Skip to content

v0.7.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Aug 19:05
· 37 commits to master since this release
v0.7.0
3e18df6

Korvun v0.7.0

The seventh release turns Korvun from a router you configure into an assistant you
operate and govern. Two capabilities land together: an Operator Console — a
multi-channel inbox with a direct chat to every brain — and Governed Tools &
Skills — a tool catalogue behind a tri-state gate whose middle state, rehearsal,
lets a tool be announced and audited without ever running. The tool piece is
additive; the one behaviour that tightens on purpose is config parsing, called out
under Compatibility.

Highlights

Operator Console (operator-console spec)

The desktop app and the headless admin API grow a real operator surface:

  • A multi-channel inbox. Every conversation across every channel in one list,
    with unread counts, newest first — Telegram, Discord, Webhook and the local console
    side by side.
  • Direct chat with each brain. A console conversation speaks as the user
    straight to a brain — the same dispatch pipeline a real channel uses, no shortcut —
    so you can talk to soporte or asistente from the app itself.
  • Takeover, with the context intact. Step into any conversation and answer by
    hand; the brain is silenced for that conversation while you hold it and released
    when you let go — the history stays whole.
  • Sessions. /new opens a fresh session inside a conversation (a clean context
    window) without losing the thread; the session list is browsable.
  • Real deletion. Deleting a conversation wipes it for good (HTTP 204) and
    releases any takeover it held — no silenced ghost left behind.

Governed Tools & Skills (ADR-0041)

Agent brains can now use tools, and every tool is governed by the operator, not the
model:

  • A v1 catalogue. Built-ins time, echo, calc; a directory-jailed
    read_file; a GET-only, allow-listed http_fetch; and a webhook_call that POSTs
    JSON to allow-listed hosts. Nothing is on by default — the operator grants it.
  • A tri-state gate: allow / SHADOW / deny. The middle state is the point.
    Shadow (rehearsal) advertises the tool to the model and records the call the
    model chose to make — but never executes it, returning an honest "simulated"
    observation. You watch the model's real judgement land in the audit trail before you
    ever let the tool touch the world. Deny hides it; allow runs it.
  • A network shield for private brains. A brain marked private may only reach
    private network space, and the check is at the dial: the shield validates
    the resolved IP of every connection (and every redirect hop), so a hostname that
    resolves to a public address is stopped at connect time, not trusted from the URL.
  • Per-tool cages. read_file is jailed to a root directory; http_fetch and
    webhook_call carry exact-host allow-lists with hard timeouts and no open
    redirects. A cage breach is audited as a denial, never a silent pass.
  • Skills as documentation, never authority. An AgentSkills-compatible loader
    (stdlib-only, flat frontmatter) reads a skills directory and appends skill bodies to
    the seed prompt under a rune budget — they inform the model, they never grant it
    power. A skill can describe how to use a tool; only a grant lets the tool run.
  • /tools in the chat. Ask a brain /tools and it answers with the gatekeeper
    report: each tool's mode, its shield/cage, and recent tool activity — the governance
    state, readable in the conversation.
  • A governance panel in the Builder. The «Herramientas y skills» section renders
    the tri-state per tool, the derived network-shield pill, the cages and the
    read-only skills — and the promotion from rehearsal to allowed is the Builder's
    usual Aplicar: a hot reload, nothing restarted.

Native tool calling, with an honest fallback (ADR-0042)

When the model provider supports it — Ollama's /api/chat tool protocol — Korvun
drives tools through the native tool-calling lane: structured tool_calls instead
of parsing tool intentions out of prose. Governance is identical on both lanes by
construction (the same grant check, the same cages). When a model does not support
native tools, the brain degrades to the text lane for the rest of the process and
says so — no pretending, no half-broken protocol.

Hardening — audit + adversarial review

This release folds in a full internal audit and an adversarial cross-review of the
whole batch:

  • Inbound de-duplication. At-least-once channels (Telegram re-delivery, webhook
    retries) no longer double-answer: an inbound event with an id is de-duplicated in a
    bounded window; an event without an id is never dropped (fail-open).
  • Strict config with schema_version. Unknown config keys are now refused by
    name    , and an optional schema_version guards the day the schema must break. See
    the migration note below.
  • go1.26.6. govulncheck (pinned) flagged five reachable Go standard-library
    advisories in the toolchain (GO-2026-5972, GO-2026-6089, GO-2026-6090,
    GO-2026-6218, GO-2026-5026); the toolchain is bumped to the patch that fixes
    them. The scanner is neither silenced nor excluded.
  • The review batch. The adversarial pass and red-team hardened the dedup window
    under failed dispatch, the mutation surface's strict decode, the native lane's edge
    cases, the tool cages (a read_file FIFO can no longer park a worker; http_fetch
    owns a hard per-call timeout; the shield no longer counts link-local as private),
    and a fail-loud boot when a sensitive tool sits on an ungoverned cloud brain.

Compatibility

One intentional tightening — a migration note. Config parsing is now strict:
an unknown key is refused with an error that names the key, instead of being
silently ignored. This is the desired behaviour — a typo'd field no longer passes
unnoticed — but a config that carried stray/unknown keys and "worked" before will now
be rejected until the key is removed or corrected. Everything else is additive: the
governed-agent block, the tools, the skills loader and the persona all default to
absent, and a config without them parses and behaves as before. The optional
schema_version is absent by default (treated as the current schema).

Toolchain. go.mod moves to go 1.26.6 (the stdlib-advisory patch above). No new
runtime Go dependency is introduced by the tools piece; the native lane rides the
existing Ollama client.

Minor

  • The governance panel ships on the canvas properties panel of the Builder (the
    shipped face), widened to fit its labels; the config→UI→config projection is a pure
    reducer, verified end-to-end against the real built UI.
  • /tools and /new are exact-first-token console commands with fixed, bounded
    responses.
  • Docs: governed-tools & skills guide, the agent-config reference and a sample skill
    under docs/.

Artifacts

Two families in one release, exactly as v0.6.0. <ver> is the version without the
leading v (e.g. 0.7.0).

Family Artifact Target
Headless korvun_<ver>_{linux,darwin}_{amd64,arm64}.tar.gz, korvun_<ver>_windows_{amd64,arm64}.zip server / CLI, six OS·arch
Headless checksums.txt + .sig + .pem, per-archive *.sbom.json signed manifest + SBOMs
Desktop korvun-desktop_<ver>_darwin_universal.dmg macOS universal app
Desktop korvun-desktop_<ver>_windows_amd64-installer.exe Windows NSIS installer
Desktop korvun-desktop_<ver>_linux_amd64.tar.gz Linux binary + .desktop
Desktop checksums-desktop.txt + .sig + .pem signed desktop manifest

Draft-until-complete: the release is born a draft and is published only once
both families and their signatures are present, so a broken desktop build can never
expose a half-populated public release (ADR-0035 §8; SP7 §1e).

Verifying this release

Both families are signed keyless with cosign
(Sigstore), each with its own manifest. Verify the manifest signature you need, then
check your download against it.

Headless:

cosign verify-blob checksums.txt \
  --signature checksums.txt.sig \
  --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/Sebastian197/korvun/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Desktop:

cosign verify-blob checksums-desktop.txt \
  --signature checksums-desktop.txt.sig \
  --certificate checksums-desktop.txt.pem \
  --certificate-identity-regexp 'https://github.com/Sebastian197/korvun/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Full install and verification walkthrough: docs/packaging/INSTALL.md.
For governed tools and the builder: docs/BUILDER.md.

Assets 23
Loading