Skip to content
KTL Registrar

All versions since 0.2.0

All versions

0.2.0

Added

  • .lokf/knowledge/: this plugin’s own self-documenting knowledge bundle.
  • release.yml verifies the pushed tag matches manifest.json’s version before building.

Security

  • build.yml/release.yml: hardened-runner auditing, least-privilege permissions, and SHA-pinned actions.

0.3.0

Added

  • Bundle root folders: a vault can hold several independent bundles as sibling project folders instead of one bundle per vault; a misconfigured root is reported rather than silently producing an empty “clean” bundle.
  • Scaffold command targets the active note’s bundle, asking when several are configured and none is open.
  • Settings shortcut to install OKF Enforcer from the community-plugin browser.
  • Unit tests for bundle-resolution logic, extracted into plain Obsidian-free functions.
  • Golden-fixture bundle checks in npm run smoke-test against a frozen scaffolding template and this repo’s own .lokf/knowledge/.
  • This repo’s .lokf/knowledge/ bundle is now maintained by lokf-agent-skills installed at run time rather than committed.
  • README rewrite: trust-model framing shared with lokf-agent-skills, install section, repo layout, credits.
  • lint-and-docs.yaml: ShellCheck, actionlint, markdownlint, lychee link-checking, and codespell on every push/PR plus weekly.
  • .markdownlint-cli2.jsonc adopted from lokf-agent-skills, with MD024 scoped to siblings_only so Keep a Changelog headings pass.
  • .github/dependabot.yml: weekly updates for pinned action SHAs, npm devDependencies, and the .lokf/ sidecar’s Python toolchain.
  • AI_COVENANT.md, CODE_OF_CONDUCT.md (Contributor Covenant 2.1), and a PR template scope checkbox/checklist, all shared with lokf-agent-skills.

Changed

  • Scaffold command writes publisher.id as person/<slug> to agree with type: Person (was org/<slug>).
  • README/CONTRIBUTING clarify bundle-root defaults, PR-based release flow, and Node 20+ requirement.
  • Type-vocabulary lookups are cached instead of rebuilt per note.
  • Renamed knowledge-validate.yaml to knowledge-registrar.yaml, matching upstream lokf-agent-skills v0.12.0; cross-references updated across docs.
  • SECURITY.md now inventories every workflow and the librarian’s privilege split.
  • .markdownlint-cli2.jsonc disables MD060 (padded-header/bare-separator tables used throughout this repo).

Fixed

  • An unreadable note was silently dropped mid-scan yet still counted as “scanned”; now gets its own report row and separate count.
  • An unreadable root index.md no longer aborts an entire scan; scaffold command refuses to write when it can’t read the file first.
  • The knowledge-librarian’s prompt-building script executed part of its own prompt as shell commands due to an unescaped heredoc; re-scaffolded.
  • .lokf/knowledge/ drift: two concepts described a nonexistent command, one misattributed scan batching to the wrong file.
  • A stale, frontmatter-free planning doc under .lokf/knowledge/ crashed lokf validate for the whole bundle; removed.
  • LOFK -> LOKF transposition fixed in manifest.json, package.json, and community-plugin-entry.json.
  • A folder in Excluded folders written with a trailing/leading slash, whitespace, or ./ prefix silently excluded nothing; now normalized like Bundle root folders.
  • Base_iri authority check compared URL.host (includes :port) against the denylist, so a ported hostname bypassed it; now compares hostname.
  • A relation field written as a bare scalar instead of a list passed validation clean even though the schema requires an array; now warned.
  • type set to a number, boolean, list, or mapping produced no finding at all; a list/mapping now gets its own shape warning.
  • Validate active note went completely silent when run on an excluded or out-of-bundle note; now always produces a Notice.
  • The report panel’s “N clean” count undercounted by subtracting bundle-level findings that were never scanned files to begin with.
  • Various markdownlint fixes (MD060 tables, MD001 heading skip, MD032 spaced-dash-as-list-item).

Security

  • release.yml passes the pushed tag through the environment instead of interpolating it into a shell command, closing a script-injection path.
  • knowledge-librarian.yaml no longer runs a repository variable’s content as a shell command; runs a pinned wrapper script and fails if the agent writes outside .lokf/knowledge/.
  • knowledge-librarian.yaml split into two jobs so the agent and the write-scoped token never meet: refresh (read-only, third-party code) hands a patch artifact to publish (no agent code, holds write access). Ported from lokf-agent-skills v0.11.0.
  • knowledge-librarian.sh parses AGENT_CLI into a quoted argv array instead of expanding it unquoted, closing a shell-injection path (SC2086).
  • The scheduled librarian run is armed by a dedicated KNOWLEDGE_LIBRARIAN_ENABLED repository variable rather than inferred from AGENT_CLI being set.

