Skip to content

v0.2.9

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Sep 18:33
· 3 commits to main since this release
v0.2.9
efde9ef

Kavrix 0.2.9 — Recovery-verified local onboarding

Changelog (from CHANGELOG.md)

0.2.9 - 2026-09-02

Added

  • A bare no-option TTY kavrix init now provides a local-file guided setup that creates an encrypted database and owner key, creates and selects one default vault, creates a separately protected recovery kit, verifies that kit locally, and only then selects the new datastore profile.
  • Blank guided destinations use the private ~/.kavrix directory for the database, owner key, and recovery kit. The generated non-secret config.toml remains a command reference and is not loaded automatically.

Security and reliability

  • Guided setup preflights every visible destination before protected input and rechecks create-only artifact destinations immediately after publishing the unselected route.
  • Canonical collision checks cover filesystem aliases, conservatively reject case-only aliases across platforms, database and protected-file locks, owner/recovery anchors, the datastore profile registry, and the generated config reference.
  • Database binding, default-vault publication, and final profile selection now require an atomic match against the exact expected public route and authenticated database/vault bindings. Concurrent route replacement fails closed.
  • Failures after route publication retain recovery-capable state and leave no verified-completion claim. Final-selection publication uncertainty requires explicit profile-status reconciliation. Owned passphrase byte copies are wiped on every exit, and protected labels/passphrases remain absent from config, argv, terminal output, and serialized artifacts.

Compatibility

  • Explicitly routed or non-TTY root init retains the version 2 single-vault compatibility behavior. MongoDB and advanced routing continue to use the explicit db profile, db init, and db vault commands.

Details (from docs/release-notes-0.2.9.md)

Kavrix 0.2.9 turns the bare interactive kavrix init path into a complete local-file setup. It creates an encrypted database and owner key, creates one default vault, creates a separately protected recovery kit, verifies that kit locally, and selects the new profile only after every authenticated step succeeds.

The zero-knowledge boundary is unchanged: protected labels and passphrases stay inside the local CLI.

Guided local first run

Run a bare no-option command in a TTY:

kavrix init

Fail-closed publication

The route is initially published without selecting it. Database initialization binds that exact route, default-vault publication verifies the same database binding, and final selection atomically checks the complete expected file route, database ID, and default vault ID.

Destination and secret hardening

Preflight canonicalizes parent directories and rejects collisions across database, owner-key, recovery-kit, and revision-anchor targets, lock paths, the profile registry and generated config reference, symbolic-link aliases and case-only aliases on every platform.

Release verification

Publication is gated by the complete local release suite, focused real-storage and race/collision regressions, package smoke and content inspection, packed command and database-container acceptance, dependency audit, exact-commit CI and CodeQL, npm trusted publishing with provenance, registry SHA-512 integrity reconciliation, and GitHub release creation only after npm confirms kavrix@0.2.9.

Full Changelog: v0.2.8...v0.2.9

Assets 2
Loading