Ikanos v1.0.0-beta5 — "Bark"

⛵ A bark trades pure square-rig power for a smaller crew and steadier ocean-going reliability — fewer hands needed to sail the same distance, safely, voyage after voyage. Beta5 is exactly that shift: the release pipeline itself gets automated (version bump/unbump, security scanning on every published artifact and image), nightly CI reliability gaps get closed, and the crew grows with the project's first external contribution. Less manual handling, more miles covered per voyage.

What is Ikanos?

Ikanos is the first open-source engine for Spec-Driven Integration. Capabilities are declared entirely in YAML — no Java, no code generation, no compilation step. The engine reads the spec at startup and immediately serves it as a multi-protocol server: MCP, Skill, REST, and Control. The spec is the artifact and the runtime contract.

Ikanos comes from the Greek ικανός — capable.

This v1.0.0-beta5 release builds on v1.0.0-beta4 ("Barquentine") with a focus on supply-chain security and release automation: every published binary and Docker image is now scanned with Trivy before it ships, the version bump/unbump steps around a release are fully automated, several CI reliability gaps affecting fork-originated PRs are closed, and the project lands its first fix from an external contributor. Only an additive schema change since beta4 ($id version bump) — no breaking change.

🌐 Ecosystem

Polychro — Spec Linting for Ikanos Capabilities

Polychro remains the companion spec linting engine for the Ikanos ecosystem. It validates Ikanos capability files against rulesets declared in YAML, surfacing diagnostics as SARIF, JSON, or LLM-native output — directly inside your editor, CI pipeline, or AI agent. See the Polychro release notes for its own changelog.

✨ Highlights

🔒 Security Scanning on Every Published Artifact (#689, closes #694)

Both artifact-publishing pipelines now block on a security scan before anything ships:

• publish-cli-bin.yml (native CLI binaries) split into three isolated jobs — build-native → test-binary → release — with contents: write restricted to the release job only, and a SHA256 checksum generated for every binary (Linux amd64/arm64, macOS arm64, Windows amd64)
• publish-engine-image.yml (engine Docker image) now runs a Trivy scan (CRITICAL/HIGH, exit-code: 1) against a local build of the image before any push to GHCR/Docker Hub — registry login and publish only happen after the scan passes
• Trivy report and SBOM published to the Job Summary and uploaded as downloadable artifacts, with collapsible details for readability (#721)

🤖 Release Process Automated — Version Bump & Unbump (#719, #726, #727)

The two manual steps that bracket every release — bumping the next engine/schema version and removing the -SNAPSHOT suffix after tagging — are now automated end to end, replacing the previous synchronize-schema-version-in-repository manual trigger. The bump-next-versions GitHub Action also had its permissions tightened and its deprecated app-id property replaced with client-id.

📦 Simplified Native Packaging — No More Hand-Maintained Reflect-Config (#718, closes #638)

A new packaging mode ships alongside the native image: a classic .jar + a bundled lightweight JRE + per-OS install scripts, letting developers test Ikanos locally without Docker or admin privileges and without exposure to native-image crashes.

• publish-cli-bin.yml now only builds and publishes the raw binaries
• New create-release.yml fires on tag creation to orchestrate the release
• New publish-cli-packages.yml generates the .tar/.zip packages and their .sha256 checksums

The GraalVM native image itself is kept for now (still needed for LangChain/Python interoperability) — its reflect-config removal is deferred to a follow-up decision.

🐛 First External Contribution — Basic/Digest Auth NPE Fix (#707, closes #699)

type: basic/type: digest authentication with a username but no password is schema-valid but crashed at call time. Fixed on both sides:

• Consumes: HttpClientAdapter.setChallengeResponse() no longer calls new String(null) on a missing password — an omitted password is now treated as empty, matching the documented password: "" workaround
• Exposes: the mirrored gap in ServerAdapter.buildChallengeAuthenticator/resolveTemplateChars is fixed too — a capability declaring basic/digest auth with an intentionally empty password can now actually be satisfied by incoming requests

Ikanos's first fix contributed by an external, non-Naftiko contributor — welcome aboard, @saiflayouni! 🎉

🛠️ Nightly CI & Fork-PR Reliability Fixes

Several dispatch and reporting paths hardened for reliability on both main and fork-originated PRs:

• nightly-orchestrator.yml: missing pagination on the PR list fixed, fork PRs filtered out of dispatch, and a failed dispatch now fails the step instead of being silently swallowed (#722)
• nightly-quality-gate.yml: Trivy's $CRITICAL/$HIGH counts now exposed as a job output so the Slack alert can actually fire on a real finding (#722); a follow-up fixed a missing jq -r flag that had silently broken every nightly dispatch since (#723)
• Badge publishing and PR comments split into a separate workflow_run-triggered workflow with write permissions, so fork PRs (which only get a read-only GITHUB_TOKEN) no longer fail with 403s (#709)
• "Validate Shipyard tutorial examples" no longer sources dummy auth values via secrets: (unavailable to fork PRs) — it now reads the already-committed fixture file directly (#711, #714)

🤝 Agent & Contributor Experience

• The DCO Signed-off-by requirement — now a required check — is documented in CONTRIBUTING.md, AGENTS.md, and the PR template, including how to retrofit a missing trailer (#713, closes #712)
• AGENTS.md's PR-review rules now point to the pr-review skill's new "External contributors — extra care" subsection, so agents apply it when reviewing a PR like #707 above (#708)

🔧 Schema

• ikanos-schema.json's $id updated to reflect the current version (was still pointing at v1.0.0-beta2) (#710)

⚠️ Known Issues & Limitations

• CLI pre-built binary installation — running the CLI binary directly is not straightforward on macOS (Gatekeeper quarantine requires xattr -dr com.apple.quarantine or system approval) and on Windows (SmartScreen warning, unsigned binary). Workaround: run via java -jar ikanos.jar from the JAR instead (#281)
• Reverse tunnel remains declarative-only in the schema — capabilities that declare tunnel: parse and validate today, but the engine still dials the public baseUri directly until the embedded tunnel feature is enabled. Use the sidecar pattern from the Reverse Tunnel guide for production today.
• CLI pre-built binaries available for macOS ARM64, Linux AMD64, Linux ARM64, and Windows AMD64.

🔢 By the Numbers

• 20 commits merged since v1.0.0-beta4
• 122 files changed, +2,103 / −190 lines
• 5 contributors, including the project's first external contributor

🙏 Contributors

Huge thanks to the team — and to a new external contributor — for shipping this release:

• @saiflayouni — first external contribution: basic/digest auth NPE fix (#707)
• @farah-t-trigui — security scanning for artifacts and images (#689), nightly quality gate fixes (#722), fork-PR CI reliability fixes (#709, #711, #714)
• @jeremnaf — release process automation (#719, #726, #727), schema $id fix (#710), beta5 release coordination
• @neyeahmed — simplified native packaging, reflect-config removal (#718)
• @eskenazit — DCO sign-off documentation (#713), pr-review skill pointer for external contributors (#708), nightly orchestrator dispatch fix (#723)

Full Changelog: v1.0.0-beta4...v1.0.0-beta5