0.4.0

Added

  • OKF v0.2 base layer (checkOkfBaseLayer, on by default): checks the plain-OKF v0.2 rules LOKF subsumes (required type, Attested Computation shape, index.md/log.md structure, v0.1→v0.2 migration hints), so a bundle stays checkable without a separate OKF validator. Severity follows the spec (REQUIRED/MUST → error); a settings toggle can downgrade those to warnings mid-migration.
  • Look up a LOKF field (command): searchable reference of frontmatter fields, sourced from the schema’s own slot definitions so wording never forks.
  • Generate Obsidian affordances: three commands projecting LOKF facts into Obsidian conventions - #genre tags and ## Related wikilinks in a managed block, plus a diataxis.md Map of Content. Idempotent, marker-delimited.
  • Inline diagnostics: CodeMirror 6 extension underlines offending frontmatter values (wavy red/amber) with the finding on hover.
  • Jump-to-line from the report: finding rows are clickable, opening the note with the cursor on the offending key.
  • Key anchors on findings: new src/locator.ts maps a key path to its line/column in raw frontmatter (prerequisite for underlines/jump).
  • Incremental re-validation: editing a note re-checks just that note from the metadata cache instead of a full rescan.
  • Schema-derived vocabulary manifest (src/lokf-vocab.json, npm run build-vocab): default type/predicate/genre vocabulary now derives from the LOKF schema, adding Role and the full 15-value RelationType.
  • Concept graph + quick-switcher: in-memory index of each concept’s type/id/relations, plus “Find a concept” and “Find an orphan concept” commands.
  • Trust/lifecycle shape checks (OKF v0.2 §5): validates the shape of verified/generated, status, stale_after, sources - never their credibility depth. All warnings, on by default.
  • Frontmatter value autocomplete: EditorSuggest for type/genre/status/predicate values and relation targets.
  • Safe quick-fixes (command + vault-wide variant): applies deterministic corrections (missing base_iri terminator, type aliases, bare-string relations) in one undo step; never guesses owned values.
  • Promote body links to typed relations (command): guesses a typed relation for body links resolving to another concept, confirmed via a review dialog before writing.
  • Per-note opt-out: lokf: ignore frontmatter key silences a note while it stays a concept in the graph.
  • Disable on this device: device-local switch (never synced) that silences the plugin entirely on one device.
  • Per-rule severity escalation: settings list of rule ids whose warnings become errors; escalation only, never downgrades.
  • Report filter + finding navigation: filter box (sev:error, rule:lokf/2, ANDed, debounced) plus go-to-next/previous commands.
  • Report context menu, finding grouping, render caps: right-click actions, grouping by top-level key, and a 300-file/100-finding-per-file cap with a filter hint.
  • Ribbon icon to open the report; last scan is retained across reopens.
  • Read-only public API at app.plugins.plugins["ktl-registrar"].api: getReport(), validatePath(path), onValidated(cb).
  • Field aliasing (advanced, off by default): user=canonical pairs rename a vault’s own keys onto LOKF ones before validation.
  • Node-tested throughout: locator, vocabulary manifest, concept graph, §5 checks, autocomplete, safe fixes, body-link promotion, opt-out, severity escalation, report filter, grouping, and field aliasing all carry smoke-test coverage.

Changed

  • Severity icons in the report via setIcon instead of spelled-out words.
  • Keyboard-operable collapse/expand in the report (role="button", aria-expanded, Enter/Space, focus ring).
  • Aligned three rules with upstream LOKF PR #69: base_iri may end in #; the by actor check matches the schema’s exact pattern; http_method is no longer a recommended-field warning on a Service.
  • @codemirror/state/@codemirror/view moved to devDependencies (types only; external at runtime).
  • tsconfig.json enables resolveJsonModule for the bundled vocabulary manifest.

0.5.0

Added

  • Bundle detection for the sidecar convention. A top-level knowledge_bundle/ with its own index.md, in a vault whose root index.md carries no LOKF header, becomes the bundle root with nothing configured. A vault whose root index.md is itself a header stays the whole-vault bundle it always was.
  • The Diátaxis map is a record the registrar accepts. diataxis.md now carries a type: Document header with a minted id and generated provenance naming the plugin; without one, lokf validate aborted the whole run. An older headerless map gains a header on its next refresh.
  • Semantic release. The version is computed from Conventional Commits on main, and CHANGELOG.md’s ## [Unreleased] section is promoted into a dated heading and used as the release notes; manifest.json, package.json and versions.json bump as they always did. The resulting tag runs the same build, attestation and draft release as before, and a hand-pushed tag still does too. See CONTRIBUTING.md.

