Huda 1.2.0

Huda 1.2.0 hardens the source candidate. The release comes out of two multi-area reviews and adds security, correctness and robustness fixes. It is not a security-qualified release; packages remain unsigned or ad-hoc test candidates for Gatekeeper and SmartScreen.

Security

• Capture origin is bound to its source. A source created by a provider accepts only that provider's captures. A local import can no longer publish forged provider facts, or withdraw real ones, under a provider-created policy.
• Rejections are durable. A refresh of a rejected statement goes back to review instead of reopening it.
• Scoped model context. Semantic extraction shows the model only the entities of the scope its output is published to.
• Bridge. Scope is checked before any path is examined, kernel pseudo-files are refused, and typed Bridge output cannot cite evidence.
• Profile controls. Going online requires admin. Provider consent can be replaced only by a caller that can write its scope. init and add_principal issue fresh credentials instead of adopting entries a deleted profile left behind.

Changed behaviour

• A goal context over 512 KiB (counting relation markers) is trimmed instead of refused. It is marked truncated and does not claim the goal is met.
• Budget exhaustion, provider backoff or a provider timeout ends an expansion as partial, with its report, instead of failing it. A provider backoff now persists across Core restarts.

Fixes

• Query Core:
  • Seeds that resolve to one entity no longer cover a typed connection.
  • The negated twin of a mid-path step is checked for conflicts.
• Idempotency:
  • Committed assertions replay after a policy-epoch change.
  • Source retries are keyed by their inputs, not by model output.
  • A repeated expansion of a cached capture replays the earlier publication.
• Expansion and providers:
  • Expansion reserves each term's worst case before starting it.
  • Provider and model responses are bounded by a total deadline.
  • The limiter wait stays cancellable.
• Code adapter: over-long names are bounded per symbol instead of failing the whole file.
• Core and desktop:
  • huda core reports readiness only after it binds.
  • The desktop shows startup failures in a window.

Four findings of the earlier 1.1.0 review need a maintainer decision, and so do four new ones. All eight are listed in docs/open-decisions.md. See CHANGELOG.md for the full list.

Verify a download

Check the file against SHA256SUMS, then verify its Sigstore bundle with cosign 3.x:

cosign verify-blob --bundle "$FILE.sigstore.json" --certificate-identity "https://github.com/devsolux/huda/.github/workflows/desktop.yml@refs/tags/v1.2.0" --certificate-oidc-issuer https://token.actions.githubusercontent.com "$FILE"

A valid bundle shows which workflow run built the file. It is not a Developer ID, notarization or Authenticode signature.

Qualification

The following were executed on native macOS / Apple Silicon:

• formatting and strict Clippy;
• default, headless and all-feature tests;
• SQLite and desktop-asset checks;
• cargo audit;
• a locked release build.

The release workflow builds, tests, packages and signs all four targets. Still open:

• native installation, login, tray, secret-store and upgrade testing;
• the G0–G8 gates (see docs/verification/gates.md).

Huda 1.1.0

Huda 1.1.0 is a maintenance release of the source candidate: upgrade-safety, correctness and hardening fixes found in a multi-area review, plus a rustls security update. It is not a security-qualified release; packages remain unsigned or ad-hoc test candidates for Gatekeeper and SmartScreen.

Highlights

• Upgrade-safe provider consent. Provider policies saved by 1.0.0 stay valid; their User-Agent version token now follows the running build instead of reading back as "not configured".
• Relation identity. Relation types are stored under their registered key, so @01 and @1 no longer split one relation and hide a conflict.
• Untrusted model and source input. Compound citations such as [R1, R99] are fully validated, model extraction cannot attach evidence, and the optional code adapter bounds destructuring-export extraction so hostile input cannot overflow the Core's stack.
• Runtime robustness. The REST listener survives client resets, and a Core whose REST listener stops shuts down. An unlockable filesystem is no longer mistaken for a running Core or desktop, early Core exits are reported quickly, panicking MCP calls are answered, and the desktop offers Initialize profile again after an interrupted first run.
• Dependencies. rustls 0.23.46 fixes RUSTSEC-2026-0346 to -0349 (low severity). No other lock entry changed, and cargo audit is clean.

See CHANGELOG.md for the full list.

Verify a download

Check the file against SHA256SUMS, then verify its Sigstore bundle with cosign 3.x:

cosign verify-blob --bundle "$FILE.sigstore.json" --certificate-identity "https://github.com/devsolux/huda/.github/workflows/desktop.yml@refs/tags/v1.1.0" --certificate-oidc-issuer https://token.actions.githubusercontent.com "$FILE"

A valid bundle shows which workflow run built the file. It is not a Developer ID, notarization or Authenticode signature.

Qualification

Executed on native macOS / Apple Silicon: formatting, strict Clippy, default, headless and all-feature tests, SQLite and desktop-asset checks, cargo audit and a locked release build. The release workflow builds, tests, packages and signs all four targets. Native installation, login, tray, secret-store and upgrade testing and the G0–G8 gates remain open; see docs/verification/gates.md.

v1.0.0

Initial commit