mkit 0.5.0

mkit 0.5.0

Content-addressed VCS for creative work.

Verifying downloads

Every archive is signed with cosign keyless via GitHub OIDC; the
signing certificate embeds the workflow identity and a Rekor
transparency log entry is public. See docs/RELEASE.md
in the repo for full verification steps.

The verifier regex below is anchored: it pins the exact workflow
path and accepts only strict semver tags (with optional
pre-release suffix like -rc.1).

cosign verify-blob \
  --certificate-identity-regexp '^https://github\.com/officialunofficial/mkit/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$' \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle <archive>.cosign.bundle \
  <archive>

SLSA build provenance

Every archive also carries a standard SLSA build provenance
attestation, generated by GitHub's
actions/attest-build-provenance
and recorded in the Sigstore public-good transparency log. Verify
it with the GitHub CLI (no extra tooling required):

gh attestation verify <archive> --repo officialunofficial/mkit

or with slsa-verifier:

slsa-verifier verify-artifact <archive> \
  --provenance-path mkit-0.5.0.provenance.jsonl \
  --source-uri github.com/officialunofficial/mkit \
  --source-tag v0.5.0

This is additive to the cosign signature above, not a
replacement for it.

Platform notes

macOS binaries are not codesigned or notarized. Trust is
established via the cosign signature above. Running from a
terminal works; double-clicking in Finder hits Gatekeeper.

Windows is not a supported target. Windows users should run
mkit under WSL, which uses the Linux binary.

SBOM

A CycloneDX SBOM (sbom.cdx.json) is attached. Reflects the
Rust crate graph of the whole workspace, including library and
test dependencies, plus toolchain and OS libraries.

npm package

The WASM bindings are also published to npm as
@officialunofficial/mkit-wasm at the
same version, with Sigstore-backed provenance attached to this
workflow run.

