v0.3.2

nitrovin v0.3.2 with NHTSA vPIC data month 2026_10 embedded.

brew install joshuasprow/tap/nitrovin
scoop bucket add joshuasprow https://github.com/joshuasprow/scoop-bucket && scoop install nitrovin
go install github.com/joshuasprow/nitrovin/cmd/nitrovin@v0.3.2
docker run --rm -p 8080:8080 ghcr.io/joshuasprow/nitrovin:v0.3.2

Linux packages, for amd64 and arm64 (put arm64 for amd64):

sudo apt install ./nitrovin_0.3.2_linux_amd64.deb                # Debian, Ubuntu
sudo dnf install ./nitrovin_0.3.2_linux_amd64.rpm                # Fedora, RHEL
sudo apk add --allow-untrusted ./nitrovin_0.3.2_linux_amd64.apk  # Alpine

MCP clients that read the MCP Registry find the
server as io.github.joshuasprow/nitrovin (this image, run with mcp; server.json here).

Every asset has a cosign keyless bundle. To verify the release, then one
asset directly:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
sha256sum --check --ignore-missing checksums.txt
cosign verify-blob --bundle nitrovin_0.3.2_linux_amd64.deb.sigstore.json \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com nitrovin_0.3.2_linux_amd64.deb
cosign verify ghcr.io/joshuasprow/nitrovin:v0.3.2 \
  --certificate-identity https://github.com/joshuasprow/nitrovin/.github/workflows/release.yml@refs/tags/v0.3.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Changelog

• 426dbda adr 0014: published identities after the move to marcy-cloud (#185) (#201)
• 886e111 ci: run contract tests when README.md changes (TestFormREADME) (#199)
• 72f3d67 deploy: turn Cloudflare Web Analytics off for nitrovin.app (#192) (#204)
• ddd9574 release: submit to winget only when WINGET_SUBMIT is true (#116) (#203)
• f76a3d8 tests: the vocabulary fixture runs on any data month, required to pass in contract.yml (#196) (#205)
• 2e13208 ui: /vocab offers part vocabularies as targets, a form from an entry per spine (#198) (#202)
• 86e4804 ui: one Vocabularies page, plain intro, slim list with Details (demo) (#215)
• ff5a86b ui: the Ram example VIN with a valid check digit (demo) (#219)
• ae8b5a1 ui: top nav, plain decode page and a vehicle summary (demo) (#217)
• 3dd5318 ui: translate shows names first, result on top, default targets (demo) (#216)

Benchmarks

bench/vocab on AMD EPYC 9V74 80-Core Processor, linux/amd64, go1.27.3. Requests run on one core: p50 / p99, then throughput. The budgets are stated for the reference machine (Apple M5 Pro class); a CI runner measures about 2× slower, so these numbers are reported beside them, not held to them. To reproduce them: CONTRIBUTING.md.

Decode alone (1HGCM82633A004352): 40 / 123 µs · 19k/s. Budget: ≥ 20k VIN/s and < 1 ms.

	fixture, 13 entries	EPA, 5,747 entries	MVL-1M (synthetic), 1,000,000 entries	budget
load, 1 core	23 ms, 43 MB peak	28 ms, 47 MB peak	2.65 s, 693 MB peak	< 100 ms up to EPA scale; < 2 s and < 1 GB peak at 1M
load, 4 cores	23 ms, 37 MB peak	23 ms, 41 MB peak	1.90 s, 710 MB peak	< 100 ms up to EPA scale; < 2 s and < 1 GB peak at 1M
translate VIN (decode + translate)	47 / 176 µs · 15k/s	40 / 152 µs · 18k/s	52 / 211 µs · 13k/s	p99 < 1 ms
translate name	1.7 / 21 µs · 380k/s	1.9 / 20 µs · 349k/s	2.1 / 12 µs · 289k/s	p99 < 1 ms
translate spine id (vPIC model → vocabulary)	1.6 / 19 µs · 414k/s	2.4 / 27 µs · 279k/s	6.0 / 63 µs · 100k/s	p99 < 1 ms
list, first page	2.6 / 51 µs · 203k/s	26 / 180 µs · 19k/s	24 / 143 µs · 24k/s	p99 < 1 ms at 1M
list, next page (cursor)	—	28 / 205 µs · 17k/s	25 / 162 µs · 22k/s	p99 < 1 ms at 1M
list, where first field	0.6 / 3.9 µs · 856k/s	27 / 197 µs · 18k/s	8.8 / 88 µs · 63k/s	p99 < 1 ms at 1M
list vpic where make	16 / 154 µs · 26k/s	16 / 162 µs · 25k/s	16 / 154 µs · 26k/s	p99 < 1 ms at 1M