Changed

  • Renamed KTL Registrar - id ktl-registrar, repository obsidian-ktl-registrar - for the role the READMEs already gave it, and to stop shadowing an unrelated community plugin one letter away. Nothing was published under the old name, so there is no migration: settings live in .obsidian/plugins/ktl-registrar/ and the read-only API at app.plugins.plugins["ktl-registrar"].api. A diataxis.md map stamped by an earlier build is still recognised as this plugin’s own.
  • A dot-folder bundle root is accepted, not refused - a community plugin can expose one to Obsidian’s index. The scan checks the live index first and explains an absent root instead of assuming.
  • “How this fits” rewritten around one desk that is always the person’s: this plugin is the registrar there, KTL Curator the curator’s assistant. It covers both ways of reaching a bundle - the doorway opened as its own vault, or a real knowledge_bundle/ folder inside your own vault - and names the vault the workshop, the bundle the exhibition.
  • The frozen template fixture is now scripts/fixtures/sidecar-skeleton/, named for the upstream ktl-sidecar skill.

Removed

  • The Alternative OKF validator settings group, its community-plugin deep link and its one-time notice, now that the OKF v0.2 base layer is checked here directly. A saved recommendOkfValidator / okfValidatorNoticeShown is ignored.

1.0.0

Changed

  • A vault with no bundle is left alone. With nothing configured, a root index.md carrying a LOKF header makes the whole vault the bundle and a top-level knowledge_bundle/ makes that the bundle, as before; a vault with neither now has no bundle - nothing scanned, no root-header warning, status bar LOKF: no bundle, commands explain instead of acting - rather than being read as one whole-vault bundle. The workshop is never mistaken for the exhibition.
  • Insert the bundle’s semantic header (was Insert semantic header template into root index.md): in a vault with no bundle it now creates knowledge_bundle/ and puts the header in its index.md instead of decorating the vault root.
  • README trimmed: the For the curious section is now docs/for-the-curious.md.

Added

  • Treat the vault root as the bundle (Scope, off by default): the break-glass switch that restores the old whole-vault reading for a vault whose root index.md carries no LOKF header.

Fixed

  • npm run lint and tsc failed on scripts/smoke-test.ts’s js-yaml import and on .github/scripts/changelog-release.mjs (outside ESLint’s project); both now pass.

1.1.0

Changed

  • “Insert the bundle’s semantic header” now asks in a vault with no bundle - make this vault the exhibition, or create a knowledge_bundle folder - instead of always nesting a folder. A two-choice modal (src/scaffold-modal.ts) suggests by what the vault holds: the root for a vault with nothing but an index.md, the folder otherwise. The palette name drops its parenthetical.
  • README restructured for the two-vault story. An early notice says the plugin works on the exhibition, never the workshop vault you already keep, and that it pairs with the lokf-agent-skills without needing them. Where it works replaces How this fits: three arrangements, the bundle as its own vault first, with the cost of a bundle folder inside your vault stated plainly. Host-by-host layouts moved to docs/for-the-curious.md.
  • This repository’s own sidecar follows the current ktl-sidecar templates: just lokf-link creates the knowledge_bundle doorway link, and the wrapper and both workflows describe the bundle’s second name as the templates do. No plugin change.

1.2.0

Changed

  • The pinned toolkit is lokf 0.8.0, and a malformed by, sources[].author, http_method or email is now an error, as lokf validate rejects each. stale_after accepts a datetime as well as a bare date, and the missing recommended fields setting no longer lists http_method.
  • npm run build-vocab reads the schema from the sidecar’s pinned toolkit, not a sibling ../lokf checkout; LOKF_SCHEMA still overrides it.
  • The settings merge rule moved into the pure vocab.ts (mergeSavedSettings, with vocabFromManifest for the malformed-manifest fallbacks), so the smoke test covers what sat untested in main.ts. No behaviour change.
  • The smoke test asserts more and characterises less. The two golden fixtures pin their warning counts, so a rule that starts or stops firing fails the build, and a drift guard catches a settings control naming a setting that does not exist.
  • The Known LOKF types setting is documented as the extension point for a bundle validated against a domain schema (lokf validate --schema <file>): list that schema’s classes there, since the plugin cannot read a schema outside the vault. Settings tab, README and docs/for-the-curious.md; no behaviour change.
  • README rewritten around how to use the plugin, as an extension of the lokf-agent-skills: the two-vault story, a four-step Quick start, Using it, the command table, Which folder is the bundle, Install and Settings. Shared material - the role table, the library metaphor, the trust ladder - now lives in the skills’ README and is linked once; no plugin change.
  • This repository’s own sidecar repaired by ktl-sidecar: the knowledge_bundle doorway link is now committed at the root, .lokf/justfile regains the template’s lokf-check-refs recipe, and markdownlint and lychee skip the link’s duplicate path. No plugin change.
  • CONTRIBUTING.md is a checklist again, with the release pipeline and the signing guide documented once in the skills repository’s docs/ and linked from here. npm run check runs build, lint and smoke test together, the settings-tab and createEl lint rules are errors rather than warnings, and CI fails an action not pinned to a commit; no plugin change.
  • The README says which line of defence this plugin’s work is, and points readers who work under that model at the skills’ page on the rest; no plugin change.
  • The registrar gate checks what lokf validate cannot: .lokf/scripts/knowledge-conventions.sh from the sidecar templates (one ISO-date log heading per day, quoted timestamps, verified as a list, open questions in the curator’s shape) and the justfile’s lokf-check-refs, on every .lokf/** pull request; no plugin change.
  • SECURITY.md is a policy, not a threat model: a surface table that links to the skills repository’s docs/threat-model.md instead of restating it, held to a word budget by npm run check. It now lists the plugin’s write paths as the README’s Privacy section does, where it had named only the header command; no plugin change.