What's Changed

• ci(release-plz): remove the push-to-main trigger, fix v0.4.2's race by @christopherwxyz in #953
• ci(actions): bump the actions-minor group with 2 updates by @dependabot[bot] in #950
• deps(spammer-worker): bump @types/node from 24.13.3 to 26.4.0 in /apps/spammer-worker by @dependabot[bot] in #948
• copy(web): remove mannered prose from the mkit.sh site by @christopherwxyz in #955
• perf(web): immutable-cache /assets/* and preload the two critical fonts by @christopherwxyz in #956
• perf(web): align _headers caching with officialunofficial.com's pattern by @christopherwxyz in #957
• docs: add mkit-transport-connect to crate listings by @christopherwxyz in #960
• deps(rust)!: upgrade commonware to v2026.9.0, drop Windows support by @christopherwxyz in #958
• perf(core,cli): parallelize pack-entry compression across rayon during push by @christopherwxyz in #962
• mcp: migrate to MCP 2026-07-28, add mkit mcp --http by @christopherwxyz in #961
• perf(core): memoize shard-dir create_dir_all in BulkWriter::write by @christopherwxyz in #954
• fix(mcp): regenerate bun.lock, stale since #961's dependency changes by @christopherwxyz in #963
• Detect concurrent serve access, warn on inert identity aliases, split delta errors by @christopherwxyz in #959
• perf(cli): parallelize post-fetch signature verification across rayon by @christopherwxyz in #964
• perf(core,cli): parallelize push-plan delta encoding across rayon by @christopherwxyz in #977
• deps(og): bump the npm-minor group in /apps/og with 2 updates by @dependabot[bot] in #970
• deps(spammer-worker): bump the npm-minor group in /apps/spammer-worker with 3 updates by @dependabot[bot] in #972
• ci(actions): bump the actions-minor group with 2 updates by @dependabot[bot] in #966
• fix: enforce specification integrity and durability contracts by @christopherwxyz in #965
• fix(web): simplify docs, align Pigment UI, and stabilize chat scrolling by @christopherwxyz in #979
• deps(mcp): bump the npm-minor group in /apps/mcp with 2 updates by @dependabot[bot] in #967
• deps: resolve Dependabot backlog and vulnerable transitive packages by @christopherwxyz in #980
• deps: apply remaining app, signer, and CI action updates by @christopherwxyz in #992
• fix(keys-worker): restore CORS on Durable Object-forwarded name responses by @christopherwxyz in #994
• deps(rust): update der and zstd across consumer lockfiles by @christopherwxyz in #993
• perf(core): eliminate per-chunk allocate-and-copy in streaming FastCDC reader by @christopherwxyz in #982
• perf: parallelize single-large-file chunk hashing, fix review findings by @christopherwxyz in #978
• feat(web): add hosted workspaces and shared passkey sessions by @christopherwxyz in #995
• deps(web): bump playwright-core from 1.62.1 to 1.63.0 in /apps/web in the npm-minor group by @dependabot[bot] in #1000
• deps(workspace-worker): bump esbuild from 0.28.1 to 0.28.2 in /apps/workspace-worker in the npm-minor group by @dependabot[bot] in #997
• deps(workspace-worker): bump vitest from 4.1.11 to 5.0.0 in /apps/workspace-worker by @dependabot[bot] in #999
• feat(sandbox): wire sccache to Cloudflare R2 for cloud-sandbox builds by @christopherwxyz in #1004
• perf(core): history-mmr ancestry publish — eliminate redundant rebuilds, switch MMR to MMB by @christopherwxyz in #1003
• Batch Ed25519 verification for post-fetch signatures, plus a scrub-state panic fix by @christopherwxyz in #1006
• deps(workspace-worker): bump @types/node from 24.13.3 to 26.4.1 in /apps/workspace-worker by @dependabot[bot] in #1001
• deps(web): bump vitest from 4.1.11 to 5.0.0 in /apps/web in the vitest group across 1 directory by @dependabot[bot] in #996
• perf(core): use a fast non-cryptographic hasher for delta::encode's block index by @christopherwxyz in #1007
• deps(workspace-worker): bump typescript from 5.9.3 to 7.0.2 in /apps/workspace-worker by @dependabot[bot] in #998
• feat(core): commonware-aligned BMT proofs + stable SPEC-MERKLE-OBJECTS §5 (verifier kit PR 1) by @marthendalnunes in #1016
• feat(core): disclosure bundle + SPEC-DISCLOSURE (verifier kit PR 2) by @marthendalnunes in #1017
• feat(core): closure profile — raw-only packs, store-less pack iterator, verify_closure (verifier kit PR 3) by @marthendalnunes in #1019
• deps(rust): bump the cargo-minor group across 1 directory with 2 updates by @dependabot[bot] in #1018
• deps(web): bump the npm-minor group in /apps/web with 11 updates by @dependabot[bot] in #1014
• deps(workspace-worker): bump the npm-minor group in /apps/workspace-worker with 3 updates by @dependabot[bot] in #1013
• deps(spammer-worker): bump the npm-minor group in /apps/spammer-worker with 4 updates by @dependabot[bot] in #1012
• deps(og): bump the npm-minor group in /apps/og with 2 updates by @dependabot[bot] in #1010
• deps(mcp): bump the npm-minor group in /apps/mcp with 3 updates by @dependabot[bot] in #1009
