mkit 0.5.0

mkit 0.5.0

Content-addressed VCS for creative work.

Verifying downloads

Every archive is signed with cosign keyless via GitHub OIDC; the
signing certificate embeds the workflow identity and a Rekor
transparency log entry is public. See docs/RELEASE.md
in the repo for full verification steps.

The verifier regex below is anchored: it pins the exact workflow
path and accepts only strict semver tags (with optional
pre-release suffix like -rc.1).

cosign verify-blob \
  --certificate-identity-regexp '^https://github\.com/officialunofficial/mkit/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$' \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle <archive>.cosign.bundle \
  <archive>

SLSA build provenance

Every archive also carries a standard SLSA build provenance
attestation, generated by GitHub's
actions/attest-build-provenance
and recorded in the Sigstore public-good transparency log. Verify
it with the GitHub CLI (no extra tooling required):

gh attestation verify <archive> --repo officialunofficial/mkit

or with slsa-verifier:

slsa-verifier verify-artifact <archive> \
  --provenance-path mkit-0.5.0.provenance.jsonl \
  --source-uri github.com/officialunofficial/mkit \
  --source-tag v0.5.0

This is additive to the cosign signature above, not a
replacement for it.

Platform notes

macOS binaries are not codesigned or notarized. Trust is
established via the cosign signature above. Running from a
terminal works; double-clicking in Finder hits Gatekeeper.

Windows is not a supported target. Windows users should run
mkit under WSL, which uses the Linux binary.

SBOM

A CycloneDX SBOM (sbom.cdx.json) is attached. Reflects the
Rust crate graph of the whole workspace, including library and
test dependencies, plus toolchain and OS libraries.

npm package

The WASM bindings are also published to npm as
@officialunofficial/mkit-wasm at the
same version, with Sigstore-backed provenance attached to this
workflow run.

What's Changed

• ci(release-plz): remove the push-to-main trigger, fix v0.4.2's race by @christopherwxyz in #953
• ci(actions): bump the actions-minor group with 2 updates by @dependabot[bot] in #950
• deps(spammer-worker): bump @types/node from 24.13.3 to 26.4.0 in /apps/spammer-worker by @dependabot[bot] in #948
• copy(web): remove mannered prose from the mkit.sh site by @christopherwxyz in #955
• perf(web): immutable-cache /assets/* and preload the two critical fonts by @christopherwxyz in #956
• perf(web): align _headers caching with officialunofficial.com's pattern by @christopherwxyz in #957
• docs: add mkit-transport-connect to crate listings by @christopherwxyz in #960
• deps(rust)!: upgrade commonware to v2026.9.0, drop Windows support by @christopherwxyz in #958
• perf(core,cli): parallelize pack-entry compression across rayon during push by @christopherwxyz in #962
• mcp: migrate to MCP 2026-07-28, add mkit mcp --http by @christopherwxyz in #961
• perf(core): memoize shard-dir create_dir_all in BulkWriter::write by @christopherwxyz in #954
• fix(mcp): regenerate bun.lock, stale since #961's dependency changes by @christopherwxyz in #963
• Detect concurrent serve access, warn on inert identity aliases, split delta errors by @christopherwxyz in #959
• perf(cli): parallelize post-fetch signature verification across rayon by @christopherwxyz in #964
• perf(core,cli): parallelize push-plan delta encoding across rayon by @christopherwxyz in #977
• deps(og): bump the npm-minor group in /apps/og with 2 updates by @dependabot[bot] in #970
• deps(spammer-worker): bump the npm-minor group in /apps/spammer-worker with 3 updates by @dependabot[bot] in #972
• ci(actions): bump the actions-minor group with 2 updates by @dependabot[bot] in #966
• fix: enforce specification integrity and durability contracts by @christopherwxyz in #965
• fix(web): simplify docs, align Pigment UI, and stabilize chat scrolling by @christopherwxyz in #979
• deps(mcp): bump the npm-minor group in /apps/mcp with 2 updates by @dependabot[bot] in #967
• deps: resolve Dependabot backlog and vulnerable transitive packages by @christopherwxyz in #980
• deps: apply remaining app, signer, and CI action updates by @christopherwxyz in #992
• fix(keys-worker): restore CORS on Durable Object-forwarded name responses by @christopherwxyz in #994
• deps(rust): update der and zstd across consumer lockfiles by @christopherwxyz in #993
• perf(core): eliminate per-chunk allocate-and-copy in streaming FastCDC reader by @christopherwxyz in #982
• perf: parallelize single-large-file chunk hashing, fix review findings by @christopherwxyz in #978
• feat(web): add hosted workspaces and shared passkey sessions by @christopherwxyz in #995
• deps(web): bump playwright-core from 1.62.1 to 1.63.0 in /apps/web in the npm-minor group by @dependabot[bot] in #1000
• deps(workspace-worker): bump esbuild from 0.28.1 to 0.28.2 in /apps/workspace-worker in the npm-minor group by @dependabot[bot] in #997
• deps(workspace-worker): bump vitest from 4.1.11 to 5.0.0 in /apps/workspace-worker by @dependabot[bot] in #999
• feat(sandbox): wire sccache to Cloudflare R2 for cloud-sandbox builds by @christopherwxyz in #1004
• perf(core): history-mmr ancestry publish — eliminate redundant rebuilds, switch MMR to MMB by @christopherwxyz in #1003
• Batch Ed25519 verification for post-fetch signatures, plus a scrub-state panic fix by @christopherwxyz in #1006
• deps(workspace-worker): bump @types/node from 24.13.3 to 26.4.1 in /apps/workspace-worker by @dependabot[bot] in #1001
• deps(web): bump vitest from 4.1.11 to 5.0.0 in /apps/web in the vitest group across 1 directory by @dependabot[bot] in #996
• perf(core): use a fast non-cryptographic hasher for delta::encode's block index by @christopherwxyz in #1007
• deps(workspace-worker): bump typescript from 5.9.3 to 7.0.2 in /apps/workspace-worker by @dependabot[bot] in #998
• feat(core): commonware-aligned BMT proofs + stable SPEC-MERKLE-OBJECTS §5 (verifier kit PR 1) by @marthendalnunes in #1016
• feat(core): disclosure bundle + SPEC-DISCLOSURE (verifier kit PR 2) by @marthendalnunes in #1017
• feat(core): closure profile — raw-only packs, store-less pack iterator, verify_closure (verifier kit PR 3) by @marthendalnunes in #1019
• deps(rust): bump the cargo-minor group across 1 directory with 2 updates by @dependabot[bot] in #1018
• deps(web): bump the npm-minor group in /apps/web with 11 updates by @dependabot[bot] in #1014
• deps(workspace-worker): bump the npm-minor group in /apps/workspace-worker with 3 updates by @dependabot[bot] in #1013
• deps(spammer-worker): bump the npm-minor group in /apps/spammer-worker with 4 updates by @dependabot[bot] in #1012
• deps(og): bump the npm-minor group in /apps/og with 2 updates by @dependabot[bot] in #1010
• deps(mcp): bump the npm-minor group in /apps/mcp with 3 updates by @dependabot[bot] in #1009
• ci(actions): bump the actions-minor group with 2 updates by @dependabot[bot] in #1008
• feat(wasm): disclosure + closure verification exports (verifier kit PR 4) by @marthendalnunes in #1020
• feat(cli): prove / verify-proof / closure export|verify (verifier kit PR 5) by @marthendalnunes in #1021
• docs: VERIFY.md guide + verifier kit closing polish (verifier kit PR 6) by @marthendalnunes in #1023
• feat(core): SPEC-DISCLOSURE ...

