config, which parses, validates and behaves byte-for-byte as before. Zero new Go
dependencies — @xyflow/react is a frontend-only, build-time dependency (MIT,
exact-pinned, bundled same-origin under the builder's CSP; ADR-0039); go.mod is
unchanged.

Minor

  • V1 roadmap: the Builder-canvas piece marked complete (SP0–SP6), the "Personalidad
    por cerebro" pending piece folded in (docs/ROAD-TO-BETA.md).
  • Docs: the piece closed in ROAD-TO-BETA.md and HANDOFF.md; the design spec marked
    implemented.
  • The visible attribution of the canvas library is kept, restyled onto house tokens
    (policy: zero licensing spend; ADR-0039).

Artifacts

Two families in one release, exactly as v0.5.0. <ver> is the version without the
leading v (e.g. 0.6.0).

Family Artifact Target
Headless korvun_<ver>_{linux,darwin}_{amd64,arm64}.tar.gz, korvun_<ver>_windows_{amd64,arm64}.zip server / CLI, six OS·arch
Headless checksums.txt + .sig + .pem, per-archive *.sbom.json signed manifest + SBOMs
Desktop korvun-desktop_<ver>_darwin_universal.dmg macOS universal app
Desktop korvun-desktop_<ver>_windows_amd64-installer.exe Windows NSIS installer
Desktop korvun-desktop_<ver>_linux_amd64.tar.gz Linux binary + .desktop
Desktop checksums-desktop.txt + .sig + .pem signed desktop manifest

Draft-until-complete: the release is born a draft and is published only once
both families and their signatures are present, so a broken desktop build can never
expose a half-populated public release (ADR-0035 §8; SP7 §1e).

Verifying this release

Both families are signed keyless with cosign
(Sigstore), each with its own manifest. Verify the manifest signature you need, then
check your download against it.

Headless:

cosign verify-blob checksums.txt \
  --signature checksums.txt.sig \
  --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/Sebastian197/korvun/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Desktop:

cosign verify-blob checksums-desktop.txt \
  --signature checksums-desktop.txt.sig \
  --certificate checksums-desktop.txt.pem \
  --certificate-identity-regexp 'https://github.com/Sebastian197/korvun/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Full install and verification walkthrough: docs/packaging/INSTALL.md.
For the builder specifically: docs/BUILDER.md.

Assets 23
Loading