v0.2.0

The first release since palan was validated against real infrastructure
rather than CI alone: a registry on object storage, a Kubernetes cluster, and
a GPU host. That exercise found the two fixes below, and neither could have
been caught by the test suite.

Runtime artifacts now work on hosts without llama.cpp installed. A runtime
packed with palan runtime pack ships its shared libraries alongside the
executable, but nothing told the dynamic loader where to find them. On a host
that already had llama.cpp the process started against the host's libraries
and appeared fine; on a host without it, the same artifact failed at startup.
The second case is the air-gapped host this delivery path exists for. palan now
points the loader at the unpacked runtime directory.

If you pack runtimes, note that ldd is not a sufficient inventory: llama.cpp
opens its compute backends with dlopen, so they never appear there and must
be packed explicitly. llama-server --list-devices reports what actually
loaded. The air-gap guide
covers this.

The zot deployment example could not start. Three values in
deploy/zot/values.yaml were wrong together: a storage root no volume backed,
deduplication enabled without the remote cache an S3 backend requires, and a
metrics endpoint that answered 403 to every caller including its own scraper.
All three are fixed, with the constraints documented inline.

GPU offload comes from the model, not from serve. --n-gpu-layers is
passed only when a model was packed with pack --ngl. Recent llama.cpp builds
offload fully on their own, which hides the difference, but a build that
defaults to none will serve from CPU with nothing in the logs to say so.

Also in this release: a palan describe command for inspecting a model's
metadata and layer digests without moving weights, corrected documentation of
how signatures are stored and verified, and Go 1.26 as the minimum version.

Releases now carry SLSA provenance as an .intoto.jsonl asset alongside the
existing cosign-signed checksums and SBOMs.

Changelog

Features

• feat(cli): add describe command
• feat(refname): hint that repository names must be lowercase
• feat(version): fall back to module build info for unstamped builds

Fixes

• fix(runtime): point the loader at libraries packed with a runtime
• fix(deploy): correct zot values that prevented the registry from serving

Documentation

• docs: bring the roadmap up to date with validation results
• docs: state the testing policy and how releases disclose vulnerabilities
• docs: add release and Go version badges to the README
• docs: drop an em-dash from the quickstart GPU note
• docs(air-gap): note that compute backends are invisible to ldd
• docs: record that GPU offload comes from the packed ngl
• docs: correct how signatures are stored and verified
• docs(k8s): record that raw artifacts do not mount as image volumes
• docs(architecture): redraw the overview diagram
• docs(quickstart): explain importing models from Ollama and Hugging Face
• docs: revise prose across docs, comments, and CLI help
• docs(readme): describe interop and serving directly
• docs: retire design doc from public repo, add architecture.md

Other

• build: make generated release notes readable
• build: move to Go 1.26
• build: pin container base images by digest

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.