mkit 0.4.2

mkit 0.4.2

Content-addressed VCS for creative work.

Verifying downloads

Every archive is signed with cosign keyless via GitHub OIDC; the
signing certificate embeds the workflow identity and a Rekor
transparency log entry is public. See docs/RELEASE.md
in the repo for full verification steps.

The verifier regex below is anchored: it pins the exact workflow
path and accepts only strict semver tags (with optional
pre-release suffix like -rc.1).

cosign verify-blob \
  --certificate-identity-regexp '^https://github\.com/officialunofficial/mkit/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$' \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle <archive>.cosign.bundle \
  <archive>

SLSA build provenance

Every archive also carries a standard SLSA build provenance
attestation, generated by GitHub's
actions/attest-build-provenance
and recorded in the Sigstore public-good transparency log. Verify
it with the GitHub CLI (no extra tooling required):

gh attestation verify <archive> --repo officialunofficial/mkit

or with slsa-verifier:

slsa-verifier verify-artifact <archive> \
  --provenance-path mkit-0.4.2.provenance.jsonl \
  --source-uri github.com/officialunofficial/mkit \
  --source-tag v0.4.2

This is additive to the cosign signature above, not a
replacement for it.

Platform notes

macOS binaries are not codesigned or notarized. Trust is
established via the cosign signature above. Running from a
terminal works; double-clicking in Finder hits Gatekeeper.

The Windows binary (mkit.exe, in the .zip archive) is
similarly not Authenticode-signed; the same cosign
signature is the trust anchor. It ships with the
backend-windows-credential keystore backend (Windows
Credential Manager) enabled. SmartScreen may warn on first run
since the binary is unsigned.

SBOM

A CycloneDX SBOM (sbom.cdx.json) is attached. Reflects the
Rust crate graph (blake3, reqwest/rustls, ed25519-dalek, etc.)
plus toolchain and OS libraries.

npm package

The WASM bindings are also published to npm as
@officialunofficial/mkit-wasm at the
same version, with Sigstore-backed provenance attached to this
workflow run.

