v0.6.0

Changelog

Features

• feat(runtime): hold an engine build to the same policy as a model
• feat(run,serve): hold what is loaded to what verified
• feat(verify): report the whole chain, and what it cannot prove
• feat(store): read an artifact's blobs back against its manifest
• feat(verify): check keyless signatures and carry them offline
• feat(policy): let a trust policy rule name a keyless identity
• feat(keyless): verify a Sigstore bundle offline

Fixes

• fix(pack): import safetensors models as recent releases save them
• fix(cli): read the store under a lock when run and serve start
• fix(store): stop collecting what only records a subject
• fix(serve): open the store afresh for every load
• fix(store): wait out an index caught halfway through a save
• fix(store): read the layout once the lock is held, not before it
• fix(store): stop unlinking a signature whose subject merely went missing
• fix(store): stop collection removing what nothing had orphaned
• fix(store): close three shapes that still hung, and let gc run twice
• fix(store): keep what the collector reaches, drop what it cannot place
• fix(store): decide against the tagged closure, as the collector does
• fix(store): decide an orphan by the whole subject chain, not one hop
• fix(store): recover from a referrer that already lost its tag
• fix(rm): take the attestation too, and keep a shared signature
• fix(store): remove a referrer instead of leaving it untagged
• fix(verify): sanitize every artifact-supplied string in a chain
• fix(runtime): hold every component above the unpack directory
• fix(verify): keep an artifact's own text out of the verdict beside it
• fix(pull): take back an output directory a refusal created
• fix(runtime): hold the unpack directory to being a directory
• fix(store): name a manifest with no config for what it is
• fix(pull): create a materialized file rather than write through one
• fix(verify): hold the resident copy to the artifact that verified
• fix(run): bound the fetch to the model that verified
• fix(runtime): unpack the engine that was checked, not the tag again
• fix(pull): fetch the artifact that was checked, not the tag again
• fix(pull): resolve a materialized file beneath the output directory
• fix(runtime): refuse two layers claiming one file name
• fix(pull): keep a materialized model inside the directory it was given
• fix(runtime): refuse a manifest before acting on it, and stage uniquely
• fix(pull): take back a partial model when materializing fails
• fix(pull): hold a materialized model to its manifest as it is written
• fix(runtime): refuse a config that would unpack outside the store
• fix(verify): re-read the blobs when asked, with or without a signature check
• fix(runtime): hold the unpacked engine to its manifest before spawning it
• fix(keyless): a forge is not a publisher
• fix(keyless): refuse a bundle format palan has not been taught
• fix(keyless): hold a subject pattern to the property, not a proxy
• fix(keyless): name a transparency log by whatever it calls itself
• fix(keyless): pin the authority in a subject, not a dotted token
• fix(keyless): prove when a signature was logged before trusting the date

Documentation

• docs: name the toolchain and linter version the project targets
• docs: show the local copy link and say what holds an unpack directory
• docs: record what containment covers and where the copy is compared
• docs(security): say what checking a copy out of the store requires
• docs(adr): record the verification surface
• docs(k8s): the gate pattern, with the refusal measured
• docs(keyless): say what the identity rules do not know
• docs: record how keyless signatures are verified offline
• docs: write down how a release is cut

---

Binaries are static (CGO disabled). The checksum file is signed with
cosign (keyless); see .goreleaser.yaml for the verify command.