v0.1.7

0.1.7 (2026-09-01)

Features

• bridge: the tuner bridge, and the eval seam that closes the loop (#184) (f900312)

Bug Fixes

• build: the ledger gate reads a minor series, and the v0.2 audit disposes every open entry (#193) (099a82f)
• docs: repair the CHANGELOG, and refuse conflict markers in future (#196) (c0f5692)
• value: the treatment arm carries the Asset's content (#190) (8f09b10)

Documentation

• adr: measured redundancy is cut from v0.2 (#191) (cea92c6)
• correct the v0.2 scope after two cuts (#192) (3726be0)
• fold the hand-written changelog into v0.1.6 (#197) (66c2a18)
• plans: the bridge measurement seam (#189) (ae955db)
• tombstone calibrate-a-judge — the cookbook migration is finished (#188) (6ab9937)
• tombstone check-your-evals, and fix the README's self-contradicting example (#185) (c8e0d62)

Build & Dependencies

• the link check walks this checkout, not agent worktrees (#194) (1acbc74)

---

Verifying this release

Every artifact below is covered by checksums.txt, and checksums.txt is
signed with cosign keyless — there is no
private key, so there is none to steal. Each archive also ships an SPDX
SBOM, and the whole set carries SLSA build provenance.

# 1. The checksum file is really ours, and really came from this workflow.
cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github\.com/uknoAI/kno/\.github/workflows/release\.yml@refs/tags/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. Your download is really what the checksum file names. Substitute the
#    archive you actually downloaded. Written this way because macOS has no
#    sha256sum, and its shasum does not understand --ignore-missing.
grep " kno_0.1.7_darwin_arm64.tar.gz$" checksums.txt | shasum -a 256 -c -

# 3. It was built by GitHub Actions from this repository, not on a laptop.
gh attestation verify kno_0.1.7_linux_amd64.tar.gz \
  --repo uknoAI/kno \
  --signer-workflow uknoAI/kno/.github/workflows/release.yml

Both identity flags are load-bearing. Without --certificate-identity-regexp,
verify-blob accepts a valid signature from anybody at all; without
--signer-workflow, attestation verify accepts an attestation from any
workflow in the repository. Anchored, they say this file built this binary.

Built with -trimpath, and timestamped from the commit rather than the
clock, so these archives are byte-reproducible — by anyone using the Go
toolchain pinned in this tag's go.mod. A different toolchain produces a
different binary; that is a property of Go, not of this pipeline.

Checksums (SHA-256)

cbe9727268c37d76232d04ea446a7cf62db3d64e366b081c3fd50a4a2b1b5daf  kno_0.1.7_darwin_amd64.tar.gz
35e52d57b4f1fe9a04d9a59720240f52d250368e84c23257ddd56a65ecd2ee08  kno_0.1.7_darwin_amd64.tar.gz.sbom.json
5e8d442d7867f075ba8c747b2a24db62c6d64071d31c2ec3a62c8b9165b538eb  kno_0.1.7_darwin_arm64.tar.gz
f9ec15de7166b1daaf0725e7d94f9654c6f5f779ee68e3ac0fcf35062512cf32  kno_0.1.7_darwin_arm64.tar.gz.sbom.json
db4ddb1441bf3d4d8b83203eff5e1ed6635d368bc94e96bcc45206ef72eecad3  kno_0.1.7_linux_amd64.tar.gz
334c8f8830eab990b4de69217066c05e58aebaf448a5a6048852335a3e7bd946  kno_0.1.7_linux_amd64.tar.gz.sbom.json
b2381d7d9d3bd98db0a4c9cecc6cf3b6a921584ef416e067d6906efc5a1e8cee  kno_0.1.7_linux_arm64.tar.gz
492a14dcc9f938e0efd0c6fa7dea583371b9e52ab3a311cefa7a407ee52f515a  kno_0.1.7_linux_arm64.tar.gz.sbom.json
866e5c6ca65a2fbc1fb5ec600800ddeb59461baa54b0138a7ad8b80b34addf71  kno_0.1.7_windows_amd64.zip
9455a30f9c624e9b8e3453cc92f3cd3bae0b13756d1b9f9f97685a94834d2ef5  kno_0.1.7_windows_amd64.zip.sbom.json
fe74412b2c25224c733b593382dcbf311c61c70a1b8e617d9375e6bdcd8569a1  kno_0.1.7_windows_arm64.zip
ce42cecf77c3a82dd2398d6ef9cd2a03353571015e1f0333854a12b68710616e  kno_0.1.7_windows_arm64.zip.sbom.json