What's Changed

• feat(web): lobby activity-row kind icons + inline signed reactions by @heavygweit in #878
• chore: post-v0.4.1-release cleanup by @christopherwxyz in #879
• feat(og): white polychrome-family social card with sunset-gradient rule by @heavygweit in #882
• fix(web): reformat signed-lobby.tsx (oxfmt drift) by @christopherwxyz in #881
• fix(web): version the og:image URL to bust social unfurl caches by @heavygweit in #883
• fix(web): reformat seo.tsx (oxfmt drift) by @christopherwxyz in #884
• chore(release): rename npm scope to @officialunofficial, switch to Trusted Publishing by @christopherwxyz in #880
• docs(release): fix npm placeholder-publish snippet + note registry CDN lag by @christopherwxyz in #885
• feat(web): rebuild streaming demo as a verified download + rename demos to concepts by @heavygweit in #886
• chore(mcp): commit missing bun.lock by @christopherwxyz in #898
• deps(mcp): bump ip-address from 10.2.0 to 10.5.0 in /apps/mcp by @dependabot[bot] in #916
• deps(mcp): bump hono from 4.12.25 to 4.13.1 in /apps/mcp by @dependabot[bot] in #913
• deps(mcp): bump postcss from 8.5.15 to 8.5.26 in /apps/mcp by @dependabot[bot] in #912
• deps(mcp): bump fast-uri from 3.1.2 to 3.1.5 in /apps/mcp by @dependabot[bot] in #906
• deps(mcp): bump body-parser from 2.2.2 to 2.3.0 in /apps/mcp by @dependabot[bot] in #899
• ci(actions): bump the actions-minor group across 1 directory with 6 updates by @dependabot[bot] in #914
• deps(web): bump the npm-minor group in /apps/web with 2 updates by @dependabot[bot] in #891
• ci(actions): bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in #888
• fix(web,repo-worker): paginate + virtualize multiplayer branches panel (mobile Safari freeze) by @christopherwxyz in #917
• deps: land all 14 open Dependabot PRs, plus RUSTSEC-2026-0258 by @christopherwxyz in #925
• deps(rust): bump the cargo-minor group across 1 directory with 15 updates by @dependabot[bot] in #924
• deps(mcp): bump @hono/node-server from 1.19.14 to 2.1.1 in /apps/mcp by @christopherwxyz in #927
• feat(web): rebuild the site on the pigment design bible by @heavygweit in #928
• deps(rust,signers,worker): upgrade connectrpc to 0.9.0, buffa to 0.9.1 by @christopherwxyz in #939
• ci(actions): bump Swatinem/rust-cache from 258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 to f0d9c3887740aee45f6153b24b3a6b815192ec16 by @dependabot[bot] in #935
• ci(actions): bump taiki-e/install-action from 2.85.13 to 2.86.5 in the actions-minor group by @dependabot[bot] in #932
• feat(web): add WebMCP tools to the multiplayer repo demo by @christopherwxyz in #940
• deps(rust): bump base64 from 0.22.1 to 0.23.1 in /rust by @dependabot[bot] in #938
• deps(rust): bump openpgp-card from 0.6.1 to 0.7.0 in /rust by @dependabot[bot] in #937
• deps(signers): bump base64 from 0.22.1 to 0.23.1 in /contrib/signers by @dependabot[bot] in #930
• deps(rust): bump the cargo-minor group across 1 directory with 6 updates by @dependabot[bot] in #936
• deps(mcp): bump the npm-minor group in /apps/mcp with 6 updates by @dependabot[bot] in #933
• ci(actions): bump the actions-minor group with 2 updates by @dependabot[bot] in #943
• deps(rust): bump the cargo-minor group in /rust with 4 updates by @dependabot[bot] in #942
• deps(rust): bump blake2 from 0.10.6 to 0.11.0 in /rust by @dependabot[bot] in #944
• deps(signers): bump the cargo-minor group across 1 directory with 3 updates by @dependabot[bot] in #945
• deps: fix dependabot coverage, unyank chacha20, bump JS/Cargo deps by @christopherwxyz in #946
• perf(cli): parallel worktree hashing for add -A/add ., re-measured perf docs by @christopherwxyz in #951
• chore: release v0.4.2 by @offuno-release-plz[bot] in #952

Full Changelog: v0.4.1...v0.4.2

mkit 0.4.1

mkit 0.4.1

Content-addressed VCS for creative work.

Verifying downloads

Every archive is signed with cosign keyless via GitHub OIDC; the
signing certificate embeds the workflow identity and a Rekor
transparency log entry is public. See docs/RELEASE.md
in the repo for full verification steps.

