knowledge-release.yaml, a third sidecar workflow. It attaches .lokf/knowledge to a GitHub release as a reproducible archive with a checksum, after the registrar’s checks pass, and attests it on a public repository. It skips an unchanged bundle unless force is set, and runs by hand or, with KNOWLEDGE_RELEASE_ENABLED, on each release. publish.yml dispatches it here.
The librarian template has a slot for the agent’s credential.AGENT_API_KEY_ENV names the variable the agent reads. The credential is the AGENT_API_KEY secret or, with AGENT_USE_JOB_TOKEN, the job’s own token for Copilot CLI. The wrapper exports it under that name only and refuses a name that gh, git or the runner also read. Layout test 1c exercises it.
Fixed
The librarian validates relation targets before it opens a pull request. Its validate step now runs lokf validate --check-refs, as the registrar gate does, because the gate never fires on the librarian’s own pull request.
The sidecar README’s layout tree names everything Step 5 lays down. It stopped at justfile and feedback.md; scripts/, queries.http and curators/ were missing.