1.2.1

Security

  • The sidecar’s scheduled-agent wrapper restores .git/config and .git/hooks/ on every exit. The copy here predated the EXIT trap, so an agent that poisoned core.hooksPath and then failed, or a cancelled job, left it for the workflow’s later steps to read.
  • The registrar gate reads a confirmation whole, not its by: line. Re-dating an existing human: event, moving its revision or writing it in flow style added no by: human: line and so passed the old gate unseen. The gate also refuses a human: id it cannot look up, resolves a commit-shaped revision against the tree, and now runs under a top-level permissions: {} with no checkout credential on disk.

Added

  • The sidecar gains the preflight, the forge-free provenance gate and the conventions parser - knowledge-preflight.sh, knowledge-provenance.sh and knowledge-conventions.py - plus .lokf/.gitattributes, keeping the bundle on LF so a Windows checkout gives CI’s verdict.
  • A pull request that would release is held to its release notes and its title. The plan job refuses an empty ## [Unreleased], which semantic-release itself skips on a pull-request event, and refuses a title with no releasing type, since a squash merge takes its commit subject from the title.

1.2.2

Fixed

  • Retitling a pull request re-runs the release checks. The title check told the author to retitle, but the workflow listened only for the default pull-request types, so a title change fired nothing and the check stayed red whatever the author did. The trigger now names edited.

1.2.3

Added

  • The family logo, .assets/knowledge-trust-ladder-logo.svg: a ladder rising out of an open book, its top rung the check mark, the rungs grey then amber then the curator’s blue. Shared byte-for-byte with the other two repositories; beside the README title, and the mark to use as the repository avatar.
  • Both diagrams carry the mark and the wordmark, from the same shared definition.

Changed

  • The diagrams no longer glare. A pure-white canvas was the brightest thing on the page, with the tinted cards sitting below it; it is now the warm #E4E1D7, so the cards read as raised.
  • Small grey labels are legible again: the faint ink moved from #888780 to #6E6D66, clearing 4.5:1 where it had been 3.6:1.
  • The skills repository is now knowledge-trust-ladder, formerly lokf-agent-skills: upstream LOKF ships its own bundled skills, and a third-party repository named after the format read as their official home.
  • Every link here follows it, and LOKF_SKILLS_REPO in the scheduled librarian names the new repository. The skill names, the pinned LOKF_SKILLS_REF and this plugin’s own name are unchanged; GitHub redirects the old paths either way.
  • A label hidden behind its own card. The curator card’s “a few at a time” was painted before the card that contains it; two labels in the plugins card came within 3px of their edges.
  • Both diagrams match the skills repository’s copies byte for byte.
  • The bundle’s log keeps the name the skills repository had on each day. The rename pass had rewritten entries written weeks before it; CHANGELOG.md was left alone, and the log is the bundle’s own record.

1.2.4

Changed

  • The scheduled librarian installs v0.19.7, up from v0.19.2, so it runs the current skill rather than one five releases behind.
  • LOKF_SKILLS_REPO/LOKF_SKILLS_REF are now TRUST_LADDER_SKILLS_REPO/TRUST_LADDER_SKILLS_REF, following the skills repository’s own rename: the names said “LOKF” for a repository now called knowledge-trust-ladder. The skills keep their lokf-* names.

1.2.5

Security

  • The provenance gate reads a concept whatever its name. Synced from the skills repository’s v0.19.5 templates: both gates list paths with core.quotePath off and refuse a path git still has to quote, so a human: confirmation in a non-ASCII-named concept no longer passes unread.

1.2.6

Fixed

  • An external source or definedBy is no longer flagged as dangling. Both slots are documented as taking an off-site URL, but the audit reported any untyped IRI target as missing. Nothing in this bundle tripped it - every target happens to point at a concept.
  • The predicate list cannot go stale again. It had drifted against the schema, missing holder, measures, memberOf and every reified relations entry; --check-refs reads the slots from the schema instead.
  • The scheduled librarian checks the relations it writes. Its validate step covered frontmatter shape only, leaving a fabricated target - an agent’s likeliest mistake - for the registrar gate to catch. It passes --check-refs now.

Changed

  • The registrar gate validates once. --check-refs rides on the existing validate step, replacing a second lokf validate run through uvx --from rust-just just.