The verifier regex below is anchored: it pins the exact workflow
path and accepts only strict semver tags (with optional
pre-release suffix like -rc.1).

cosign verify-blob \
  --certificate-identity-regexp '^https://github\.com/officialunofficial/mkit/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$' \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle <archive>.cosign.bundle \
  <archive>

SLSA build provenance

Every archive also carries a standard SLSA build provenance
attestation, generated by GitHub's
actions/attest-build-provenance
and recorded in the Sigstore public-good transparency log. Verify
it with the GitHub CLI (no extra tooling required):

gh attestation verify <archive> --repo officialunofficial/mkit

or with slsa-verifier:

slsa-verifier verify-artifact <archive> \
  --provenance-path mkit-0.4.1.provenance.jsonl \
  --source-uri github.com/officialunofficial/mkit \
  --source-tag v0.4.1

This is additive to the cosign signature above, not a
replacement for it.

Platform notes

macOS binaries are not codesigned or notarized. Trust is
established via the cosign signature above. Running from a
terminal works; double-clicking in Finder hits Gatekeeper.

The Windows binary (mkit.exe, in the .zip archive) is
similarly not Authenticode-signed; the same cosign
signature is the trust anchor. It ships with the
backend-windows-credential keystore backend (Windows
Credential Manager) enabled. SmartScreen may warn on first run
since the binary is unsigned.

SBOM

A CycloneDX SBOM (sbom.cdx.json) is attached. Reflects the
Rust crate graph (blake3, reqwest/rustls, ed25519-dalek, etc.)
plus toolchain and OS libraries.

npm package

The WASM bindings are also published to npm as
@makechain/mkit-wasm at the
same version, with Sigstore-backed provenance attached to this
workflow run.

What's Changed

• ci(release-plz): publish to crates.io on push, not only from a Release PR by @marthendalnunes in #365
• fix(mcp-release): tolerate wrangler d1 --json shape drift by @marthendalnunes in #366
• ci: tag-driven crates.io publish (cargo publish --workspace); retire release-plz by @marthendalnunes in #367
• fix(mcp-release): surface wrangler output + tolerant parse in indexed check by @marthendalnunes in #368
• fix(mcp-release): print wrangler error on d1 indexed check by @marthendalnunes in #369
• chore(mcp-release): temp wrangler whoami to diagnose D1 7403 by @marthendalnunes in #370
• chore(release): apply safe crates.io publish-hygiene fixes by @christopherwxyz in #371
• docs(release): consolidate docs/release/* into a single docs/RELEASE.md by @christopherwxyz in #372
• chore(docs): delete docs/advisories directory by @christopherwxyz in #373
• chore(#223): close-out — bundle LICENSE in cli/git-bridge/enc, drop SPDX strays by @marthendalnunes in #374
• docs: route CODEOWNERS to provisioned makechain team by @christopherwxyz in #376
• chore: open-source readiness — docs accuracy + CI token hardening by @marthendalnunes in #375
• chore: clean up MCP private-repo claims and resolve the mkit-mcp double-deploy by @marthendalnunes in #377
• ci: add crates-owners workflow to keep the makechain team as crate owner by @marthendalnunes in #378
• ci: accept Dependabot deps commit type and drop double scope by @christopherwxyz in #394
• ci: replace broken per-PR semver-checks with a pre-publish semver gate by @marthendalnunes in #393
• deps(rust): bump criterion from 0.5.1 to 0.7.0 by @dependabot[bot] in #387
• deps(mcp): bump the npm-minor group with 4 updates by @dependabot[bot] in #382
• deps(signers): bump zeroize from 1.8.2 to 1.9.0 by @dependabot[bot] in #380
• deps(mcp): bump vitest from 3.2.6 to 4.1.9 in /mcp by @dependabot[bot] in #384
• deps(mcp): bump zod from 3.25.76 to 4.4.3 in /mcp by @dependabot[bot] in #385
• deps(signers): bump sha2 from 0.10.9 to 0.11.0 by @dependabot[bot] in #381
• ci(actions): bump taiki-e/install-action from 2.81.10 to 2.81.11 by @dependabot[bot] in #388
• deps(mcp): bump typescript from 5.9.3 to 6.0.3 in /mcp by @dependabot[bot] in #386
• deps(signers): bump dirs from 5.0.1 to 6.0.0 in /contrib/signers by @dependabot[bot] in #383
• deps(web): bump oxfmt from 0.54.0 to 0.55.0 by @dependabot[bot] in #379
• deps(mcp): bump the npm-minor group across 1 directory with 2 updates by @dependabot[bot] in #395
• deps(rust): bump criterion from 0.7.0 to 0.8.2 in /rust by @dependabot[bot] in #396
• ci: reorganize workflows for DRY setup, path filters, concurrency, naming by @christopherwxyz in #397
• feat(web): git-parity page and landing copy refresh by @heavygweit in #392
• feat(cli): git CLI/UX parity flags, doc reconciliation, and review fixes by @marthendalnunes in #398
• feat(web): serve install.sh from mkit.sh + curl mkit.sh | sh by @christopherwxyz in #400
• feat(cli): git CLI/UX parity push — output messages, labels, global flags, switch/merge-base/rev-list by @marthendalnunes in #402
• feat(og): add og.mkit.sh Open Graph image service by @christopherwxyz in #399
• chore: open-source & publish readiness cleanup by @marthendalnunes in #403
• chore(web): homepage install cleanup + consolidate staging scripts by @christopherwxyz in #404
• feat(web): restore bare-domain curl mkit.sh | sh + apply security headers in prod by @christopherwxyz in #405
• style(web): fix fmt:check on main (oxfmt security-headers.ts) by @christopherwxyz in #413
• feat(transport): wire delta encoding into the push/fetch path by @heavygweit in #401
• feat(web): reorder nav + add 'On this page' sidebar by @christopherwxyz in #415
• feat(core)!: merkelize ChunkedBlob & Tree identity (BMT roots) [stacked on #401] by @christopherwxyz in #414
• ci(actions): bump the actions-minor group with 2 updates by @dependabot[bot] in #419
• ci(actions): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #420
• deps(mcp): bump the npm-minor group in /mcp with 2 updates by @dependabot[bot] in #417
• deps(rust): bump the cargo-minor group in /rust with 2 updates by @dependabot[bot] in #418
• feat(transfer): content-aware delta base selection (#407) by @heavygweit in #421
• feat(transport): atomic branch+packmap advance seam (#408) by @heavygweit in #422
• deps(rust): fix Security: Rust CI — quinn-proto 0.11.15 & crypto-bigint 0.7.5 by @heavygweit in #426
• chore: production-readiness sweep (CI gating, durability, web/mcp hardening, docs) by @christopherwxyz in #424
• chore(repo): slim operational and governance scaffolding by @christopherwxyz in #427
• refactor(mcp): use the canonical SDK client in the integration harness by @christopherwxyz in #428
• chore: remove phaseN dev-milestone naming (deslop) by @christopherwxyz in #432
• docs(rpc): correct stale proto comments and fastcdc fixture metadata (#391) by @christopherwxyz in #433
• test(core): pin v2 phase4 index goldens alongside v1 read-compat fixtures (#390) by @christopherwxyz in https://github.com/officialunoffici...

