v0.12.0

First release published by publish.yml over GitHub OIDC trusted publishing rather than by hand.

This is the first huqan tarball that carries an npm provenance attestation tying it to this repository, this workflow, and commit 29112b74. Every earlier version, including v0.11.1, was uploaded manually and cannot be traced cryptographically back to its tag.

Evidence	Value
Publisher	GitHub Actions via trustedPublisher: github — no stored token
Attestation	SLSA provenance v1
gitHead	29112b7480f0dafea601ccff03977f8f0410c582

Both NPM_TOKEN secrets (repository and npm-publish environment) were deleted before this release. No workflow referenced them.

Carries 320 commits since v0.11.1 — see v0.11.1...v0.12.0 and CHANGELOG.md. Notable: the README was rewritten (#1964, #1965) after sitting empty on main; the public page and the npm page now show the same current text.

huqan v0.11.1

npm install -g huqan now serves 0.11.1. The previous release on this page was v0.10.0 — v0.10.1 and v0.11.0 were tagged but never reached the registry, so everything under those headings ships here for the first time.

Added

• fractal-learn (#1714). New huqan.fractal-learn MCP tool running a bounded recursive knowledge-synthesis loop: it chains kernel.dream rounds (hypothesis generation admitted through the mutation gate) and stops when the per-round entropy gain saturates (exhausted / saturated / maxRounds). Every write is receipted and the tool is gated mutating_requires_review, so the graph never grows silently.
• autoTune (#1716). huqan.fractal-learn gains a one-way autoTune mode: after each round it reads review feedback and tightens minScore / entropyFloor, but never loosens them automatically. Tightening is recorded per round; loosening always requires human approval.
• Graph health scoring and threshold tuning advice. huqan fitness scores graph health (coverage, precision, connectivity, consistency → A–F grade); huqan tuning turns review feedback into a threshold proposal — advice only, it never applies a change.
• Graceful shutdown on SIGTERM/SIGINT (#1697). server.js stops accepting connections and drains the HTTP server before closing observability timers, viewer state, approval storage, external-client resources and the kernel graph. A five-second fail-safe exits non-zero if the drain does not finish, so a container stop no longer severs in-flight requests silently.

Fixed

• Mutation journal replay tracking (#1671). Journal sections are null-prototype maps. On a plain object operations['__proto__'] = entry re-points the prototype instead of creating an own property, so a completed mutation left no record and the same operationId ran a second time; constructor and toString failed the other way, reading an inherited value back as a journal row. Persisted records keep own-property semantics across a JSON round trip.
• External client transport (#1672). scripts/external-client.js requires HTTPS for any bearer-authenticated destination that is not loopback. It previously sent authorization: Bearer <HUQAN_API_KEY> in the clear to whatever URL it was given. Plain HTTP survives only for 127.0.0.0/8, [::1] and localhost, where the request never reaches a network interface, and the check runs before the credential is read.
• Release authority (#1673). publish.yml checks the ref for every trigger, not only for tag pushes. A manual workflow_dispatch could reach npm publish from any ref, skipping the tag/version binding entirely. A publish now requires an immutable v<version> tag matching the manifest whose commit is an ancestor of the default branch, and the job runs in the npm-publish environment.
• Publishing from a release tag (#1745). The live Git guard in scripts/agent-context.js knew two shapes — sitting on the baseline branch, or working on a branch that already contains it. publish.yml checks out an immutable v<version> tag, which is deliberately behind origin/main by however many commits landed since the release, so the guard read a reviewed, merged commit as an unrebased feature branch and failed closed. A release checkout is now a third recognised state, admitted only on all three of: a detached HEAD, a v* tag at that commit, and reachability from origin/main. A detached HEAD without a tag, and a tag outside canonical ancestry, both still fail closed.

Note on this artifact

This tarball was uploaded by hand rather than by the release workflow, so it carries no npm provenance attestation — it cannot be cryptographically traced back to this tag. The source it was built from is ffbe070, the commit this tag points at.

The publish pipeline has since been moved off stored npm tokens onto GitHub OIDC trusted publishing (#1690), which attests every upload automatically. Releases from the next tag onward will carry provenance.

huqan v0.10.0

huqan v0.10.0

Huqan’ın ilk public npm yayını.

Yayın bilgileri

• npm paketi: huqan@0.10.0
• Git tag: v0.10.0
• Tag hedefi: d858b9f19d9b6d5f3a5e96ed1e78e5db98f93d32
• Lisans: AGPL-3.0-only

Doğrulama

• Paket sürümü npm registry’de 0.10.0 olarak doğrulandı.
• v0.10.0 tag’indeki package.json sürümü 0.10.0 ile eşleşiyor.
• Yayın öncesi package-closure ve tarball doğrulamaları tamamlandı.

Kurulum:

npm install huqan

Bu Release mevcut v0.10.0 tag’i üzerinden oluşturulmuştur; yeni bir tag oluşturulmamıştır.

HUQAN Trust Panel 1.1.0 beta

Beta release of HUQAN Trust Panel. Requires a local HUQAN runtime. Verification is read-only and the API key is restricted to loopback endpoints.