1.2.7

Fixed

  • The scheduled librarian installs v0.21.0, up from v0.19.7, so it runs the current skill rather than two releases behind.
  • The publish job’s path check reads a concept named outside ASCII. It listed the patch’s paths with git’s default quoting, so such a path arrived C-quoted and was refused as outside the bundle. Synced from the skills repository’s template: it now lists with core.quotePath off.

1.2.8

Fixed

  • The type-check survives a TypeScript 7 / @types/node 26 bump. moduleResolution: "bundler" drops the "node" package.json export condition by design; a newer @types/node gates its node:fs/node:path/node:url/node:module subpaths on that condition, so scripts/smoke-test.ts’s plain-Node imports stopped resolving. customConditions: ["node"] in tsconfig.json re-adds it. lib moves to ES2022 for Array.prototype.at() in src/main.ts; esbuild.config.mjs’s own output target is unaffected.

1.3.0

Added

  • A dark counterpart for all three diagrams, *-dark.svg beside each original. Same geometry and wording; only the palette differs, re-toned role for role from the light one. Shared byte-for-byte with the other repositories.
  • The README picks by theme. Each diagram is a <picture> with a prefers-color-scheme: dark source over the existing file, so the light original stays the fallback and its path is unchanged.

Changed

  • The registrar’s logo has no check mark. Its ladder stops at the amber rung, checked by automation; the blue tick, a named person’s confirmation, is the curator’s alone. The logo is no longer shared byte-for-byte with the other repositories.

Fixed

  • A dark copy carries no stale content credential. The originals embed a C2PA manifest that signs their own bytes; recolouring changes those, so the copies ship without one rather than with a signature that cannot verify.

1.4.0

Changed

  • The ribbon and tab carry the trust ladder, not Lucide’s shield-half. No check mark on top: this plugin keeps every record well-formed and never vouches for one, so the check belongs to KTL Curator, whose icon is this ladder with it. Line art at Lucide’s weight, in currentColor, so it sits with Obsidian’s own icons and follows any theme.

1.4.1

Fixed

  • The description names the role as the project does. LOKF is “a semantic profile of OKF”, and the registrar keeps a vault well-formed. The manifest, the package and the community listing entry carry the same sentence.

1.5.0

Added

  • A dimmed counterpart for all three diagrams, *-dimmed.svg beside each original: the same geometry on warm grey paper rather than a dark one. The two shared diagrams are byte-for-byte with the other repositories; the logo keeps this repository’s own ladder, which stops at the amber rung.

Changed

  • The dark-mode source is the dimmed set. Each prefers-color-scheme: dark source now points at *-dimmed.svg; the *-dark.svg files from 1.3.0 stay in .assets/ but nothing references them.

Fixed

  • The dimmed ink follows the dimmed paper. The light diagrams sit right on 4.5:1, so darkening only the backgrounds would have dropped every faint label under it.
  • Three labels that never met 4.5:1 now do, on the greyed-out roles in the plugin card - the darker ink reaches them as well.

1.5.1

Changed

  • The README and docs/for-the-curious.md are restyled for the reader: shorter sentences, plain statements, labels set off with a colon, the OKF base layer as a table. The section Philosophy: warnings, not errors, almost everywhere is now Why almost everything is a warning, and the host-by-host layouts live once in the skills’ docs/obsidian.md.

Fixed

  • The scheduled librarian installs its skill from v0.23.0. The pin still named v0.21.0, which has no skills/ktl-librarian, so the weekly run had failed at that step since the plugin took the KTL name.

Security

  • The sidecar carries knowledge-feedback.sh. ktl-docent records a reader’s gap through it and never opens feedback.md, so no other reader’s text enters its session (Snyk W011). It comes from the v0.23.0 templates, the release the pin now names.

1.5.2

Security

  • The sidecar’s preflight and skills pin match v0.23.1. The preflight now compares a librarian workflow with the template’s apart from TRUST_LADDER_SKILLS_REF, which each repository moves on its own schedule. This repository has no bare skills/ directory for that check to compare against, so its output does not change; no plugin change.

1.5.3

Security

  • The sidecar copies and the skills pin match v0.25.0. The scheduled librarian installs its skill from that release. knowledge-release.yaml is new: it attaches the bundle to a release as knowledge-<tag>-<repository>.zip unless the bundle matches the last release’s, runs when dispatched by hand and on each published release once KNOWLEDGE_RELEASE_ENABLED is true, and is otherwise inert. The librarian workflow and wrapper hand the agent its credential, the AGENT_API_KEY secret or the job’s own token with AGENT_USE_JOB_TOKEN, under the name AGENT_API_KEY_ENV gives and to nothing else; the job requests copilot-requests: write for Copilot CLI, idle until then, and sets up Node 22 for an npx-run agent. knowledge-preflight.sh compares the new workflow with its template.