mkit 0.3.0

mkit 0.3.0

Content-addressed VCS for creative work.

Verifying downloads

Every archive is signed with cosign keyless via GitHub OIDC; the
signing certificate embeds the workflow identity and a Rekor
transparency log entry is public. See docs/release/SIGNING.md
in the repo for full verification steps.

The verifier regex below is anchored: it pins the exact workflow
path and accepts only strict semver tags (with optional
pre-release suffix like -rc.1).

cosign verify-blob \
  --certificate-identity-regexp '^https://github\.com/officialunofficial/mkit/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$' \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle <archive>.cosign.bundle \
  <archive>

Platform notes

macOS binaries are not codesigned or notarized. Trust is
established via the cosign signature above. Running from a
terminal works; double-clicking in Finder hits Gatekeeper.

SBOM

A CycloneDX SBOM (sbom.cdx.json) is attached. Reflects the
Rust crate graph (blake3, reqwest/rustls, ed25519-dalek, etc.)
plus toolchain and OS libraries.

npm package

The WASM bindings are also published to npm as
@makechain/mkit-wasm at the
same version, with Sigstore-backed provenance attached to this
workflow run.

What's Changed

• ci(release): make keyserver key import robust to UID-less keys by @marthendalnunes in #320
• docs(release): document why mkit-cli/wasm/enc are off crates.io by @marthendalnunes in #322
• feat(release): make mkit-transport-enc + mkit-cli publishable by @marthendalnunes in #323
• ci(release): source crates.io token from org CRATES_PACKAGE_KEY by @marthendalnunes in #324
• docs(release): mkit-transport-enc + mkit-cli now on crates.io by @marthendalnunes in #325
• chore(deps): buffa 0.6 → 0.7.1, regenerate vendored mkit-rpc codegen by @christopherwxyz in #327
• refactor(rpc): adopt buffa 0.7 idioms — enum aliases, decode caps, debug_redact, fuzz by @christopherwxyz in #328
• feat(skill+mcp): add mkit-cli Agent Skill and crates/docs MCP server by @marthendalnunes in #329
• chore(mcp): provision D1 id, live polish, release-gated deploy model by @marthendalnunes in #331
• fix(web): blank mkit.makechain.net (waku beta.2 fsRouter regression) + copy alignment + measured /performance page by @christopherwxyz in #333
• refactor(web): migrate package management from pnpm to bun 1.3.14 by @christopherwxyz in #334
• feat(cli): add mkit mcp local MCP server for agent-driven repositories by @marthendalnunes in #337
• feat(web): grid-svg navbar logo + agentation dev toolbar by @christopherwxyz in #335
• fix(web): collision-free hues for /performance bars by @christopherwxyz in #340
• feat: git interop — export, importer-signed import, and fork-mode publishing (Phase 0+1+2a) by @marthendalnunes in #330
• perf: batched durability, zero-copy ingest, stat-cached index — faster than git on every benchmark by @christopherwxyz in #341
• test(fuzz): adopt commonware-invariants minifuzz for rpc_decode (pilot) by @christopherwxyz in #348
• perf: add samply sampling-profiler support by @christopherwxyz in #347
• chore(deps): bump commonware to the 2026.5.0 train by @christopherwxyz in #345
• chore(web): code-review follow-ups — deps, a11y, payload, lint guard by @christopherwxyz in #342
• ci(actions)(deps): bump taiki-e/install-action from 2.81.8 to 2.81.10 in the actions-minor group by @dependabot[bot] in #355
• ci(actions)(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #356
• ci(actions)(deps): bump actions/create-github-app-token from 2.2.2 to 3.2.0 by @dependabot[bot] in #357
• build(deps): bump @tailwindcss/vite 4.3.1 and waku 1.0.0-beta.3 by @christopherwxyz in #363
• build(deps): bump signal-hook 0.4, sha1 0.11, git2 0.21, cargo-minor group by @christopherwxyz in #362
• chore(release): prepare 0.3.0 + keystore protector-mismatch fix (#326) by @marthendalnunes in #364

