AkôFlow 1.0.10

AkôFlow 1.0.10

This release integrates the execution, planning, transfer and Desktop improvements validated for the 1.0.10 release.

• Shared planning/SimGrid materialization stages, whole-workspace byte accounting and explicit calibration provenance.
• Per-dependency routing: mandatory cloud ↔ HPC relay; authenticated eligible cloud peers; proven shared HPC storage; exact-instance local copies.
• Verified compressed snapshots, reader-safe archive reuse, streaming extraction and conflict-safe consumer barriers.
• Safer recovery, exact cloud-generation SSH trust, bounded Slurm reconciliation and explicit CPU-capacity admission.
• Workflow-filtered execution pagination, Desktop navigation and runtime-version pinning.
• Runnable local workflow examples and verified physical output manifests.
• Dependency security updates and reproducible depth-limit mitigation for the unpatched upstream braces advisory.

Validation and limitations

Go tests, native SimGrid tests, Desktop build/regressions and documentation checks were validated. Scientific profiles retain measured-versus-estimated provenance; this release does not claim global ±20% prediction accuracy. Recovered references are not independent cold-run benchmarks.

Upstream GHSA-vfj7-8cjw-p6xm has no patched braces version. A version-bound, fail-closed local patch is applied on installation, and CI verifies malicious patterns, direct AST depth and normal glob compatibility. The original version/advisory remains documented; the audit gate rejects other advisories.

Functioning workflow screenshots

These are preserved reference screenshots of completed local Docker workflows, not newly executed cloud benchmarks.

Completed ML workflow: five activities completed, with dependency staging visible.

RAG generated files: observed outputs with sizes and SHA-256 checksums.

Screenshot integrity is provided in the attached screenshots.sha256 file.

Reproducible packaging

Application source tags were not moved. The reviewed packaging recipe rebuilds the frozen tags with distinct Windows setup/portable names and validates updater SHA-512 values against the distributed packages before upload. Core application code remains the tagged source; the packaging correction is explicit rather than hidden by rewriting a tag.

Installation

Docker Desktop is required on macOS and Windows; Linux requires Docker Engine and Compose v2. Use the universal macOS DMG, the Windows portable executable or the separate setup installer, and the Linux AppImage or Debian package. Runtime archives are loaded locally by Desktop. Packages follow the project's unsigned-build configuration.