• ci(actions): bump the actions-minor group with 2 updates by @dependabot[bot] in #1008
• feat(wasm): disclosure + closure verification exports (verifier kit PR 4) by @marthendalnunes in #1020
• feat(cli): prove / verify-proof / closure export|verify (verifier kit PR 5) by @marthendalnunes in #1021
• docs: VERIFY.md guide + verifier kit closing polish (verifier kit PR 6) by @marthendalnunes in #1023
• feat(core): SPEC-DISCLOSURE v2 — mandatory per-step inner roots for native commonware verification by @marthendalnunes in #1025
• feat(core): streaming store-backed closure verification (closes #1022) by @marthendalnunes in #1026
• chore: verifier kit close-out (corrupt merge, wasm32 check, ci-scripts, tracking issues) by @marthendalnunes in #1029
• fix: drain workspace-worker request body before auth-header rejection by @marthendalnunes in #1033
• fix: verifier kit pre-release polish (man flags, MCP hint, stdin cap, fuzz, check order) by @marthendalnunes in #1032
• perf(core): skip reading dedup-matched chunks in content_eq by @christopherwxyz in #1031
• perf(core): decode read_object's Tree/ChunkedBlob once, not twice by @christopherwxyz in #1030
• perf(core): parallelize raw-entry pack unpack across worker threads by @christopherwxyz in #1028
• perf(core): roll delta::encode's block hash instead of recomputing it by @christopherwxyz in #1034
• perf(core): basename fast path for non-anchored gitignore patterns by @christopherwxyz in #1045
• deps(mcp): bump vitest from 5.0.0 to 5.0.1 in /apps/mcp in the vitest group by @dependabot[bot] in #1046
• ci(actions): bump the actions-minor group with 2 updates by @dependabot[bot] in #1047
• deps(web): bump vitest from 5.0.0 to 5.0.1 in /apps/web in the vitest group by @dependabot[bot] in #1049
• deps(spammer-worker): bump the npm-minor group in /apps/spammer-worker with 5 updates by @dependabot[bot] in #1050
• deps(og): bump vitest from 5.0.0 to 5.0.1 in /apps/og in the vitest group by @dependabot[bot] in #1051
• deps(workers): bump worker from 0.8.5 to 0.8.6 in /apps/vcs-worker in the cargo-minor group by @dependabot[bot] in #1052
• deps(workers): bump worker from 0.8.5 to 0.8.6 in /apps/mkit-worker-common in the cargo-minor group by @dependabot[bot] in #1053
• deps(workers): bump worker from 0.8.5 to 0.8.6 in /apps/keys-worker in the cargo-minor group by @dependabot[bot] in #1054
• deps(workers): bump the cargo-minor group in /apps/repo-worker with 2 updates by @dependabot[bot] in #1055
• deps(workspace-worker): bump the npm-minor group in /apps/workspace-worker with 5 updates by @dependabot[bot] in #1056
• deps(rust): bump the cargo-minor group in /rust with 2 updates by @dependabot[bot] in #1058
• perf(core): pipeline FastCDC chunk-cutting with chunk-hashing on large-file ingest by @christopherwxyz in #1042
• perf(core): parallelize status/diff staged-object check + pack-unpack precedence fix by @christopherwxyz in #1035
• deps(og): bump the npm-minor group across 1 directory with 4 updates by @dependabot[bot] in #1057
• perf(core): elide common line prefix before Myers diff core by @christopherwxyz in #1040
• perf(core,cli): parallelize ChunkedBlob chunk reads on checkout/clone/reset/restore by @christopherwxyz in #1043
• deps(mcp): bump the npm-minor group across 1 directory with 3 updates by @dependabot[bot] in #1060
• deps(web): bump the npm-minor group across 1 directory with 13 updates by @dependabot[bot] in #1059
• fix(workspace-worker): migrate nanocodex Agent.create to the 0.6.1 host API by @christopherwxyz in #1061
• perf(core): fan out closure-verification pre-pass across worker threads by @christopherwxyz in #1062
• perf(core): elide common leading run before blame's LCS matcher by @christopherwxyz in #1064
• docs: tighten README and site copy; add spec icons by @christopherwxyz in #1083
• perf(core): reuse a thread-local zstd Compressor in maybe_compress by @christopherwxyz in #1081
• docs: state the glibc requirement of the Linux release archives by @marthendalnunes in #1136
• fix(core): bound pack-reader memory and 32-bit framing arithmetic by @marthendalnunes in #1144
• deps: roll up open Dependabot updates + fix RUSTSEC-2026-0304 by @christopherwxyz in #1177
• perf(core): fan out build_tree_inner's cache-miss file hashing by @christopherwxyz in #1176
• perf(core): single-read ref listing + core microbenchmarks on the performance page by @christopherwxyz in #1197
• feat(server): production mkit-server and Uno Workers launch by @marthendalnunes in #1261
• fix(ci): restore Workers, geiger, and Linux test gates by @marthendalnunes in #1291
• fix(server): repair Blob admission and extracted HTTP readback by @marthendalnunes in #1288
• chore: remove internal sandbox hook, review reports and account identifiers by @marthendalnunes in #1297
• release: mkit 0.5.0 (production mkit-server and Workers adapter) by @marthendalnunes in #1307

Full Changelog: v0.4.2...v0.5.0