Skip to content

Huda 1.2.0

Latest
Latest

Choose a tag to compare

View all tags
@devsolux devsolux released this 16 Oct 19:41
v1.2.0
3719801

Huda 1.2.0 hardens the source candidate. The release comes out of two multi-area reviews and adds security, correctness and robustness fixes. It is not a security-qualified release; packages remain unsigned or ad-hoc test candidates for Gatekeeper and SmartScreen.

Security

  • Capture origin is bound to its source. A source created by a provider accepts only that provider's captures. A local import can no longer publish forged provider facts, or withdraw real ones, under a provider-created policy.
  • Rejections are durable. A refresh of a rejected statement goes back to review instead of reopening it.
  • Scoped model context. Semantic extraction shows the model only the entities of the scope its output is published to.
  • Bridge. Scope is checked before any path is examined, kernel pseudo-files are refused, and typed Bridge output cannot cite evidence.
  • Profile controls. Going online requires admin. Provider consent can be replaced only by a caller that can write its scope. init and add_principal issue fresh credentials instead of adopting entries a deleted profile left behind.

Changed behaviour

  • A goal context over 512 KiB (counting relation markers) is trimmed instead of refused. It is marked truncated and does not claim the goal is met.
  • Budget exhaustion, provider backoff or a provider timeout ends an expansion as partial, with its report, instead of failing it. A provider backoff now persists across Core restarts.

Fixes

  • Query Core:
    • Seeds that resolve to one entity no longer cover a typed connection.
    • The negated twin of a mid-path step is checked for conflicts.
  • Idempotency:
    • Committed assertions replay after a policy-epoch change.
    • Source retries are keyed by their inputs, not by model output.
    • A repeated expansion of a cached capture replays the earlier publication.
  • Expansion and providers:
    • Expansion reserves each term's worst case before starting it.
    • Provider and model responses are bounded by a total deadline.
    • The limiter wait stays cancellable.
  • Code adapter: over-long names are bounded per symbol instead of failing the whole file.
  • Core and desktop:
    • huda core reports readiness only after it binds.
    • The desktop shows startup failures in a window.

Four findings of the earlier 1.1.0 review need a maintainer decision, and so do four new ones. All eight are listed in docs/open-decisions.md. See CHANGELOG.md for the full list.

Verify a download

Check the file against SHA256SUMS, then verify its Sigstore bundle with cosign 3.x:

cosign verify-blob --bundle "$FILE.sigstore.json" --certificate-identity "https://github.com/devsolux/huda/.github/workflows/desktop.yml@refs/tags/v1.2.0" --certificate-oidc-issuer https://token.actions.githubusercontent.com "$FILE"

A valid bundle shows which workflow run built the file. It is not a Developer ID, notarization or Authenticode signature.

Qualification

The following were executed on native macOS / Apple Silicon:

  • formatting and strict Clippy;
  • default, headless and all-feature tests;
  • SQLite and desktop-asset checks;
  • cargo audit;
  • a locked release build.

The release workflow builds, tests, packages and signs all four targets. Still open:

  • native installation, login, tray, secret-store and upgrade testing;
  • the G0–G8 gates (see docs/verification/gates.md).
Assets 14
Loading