kit

kit managed a developer toolchain as a supply chain. A tool definition was a small TOML file: name, source (GitHub, GitLab, npm, crates.io, a direct URL, rustup or Homebrew), version, per-platform asset names, where the checksum lives, and a signature method where the publisher signs. A registry was a git repository of those files under tools/. kit resolved them across every configured registry, wrote mise configuration, and verified what mise installed; CI kept the versions moving.

• Every version kit installed came from a pinned registry definition.
• Every bump returned to that registry as a merge request, re-checked before it landed.

With several registries configured, declaration order settled a tool defined twice; the loser was logged as shadowed. Each tool carried a trust tier, own, high or low, a judgment recorded once in its definition. The tier decided review, not verification: a registry’s _meta.toml named which tiers and bump sizes could merge without a person.

Verification followed the definition instead: cosign keyless verification against an anchored certificate identity, or a GitHub artifact attestation, where the publisher signs bare binaries; otherwise a SHA-256 comparison against the checksum file, npm integrity hash or multi-column checksum listing.

1. Sense runs on a schedule, reads upstream releases, downloads assets, computes checksums and classifies each finding by bump size, tier and checksum status; drift never fails it.
2. Respond evaluates, then applies: rules pass any non-major bump whose checksums verify and reject a checksum mismatch; a small model sees only the edge cases, never a release note. Approved updates land in the TOML files, split into an auto-merge group and a review group, one merge request each.
3. Verify runs on the merge request, re-validating every definition and re-checking every checksum; the auto-merge request merges itself once it passes.

Trust lives in the registry, not on the machine. That is the shape immutable applies one level down, at the operating system: pin it, verify it, track what moved.