Full Changelog: v0.2.0...v0.3.0

mkit 0.2.0

mkit 0.2.0

Content-addressed VCS for creative work.

Verifying downloads

Every archive is signed with cosign keyless via GitHub OIDC; the
signing certificate embeds the workflow identity and a Rekor
transparency log entry is public. See docs/release/SIGNING.md
in the repo for full verification steps.

The verifier regex below is anchored: it pins the exact workflow
path and accepts only strict semver tags (with optional
pre-release suffix like -rc.1).

cosign verify-blob \
  --certificate-identity-regexp '^https://github\.com/officialunofficial/mkit/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$' \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle <archive>.cosign.bundle \
  <archive>

Platform notes

macOS binaries are not codesigned or notarized. Trust is
established via the cosign signature above. Running from a
terminal works; double-clicking in Finder hits Gatekeeper.

SBOM

A CycloneDX SBOM (sbom.cdx.json) is attached. Reflects the
Rust crate graph (blake3, reqwest/rustls, ed25519-dalek, etc.)
plus toolchain and OS libraries.

npm package

The WASM bindings are also published to npm as
@makechain/mkit-wasm at the
same version, with Sigstore-backed provenance attached to this
workflow run.

What's Changed

• fix(cli): mkit commit reads the staging index (#102) by @christopherwxyz in #103
• ci(actions)(deps): bump the actions-minor group with 4 updates by @dependabot[bot] in #105
• ci(actions)(deps): bump amannn/action-semantic-pull-request from 5.5.3 to 6.1.1 by @dependabot[bot] in #106
• ci(actions)(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #107
• feat(cli): add commit all shortcut by @marthendalnunes in #108
• fix(cli): wire SIGINT/SIGTERM cooperative shutdown by @christopherwxyz in #111
• ci: add typos, actionlint, cargo-geiger, cargo-llvm-cov by @christopherwxyz in #112
• fix(cli): convert silent-failure exits to proper error codes by @christopherwxyz in #113
• feat(cli): mkit status --porcelain=v1 + route prose to stderr by @christopherwxyz in #114
• feat(cli): mkit log --format=json (JSONL) by @christopherwxyz in #115
• fix(cli): route confirmation/progress prose to stderr (17 commands) by @christopherwxyz in #116
• feat(cli): add --format=json to blame, branch, remote, config by @christopherwxyz in #117
• feat(cli): clap-derive shim with sysexits-aware error mapping by @christopherwxyz in #118
• refactor(cli): migrate mkit log to clap-derive by @christopherwxyz in #119
• refactor(cli): migrate trivial commands to clap-derive (8 commands) by @christopherwxyz in #120
• refactor(cli): migrate 9 more commands to clap-derive by @christopherwxyz in #121
• refactor(cli): migrate branch/remote/bisect/config/clone to clap-derive by @christopherwxyz in #122
• refactor(cli): migrate rebase + keygen to clap-derive by @christopherwxyz in #123
• refactor(cli): migrate stash/commit/verify-attest/attest to clap-derive by @christopherwxyz in #124
• refactor(cli): migrate status to clap-derive (final command) by @christopherwxyz in #125
• docs(readme): fix chart labels + expand Architecture section by @christopherwxyz in #126
• docs: add mkit writing style guide by @christopherwxyz in #127
• feat(keystore): add signing key vault by @marthendalnunes in #109
• fix(keystore): address vault follow-up issues by @marthendalnunes in #135
• chore: public-launch readiness rollup (legal + security + docs + CI + community) by @christopherwxyz in #146
• docs(readme): restructure for first-time-visitor flow; trim MAINTAINERS to TBD by @christopherwxyz in #148
• docs(specs): align SPEC-* documents with code reality (rollup) by @christopherwxyz in #149
• chore(deps): bump buffa 0.5 → 0.6 across all consumer crates by @christopherwxyz in #150
• cleanup: protocol-vocabulary drift in code comments + signer docs by @christopherwxyz in #151
