CivicRecords AI v1.6.0

About this release

CivicRecords AI is an open-source, locally-hosted AI system for municipal open-records request processing. Every deployment is a sovereign instance owned by the city — no cloud, no telemetry, no outbound data transfer.

Windows installer is UNSIGNED by design. On first run, Windows SmartScreen will show "Windows protected your PC — Unknown publisher." To proceed: click More info → Run anyway, then confirm UAC. See installer/windows/README.md for the full remediation walkthrough.

Release provenance

Post-baseline releases include release-attestation.json and
release-attestation.json.bundle. The Git tag is a release pointer; the
Sigstore-signed attestation is the trust artifact. Verify the attestation with
the exact CivicSuite/civicrecords-ai workflow identity printed in the release
notes and then verify the installer checksum sidecar.

Downloads

• Windows double-click installer: CivicRecordsAI-<version>-Setup.exe (bundled with .sha256 checksum sidecar for Get-FileHash verification).
• Linux / macOS guided-script install: clone the repo at this tag and run ./install.sh — see README.md and USER-MANUAL.md for prerequisites and a step-by-step walkthrough.

Cross-platform native installer parity is explicit follow-on work, not shipped in this release.

Docs

• README · USER-MANUAL · Canonical spec · CHANGELOG

---

What's in this release

Verify release provenance

cosign verify-blob release-attestation.json \
  --bundle release-attestation.json.bundle \
  --certificate-identity "https://github.com//.github/workflows/release.yml@refs/tags/" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

sha256sum -c CivicRecordsAI--Setup.exe.sha256
python scripts/verify-release-provenance.py "" \
  --repo "" \
  --attestation release-attestation.json \
  --bundle release-attestation.json.bundle \
  --artifacts-dir .

What's Changed

• feat(security): move records secrets to Docker secret files by @scottconverse in #74
• chore: commit B2 Phase 2 RED rehearsal artifact by @scottconverse in #75
• fix(security): remove B2 secret file pointer env names by @scottconverse in #76
• chore: record B2 Phase 2 green rehearsal by @scottconverse in #77
• fix(ci): remove secret pointer env names from release workflow by @scottconverse in #78

Full Changelog: v1.5.0...v1.6.0