1.5.4

Security

  • The sidecar copies and the skills pin match v0.26.0. Conventions rule 11 rejects an at: later than the commit that recorded it; the six librarian times in this bundle that broke it now carry that commit’s time. knowledge-librarian.yaml matches its template apart from the pin. No plugin change.

1.5.5

Security

  • The sidecar copies and the skills pin match v0.27.0. Releases now carry the docent as a Microsoft 365 Copilot skill: knowledge-release.yaml attaches ktl-docent-m365-<tag>-<repository>.zip beside the bundle zip, checks each zip against its checksum and attests each one. The new .lokf/m365/ holds that skill’s instructions, ktl-docent-m365.md, and knowledge-m365.sh, which builds it from a snapshot of the bundle; knowledge-preflight.sh compares both with their templates, and CONTRIBUTING.md and SECURITY.md count them among the copies that move with the pin. The release workflow stays inert until KNOWLEDGE_RELEASE_ENABLED is true. No plugin change.

1.5.6

Security

  • The sidecar copies and the skills pin match v0.33.0. The scheduled librarian’s one output is now .lokf/patch.yaml. knowledge-apply.sh, new here, checks every operation in it and writes the bundle, and keeps an index in the shape a person gave it. publish reads each person’s event and note off the patched tree before it pushes, and the registrar gate asks the person behind a confirmation that a change removes, as it asks the one behind a confirmation it adds. knowledge-report.sh, also new, computes the health line and the record changes the pull request carries. A scheduled week with nothing waiting runs no agent, though a month’s first week always does. A handled feedback entry moves to .lokf/questions.md, and the librarian’s hand-off reaches the pull request in a code block. Release assets take their name from KNOWLEDGE_RELEASE_NAME when it is set, and a retrieval score runs only once KNOWLEDGE_RETRIEVAL is true.

    Conventions rule 12 holds an index bullet equal to its concept’s title and description, so the apply script’s reindex operation re-derived the bullets of the five concepts here that had drifted. Rule 13 fails a change to a confirmed concept that does not move its generated stamp past the confirmation. The scripts’ comments read plainer. SECURITY.md names the new path and checks, and says the workflow copy differs from its template only in the pin. No plugin change.

1.5.7

Security

  • The sidecar copies and the skills pin match v0.34.0. The pin names the tag’s commit too, in TRUST_LADDER_SKILLS_SHA, and the librarian’s install step installs nothing unless the tag still names that commit. The librarian workflow has a third job, earlier, which reads the workflow’s earlier pull requests under a token that reads pull requests and nothing else. A scheduled run then opens no second pull request beside an open one, and does not propose again what a person declined. The pen refuses a patch that would change a person’s record, and writes each frontmatter value back as the file held it. The registrar gate and the release workflow install the toolkit with uv sync --locked, and the conventions script and the pen pin PyYAML. A week is quiet again once the librarian has asked about a source it cannot act on.

    CONTRIBUTING.md says the two pin values move together, and no longer says the librarian workflow carries local changes. No plugin change.

1.5.8

Security

  • The sidecar copies and the skills pin match v0.34.1. The Copilot docent’s instructions, .lokf/m365/ktl-docent-m365.md, label a concept as the report script does. A retired concept carries no other label, edited since a person last confirmed it takes the place of confirmed by a person, and an empty verified list reads as nobody has checked this yet. A Miss in its gap report starts with the reader’s question and says whether a concept looked relevant from index.md. No plugin change.

1.5.9

Security

  • The sidecar copies and the skills pin match v0.34.2. The preflight reads the CI variables by indirect expansion rather than eval, so a scanner that searches for eval finds none, and its output is unchanged. When knowledge-feedback.sh or knowledge-report.sh is missing, it names ktl-curator and an earlier ktl-docent as the skills that need it, since ktl-docent now runs its own copies. The scheduled librarian installs a ktl-librarian that reads LOKF’s schema from a commit rather than a tag (Snyk W012). No plugin change.

1.5.10

Fixed

  • The relation rules cover measures, memberOf and holder. The LOKF schema ranges thirteen slots over Concept, and the plugin’s list had the first ten. A bare scalar in one of the three went unflagged, with no Make it a list fix, no target completion, and no edge in the concept graph or in the proposals. The smoke test now holds the list to the pinned schema manifest, as the skills repository’s contract holds its report script’s copy to the schema, and scripts/build-vocab.mjs keeps each slot’s range and cardinality in the manifest. The built-in knownPredicates default stays as it was, so an untouched setting is still refreshed from the schema on upgrade.

1.5.11

Security

  • The sidecar copies and the skills pin match v0.37.1. The provenance gate reads a verified or generated event that spans lines, or that sits behind a byte order mark or CRLF line endings, so a forged confirmation cannot hide in either. The unattended check follows a renamed concept. The pen refuses a provenance key in any letter case, and keeps a curator’s send-back. The report reads every timestamp and event layout, names a retired concept’s successor, marks a concept a reader disputed, and counts reliance through all thirteen relation fields. Conventions rule 14 refuses a commit that records a person’s confirmation and also changes what the concept says. No plugin change.

