v0.38.0

All nine public packages at 0.38.0, published to npm latest from main 47a3ac47c (release validation run 41859701665, artifact release-pack-47a3ac47… sha256:2d33a48c…e4f05b). This is a MINOR release: the upgrade manifest from 0.37.0 holds 1 breaking entry and 1 additive entry. The wire stays v5; no drain is needed.

Security fix

• .byok case variants in the file scope (#1426, fixed by #1427). Affects 0.32.0 through 0.37.0 when the daemon configures toolAuthorization.fileScope, the task runs on Pi with the SDK's scoped file tools, and the Agent home is on a case-insensitive volume (the macOS APFS default). A path such as .BYOK/… reached <home>/.byok/ without an approval. The guard now matches .byok without ASCII case and re-checks the canonical target; both refusals are internal_path. Upgrade to 0.38.0; no config change is needed.

Highlights

• K8 idempotent owner cancels (#1405, breaking): cancelTurn and cancelDelegation are idempotent and return TurnCancelResult / DelegationCancelResult, read from the ledger, in the shape of cancelHostIntent; K8 refusals carry codes. inputRoot(key, botId) reports whether an input committed (#1407).
• Memory-reader tasks under file scope (#1422): with toolAuthorization.fileScope, a memory-reader task runs on the Pi rpc and prepared lanes on darwin and linux, with a read-only Agent home and a writable run root. The fileScope root ids home and run are reserved. Launch configs move to byok.pi.rpc-launch 11, durable-launch 4 and prepared-launch 8 (#1431), so the daemon and the Pi hosts must come from the same SDK version.
• Agent-home projection hostRevision (#1404, additive): gated behind the device flag agent-home-projection-host-revision.
• Fixes: byok-agent pair against a running service waits up to 10 minutes for enrollment.pair instead of reporting a 10 s timeout while pairing succeeds (#1434). On Windows the Hermes gateway ownership check reads the process table through Windows Script Host instead of PowerShell (#1410).

Upgrading

• Host checklist (0.37.0 → 0.38.0): docs/releases/host-upgrade-0.38.0.md. A Host on an earlier release applies the 0.37.0 checklist first.
• Pin all nine packages to exactly 0.38.0 together.
• Full notes: docs/releases/v0.38.0.md · CHANGELOG
• The first source candidate (9519c6810) failed release validation and was never tagged or published; see the notes.
• Known limitations: unchanged from 0.37.0 except that memory-reader offers under file scope no longer decline on the Pi rpc and prepared lanes on darwin and linux. The durable lane still refuses them.

v0.37.0

All nine public packages at 0.37.0, published to npm latest from main 1ba3779fd (release validation run 41716953828, artifact release-pack-1ba3779f… sha256:806d7084…fd052). This is a MINOR release: the upgrade manifest from 0.36.0 holds 4 breaking entries and no additive entry. The wire stays v5; no drain is needed.

Highlights

• Windows Pi launch without PowerShell (#1373): the client grants an OWNER RIGHTS (S-1-3-4) READ_CONTROL ACE when it creates the Pi projection directory, and the keys launcher requires that ACE instead of starting PowerShell to read the directory's owner. @byok-sdk/client and @byok-sdk/keys must run at the same version; when they differ, the launch fails closed.
• Pi 1.5.0 (#1402): the official Pi closure is pinned to exactly 1.5.0 and adds @earendil-works/pi-schema. A preparation compiled for 1.4.0 declines with preparation_runtime_identity_mismatch. pi-durable migrates replicas forward on open, so a device or Durable Object cannot roll back past 0.37.0. A DurableObjectSqliteDatabase implementation must provide runCounted.
• Outcome rules on the device (#1375): bot-turn-outcome.v1 runs every rule that reads only the outcome, so the model corrects a violating outcome in the same Turn, with new contract-mismatch keywords. The routine calendar moves from @byok-sdk/core to @byok-sdk/protocol.
• Windows logon PATH (#1317): the login-shell runtime environment takes PATH and PATHEXT from the machine and user Environment registry keys as Windows builds them at logon. A failed read fails closed with logon-registry-unavailable.
• K8 rooms (#1393, #1394): K8 publishes room-seat:<roomId>:<seatId> and room-root:<roomId>:<root> projections, and retainRoots archives room messages outside each room's last contextTurnLimit messages into namespace roomMessages.
• Also: the SDK-owned OAR source moves to 0.86.0 (#1401); repository scripts detect their CLI entry with import.meta.main (#1392).

