Skip to content

BerryBrain v1.0.0

Choose a tag to compare

View all tags
@imsouza imsouza released this 14 Jul 01:57
v1.0.0
10b5a6e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

BerryBrain v1.0.0 Release Audit

Date: 14 July 2026
Repository: https://github.com/imsouza/berrybrain
Tag: v1.0.0
Commit: 10b5a6e28ed778672ca190cae09a92e2a6c2ab52
Planning result: 307/307 release criteria complete

Decision

BerryBrain v1.0.0 is approved as a functional, local-first, single-owner second brain release. Notes remain user-owned Markdown files. The cognitive pipeline, semantic memory, explainable knowledge graph, grounded insights, reviews, cognitive attachments, monitoring, backup/restore, and owner authentication are implemented and covered by reproducible checks.

Protected Delivery Evidence

  • main requires Backend, Worker, Web, Compose, Security, and CodeQL checks.
  • CODEOWNERS review, conversation resolution, force-push protection, and deletion protection are enabled.
  • 12 consecutive container smokes passed on commit dfb1ecb3d8256d38791bc7ca7a3c0a4d479a127c.
  • All required workflows passed again on release commit 10b5a6e28ed778672ca190cae09a92e2a6c2ab52.
  • The container smoke builds all services, scans images, starts Web/API/Worker, verifies health, creates a note, processes the cognitive pipeline, checks search, and generates an SBOM.

Evidence:

Test Evidence

  • API: 156 tests, coverage gate, Ruff, and MyPy.
  • Worker: 34 tests including disposable-database integration coverage.
  • Web: 13 Playwright production-browser checks against an isolated authenticated stack.
  • Security: dependency audits, Gitleaks, Trivy, and CodeQL.
  • Clean stack: Web, API, and Worker healthy; note pipeline completed; semantic search returned the created note.

Published Images

All images are OCI indexes for linux/amd64 and linux/arm64, with immutable semantic-version and commit-SHA tags.

Service Image Manifest digest
API ghcr.io/imsouza/berrybrain-api:1.0.0 sha256:b951271f6d1486af40c3a6c27909f0f096867e22275982f36ddeadad6c274b34
Worker ghcr.io/imsouza/berrybrain-worker:1.0.0 sha256:74c7fa4431fd49400c9b615f719614a9b690935e98f1b0625208036f919b4c19
Web ghcr.io/imsouza/berrybrain-web:1.0.0 sha256:9b614aaf83f7a1754553abdf23e26f7bc864d5e4c4200d16c50e81ed505843e2

Signatures And Attestations

Cosign 3.0.6 verified all three image signatures against:

  • certificate identity: https://github.com/imsouza/berrybrain/.github/workflows/release.yml@refs/tags/v1.0.0
  • OIDC issuer: https://token.actions.githubusercontent.com
  • offline transparency-log inclusion;
  • trusted certificate authority roots.

The release workflow also attached SPDX JSON attestations to each image digest.

Release SBOMs

Asset SHA-256
berrybrain-api-v1.0.0.spdx.json a6a4373a11843c755689f372b4ce5a4f62d040c80eca932dd5710f97b52a0ec0
berrybrain-worker-v1.0.0.spdx.json 260fe5445cc3663f6460ef624ffb8918e425c31a8986aa0abd1ca8ff391872d5
berrybrain-web-v1.0.0.spdx.json 9f270ad57e5f81c9d33c146b3dd6c542a53f9cd8123cfaf81a479f97f1e4b16f

Scope And Limitations

  • The release is single-owner and self-hosted; it is not a hosted multi-user service.
  • Cloud providers are optional and require explicit configuration and consent.
  • Knowledge quality still depends on source quality, configured models, and available evidence.
  • The license permits personal, educational, research, and internal non-commercial use; commercial use requires written permission.

Conclusion

The v1.0.0 release gates are complete. BerryBrain qualifies as a mature, evidence-backed second brain within its documented single-owner, local-first scope.

Assets 6
Loading