All versions since 0.5.3

0.5.3

Oct 27, 2026

The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.56.2. The release changed .lokf/.gitignore here.

Oct 27, 2026

The digest set names every algorithm in-toto defines, and additional_digests holds any other, such as an SCS’s own svn_revision_id. A resource descriptor can also carry its content, base64-encoded, and SlsaDocument holds control_planes, the one class its root could not reach.
verified_levels and the dependency counts take an issuer’s own results beside SLSA’s, through the slsa_result_value type. An issuer’s own result is printable ASCII and never starts with SLSA_, in any letter case.
docs/index.md says what each validator checks, and a test keeps the rules the schema states twice in step.

Validation enforces the in-toto and SLSA rules the descriptions stated, and data that breaks them no longer validates. A descriptor needs a URI, a digest or its content, a digest set at least one digest, each statement subject and input attestation a digest, a VSA’s policy a URI, and build provenance its external_parameters; a null value counts as absent.
A required list may not be empty, and a digest has its algorithm’s length. dir_hash takes 64 hexadecimal digits, and a SHAKE or BLAKE2 digest at least 32 bytes.

organization_properties: its ORG_SOURCE_ values go in verified_levels, where the attestation’s JSON puts them.

Descriptions and comments match the v1.2 specification and the adoption study. Hermetic builds are not a Build L3 aim, an automated review is not two-party review, the storage comment names SLSA’s preferred places, and the study’s claims and sub-theme names follow the paper.
project/java/ drops the 23 classes left over from the names used before 0.4.0.
The README’s KTL section gives the right reason the copy renames no key.
codespell and typos accept gost and intoto, and skip the KTL scripts and website/package-lock.json.

Oct 28, 2026

The documentation site’s home page has a Schema button, which opens the schema’s pages.
The build checks that .lokf/slsa.yaml matches the schema and .lokf/lokf.yaml.
The README says what the schema models, what shaped it and what it maps to.

The knowledge bundle needs lokf 0.9.0, and .lokf/slsa.yaml, the release’s schema asset, is regenerated by its released adapt. The slot revision is slsa_revision in the copy, with its IRI unchanged, because LOKF 0.9.0 defines revision; a host concept that writes revision for an SLSA source revision renames the key.

Oct 29, 2026

The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.59.0. The release changed .github/workflows/knowledge-registrar.yaml, .github/workflows/knowledge-librarian.yaml, .github/workflows/knowledge-release.yaml, .github/workflows/knowledge-sync.yaml, .lokf/scripts/knowledge-conventions.sh, .lokf/scripts/knowledge-conventions.py, .lokf/scripts/knowledge-preflight.sh, .lokf/scripts/knowledge-apply.sh, .lokf/scripts/knowledge-apply.py, .lokf/scripts/knowledge-report.sh, .lokf/m365/ktl-docent-m365.md, website/package-lock.json, website/package.json, website/scripts/config.mjs and .github/workflows/knowledge-website.yaml here.

Oct 30, 2026

The in-toto layer comes from lmodel/in-toto’s core module at v0.1.0, vendored at src/slsa/schema/in_toto/in_toto_core.yaml, and the schema’s own copy is gone. The class names stay, and the six classes and their keys take in-toto’s IRIs; media_type and algorithm take the IRIs LOKF gives them.
SlsaPredicate extends in-toto’s InTotoPredicate. A statement keeps its predicate key, which the adapt copy calls slsa_predicate, because LOKF’s predicate is a relation’s type.
attestation_storage_uri, signing_tool and transparency_log_entry moved to SlsaStatement, a subclass of InTotoStatement that SlsaDocument holds, since in-toto’s statement carries only what its specification defines.
build_type, builder_id and verifier_id take in-toto’s in_toto_type_uri, and started_on, finished_on and time_verified take in_toto_timestamp, the field types the SLSA specification gives them. A timestamp now ends in Z, and a type URI keeps its scheme and host in lowercase.