Upgrading

• Host checklist (0.36.0 → 0.37.0): docs/releases/host-upgrade-0.37.0.md. A Host on an earlier release applies the 0.36.0 checklist first.
• Pin all nine packages to exactly 0.37.0 together. A Host that vendored K8 handles the room-seat: and room-root: prefixes before it upgrades.
• Full notes: docs/releases/v0.37.0.md · CHANGELOG
• Known limitations: unchanged from 0.36.0 except that the Windows Pi projection ACL query no longer starts PowerShell. byok-agent install still installs only the WinSW service on Windows.

v0.36.0

All nine public packages at 0.36.0, published to npm latest from main 644cf95a2 (release validation run 41591161869, artifact release-pack-644cf95a… sha256:5c54a532…26ee). This is a MINOR release: the upgrade manifest from 0.35.0 holds 3 breaking entries and no additive entry. It also carries the fixes prepared for 0.35.1, which was never published. The wire stays v5; no drain is needed.

Highlights

• Windows per-user autostart (#1337): ServiceDefinition.windows is the union ServiceWindowsOptions. { scope: 'user'; stop: ServiceProgram } autostarts at the user's logon from a Startup .cmd, with no SCM registration and no administrator; { winswBin } still selects the WinSW service. A failing stop program is the new ServiceUnitError code service_stop_failed. byok-agent install still installs only the WinSW service.
• Result outcome contract rules (#1374): validateResultOutcome takes ({ contract, schema }, outcome). For bot-turn-outcome.v1 it rejects a repeated ask_user option id or a blank string with the new reason contract-mismatch, and the device applies it on submit_result so the model corrects the outcome in the same Turn.
• Status no longer trips on metadata-only changes (#1342, #1366): byok-agent status, doctor and the support bundle ignore a ctime-only change to a store file, and operational health no longer rewrites ACLs on every write on Windows.
• Service upgrade rollback (#1350): a failed or interrupted upgrade now rolls back a directory store whose path ends in /, /. or /./.
• Also: Grok no longer declares isolation.userContext (#1335); the device diagnostics summary names why identity cannot be read (#1365); the Windows Pi projection ACL query is about 6x faster (#1364); K8 gains the ./l-test-host export, suspended Bots, setModels, hostIntentMessages, create_room and external rooms (#1325, #1319, #1357, #1356, #1321, #1362).

Upgrading

• Host checklist (0.35.0 → 0.36.0): docs/releases/host-upgrade-0.36.0.md. A Host on an earlier release applies the 0.35.0 checklist first.
• Full notes: docs/releases/v0.36.0.md · CHANGELOG
• Known limitations: a Windows Pi projection ACL query still pays the PowerShell host start and exit, which can take seconds on a slow VM (#1373).

v0.35.0

All nine public packages at 0.35.0, published to npm latest from main 312d5f6b6 (release validation run 41426696751, artifact release-pack-312d5f6b… sha256:a41a1b9a…35e0). This is a MINOR release: the upgrade manifest from 0.34.0 holds 3 breaking entries and 6 additive entries, and the approveTools change (#1324) is a fourth, behavior-only breaking change recorded in the CHANGELOG. The wire stays v5; no drain is needed.

