[hellices]

Closes #507

Summary

Source preparation for v0.6.1, a security and packaging patch (#506). No tag, publication, release workflow or Homebrew operation. Tagging and publishing remain your decision, following docs/release.md.

• Metadata:
  • pyproject.toml and korvid.__version__ become 0.6.1, and the lock's own korvid entry follows. No dependency changes: main already ships the fixed versions.
  • upgrade-from stays 0.5.0, as v0.4.1 kept 0.3.0; test_upgrade_source_is_the_previous_minor_release requires it.
• docs/release-notes/v0.6.1.md:
  • Security fixes: certifi 2026.10.19 (critical, compromised emSign CAs), aiohttp 3.14.4, filelock 4.2.4 and litellm 1.100.4 (high), opentelemetry-api 1.45.1 (moderate).
  • LiteLLM: the note says why korvid was not exploitable through the LiteLLM advisory (it is in the proxy server, which korvid never runs or imports).
  • Reliability: two shutdown fixes and the Intel Homebrew prebuilt-Rust formula.
  • Documentation: the throwaway-cluster walkthrough and the Kubernetes support page, both already on main.
  • Kubernetes versions verified: 1.33 to 1.36, as the support policy requires.
  • Safety perimeter: stated as unchanged.
• Navigation: mkdocs.yml lists v0.6.1. unreleased.md now points at the v0.6.1 candidate and v0.7.0, and its two sections moved into the v0.6.1 note.
• Contracts:
  • The v0.6.0 note's feature contracts (summary sections, priority-key validation, Action Palette and connection-test links, canonical guide URLs) are pinned to v0.6.0.md, as v0.6.0's preparation pinned v0.5.0's.
  • A new contract requires the current note to be a security patch whose dependency table matches uv.lock.

For your release decision

• Release commit: release.yml tags only commits reachable from origin/main, so v0.6.1 is cut from main after this merges. The v0.7.0 foundation modules (Add capability-aware diagnostics with explicit older-cluster fallbacks #409 S1–S5, Project ConfigMap and Secret consumers by mode (#410 P1, core) #503 if merged first) ride along; no screen uses them yet.
• Kubernetes versions: this PR changes pyproject.toml and uv.lock, so the Kubernetes version matrix runs on it, and runs again on the merge commit on main. The runbook's "List the verified Kubernetes versions" step takes the versions from that run.

Verification

• uv run pytest -p no:tach tests/test_release_policy.py tests/test_docs_*.py tests/test_check_docs_site.py tests/test_lockfile.py tests/test_release_*.py tests/test_homebrew_formula.py -q: 861 passed.
• uv run mkdocs build --strict and python scripts/check_docs_site.py: passed.
• python scripts/check_lock_hosts.py uv.lock: resolves from PyPI only.
• Full gate (check_source_size, ruff check, ruff format --check, mypy, tach check, pytest -n 8): 14757 passed, 39 skipped. One local failure, test_the_measured_release_is_the_installed_one: this machine's venv still has litellm 1.100.3 and cannot install the lock from behind the mirror. CI installs from the lock.

Checklist

• This closes an accepted issue in this repository that is assigned to me.
• Tests cover the change, written to fail first where behavior changed.
• make check passes locally. (Except the litellm version test above, which depends on this machine's venv.)
• User-facing docs and the README match the change, or nothing user-facing changed.
• No security invariant is weakened: writes still need a keystroke approval
  and a fail-closed audit entry, and sensitive reads are still masked.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

🟡 Changes recommended

The release notes incorrectly classify filelock as development-only even though it ships as a runtime dependency of the agent extra.

1 open issue

• Correct runtime dependency scope to include filelock · New

_{Review effort: Balanced}

[my-reviewer-agent]

검토 범위에서 보고할 이슈가 없습니다.

리뷰 범위: 변경사항 일부만 검토했습니다.

[Copilot]

🟢 Approved

No active review issues remain for the v0.6.1 source-candidate metadata and release-documentation changes.

No open issues 🎉

1 resolved since last review

• Correct runtime dependency scope to include filelock

_{Review effort: Balanced}

[my-reviewer-agent]

이슈 1건을 인라인 코멘트로 남겼습니다.

리뷰 범위: 변경사항 일부만 검토했습니다.

[my-reviewer-agent]

검토 범위에서 보고할 이슈가 없습니다.

리뷰 범위: 변경사항 일부만 검토했습니다.