v1.3.0rc20

Consulte o CHANGELOG.md para as novidades desta versão.

Instalação rápida (detalhes em docs/INSTALL.md):

• Mac/Linux: baixe install.sh + o .whl, rode bash install.sh
• Windows: baixe install.ps1 + o .whl, rode no PowerShell
• ou apenas: pip install nomos-*.whl

Verifique a integridade dos artefatos com SHA256SUMS
(sha256sum --check SHA256SUMS).

Esta release inclui sbom.cdx.json (CycloneDX 1.5): inventário
de dependências para auditoria de supply chain.

Para a proveniência criptográfica dos artefatos:
gh attestation verify <artefato> -R Voltolini-SPACE/NOMOS.

O NOMOS nunca se atualiza sozinho: para checar novidades,
rode nomos atualizar (opt-in, com sua aprovação).

What's Changed

• H4.9 — reproducible supply chain and release hardening by @Voltolini-SPACE in #2

New Contributors

• @Voltolini-SPACE made their first contribution in #2

Full Changelog: v1.3.0rc19...v1.3.0rc20

v1.3.0rc19

Consulte o CHANGELOG.md para as novidades desta versão.

Instalação rápida (detalhes em docs/INSTALL.md):

• Mac/Linux: baixe install.sh + o .whl, rode bash install.sh
• Windows: baixe install.ps1 + o .whl, rode no PowerShell
• ou apenas: pip install nomos-*.whl

Verifique a integridade dos artefatos com SHA256SUMS
(sha256sum --check SHA256SUMS).

Esta release inclui sbom.cdx.json (CycloneDX 1.5): inventário
de dependências para auditoria de supply chain.

O NOMOS nunca se atualiza sozinho: para checar novidades,
rode nomos atualizar (opt-in, com sua aprovação).

Full Changelog: v1.3.0rc18...v1.3.0rc19

v1.3.0rc18

Consulte o CHANGELOG.md para as novidades desta versão.

Instalação rápida (detalhes em docs/INSTALL.md):

• Mac/Linux: baixe install.sh + o .whl, rode bash install.sh
• Windows: baixe install.ps1 + o .whl, rode no PowerShell
• ou apenas: pip install nomos-*.whl

Verifique a integridade dos artefatos com SHA256SUMS
(sha256sum --check SHA256SUMS).

Esta release inclui sbom.cdx.json (CycloneDX 1.5): inventário
de dependências para auditoria de supply chain.

O NOMOS nunca se atualiza sozinho: para checar novidades,
rode nomos atualizar (opt-in, com sua aprovação).

Full Changelog: v1.3.0rc17-cockpit-conexoes...v1.3.0rc18

v1.3.0rc17-cockpit-conexoes

Consulte o CHANGELOG.md para as novidades desta versão.

Instalação rápida (detalhes em docs/INSTALL.md):

• Mac/Linux: baixe install.sh + o .whl, rode bash install.sh
• Windows: baixe install.ps1 + o .whl, rode no PowerShell
• ou apenas: pip install nomos-*.whl

Verifique a integridade dos artefatos com SHA256SUMS
(sha256sum --check SHA256SUMS).

O NOMOS nunca se atualiza sozinho: para checar novidades,
rode nomos atualizar (opt-in, com sua aprovação).

Full Changelog: v1.3.0rc4-motor-council-dry-run...v1.3.0rc17-cockpit-conexoes

NOMOS v1.3.0rc4 — Motor Council Dry-run

NOMOS v1.3.0rc4 prepares the Motor Council dry-run stack: a multi-engine
review-and-arbitration pipeline that runs entirely in memory, entirely
local, and entirely without executing a real model, before any future real
integration.

Included

• Data models.
• Offline simulator.
• Local provider contract.
• Local adapter dry-run.
• Real execution harness locked with hardcoded false flag
  (REAL_LOCAL_ENGINE_EXECUTION_ENABLED = False, no activation API).
• Policy gate dry-run (A0–A6).
• Private audit envelope dry-run (metadata-only).
• Orchestrator dry-run (composes all of the above into one deterministic,
  fail-closed pipeline).
• CLI/chat UX specification (nomos conselho / /conselho — spec only, not
  implemented).
• Technical index consolidating MC0–MC9.

Security posture

REAL_ENGINE_EXECUTION=false
REAL_POLICY=false
REAL_AUDIT=false
REAL_VAULT=false
REAL_APPROVAL=false
CLOUD=false
NETWORK=false
SUBPROCESS=false
PERSISTENCE=false
CLI_IMPLEMENTED=false
CHAT_IMPLEMENTED=false

Every module in nomos.council is proven, by AST-based test (not
convention), to import no network, subprocess, threading/asyncio, cloud SDK,
real local-engine runtime, or real kernel policy/vault/approval module.

Validation

PYTEST=778
CI=17/17

12 test jobs across 3 OS × 4 Python versions, plus informational coverage,
informational mypy, and post-install wheel smoke tests on 3 OS — all green
on the tagged commit before this tag was created. Package builds cleanly as
a wheel and sdist (attached below); a sandbox-mount-only quirk in the
authoring environment does not affect the published package.