Highlights

• Pi asset root is config only (#1315): runtimes.pi.packageDir (and PiAdapterOptions.packageDir) is the only source of the Pi asset root. A PI_PACKAGE_DIR in the Host environment or login-shell snapshot no longer reaches Pi. New createRuntimeAdapters(config) in @byok-sdk/client/adapters builds the adapters createDaemon builds, for Hosts that decorate them.
• Progress message boundary (#1323): progressEventsAreMessages is replaced by progressMessageBoundary ('event' or 'session'). Declared Session members are bound once at start(); a missing member fails with runtime_session_incomplete.
• approveTools is a grant only (#1324): it is projected to runtimes that declare mcpToolApprovals (Codex) and no longer takes part in admission or runtime selection. Automatic selection with Claude and Codex both present now picks Claude.
• Multi-store service stop (#1328): ServiceInstallationOptions.daemonStores() lists every store a service owns; upgrade, rollback and recover stop all of them under an owner lease and reclaim a store a crashed daemon left behind. Precheck, receipts and errors carry ServiceStoreVerdict; directory stores are snapshotted as a whole tree. New codes daemon_stores_invalid and snapshot_failed.
• Pi excluded loads the Agent home's own instructions (#1338): the Agent home's AGENTS.md and below are loaded, user-level resources stay excluded. Launch config moves to v10.
• Also: byok-agent upgrade check --from <version> and checkUpgradeFrom (#1316); keys WindowsCredentialManagerSecretStoreOptions.systemRoot (#1310); K8 history rows carry reply and K8 gains cancelHostIntent (#1318, #1320).

Upgrading

• Host checklist (0.34.0 → 0.35.0): docs/releases/host-upgrade-0.35.0.md. A Host on 0.30.2–0.33.0 applies the 0.34.0 checklist first.
• Full notes: docs/releases/v0.35.0.md · CHANGELOG
• Known limitations: byok-agent status can falsely report "device identity pathname changed before safe open" after a metadata-only change to the store file (#1342, fixed on main after 0.35.0). Windows has no per-user autostart unit yet (#1337).

v0.34.0

All nine public packages at 0.34.0, published to npm latest from main 58658abd5 (release validation run 41355970624, artifact sha256:bd166fbb…0a06). This is a MINOR release: the upgrade manifest from 0.33.0 holds 2 breaking entries and 1 additive entry. The envelope wire moves from v4 to v5, and 0.33.0 was the last v4 release.

Highlights

• Wire v5 and generic runtime names (#1290): durablePi is renamed durableLane on the wire, in presence, in RuntimeCapabilities and in PiAdapterOptions. DaemonConfig.durablePi is removed; set runtimes.pi.durableLane instead. A v4 deployment drains once, then the server and daemons cut over together.
• Pi user context (#1295, #1296): under inherit, a user's Pi package that registers the same tool name as a bundled extension (pi-web-access, rpiv-todo) replaces the bundled copy instead of failing the launch. excluded keeps the user's global default provider and model, and a new session without a usable default fails before any provider call.
• File scope on more Pi lanes (#1061): file scope and per-call auto tool approval now cover Pi's prepared and durable lanes, with the same rules as the ordinary lane. Windows, non-Pi adapters and memory-reader tasks still decline these tasks before claim.
• Process cleanup:
  • The process table is read by absolute path, and a failed read during disposal is a typed failure (#1298).
  • Tools orphaned by a native ACP cancel are cleaned up on dispose (#1297), including on Hermes (#1305).
  • A refused cancel on Grok/dsh is now reported, not silently dropped (#1305).
  • System tools (taskkill, launchctl, systemctl, secret-tool, ioreg, reg, sc.exe, icacls) run from fixed trusted locations, never from PATH. A missing one raises the new SystemToolUnavailableError (#1304).
• Durable MCP results (#1303): MCP tool results on the durable lane reach the model again.
• Also: the bundled OAR source moves to 0.83.0 (#1293), and the K4 Host ledger is in the 10k-task soak (#1105).

Upgrading

• Host checklist (0.30.2 / 0.33.0 → 0.34.0): docs/releases/host-upgrade-0.34.0.md.
• Full notes: docs/releases/v0.34.0.md · CHANGELOG
• Known gap (#1310): on Windows, WindowsCredentialManagerSecretStore now needs SystemRoot, which every real Windows process has. Tests that inject platform: 'win32' on another OS must also set it.

v0.33.0

All nine public packages at 0.33.0, published to npm latest from main fdf39b10a (release validation run 41319005023, artifact sha256:9bf6b42f…f4e7). MINOR release: the upgrade manifest from 0.32.0 holds 7 breaking and 6 additive entries.

