The Kokomoji worker release 0.1.0, published here on 22 October 2026. There is no public code repository or image registry yet, so this page is where the source and its signatures live. The worker is open source (MIT). Check the files below with 2 of the 3 release keys before you run anything.

Files

• kokomoji-worker-0.1.0.tar.gz: the worker/ folder with its signed release manifest, and the pinned dao/engine/ it runs. sha256 4fc68667172428fb617b66244152c0e2e7a5aeddaff268b90c42809bc805520f
• SHA256SUMS, signed by the three release keys: .minisig.1, .minisig.2, .minisig.3
• manifest.json (the release manifest, also inside the tarball) and its signatures .minisig.1, .minisig.2, .minisig.3
• Release hash (what the worker reports): 03484cd4c790ebb9b44f1d3cad6917a3c4277624d95b38ecd1a7d9f73c7dc5d8. It expires on 20 January 2027.
• Runner image built by the project from this release: image ID sha256:7110feb6b6d5138015e24b987cda51032b591225ace11b2ea5855e4e3703fbe7, base node:24-bookworm-slim@sha256:55fb5f5a527ea2c5c4a95f963e48ef90aa38c7b346054fdc8ee9957a2b55d205. The image is not published: build it yourself from the tarball (your build gets its own image ID). In the default code mode the runner runs the verified files from your checkout.

The release keys

A release is valid only when 2 of these 3 minisign keys signed it. The same keys are built into the worker (src/release.js) and listed in the docs.

• Key 1, id 2158F164CD828B58: RWRYi4LNZPFYITTsqqlwFRn7zvKx+w3YHqB7So2YP/JL1+MJ2XnrbCH1 (.pub)
• Key 2, id BC68DEAAAC463400: RWQANEasqt5ovAsxLbt5OnhoEb+btp/6oKDf0Tgzi4iEuOv0/Gb+0V+Y (.pub)
• Key 3, id 51B7C22E20E51207: RWQHEuUgLsK3UWpARRhIhpEXUYyegCnL1x0neNuJy/YFFDNrkk9y8Vt0 (.pub)

Check it

minisign -V -P RWRYi4LNZPFYITTsqqlwFRn7zvKx+w3YHqB7So2YP/JL1+MJ2XnrbCH1 -m SHA256SUMS -x SHA256SUMS.minisig.1
minisign -V -P RWQANEasqt5ovAsxLbt5OnhoEb+btp/6oKDf0Tgzi4iEuOv0/Gb+0V+Y -m SHA256SUMS -x SHA256SUMS.minisig.2
sha256sum -c SHA256SUMS
mkdir kokomoji-worker && tar -xzf kokomoji-worker-0.1.0.tar.gz -C kokomoji-worker && cd kokomoji-worker
(cd dao/engine && npm ci --omit=dev --ignore-scripts)
node worker/bin/kokoworker.js verify

The last line should end with "ok: this tree is the signed release" and name the key ids above. Then follow Install the worker and pair it on the worker page. Only pair a worker you run yourself.