Knovaryn v0.2.2 — public launch

Knovaryn 0.2.2

Wheel and source distribution are attached below and published to PyPI with Sigstore provenance attestations (verifiable via PyPI's attestation UI). SHA256SUMS covers both distributions; sbom.cdx.json is the CycloneDX SBOM for this release.

Added

• Original brand identity: Tracemark logo family, design tokens, and a
  documented design system (docs/assets/brand/, docs/design-system/).
• Canonical benchmark methodology (docs/reference/benchmark-methodology.md)
  and a current benchmark report with three-run reproducibility evidence
  (benchmarks/report-0-2-1.md).
• ADR-0007: dual-major MCP SDK compatibility decision record, superseding
  ADR-0002's adapter guidance with the tested 1.x/2.x acceptance matrix.
• Visual-asset governance: scripts/check_visual_assets.py and the
  reproducible brand/diagram/screenshot generators under scripts/visuals/.
• Browser and accessibility verification for the documentation site
  (tests/browser/).

Fixed

• Release-bundle reproducibility: release bundles no longer inherit
  wall-clock UUIDv7 handles — IdGenerator(seed=...) provides opt-in
  deterministic identifiers for reproducible-mode runs, so identical inputs
  produce byte-identical bundles (H(R1)=H(R2)=H(R3), enforced by
  benchmarks/run_report.py and regression tests). Production identifiers
  remain unguessable UUIDv7s, and security tokens stay secrets-based in
  every mode.

Changed

• Security and maintainer contact routes: vulnerability reporting now goes
  exclusively through GitHub private vulnerability reporting (no
  project-domain email exists); maintainer/CoC/legal contact updated.
• Redesigned README and documentation site presentation (original visual
  identity, interactive pipeline and architecture explorers with static
  fallbacks); regenerated all architecture diagrams for readability.
• Release-date hygiene: v0.2.1's publication date corrected to 2026-08-25
  across CITATION.cff, codemeta.json, and this changelog; version-sync
  checks extended to cover release dates, project URLs, and social-preview
  wiring.

Knovaryn 0.2.1

Knovaryn 0.2.1

Wheel and source distribution are attached below and published to PyPI with Sigstore provenance attestations (verifiable via PyPI's attestation UI). SHA256SUMS covers both distributions; sbom.cdx.json is the CycloneDX SBOM for this release.

Fixed

• MCP SDK support contract: declared range is now mcp>=1.28,<3 and an
  official acceptance matrix runs the full MCP lifecycle against both 1.x
  and 2.x pins (stdio + authenticated streamable HTTP + bind-refusal),
  wired into CI as a required job.
• Async shutdown hygiene: SQLite/aiosqlite connections now use NullPool
  and engine disposal is shielded, eliminating post-loop
  RuntimeError('Event loop is closed') worker-thread noise when lifespans
  tear down inside a cancelled anyio scope; regression tests plus a
  warnings-as-errors policy (PytestUnhandledThreadExceptionWarning,
  PytestUnraisableExceptionWarning, incomplete pydantic field definitions).
• Provenance location precision: every source span carries a
  machine-verifiable precision derived from stored parser evidence
  (exact_bbox / exact_page / page_range / section / chunk /
  unknown) via SourceSpan.with_derived_precision; Docling page/bbox
  provenance flows through chunker to spans to lineage (REST + MCP) and
  export manifests; markdown/text sources honestly report lower precision
  instead of fabricating page numbers.
• Schema evolution: create_all now performs idempotent additive column
  migration so databases created by older versions upgrade in place; a new
  Alembic revision (b81d4f6a2c39) matches the ORM metadata exactly.
• Version synchronization: single authoritative __version__ feeds
  CITATION.cff, codemeta.json, MkDocs config, container labels, REST/MCP
  servers and the README marker (scripts/check_version_sync.py --check).

Added

• Semantic validation profiles (quality.semantic_profile): explicit
  offline-fast (deterministic-only, network-free) and certified-semantic
  (deterministic first, cited-evidence-only judge second via fingerprinted,
  cached, budget-accounted ModelGateway.judge). Deterministic
  contradictions can never be overridden; unavailable judges yield
  unverified, never verified. Adversarial benchmark with false-accept /
  false-reject rates and Wilson confidence intervals.
• Certified pairwise preference profile (preference.profile):
  two-order evidence-cited judge with randomized presentation, minimum
  preference margin, length/style signature detection, classified
  rejected-defect requirement, and fail-closed lineage recording.
• CLI reference generated from the real Typer command tree
  (scripts/generate_cli_reference.py) with CI drift checks and a command
  tree snapshot test.

Changed

• REST API reports the real application version (__version__) instead of a
  stale literal; MCP health tool exposes server_version.
• CITATION.cff no longer carries a placeholder DOI pending real registration.

v0.2.0

Highlights

• Truth-before-reach remediation: every quality gate in the acceptance path is now wired into the product, not just tested as library code — semantic consistency (causal reversal, number/unit mismatch, negation flip, entity-role reversal) is a critical rejection dimension applied to every example.
• Durable jobs & workers: lease-based job engine with crash recovery and budget accounting.
• MCP product surface: 23-tool suite over stdio + streamable HTTP.
• REST API + web console: typed API with status-code contracts, scopes/tenancy, safe binding, accessible console, per-principal rate limiting.
• Deployment: production compose topology (api/worker/postgres/minio/proxy), full Kubernetes kustomize base (migration Job, network policies, PDBs), metrics endpoints, backup/restore runbook.
• Supply chain: CI matrix with tiered jobs and branch-coverage gate, security scanning, SBOM, OIDC publishing, reproducible release with detached checksums (verify-release).
• 8-format export with an artifact-first intake service and golden-corpus regression tests.

Verification

• 654 offline tests passing; opt-in suites (compose E2E, Postgres/S3 storage modes, live provider) exercised separately.
• Release assets include SHA256SUMS (detached, strictly verified) and a CycloneDX SBOM.

🤖 Generated with Claude Code

Knovaryn 0.1.1

What's Changed

• Production correctness: provenance, quality, MCP, REST, deploy, docs & release prep (WPs A-N + audit) by @waalwalker1 in #1

New Contributors

• @waalwalker1 made their first contribution in #1

Full Changelog: v0.1.0...v0.1.1

v0.1.0 — Knovaryn alpha (technical preview)

Full Changelog: https://github.com/waalwalker1/knovaryn/commits/v0.1.0