Highlights

• E2EE v2 first batch (#1045): Agent message bodies and hosted memory projection snapshots can be sealed end to end (hosted @byok-sdk/cloud only; opt-in via consumeSealed and grant sealing). Includes the writer-epoch sealing binding (#1288) and the redaction/reference fix (#1289).
• Durable task events (#1113): activity log persisted in the embedded server (SQLite schema 8, one-way); activity and approval timelines close with the task; tasks.events coalesces states.
• Runtimes: Grok in DaemonConfig.runtimes (#1094), DeepSeek Harness (dsh) adapter, quota failures carry scope: 'account' | 'model' (#1271).
• Process safety: pi-durable shell gate runs bash with --norc (#1273); tools in their own process groups are reaped after an outside SIGKILL (#1269).
• Adapters: adapter-declared admission facts and one LF-only JSONL decoder (#1278).

Upgrading

• Host checklist (0.30.2 / 0.31.0 / 0.32.0 → 0.33.0): docs/releases/host-upgrade-0.33.0.md. Back up server SQLite first (schema 8 is one-way); Postgres 0035–0037 run through the migration runner in one maintenance window.
• Full notes: docs/releases/v0.33.0.md · CHANGELOG

BYOK SDK 0.32.0 · keys 0.32.0

0.32.0 publication record

Date: 2026-11-01 (UTC).
Status: all nine packages are published on npm latest at 0.32.0. The complete registry readback passed.

Release SHA: 5f9759558911d76d0d61a5f4fa4eea2116c0dbe1 on main (the merge of #1250). The tarballs are the release-pack-5f975955… artifact (sha256:9ee33f01…) from release-validation CI run 41274113989, and every registry dist.integrity matches them. The packages were published from a local npm session without provenance; the trusted-publishing workflow stopped with ENEEDAUTH before any upload (run 41277301045).

0.32.0 is a MINOR release under the default pre-1.0 policy. The upgrade manifest from 0.31.0 holds 28 breaking and 19 additive entries. These notes do not say that 0.32.0, or a Host on it, is ready for production. AiphaBee skips 0.32.0 and adopts once at 0.33.0 (owner, 2026-11-01); the product loop gates (#977, #978) are anchored to 0.33.0.

Upgrade

• Upgrade the Host before its devices (expiresIn, #1114), and stop every SDK process that shares a protected target first (path-mutation gate, #1149).
• Postgres migrations 0031 to 0034. 0034 drops activity_tail and starts an empty activity log with no pre-cutover history and no application-only rollback. Server SQLite upgrades a schema 6 file to 7 in place.
• Tool authorization: one policy document per daemon (D3), file scope v1 for ordinary Pi RPC on darwin and linux (#1061), Host-only tool approval (#1101).
• The daemon no longer inherits its environment; list Host-set runtime variables in runtimeEnvironment.pass (#1095).
• The K4 execution core is @byok-sdk/server/execution-core; the Agent memory contract is @byok-sdk/protocol/agent-memory (#1106).

The full list, with one row per Host step, is in CHANGELOG.md, docs/releases/v0.32.0.md, docs/releases/host-upgrade-0.32.0.md and packages/client/upgrade-manifest.json.

Not in 0.32.0

#1113 A2b to A5 (SQLite activity adapter, canonical lifecycle, cross-instance wakes, restart-resumable tasks.events), Grok runtimes (#1094, #1255) and the DeepSeek Harness adapter (#1258) target 0.33.0. #1061 v2 residuals (Windows, non-Pi native runtimes, prepared and durable lanes, OS sandbox) decline file_scope_unsupported before claim.

Known issue

On macOS and Linux bash, the durable-shell gate can source the user's ~/.bashrc before shell ownership is acknowledged, and any rc output joins the tool output. The fix (--norc on the gate spawn) targets 0.33.0.

BYOK SDK 0.31.0 · keys 0.31.0

0.31.0 publication record

Date: 2026-10-29 (UTC).
Status: all nine packages are published on npm latest at 0.31.0. The complete registry readback passed.

Release SHA: 982aa2d7933292acfdb545e3619413a2bea5658b on release/0.31 (base 91976a34). The tarballs are the release-pack-982aa2d7… artifact from release-validation CI run 40769476140, and every registry dist.integrity matches them. The packages were published from a local npm session without provenance.

