From 712df93ff3945e8abaa8d9ca4b3d144b8916f31b Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 5 Oct 2026 08:36:21 +0000 Subject: [PATCH 1/2] fix(release): build Linux and Windows binaries, allow re-running for a tag Both v0.1.0 and v0.2.0 shipped with only the macOS binaries: - Linux musl failed in openssl-sys (reqwest's default TLS needs OpenSSL, which the runner has no musl build of). Build the glibc target instead. - Windows failed with LNK2038: esaxx-rs (via tokenizers) always uses the static CRT while mimalloc used the dynamic one. Build with +crt-static. Add a workflow_dispatch trigger with a tag input so the missing binaries can be attached to an existing release without moving its tag. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01QsuMoxNk88vZYnxPepuUKV --- .github/workflows/release.yml | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8646ef1..1aa4d51 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,12 @@ on: push: tags: - 'v*' + # Re-run packaging for an existing release tag (e.g. after a build fix lands on main). + workflow_dispatch: + inputs: + tag: + description: 'Existing release tag to build and attach binaries to (e.g. v0.2.0)' + required: true permissions: contents: write @@ -17,8 +23,10 @@ jobs: fail-fast: false matrix: include: + # glibc, not musl: reqwest's default TLS pulls in openssl-sys, which + # has no musl OpenSSL to link against on the runner. - os: ubuntu-latest - target: x86_64-unknown-linux-musl + target: x86_64-unknown-linux-gnu suffix: "" bin_name: korg-linux-x86_64 - os: macos-latest @@ -37,19 +45,19 @@ jobs: steps: - name: Checkout Repository uses: actions/checkout@v4 + with: + ref: ${{ inputs.tag || github.ref }} - name: Install Rust Toolchain uses: dtolnay/rust-toolchain@stable with: targets: ${{ matrix.target }} - - name: Install musl-tools (Linux Only) - if: matrix.os == 'ubuntu-latest' - run: | - sudo apt-get update - sudo apt-get install -y musl-tools - - name: Build Binary (Release Mode) + env: + # esaxx-rs (via tokenizers) always builds with the static CRT (/MT); + # link everything statically so mimalloc's /MD objects don't clash (LNK2038). + RUSTFLAGS: ${{ matrix.os == 'windows-latest' && '-C target-feature=+crt-static' || '' }} run: | cargo build --release --target ${{ matrix.target }} @@ -68,5 +76,6 @@ jobs: uses: softprops/action-gh-release@v2 with: files: ${{ matrix.bin_name }} + tag_name: ${{ inputs.tag || github.ref_name }} env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From a3a5d8ed955d0ee6c27be015299cceb98a02b347 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 5 Oct 2026 08:39:05 +0000 Subject: [PATCH 2/2] feat(release): publish release notes from .github/release-notes/.md Add the v0.2.0 notes and a release-notes job that sets the GitHub release body from that file. On a manual run it reads the notes from main, so notes can be added after a tag is cut. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01QsuMoxNk88vZYnxPepuUKV --- .github/release-notes/v0.2.0.md | 25 +++++++++++++++++++++++++ .github/workflows/release.yml | 28 ++++++++++++++++++++++++++++ 2 files changed, 53 insertions(+) create mode 100644 .github/release-notes/v0.2.0.md diff --git a/.github/release-notes/v0.2.0.md b/.github/release-notes/v0.2.0.md new file mode 100644 index 0000000..27aefcd --- /dev/null +++ b/.github/release-notes/v0.2.0.md @@ -0,0 +1,25 @@ +korg is a tamper-evident, SHA-256-chained ledger for AI agents. This release turns it into something you can hand to someone else: capture a session, mint it into a signed Certificate, and let anyone re-verify it offline with zero trust in you or in korg. + +## Highlights + +- **Zero-config capture for Claude Code.** `korg-setup` installs a hook that writes one verifiable ledger per session under `~/.korg/sessions/`. `korg-backfill` captures your past transcripts too. +- **`korgcert@v1` Certificates.** `korg-seal mint session.jsonl --claim "..."` produces a signed certificate whose human-readable summary (files touched, tools used, steps) is re-derived from the events at verify time, so it cannot lie. Three conformant verifiers (Rust, Python, JS) plus a zero-install browser verifier at https://new1direction.github.io/korg/. +- **Trusted time.** `korg-seal anchor` binds a public git commit as a witness; `korg-seal resolve` proves the chain existed no later than that commit. +- **Verify in CI.** The `verify-korgcert` GitHub Action fails a job on a tampered or unpinned artifact and posts the attestation as a sticky PR comment. +- **An honest swarm.** Workers apply real patches in git worktrees and the ledger attests the real diff, never synthetic numbers. `korg run-once --provider ollama` runs the pipeline on a real local model. +- **Cross-vendor capture (N=3).** Adapters for Claude Code, OpenAI Codex CLI and Grok Heavy, plus `recall-mcp` for cross-session memory and `introspect-mcp` to expose any `--introspect` binary as MCP tools. +- **Hardened.** Three adversarial bug-hunt passes fixed 32 real bugs, including a receipt-signature forge and a JS canonicalization divergence. Verifiers are fuzzed and differentially tested across all three implementations with 0 divergences. + +## Breaking change + +The certificate format `goldseal@v1` is renamed `korgcert@v1`. Seals minted under the old name must be re-minted. + +## Try it in 30 seconds + +See the [quickstart](https://github.com/New1Direction/korg#readme): build `korg-verify`, verify a real session ledger, edit one event, and watch the verifier name it. + +## Downloads + +Prebuilt `korg` binaries for Linux x86_64 (glibc), macOS x86_64 and arm64, and Windows x86_64 are attached below. + +Full details: [CHANGELOG.md](https://github.com/New1Direction/korg/blob/main/CHANGELOG.md#020--2026-10-05) ยท Compare: [v0.1.0...v0.2.0](https://github.com/New1Direction/korg/compare/v0.1.0...v0.2.0) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1aa4d51..f4bb8e5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -79,3 +79,31 @@ jobs: tag_name: ${{ inputs.tag || github.ref_name }} env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + release-notes: + name: Publish Release Notes + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + # Notes come from the triggering ref (main on a manual run), so they can be + # added or fixed after the tag was cut. + - name: Checkout Repository + uses: actions/checkout@v4 + + - name: Set release body from .github/release-notes/.md + shell: bash + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ inputs.tag || github.ref_name }} + run: | + notes=".github/release-notes/${TAG}.md" + if [ ! -f "$notes" ]; then + echo "No $notes; leaving the release body unchanged." + exit 0 + fi + # A tag push can get here before the build jobs create the release. + for i in 1 2 3 4 5 6 7 8 9 10; do + gh release view "$TAG" >/dev/null 2>&1 && break + sleep 30 + done + gh release edit "$TAG" --notes-file "$notes"