The workspace counts the links between its members. The lock, the workspace index and queries/links.rq count the typed relations in one bundle whose target is a concept of another, by slot.
The workspace carries graph.json, every bundle’s concepts and typed relations as cytoscape.js elements. Each node names its bundle, and the links between bundles are marked.
The MCP server loads a member’s graph when a walk first reaches it, as section 11.4 of the LOKF specification has members load, and a SPARQL query loads them all. The lock’s graphs (format 4) says where each graph lies in graph.nq, with its digest, the namespaces it names and the IRIs it shares with another graph.
The federation build has the sensitivity gate of LOKF section 11.5. A member concept says public, internal or confidential: an internal member joins once a person confirms sensitivity: internal on the Domain concept, and only in a private or internal repository, a confidential one never, and the workflow keeps an internal workspace off the site.
A bundle that releases no zip joins by the concepts.jsonld its site serves, pinned by that file’s checksum; the build writes the file out as the bundle. The members script asks for it with a conditional request and proposes a changed file, and members --add <address> drafts such a member.
A member whose file cannot be fetched is held at its last good state, as section 11.5 of the LOKF specification has it, from the previous release’s workspace that --previous names. A release zip with other bytes is held only at the release a build fetched before, a member never built is left out until it can be fetched, and a check holds nothing its pull request proposes.
The readers read a workspace where it lies: a folder, a workspace-<tag>.zip in place, or the site that serves it, a graph at a time by range request. read_document reads the workspace’s copy of a release, else its concepts.jsonld, else its source, as section 11.4 chains them.
A reader can be given some members alone.--member <slug> on mcp, serve and query loads those bundles’ graphs and no other, and refuses the stored queries that read the lock graph.
A domain host’s release notes say what changed in its workspace.knowledge-federate.py diff compares two workspaces, and the federation workflow adds the members that joined, moved or left, and the links between them, to each release’s notes.
A domain host’s graph page draws the workspace. Its The workspace view draws every bundle the domain names, each in a colour and shape of its own, with the links between bundles dashed, from the graph.json the federation workflow serves. WORKSPACE in site.config.mjs turns the view on or off, and it is on when the repository has the workflow.
Changed
docs/federation.md holds the whole federation design, and states each rule once. Domains as manifests, LOKF section 11 and the release moved there from docs/context-layer.md, which keeps what a context layer is, the one-bundle table and what OKF leaves open.
The docs say the pen, its figure and the ingest’s guards once. The figure of who writes the bundle stays on docs/architecture.md, and docs/for-the-curious.md, docs/ingest.md and docs/three-lines.md link to the page that holds each detail instead of repeating it.
docs/context-layer-technology.md keeps to what KTL needs from a product. The vendor tables of limits, plans and quotes are gone, and the page names the sidecar’s own workspace server and MCP server beside the stores’.
docs/for-the-curious.md says how readers and verdicts steer the next run. It now holds what KTL took from the WikiSkill and SkillWiki papers, so docs/wikiskill.md and docs/skillwiki.md are gone. The bundle’s two concepts stay the record of each paper.
The federation build runs lokf in its own process. It exported and validated each bundle through a new lokf process, which imported lokf and LinkML again every time. A build of ktl-federation’s five members takes 4.5 seconds instead of 12, with the same output, and the federation tests run in half the time.
SECURITY.md and docs/threat-model.md say what holds after these fixes, with a section on the website, and no longer claim the most a hostile release could do before review was propose a change.
Fixed
The sync script no longer fails after a complete sync that replaces it with a longer copy. Bash read on into the new copy and ran a line from its middle, so the run exited with an error and the sync workflow opened no pull request. The script now exits on the line that calls main, a v0.52.0 copy also stops when it syncs to this release, and scripts/sync-sidecar.sh runs each sibling’s script from a copy.
A confidential ingest entry is refused where git could commit its copy. The script checks that git ignores .lokf/.cache/mirror/ and tracks nothing there before it fetches the entry.
The sync keeps a host’s .lokf/.gitignore current. A host kept the copy ktl-sidecar Step 1 first wrote, so it could lack the template’s later lines, such as .cache/, where a confidential copy goes.
The scheduled librarian stops before any agent runs when git does not ignore .agents/. It stopped only after the agent had run, at the write-scope check, with ?? .agents/.
The federation gate refuses a link into a member’s namespace that names no concept of that member, as --check-refs refuses one inside a bundle, under the same unowned_targets policy. It checked only that some member owned the namespace.
