v0.6.0

Changelog

Features

• feat(runtime): hold an engine build to the same policy as a model
• feat(run,serve): hold what is loaded to what verified
• feat(verify): report the whole chain, and what it cannot prove
• feat(store): read an artifact's blobs back against its manifest
• feat(verify): check keyless signatures and carry them offline
• feat(policy): let a trust policy rule name a keyless identity
• feat(keyless): verify a Sigstore bundle offline

Fixes

• fix(pack): import safetensors models as recent releases save them
• fix(cli): read the store under a lock when run and serve start
• fix(store): stop collecting what only records a subject
• fix(serve): open the store afresh for every load
• fix(store): wait out an index caught halfway through a save
• fix(store): read the layout once the lock is held, not before it
• fix(store): stop unlinking a signature whose subject merely went missing
• fix(store): stop collection removing what nothing had orphaned
• fix(store): close three shapes that still hung, and let gc run twice
• fix(store): keep what the collector reaches, drop what it cannot place
• fix(store): decide against the tagged closure, as the collector does
• fix(store): decide an orphan by the whole subject chain, not one hop
• fix(store): recover from a referrer that already lost its tag
• fix(rm): take the attestation too, and keep a shared signature
• fix(store): remove a referrer instead of leaving it untagged
• fix(verify): sanitize every artifact-supplied string in a chain
• fix(runtime): hold every component above the unpack directory
• fix(verify): keep an artifact's own text out of the verdict beside it
• fix(pull): take back an output directory a refusal created
• fix(runtime): hold the unpack directory to being a directory
• fix(store): name a manifest with no config for what it is
• fix(pull): create a materialized file rather than write through one
• fix(verify): hold the resident copy to the artifact that verified
• fix(run): bound the fetch to the model that verified
• fix(runtime): unpack the engine that was checked, not the tag again
• fix(pull): fetch the artifact that was checked, not the tag again
• fix(pull): resolve a materialized file beneath the output directory
• fix(runtime): refuse two layers claiming one file name
• fix(pull): keep a materialized model inside the directory it was given
• fix(runtime): refuse a manifest before acting on it, and stage uniquely
• fix(pull): take back a partial model when materializing fails
• fix(pull): hold a materialized model to its manifest as it is written
• fix(runtime): refuse a config that would unpack outside the store
• fix(verify): re-read the blobs when asked, with or without a signature check
• fix(runtime): hold the unpacked engine to its manifest before spawning it
• fix(keyless): a forge is not a publisher
• fix(keyless): refuse a bundle format palan has not been taught
• fix(keyless): hold a subject pattern to the property, not a proxy
• fix(keyless): name a transparency log by whatever it calls itself
• fix(keyless): pin the authority in a subject, not a dotted token
• fix(keyless): prove when a signature was logged before trusting the date

Documentation

• docs: name the toolchain and linter version the project targets
• docs: show the local copy link and say what holds an unpack directory
• docs: record what containment covers and where the copy is compared
• docs(security): say what checking a copy out of the store requires
• docs(adr): record the verification surface
• docs(k8s): the gate pattern, with the refusal measured
• docs(keyless): say what the identity rules do not know
• docs: record how keyless signatures are verified offline
• docs: write down how a release is cut

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.

v0.5.0

Changelog

Features

• feat(cli): name the publisher key a source must be signed with
• feat(cli): verify against the identities a policy allows
• feat(cli): read a trust policy from the config
• feat(trustpolicy): decide which keys may sign a reference
• feat(trustpolicy): match a reference against a pattern
• feat(cli): say when a model lost the provenance its layers claim
• feat(transfer): report how many attestations a bundle carries
• feat(transfer): carry the attestation with the model
• feat(cli): attest to a model's sources when signing it
• feat(attest): state where an artifact's layers came from
• feat(cli): carry a fetched file's source into the packer
• feat(pack): record where a fetched file came from
• feat(cli): check an import against the publisher's signature
• feat(omsig): read the signature a model repository publishes
• feat(cli): pack a whole repository, keeping each file's digest
• feat(pack): record the digest each file was published under
• feat(hf): resolve a whole published model
• feat(cli): report the weight encoding, and carry a model's licence

Fixes

• fix(ci): decide from the changed files rather than a pattern library
• fix(ci): make the change filter subtract from everything
• fix(cli): hold an attestation to the identity that signed the artifact
• fix(trustpolicy): bound ** segments to prevent exponential backtracking
• fix(signing): resolve an attestation by the reference its target uses
• fix(cli): lay fetched files out under their repository path
• fix(hf): name the endpoint a repository was actually fetched from
• fix(cli): report a manifest that cannot say what was owed
• fix(hf): refuse an encoded walk and escape the path on the wire
• fix(cli): say how much of an artifact an attestation covers
• fix(cli): give every fetched file a directory of its own
• fix(hf): check a published path where it is decoded
• fix(cli): name the same layer every time an attestation falls short
• fix(hf): hold a paths-info response to the files that were requested
• fix(cli): match an attestation's records against whole layers
• fix(signing): annotate an attestation the way cosign reads one
• fix(transfer): report whether a source attestation travelled
• fix(signing): read attestations and tags consistently with the rest of the store
• fix(attest): validate the caller's subject digest before comparing it
• fix(hf): validate a reported commit and pin every request to it
• fix(hf): fetch from the commit the listing resolved to
• fix(cli): isolate each fetched repository under its own directory
• fix(omsig): read per-file digests from predicate.resources
• fix(cli): refuse local files and misreported failures under --oms-key
• fix(omsig): reject empty and malformed sha256 digests
• fix(e2e): stop the supervised child instead of orphaning it