Not included

• No real engine execution.
• No real CLI (nomos conselho is specified, not implemented).
• No real chat command (/conselho is specified, not implemented).
• No PyPI publication.
• No production release.

Installation

• Mac/Linux: download install.sh + the .whl below, run bash install.sh
• Windows: download install.ps1 + the .whl below, run it in PowerShell
• or simply: pip install nomos-*.whl

Verify artifact integrity with SHA256SUMS (sha256sum --check SHA256SUMS).

NOMOS never updates itself: to check for news, run nomos atualizar
(opt-in, with your approval).

Full Changelog: v1.2.0rc3-audit-anchored...v1.3.0rc4-motor-council-dry-run

NOMOS v1.2.0rc3 — Audit Anchored

NOMOS v1.2.0rc3 — Audit Anchored

Summary

This technical release candidate closes the audit log tail truncation gap
disclosed in v1.2.0rc2-security-audited. The audit log now supports
vault-backed HMAC-SHA256 anchoring.

Security Improvement

Added HMAC anchoring for audit logs. The anchor protects:

• final chain tip
• total entries count
• log id
• schema version
• anchor metadata

The HMAC key is protected by the local NOMOS vault.

What this prevents

After anchoring, verification can detect:

• modification
• reordering
• middle deletion
• tail truncation
• chain rewrite attempts without the HMAC key

Validation

• 520 tests passing
• 17 new audit-anchor tests
• CI green on Linux, macOS and Windows
• 17/17 CI jobs passing
• Wheel build validated
• Post-install smoke validated
• nomos doutor validated

Compatibility

Legacy unanchored logs produce a warning, not a silent success.

Known Residual Risks

Entries after the latest anchor are only hash-chain protected until re-anchored.
Anyone with the correct vault passphrase can create a new valid anchor.
External append-only anchoring is not included.

Not Included

• Motor Council
• PyPI publication
• read-write panel
• Obsidian integration
• new product features

Recommended Use

Preferred technical pre-release for controlled adoption and further security review.
Suggested tag: v1.2.0rc3-audit-anchored.

NOMOS v1.2.0rc2 — Security Audited

⏭️ Superseded by v1.2.0rc3-audit-anchored, which additionally closes the audit-log tail-truncation gap (vault-anchored HMAC). Prefer rc3.

NOMOS v1.2.0rc2 — Security Audited

Summary

This is a technical release candidate for controlled adoption and security review.

It includes the delivery-ready NOMOS v1.2.0rc1 work plus a post-audit security fix for skill manifest path safety.

Security Fix

Fixed a skill manifest path safety issue where an unsafe absolute entry path could point outside the installed skill directory and outside the checksummed file set.

Mitigation

• Absolute paths are rejected.
• .. traversal is rejected.
• Windows drive paths are rejected.
• entry must be present in files.
• entry must be covered by checksum.
• Runtime execution includes defense-in-depth path validation.

Validation

• 503 tests passing.
• CI green on Linux, macOS and Windows.
• 17/17 CI jobs passing.
• Wheel build validated.
• Post-install smoke validated.
• nomos doutor validated.
• python -m nomos doutor validated.
• Official agents included in wheel and validated.

Known Gaps

Audit log tail truncation

The current unkeyed hash-chain detects modification, reordering and removal from the middle of the log, but it does not detect truncation of the last entries.

Future mitigation should use HMAC anchored in the vault, signed checkpoints, or another keyed integrity anchor.

Not Included

This release does not include:

• Motor Council
• PyPI publication
• read-write panel
• Obsidian integration
• new features beyond the audited fix and release documentation

Recommended Use

Use as a technical pre-release for security review and controlled adoption.

Do not treat this as the final stable release.

v1.2.0rc1-delivery-ready

⚠️ Superseded by v1.2.0rc2-security-audited. This build predates a post-audit security fix for skill manifest path safety. Use v1.2.0rc2-security-audited for any review or adoption.

Consulte o CHANGELOG.md para as novidades desta versão.

Instalação rápida (detalhes em docs/INSTALL.md):

• Mac/Linux: baixe install.sh + o .whl, rode bash install.sh
• Windows: baixe install.ps1 + o .whl, rode no PowerShell
• ou apenas: pip install nomos-*.whl

Verifique a integridade dos artefatos com SHA256SUMS
(sha256sum --check SHA256SUMS).

O NOMOS nunca se atualiza sozinho: para checar novidades,
rode nomos atualizar (opt-in, com sua aprovação).

Full Changelog: v1.0.0rc1...v1.2.0rc1-delivery-ready

v1.0.0rc1

Consulte o CHANGELOG.md para as novidades desta versão.

Instalação rápida (detalhes em docs/INSTALL.md):

• Mac/Linux: baixe install.sh + o .whl, rode bash install.sh
• Windows: baixe install.ps1 + o .whl, rode no PowerShell
• ou apenas: pip install nomos-*.whl

Verifique a integridade dos artefatos com SHA256SUMS
(sha256sum --check SHA256SUMS).

O NOMOS nunca se atualiza sozinho: para checar novidades,
rode nomos atualizar (opt-in, com sua aprovação).

Full Changelog: https://github.com/Voltolini-SPACE/NOMOS/commits/v1.0.0rc1