1.5.12

Changed

  • The sidecar’s README links OKF’s specification in its own repository. Google moved the Open Knowledge Format to GoogleCloudPlatform/open-knowledge-format and froze the copy under knowledge-catalog/okf/.

Security

  • The sidecar copies and the skills pin match v0.38.2. The registrar, librarian and release workflows run the justfile’s lokf-check-refs recipe, and their actions move to newer pinned releases. The docent’s Copilot instructions prefer a retelling for a younger reader, and give the adult concept’s label with it. The pen no longer adds a second “edited since” note to a log line that already has one. The scheduled librarian installs a ktl-librarian that retells a confirmed concept for younger readers when the curation policy declares a band. No plugin change.

1.5.13

Security

  • The sidecar copies and the skills pin match v0.39.0. The preflight looks for ktl-website among the installed skills. The librarian and release workflows say their variables go under Repository variables, never on an environment, which neither job can read, and the scheduled librarian installs a ktl-librarian whose setup page says the same. No plugin change.

1.5.14

Changed

  • The architecture and for-the-curious pages lose their dead sentences. The host-by-host section, the independence paragraph and the warnings section say each fact once, and link what the skills’ pages already record. No plugin change.
  • The README is a doorway, in the style of Knowledge Trust Ladder’s. It keeps the poem, the opening paragraph and the agents note, and links the quick start, the architecture and the usage pages. What a bundle is, the two vaults, which folder is the bundle, privacy, the development layout and the credits moved to docs/architecture.md; the quick start and the install routes to docs/install.md; the report panel, the commands, the settings and the read-only API to docs/using.md. No plugin change.

1.5.15

Security

  • The sidecar copies and the skills pin match v0.41.0. The scheduled librarian takes an agent that wants its prompt somewhere other than after -p, named by the repository variable AGENT_PROMPT_FLAG. It writes its patch with the agent’s own file tool, so an agent refused a shell write no longer gives up. Both came with the v0.40.0 copies, which 1.5.14 included without an entry; v0.41.0 changes only ktl-website, which this repository does not use. No plugin change.

1.5.16

Security

  • The sidecar copies and the skills pin match v0.42.0. Conventions rule 13 no longer reads a move of the bundle’s base_iri as an edit of every confirmed concept. No plugin change.

1.5.17

Security

  • The skills pin matches v0.43.0. The release changed none of the sidecar copies this repository carries. No plugin change.

1.5.18

Fixed

  • .lokf/justfile takes a domain schema as one variable. It was the copy from before ktl-sidecar v0.38.0, which the sidecar sync never carried. No plugin change.

1.5.19

Security

  • The skills pin matches v0.43.1. The release changed none of the sidecar copies this repository carries. No plugin change.

1.6.0

Added

  • A website for the knowledge bundle. website/ builds an Astro Starlight site from .lokf/knowledge, the README, docs/ and this changelog, with a trust label on every concept page; knowledge-website.yaml publishes it to GitHub Pages once KNOWLEDGE_WEBSITE_ENABLED is true. No plugin change.

1.6.1

Fixed

  • The website’s link check reads an address in a code span without its closing backtick. A concept that named the site’s address in backticks failed the build with a broken link in llms.txt. The script matches ktl-website’s fixed template. No plugin change.

1.7.0

Changed

  • The knowledge bundle’s namespace is https://w3id.org/ktl/registrar/knowledge/. It was the placeholder https://ktl-registrar.example/knowledge/, and every concept’s id moved with it, so the bundle can join the KTL federation. The golden fixture of this repository’s own bundle expects one warning fewer, since the placeholder warning is gone. No plugin change.

1.7.1

Security

  • The skills pin matches v0.44.0. The release changed none of the sidecar copies this repository carries. No plugin change.

1.7.2

Security

  • The sidecar copies and the skills pin match v0.45.0. The release changed .lokf/scripts/knowledge-report.sh, .lokf/m365/ktl-docent-m365.md, website/scripts/sync.mjs, website/src/components/ConceptCard.astro, website/src/content.config.ts and website/src/styles/catalogue.css here; its changelog says how.

1.7.3

Security

  • The sidecar copies and the skills pin match v0.45.1. The release changed .lokf/scripts/knowledge-apply.py and .lokf/scripts/knowledge-federate.py here; its changelog says how.

1.7.4

Security

  • The sidecar copies and the skills pin match v0.46.0. The release changed .github/workflows/knowledge-release.yaml, .lokf/scripts/knowledge-federate.py, website/package-lock.json and website/package.json here; its changelog says how.