Documentation

• docs: say when each set of verification rules is read
• docs: describe the trust policy and what it refuses
• docs(roadmap): separate keyless verification from the policy it extends
• docs: shorten three comments to what they explain
• docs: give the sample verify output a language
• docs: describe the listing check as the drop it is
• docs: record what a missing attestation costs and what says so
• docs: record what an attestation does and does not settle
• docs: record how a source attestation binds layers to upstream files
• docs(adr): record verifying a publisher's signature at import
• docs(readme): state what an import checks and what CI proves
• docs: scope the import digest check to what a repository publishes
• docs: packing a repository, and what its signature is checked against
• docs(roadmap): lay out the milestones from import provenance to 1.0
• docs(roadmap): plan the provenance chain from a publisher to a load
• docs(comparison): record where KitOps verifies a signature
• docs: say what the remaining validation actually waits on
• docs(readme): add the OpenSSF Best Practices badge
• docs(readme): say how to obtain palan, and how to check what you obtained
• docs: correct three claims that had drifted from what the code does
• docs: separate the Kubernetes patterns that were run from the one that was not
• docs(readme): describe zero-copy and packing for both weight formats

Other

• refactor(cli): fill an attestation reference only where it is read
• build(deps): bump golang.org/x/crypto to v0.56.0
• build: lint markdown as part of check
• refactor(cli): spell out what makes two layer records the same
• build: build on the newest patch of the Go toolchain
• refactor(safetensors): name the files a model travels with in one place
• build(release): describe the image by what it distributes and what it serves

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.

v0.4.0

Changelog

Features

• feat(cli): pack a safetensors model directory
• feat(pack): pack a safetensors model whole, or refuse it
• feat(safetensors): read config.json and the shard index
• feat(safetensors): read the tensor header, parameter count and dtype

Fixes

• fix(pack): record a safetensors dtype as the config precision
• fix(serve): refuse an artifact whose weights llama.cpp cannot read

Documentation

• docs(roadmap): safetensors distribution is exercised end to end
• docs: record the distribution path as the README demonstration
• docs(pack): record why a shared weight does not trip the shard-size check
• docs(roadmap): narrow the safetensors validation gap to what is still open
• docs(roadmap): record format-neutral distribution and the gaps it leaves
• docs(readme): name safetensors where the README described GGUF alone
• docs(adr): record that distribution is format-neutral and serving is not
• docs(comparison): split distribution from serving
• docs(readme): lead with distribution and name the two audiences
• docs: move the tool comparison to a dated page and correct it
• docs: describe third-party marks and name the image vendor
• docs: route questions to the Discussions Q&A category
• docs: add NOTICE with third-party attribution

Other

• refactor(pack): read model metadata through a format-neutral type
• build: generate NOTICE and gate it on the module graph
• build(release): ship LICENSE and NOTICE with the archives and the image

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.

v0.3.2

Changelog

Fixes

• fix(pack): pack a split model whole, or refuse it

Documentation

• docs(deploy): describe the object store by what zot needs from it

Other

• build(deps): group the codeql-action updates

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.

v0.3.1

Changelog

Fixes

• fix(deps): raise goldmark past a cross-site scripting advisory

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.

v0.3.0

Changelog

Features

• feat(cli): pick a model when the command names none
• feat(cli): render the model's replies as it writes them
• feat(cli): align listings without breaking on colour
• feat(cli): styled help, errors, completions and man pages
• feat(cli): decide in one place how output is styled
• feat(signing): verify a signature found through referrers
• feat(signing): index signatures through the referrers API
• feat(cli): pack accepts hf:// sources
• feat(hf): resolve and fetch models from Hugging Face
• feat(cli): enforce the verification policy when a model is served
• feat(cli): let load enforce the verification policy
• feat(transfer): carry signatures through pull, save, and cp

Fixes

• fix(store): reclaim a model whose signature outlived it
• fix(transfer): never fail a transfer over the signature lookup
• fix(cli): stop a signature-shaped tag bypassing bundle verification

Documentation

• docs(roadmap): image volumes are confirmed on the containerd K3s embeds
• docs(deploy): a redirecting registry must redirect somewhere the node can reach
• docs: the terminal experience
• docs(cli): show one real invocation per command
• docs: signatures are discoverable through the referrers API
• docs(router): cite the architecture document by heading
• docs: pack straight from Hugging Face
• docs: verification covers every way a model gets used
• docs: signature identity includes the registry host
• docs(adr): record how signatures are stored and verified
• docs: signatures verify offline from a bundle

Other

• refactor(signing): verify from any read-only target

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.

v0.2.0

The first release since palan was validated against real infrastructure
rather than CI alone: a registry on object storage, a Kubernetes cluster, and
a GPU host. That exercise found the two fixes below, and neither could have
been caught by the test suite.

