Cordum v1.3.1

Released 2026-11-11.

These notes summarize first-parent history on main from the v1.3.0 tag (d027ae97, 2026-11-11) to the v1.3.1 tag. See CHANGELOG.md (github.com), under [v1.3.1]. For everything since v1.2.0, see the v1.3.0 notes.

Why this release exists

The v1.3.0 tag published the 7 control-plane and dashboard images, but its publish run stopped at the demo-quickstart-worker vulnerability scan. That image, the published-image smoke test and the Helm chart were not published for 1.3.0. v1.3.1 fixes the cause and is the first 1.3 release with the full artifact set. Use 1.3.1 instead of 1.3.0.

Fixed

• Demo quickstart worker image (#531). Its runtime stage now refreshes Alpine packages, as the control-plane image already did. The alpine:3.21 base shipped zlib 1.3.2-r1 (CVE-2026-4738, fixed in zlib 1.4-r0), which failed the release scan.
• Lighthouse CI PR comment (#528). The comment shows category scores again instead of "artifacts unavailable".

Security

• MCP approval-store outage errors (#528). When the MCP approval store is unreachable, an approval-required HTTP MCP tools/call returns -32096 with the fixed reason approval store unavailable and runs nothing. It used to return -32603 with the raw Redis error, internal host and port included. The cause is in the gateway log.

Upgrade notes

• MCP clients (#528). An approval-store outage on the legacy approval path is now -32096 approval_store_unavailable, not -32603. error.data.reason is a fixed string; do not parse it for the cause.
• Dependencies (#528). crewjam/saml 0.6.3 and rollup-plugin-visualizer 7.1.3.

Artifacts

• Container images (8). For a stable v1.3.1 tag, the publish workflow (.github/workflows/docker.yml) is configured to publish each image as 1.3.1, 1.3 and latest, on both ghcr.io/cordum-io/cordum/<name> and docker.io/cordum/<name>: api-gateway, scheduler, safety-kernel, workflow-engine, context-engine, mcp, dashboard and demo-quickstart-worker.
• Helm chart: oci://ghcr.io/cordum-io/cordum/charts/cordum, at the core version, published only after the published-image smoke tests succeed.
• Verify published artifacts with the RELEASING.md verification [steps](https://github.com/cordum-io/cordum/blob/main/RELEASING.md#4.

Known gaps

• Desktop binaries are gated on a signed manifest. Without the GPG signing key the release workflow attaches no cordum-hook, cordum-claude, cordum-agentd or SHA256SUMS, as for v1.2.0 and v1.3.0.
• 1.3.0 has no demo worker image and no Helm chart. The 1.3 and latest aliases move to 1.3.1 when it is published.