# Kern-pkg, cloud KMS, chain-hashed audit

> Also shipped: Kern-pkg, cloud KMS, chain-hashed audit.

Source: https://kern-lang.eu/releases/kern-pkg-cloud-kms-audit-log

Also shipped

## Release notes

### `kern-pkg` ported to Kern (full surface)

`init` / `build` / `run` / `test` / `add` / `remove` / `verify` / `install` / `publish` / `search` / `update` with manifest `[dependencies]` / `[dev-dependencies]` parsing. The Python shim is gone.

### EU-sovereign cloud KMS providers

`KERN_KMS_PROVIDER` routes `kms_encrypt` / `kms_decrypt` to Scaleway (EU-native), Azure Key Vault (with AAD bearer cache), or an OVH stub; local AES-256-GCM remains the default.

### Chain-hashed AI audit log

Every record carries `prev_hash` \+ `record_hash` (SHA-256 over the previous hash plus canonical body); `kern_ai_audit_verify()` replays the file and refuses appends if any link mismatches, and the `kern ai-audit verify` CLI runs that replay from the shell. This closes the EU AI Act traceability gate.