Kern-pkg, cloud KMS, chain-hashed audit
Release notes
kern-pkg ported to Kern (full surface)
init / build / run / test / add / remove / verify / install / publish / search / update with manifest [dependencies] / [dev-dependencies] parsing. The Python shim is gone.
EU-sovereign cloud KMS providers
KERN_KMS_PROVIDER routes kms_encrypt / kms_decrypt to Scaleway (EU-native), Azure Key Vault (with AAD bearer cache), or an OVH stub; local AES-256-GCM remains the default.
Chain-hashed AI audit log
Every record carries prev_hash + record_hash (SHA-256 over the previous hash plus canonical body); kern_ai_audit_verify() replays the file and refuses appends if any link mismatches, and the kern ai-audit verify CLI runs that replay from the shell. This closes the EU AI Act traceability gate.