1.7.5

Security

  • The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.47.0. The release changed .lokf/scripts/knowledge-preflight.sh, .github/workflows/knowledge-sync.yaml, .github/PULL_REQUEST_TEMPLATE/knowledge-sync.md and .lokf/scripts/knowledge-sync.sh here. No plugin change.

1.7.6

Security

  • The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.52.0. The release changed .github/workflows/knowledge-registrar.yaml, .github/PULL_REQUEST_TEMPLATE/knowledge-sync.md, .lokf/scripts/knowledge-conventions.sh, .lokf/scripts/knowledge-conventions.py, .lokf/scripts/knowledge-preflight.sh, .lokf/scripts/knowledge-report.sh and .lokf/scripts/knowledge-sync.sh here. No plugin change.

1.7.7

As it stood at this release: the repository · the docs · the knowledge bundle · the release

Security

  • The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.53.0. The release changed .github/workflows/knowledge-librarian.yaml, .github/workflows/knowledge-sync.yaml, .github/PULL_REQUEST_TEMPLATE/knowledge-sync.md, .lokf/scripts/knowledge-librarian.sh, .lokf/scripts/knowledge-apply.py, .lokf/scripts/knowledge-sync.sh, .lokf/.gitignore, website/scripts/config.mjs, website/scripts/markdown-ktl.mjs, website/scripts/sync.mjs, website/src/components/KnowledgeGraph.astro, website/src/pages/graph.astro, .github/workflows/knowledge-website.yaml and website/scripts/raw-html.mjs here. No plugin change.

1.7.8

As it stood at this release: the repository · the docs · the knowledge bundle · the release

Security

  • The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.55.0. The release changed .github/workflows/knowledge-registrar.yaml, .github/workflows/knowledge-release.yaml, .github/workflows/knowledge-sync.yaml, .lokf/scripts/knowledge-librarian.sh, .lokf/scripts/knowledge-conventions.sh, .lokf/scripts/knowledge-conventions.py, .lokf/scripts/knowledge-preflight.sh, .lokf/scripts/knowledge-provenance.sh, .lokf/scripts/knowledge-feedback.sh, .lokf/scripts/knowledge-apply.sh, .lokf/scripts/knowledge-apply.py, .lokf/scripts/knowledge-report.sh, .lokf/scripts/knowledge-sync.sh, .lokf/.gitignore, .lokf/justfile and website/src/components/KnowledgeGraph.astro here. No plugin change.

1.7.9

As it stood at this release: the repository · the docs · the knowledge bundle · the release

Security

  • The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.55.2. The release changed .lokf/scripts/knowledge-preflight.sh and .lokf/scripts/knowledge-sync.sh here.

1.7.10

As it stood at this release: the repository · the docs · the knowledge bundle · the release

Security

  • The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.56.1. The release changed .github/workflows/knowledge-registrar.yaml, .github/workflows/knowledge-librarian.yaml, .github/workflows/knowledge-release.yaml, .lokf/scripts/knowledge-preflight.sh, .lokf/scripts/knowledge-sync.sh, website/astro.config.mjs, website/scripts/check-links.mjs, website/scripts/config.mjs, website/scripts/markdown-ktl.mjs, website/scripts/raw-html.mjs, website/scripts/routes.mjs, website/scripts/sync.mjs, website/src/components/ConceptCard.astro, website/src/components/ConceptPreviews.astro, website/src/components/KnowledgeGraph.astro, website/src/components/Mermaid.astro, website/src/components/Neighbourhood.astro, website/src/components/TrustChart.astro, website/src/content.config.ts, website/src/pages/og/[...route].ts, website/src/styles/catalogue.css and .github/workflows/knowledge-website.yaml here. No plugin change.

1.7.11

As it stood at this release: the repository · the docs · the knowledge bundle · the release

Security

  • The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.56.2. The release changed .lokf/.gitignore here. No plugin change.

1.7.12

As it stood at this release: the repository · the docs · the knowledge bundle · the release

Fixed

  • A ! after the type marks a breaking change. .releaserc.json names the Conventional Commits preset, so a feat!: commit releases a new major version instead of nothing. No plugin change.

1.7.13 Latest

As it stood at this release: the repository · the docs · the knowledge bundle · the release

Security

  • The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.59.0. The release changed .github/workflows/knowledge-registrar.yaml, .github/workflows/knowledge-librarian.yaml, .github/workflows/knowledge-release.yaml, .github/workflows/knowledge-sync.yaml, .lokf/scripts/knowledge-conventions.sh, .lokf/scripts/knowledge-conventions.py, .lokf/scripts/knowledge-preflight.sh, .lokf/scripts/knowledge-apply.sh, .lokf/scripts/knowledge-apply.py, .lokf/scripts/knowledge-report.sh, .lokf/m365/ktl-docent-m365.md, website/package-lock.json, website/package.json, website/scripts/config.mjs and .github/workflows/knowledge-website.yaml here. No plugin change.