The federation gate reads a reified relations entry as it reads the slot that entry names, so a target no member owns there stops the build too. links.rq and unowned.rq count such entries as well.
The members script moves the other members when it cannot check one, which the hand-off names. When the GitHub API refuses a release list as rate limited, gh asks again with the job’s token.
The MCP server’s federated_sparql stops reading at its limit, 1000 rows or 2000 triples, and says when it cut an answer. It read a SELECT whole before cutting it, and returned a CONSTRUCT whole.
The workspace’s stored queries take their predicates from the toolkit.unowned.rq named owl:sameAs where lokf writes schema:sameAs, and left out memberOf and holder.
The graph page’s details panel sets each label beside its value. Starlight’s spacing for page content put every label a line below it.
A member whose index gives its licence as text, such as MIT, no longer stops the domain build. The lock graph keeps such a value as a literal, and the index writes it as text.
The MCP server reads a concept whose id lies outside its bundle’s namespace, which the registry routes through its id_index. It cut the IRI by the wrong prefix.
A member whose namespace nests with another’s stops the build with a finding that names both, before anything is fetched. The registry refused it only after every download, with a Python traceback.
A checksum must be sha256: and 64 hex digits. Only its length was checked, so a path in it could reach outside the download cache and have the build delete a file there.
Every download stops at --max-bytes, a member’s schema and workspace as well as its zip, where each was read whole before its checksum was compared.
A download is tried again after a server error or a dropped connection, and follows a redirect only within http and https, never from https to http and never from a public address to a private one.
A zip of more than 100,000 entries, or one that matches its checksum but cannot be read, stops the build with a finding, where it filled the disk or ended in a traceback.
A reader keeps no partial answer to a range request as the whole file, and --previous refuses a site address, from which no zip member could be held.
The federation workflow’s weekly schedule no longer takes the place of a release build that waits for its turn, and each job has a time limit.
A domain host’s site serves each member’s release inside the workspace. The Pages upload left out the hidden bundles/<slug>/.lokf/ folders, so every member link in the served workspace index answered 404.
The contract records every sibling host’s links into this repository, among them ktl-federation’s into the federation page and the domain-bundle playbook. Its local cross-check reads all five hosts, and skips a domain host’s ignored snapshot/, which holds a copy of this bundle.
The librarian keeps run accounts out of the source map. No rule asked for one, yet each refresh had added its account to playbooks/knowledge-sources.md, 41 of them by 2026-10-19. The skill now says the map holds none.
An agent that applies its own patch no longer loses a scheduled run’s work. The wrapper sets KNOWLEDGE_PEN_DRY_RUN_ONLY for the agent, so the pen only checks the patch file there and leaves it for the wrapper to apply. The skill and the pen’s dry-run line no longer tell a scheduled agent to apply and validate.
Security
A release can no longer write a host’s git configuration through the sync.knowledge-sync.sh refuses a copy path inside a .git folder and clones the release without a checkout.
The branch the sync pushes carries no workflow a release wrote. A workflow on a pushed branch runs with the repository’s secrets, so publish applies the patch with knowledge-sync.sh --apply, keeps every workflow but for the pin, and holds the release’s workflow changes for a person, or for a reviewer of the Environment KNOWLEDGE_SYNC_REVIEW_ENVIRONMENT names.
The sync’s publish refuses a deletion, a link or an unusual mode, and leases its push to the commit it read. A branch holding a person’s commit is left alone with or without a pull request, and the report names a manifest rule the script does not know.
Each workflow reads its secrets from an Environment limited to the default branch:knowledge-librarian, knowledge-sync and knowledge-ingest. Move every repository secret there on every host, as the sidecar’s references/automation.md says.
A federation build refuses a member zip holding a hidden file or a file a browser runs, and a distribution name that is not one plain file name. A .git folder in a zip, or a name that climbs out of the workspace, could run code in the build; the health line now runs git on no member’s folder.
A federation build fetches members over http or https from public addresses only.--allow-local allows local paths and private addresses, and a person’s private_addresses: allow on the Domain concept allows a forge on the host’s own network.
A member’s attestation must come from its own release workflow, or its federation workflow for a workspace, and a build without gh stops unless given --no-attestation.
The federation workflow hands its token to gh alone, and the website and federation builds run no npm install script.
The website copies only files inside the repository, and passes raw HTML as GitHub renders a README. A link out of the repository and an SVG holding a script are left out, other markup is shown as text, and Astro’s telemetry is off.
