kern 1.0.0-rc2

v1.0.0-rc2, static file serving and safe long-lived state

http_static(prefix, dir) now actually serves files, over both plain HTTP and HTTPS (it was a no-op that recorded the mount but never read it). Content type is set by extension, index.html is served for directories, requests are GET/HEAD only, and a strict path-traversal guard rejects any .. with a 403 before a file is ever opened (verified it will not serve /etc/passwd); the TLS path was refactored around a write sink so the same implementation serves plaintext and TLS sockets correctly. persist(s) is the epoch-GC escape hatch: under request-scoped GC (KERN_HTTP_EPOCH_GC) every object allocated during an HTTP request is reclaimed at request end, so a request-derived key stored into a long-lived global map (a rate-limiter's client-IP table, a cache) would dangle; persist copies the bytes onto the permanent heap so they survive, implemented as a thread-local allocator redirect that leaves epoch and collection semantics untouched.

v1.0.0-rc2, adopter tooling: version pinning and a Docker-independence attestation

Two adopter-requested tools turn claims into checks. A one-line .kern-version file pins the toolchain: kern build / run / check compare it to the running compiler and print warning: kern-version-mismatch when a compiler upgrade or a stale binary drifts from what the project expects (warning-only, so it never breaks a build; CI that wants hard enforcement greps for the line). kern audit-docker <file> walks a program's full resolved import graph and reports whether it takes any Docker dependency (an import of sys.docker, which shells out to the docker CLI, or a /var/run/docker.sock reference): a clean program prints audit-docker: PASS, a Docker dependency is FLAGGED and the command exits non-zero so CI can gate on it. “Docker-free” becomes auditable: a Kern binary is native and links no Docker client.

Read the announcement: kern v1.0.0-rc2, reproducible across two machines →