• feat(worktree): produce chunked_blob for files > 1 MiB by @christopherwxyz in #152
• chore: 4 follow-ups rollup — file CAS, builders, SSH expectation, sign-se v1 port by @christopherwxyz in #153
• chore(ssh): drop back-compat scaffolding; make expectation field required by @christopherwxyz in #154
• chore: apply code-review findings (reuse / quality, no behavior change) by @christopherwxyz in #155
• ci(actions)(deps): bump the actions-minor group across 1 directory with 2 updates by @dependabot[bot] in #147
• ci(actions)(deps): bump actions/cache from 4.3.0 to 5.0.5 by @dependabot[bot] in #137
• feat: phase-1 commonware adoption rollup (stream + MMR + bitmap + RS + BLS-threshold) by @christopherwxyz in #162
• test(infra): adopt TDD tooling — proptest, insta, nextest, mutation-score by @christopherwxyz in #165
• ci(coverage): wire Codecov upload + add badge + repo config by @christopherwxyz in #166
• chore: batch A rollup — zeroization (#99) + repo-config gate (#97) + streaming cap (#81) + deferred cleanups by @christopherwxyz in #167
• feat: phase-2 commonware adoption rollup (transport-enc + history-MMR + sparse + pack-shards + BLS-threshold) by @christopherwxyz in #169
• ci(actions)(deps): bump codecov/codecov-action from cddd853df119a48c5be31a973f8cd97e12e35e16 to e79a6962e0d4c0c17b229090214935d2e33f8354 by @dependabot[bot] in #172
• ci(actions)(deps): bump crate-ci/typos from ca8395668a014bffeb39e0463c660f958402e0ff to 5374cbf686e897b15713110e233094e2874de7ef by @dependabot[bot] in #171
• ci(actions)(deps): bump the actions-minor group with 3 updates by @dependabot[bot] in #170
• chore(deps): replace yanked aes dependency by @marthendalnunes in #196
• security(core): harden persisted state and worktree hashing by @marthendalnunes in #191
• fix(cli): protect restores and remote refs by @marthendalnunes in #193
• security(transport): harden upload and S3 namespace boundaries by @marthendalnunes in #190
• fix(transport): bound HTTP retries and SSH waits by @marthendalnunes in #195
• security(attest): harden attestation trust boundaries by @marthendalnunes in #189
• fix(web): harden production build and browser limits by @marthendalnunes in #192
• release: enforce trusted tags and package docs by @marthendalnunes in #194
• feat(remote): named remotes, safe push, and centralized credential gate (#97, #175) by @marthendalnunes in #198
• feat(attest): bound external signer and harden key zeroization (#187, #99) by @marthendalnunes in #200
• feat(transport): enc serving fail-closed and shard-retry robustness (#178, #181) by @marthendalnunes in #199
• feat(cli): resolvable conflict workflow for merge/rebase/cherry-pick by @marthendalnunes in #201
• feat(cli): local-command git parity and doc accuracy (#188) by @marthendalnunes in #202
• fix(cli): worktree/index-mutation safety — stash-pop guard, conflict mode, worktree.lock by @marthendalnunes in #234
• feat(cli): revision resolver + ref-write and diff correctness by @marthendalnunes in #235
• fix(core): make ChunkedBlob consistent across add/commit/cat/build_tree by @marthendalnunes in #236
• fix(core): cap tree-walker recursion depth (MAX_TREE_DEPTH) by @marthendalnunes in https://github.com/officialunoffici...

mkit 0.1.0

mkit 0.1.0

Content-addressed VCS for creative work.

Verifying downloads

Every archive is signed with cosign keyless via GitHub OIDC; the
signing certificate embeds the workflow identity and a Rekor
transparency log entry is public. See docs/release/SIGNING.md
in the repo for full verification steps.

cosign verify-blob \
  --certificate-identity-regexp "https://github.com/officialunofficial/mkit/.github/workflows/release.yml@refs/tags/v.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle <archive>.cosign.bundle \
  <archive>

SBOM

A CycloneDX SBOM (sbom.cdx.json) is attached. Reflects the
Rust crate graph (blake3, reqwest/rustls, ed25519-dalek, etc.)
plus toolchain and OS libraries.