Runtime artifacts now work on hosts without llama.cpp installed. A runtime
packed with palan runtime pack ships its shared libraries alongside the
executable, but nothing told the dynamic loader where to find them. On a host
that already had llama.cpp the process started against the host's libraries
and appeared fine; on a host without it, the same artifact failed at startup.
The second case is the air-gapped host this delivery path exists for. palan now
points the loader at the unpacked runtime directory.

If you pack runtimes, note that ldd is not a sufficient inventory: llama.cpp
opens its compute backends with dlopen, so they never appear there and must
be packed explicitly. llama-server --list-devices reports what actually
loaded. The air-gap guide
covers this.

The zot deployment example could not start. Three values in
deploy/zot/values.yaml were wrong together: a storage root no volume backed,
deduplication enabled without the remote cache an S3 backend requires, and a
metrics endpoint that answered 403 to every caller including its own scraper.
All three are fixed, with the constraints documented inline.

GPU offload comes from the model, not from serve. --n-gpu-layers is
passed only when a model was packed with pack --ngl. Recent llama.cpp builds
offload fully on their own, which hides the difference, but a build that
defaults to none will serve from CPU with nothing in the logs to say so.

Also in this release: a palan describe command for inspecting a model's
metadata and layer digests without moving weights, corrected documentation of
how signatures are stored and verified, and Go 1.26 as the minimum version.

Releases now carry SLSA provenance as an .intoto.jsonl asset alongside the
existing cosign-signed checksums and SBOMs.

Changelog

Features

• feat(cli): add describe command
• feat(refname): hint that repository names must be lowercase
• feat(version): fall back to module build info for unstamped builds

Fixes

• fix(runtime): point the loader at libraries packed with a runtime
• fix(deploy): correct zot values that prevented the registry from serving

Documentation

• docs: bring the roadmap up to date with validation results
• docs: state the testing policy and how releases disclose vulnerabilities
• docs: add release and Go version badges to the README
• docs: drop an em-dash from the quickstart GPU note
• docs(air-gap): note that compute backends are invisible to ldd
• docs: record that GPU offload comes from the packed ngl
• docs: correct how signatures are stored and verified
• docs(k8s): record that raw artifacts do not mount as image volumes
• docs(architecture): redraw the overview diagram
• docs(quickstart): explain importing models from Ollama and Hugging Face
• docs: revise prose across docs, comments, and CLI help
• docs(readme): describe interop and serving directly
• docs: retire design doc from public repo, add architecture.md

Other

• build: make generated release notes readable
• build: move to Go 1.26
• build: pin container base images by digest

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.

v0.1.0

Changelog

Features

• cd042a3 feat(signing): cosign-compatible sign and verify with pull gate
• 95e2eb1 feat(deploy): zot deployment assets and K8s consumption examples
• 23b96e8 feat(cli): pull --output materializes model files
• df10e31 feat(transfer): cp, save, and load for air-gap transfer
• b952fc9 feat(cli): serve command
• 3c2e733 feat(router): OpenAI-compatible multi-model router
• 68a1c84 feat(cli): run command with interactive chat and one-shot prompt
• 337589d feat(runtime): llama-server supervisor and runtime artifacts
• 12ee79c feat(cli): pack command
• e15f67f feat(pack): deterministic ModelPack builder with car profile
• f735615 feat(gguf): minimal GGUF header reader
• b14fd3a feat(cli): root command plus pull, push, ls, rm, gc, login
• 748c055 feat(transfer): registry pull/push engine with resume
• eb496b7 feat(store): content-addressed OCI image-layout local store
• 0fe8668 feat(modelspec): ModelPack media types and config schema

Fixes

• 7f2515f fix(release): adopt the cosign v3 bundle format for checksum signing
• 9579cd3 fix(release): copy per-platform binary in release image build

Documentation

• 3d1c62b docs: record ADR-0006 renaming the project to palan
• 96d718d docs: README, quickstart, and reference documentation
• f5961b1 docs: air-gap and Kubernetes guides
• 1366e23 docs: record ADR-0001 through ADR-0005
• 52b2af3 docs: add community and governance files
• 700c9f6 docs: add design document v0.2

Other

• ae4c459 refactor: rename project from moci to palan
• 3dad443 ci: markdownlint for the documentation
• ac6d121 ci: fix toolchain pinning for interop tools and govulncheck
• 1bdf004 chore: ignore private working notes
• 9ef5754 ci(release): goreleaser with SBOM, signing, and puller image
• d8b819e test(interop): e2e round-trip against zot, oras, and modctl
• 25957e4 ci: add lint, test, and vulnerability workflows
• 26cd289 chore: bootstrap Go module and repo hygiene
• 897f95b first commit

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.