What's Changed

• ci: install Zig via direct download (fixes failing CI) by @christopherwxyz in #1
• ci(actions)(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3 in the actions-minor group by @dependabot[bot] in #2
• ci(actions)(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #3
• ci(actions)(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #4
• ci(actions)(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #5
• ci(actions)(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #6
• Upgrade to Zig 0.16.0 by @christopherwxyz in #8
• chore: strip remaining zmit residue from src, tests, docs, CHANGELOG by @christopherwxyz in #7
• fix(blame): integer-overflow panic in formatAuthorShort by @christopherwxyz in #9
• fix(e2e): wire the three e2e scripts up to the current mkit CLI by @christopherwxyz in #14
• test(e2e): wire-level e2e harness for mkit+ssh:// transport by @christopherwxyz in #15
• release: v0.2.0 by @christopherwxyz in #16
• ci: add -Djemalloc smoke on ubuntu-latest by @christopherwxyz in #17
• ci: run tests/e2e-ssh.sh on every PR by @christopherwxyz in #18
• chore: drop 0.1.0-specific language from distribution metadata by @christopherwxyz in #19
• fix(ssh): derive wire CLIENT_VERSION/SERVER_VERSION from cli.cli_version by @christopherwxyz in #20
• fix(file-transport): actually fsync the containing dir after rename by @christopherwxyz in #21
• release: v0.2.1 by @christopherwxyz in #22
• ci(release): add workflow_dispatch trigger as escape hatch by @christopherwxyz in #23
• security: input validation + resource limits across parsers, transports, and on-disk code by @christopherwxyz in #24
• feat(attestations): native in-toto v1 + DSSE attestation subsystem; remove Notary trait by @christopherwxyz in #26
• rewrite(rust): CI — rust.yml + rust-security.yml (Phase 10 prep) by @christopherwxyz in #28
• rewrite(rust): Phase 0.5+1 — hash, object, serialize + golden vectors by @christopherwxyz in #29
• rewrite(rust): Phase 2 store + review follow-ups (serialize fallible, more goldens, spec §13) by @christopherwxyz in #30
• rewrite(rust): Phase 6 sign — Ed25519 + DSSE-prefixed signing (mkit.commit, mkit.remix) by @christopherwxyz in #31
• rewrite(rust): Phase 8 — mkit-attest (JCS + in-toto v1 + DSSE + signers) by @christopherwxyz in #32
• rewrite(rust): Phase 3 — fastcdc (chunker) + delta + pack + fuzz harnesses by @christopherwxyz in #33
• rewrite(rust): Phase 4 — refs + index + worktree + ignore + repo_lock by @christopherwxyz in #34
• rewrite(rust): Phase 5a — diff, graph, merge, cherry_pick by @christopherwxyz in #35
• rewrite(rust): Phase 5b — rebase, bisect, blame, stash, restore by @christopherwxyz in #36
• rewrite(rust): Phase 7a — protocol trait (7 verbs + SSH framing + backoff) by @christopherwxyz in #37
• rewrite(rust): Phase 7b — memory + file Transport impls by @christopherwxyz in #39
• rewrite(rust): Phase 7c — HTTP/HTTPS Transport impl (reqwest/rustls) by @christopherwxyz in #38
• rewrite(rust): Phase 7d — S3 / R2 Transport (SigV4 + rustls) by @christopherwxyz in #41
• rewrite(rust): Phase 7e — SSH Transport (framed, OP_HELLO first) by @christopherwxyz in #40
• rewrite(rust): Phase 9 — mkit-cli binary + snapshot tests by @christopherwxyz in #42
• ci(rust): port reproducible-build.yml to Rust; audit supply-chain.yml by @christopherwxyz in #43
• docs(rust): Zig archival plan + dry-run script (soak-window follow-up) by @christopherwxyz in #44
• attest(rust): derive golden keyid from pubkey + SPEC-ATTESTATIONS §3 prose fix by @christopherwxyz in #45
• rewrite(rust): ops::diff::status_diff + CLI wire-up by @christopherwxyz in #46
• rewrite(rust): CLI completeness — worktree checkout, push/pull packs, $EDITOR, author identity by @christopherwxyz in #47
• rewrite(rust): wire 9 stubbed CLI subcommands by @christopherwxyz in #48
• rewrite: Rust port (Phases 0–10 cutover prep) by @christopherwxyz in #27
• ops(rust): stash show diff renderer + bisect skip exclusion set by @christopherwxyz in #57
• cli(rust): wire HTTP/S3/SSH transports into remote_dispatch by @christopherwxyz in #55
• ssh(rust): promote per-verb decoders to pub; dedupe CLI serve.rs copies by @christopherwxyz in #56
• ci(actions)(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #49
• ci(actions)(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #51
• deps(rust)(deps): bump md-5 from 0.10.6 to 0.11.0 in /rust by @dependabot[bot] in #50
• deps(rust)(deps): bump getrandom from 0.3.4 to 0.4.2 in /rust by @dependabot[bot] in #54
• deps(rust): bump sha2 0.11 + hmac 0.13 (paired) by @christopherwxyz in #58
• sign(rust): verify with strict ZIP-215 rules + regression guard by @christopherwxyz in #59
• cleanup: reset to v0.1.0 — fresh CHANGELOG + scrub prior-impl references by @christopherwxyz in #60
• docs: replace CHANGELOG with fresh v0.1.0 entry by @christopherwxyz in #61

New Contributors

• @christopherwxyz made their first contribution in #1
• @dependabot[bot] made their first contribution in #2

Full Changelog: https://github.com/officialunofficial/mkit/commits/v0.1.0