0.31.0 is a MINOR release under the default pre-1.0 policy. It is a transitional release: it carries the wire v4 cutover (#925) and the work that had to ship with it. These notes do not say that 0.31.0, or a Host on it, is ready for production. The product loop gates (#977, #978) and AiphaBee candidate acceptance are not evaluated against it.

Upgrade

• Wire major 4 (#925): a v3 envelope is rejected, with no reader or negotiation. Drain the v3 deployment, then start the v4 server side and the daemons together on a new store.
• Claude and Codex no longer run interactive tool approval through nativeInteractions (#1078). Tool authorization is auto | all.
• #980 adds TaskAttempt phase timestamps and a Postgres migration.

The full list of breaking changes, with one row per Host step, is in CHANGELOG.md, docs/releases/v0.31.0.md and docs/releases/host-upgrade-0.31.0.md.

Not in 0.31.0

The user-defined tool rules (#1092, #1061), Host-only tool approval (#1101), the upgrade manifest gate (#1102) and the approval replay fix (#1109) landed on main after the release base. They ship in the 0.32 line.

Scope and release steps: #1008.

BYOK SDK 0.30.2 · keys 0.30.2

0.30.2 publication record

Date: 2026-10-26 (UTC).
Status: all nine packages are published on npm latest. The complete registry readback passed.

This record does not say that 0.30.2, or a Host on it, is ready for production. The product loop gate (#977) is evaluated after release, against the published 0.30.2.

Changes

0.30.2 is a PATCH release under a one-release exception to the pre-1.0 policy, as 0.30.1 was. By that policy it would be a MINOR: it adds public API and Postgres migration 0029, and it has breaking changes in client, core, cloud and protocol. The owner chose 0.30.2 instead of 0.31.0 (#978, #977). The envelope wire stays v3.

• Client, core, cloud and protocol (breaking): scope key packages are version 2, the Host takes only version 2 puts, and the deployment declaration gains e2ee.member.kem-epoch. Postgres needs migration 0029_e2ee_member_kem_floor.sql. The daemon advertises sealed-payload-v1 only where the Host declares e2ee.member.kem-epoch, so the Host upgrades first. Migration 0029, and the first 0.30.2 open of a SQLite store, refuse a member chain that already holds a rotate entry (#950, #951, #654 E5b-2).
• Client (breaking): a refused sealed terminal sent by ciphertextRef is replaced by one closed-form terminal (#930). The durable journal is the only daemon mode, and a daemon config with hostedJournal is refused (#941, #924). byok-agent doctor no longer scans for pre-0.27.0 temp directories (#949, #938). The Agent home lease marker is published whole, so an Agent home root needs a filesystem with hard links (#990, #605).
• Client: AgentHomeLeaseCorruptError for a lease marker says how to recover, for example from an empty marker that a crash before 0.30.2 left. The marker is still refused (#1006). agentUserMcpServers for Codex and Grok Agent tasks (#947), ClaudeAdapterOptions.agentSessionPersistence (#946), and HermesAdapter declares Windows after a real Hermes run (#967). The Pi durable lane has a typed start contract and a run failure class (#921), and a Codex record consumer failure on an exit's own record stays runtime_exited (#920). task-runner.ts and create-daemon.ts are split into modules with no change to behavior, exports or published declarations (#964, #969).
• Cloud, cloud-dataplane and server: maintenance prunes the receipts of used device-proof request ids in the new twelfth step proofReceipts. A hosted Postgres Host passes proofReceiptRetention to createByokCloud, or the step reports not-configured (#942).
• Examples (private, not published): the hosted reference Host H adds S9 to S14 (#793), the Worker H Host adds D3, H1, H3 and H4 (#794), and the owner switch between L and H moves forward (#957, #975). Sealed executions and routines advance (#953). The changes of #793 S9, #794 H3 and #975 slice 5b are breaking for a Host that copies the hosted collaboration example.

See the CHANGELOG, the release notes and the Host upgrade checklist for the full scope and the upgrade steps. The CHANGELOG is the authority.

Source and accepted artifacts

• Source commit: b1469e5a236e99736c9a63b75fe845f102f81dc0 on main, the merge of #1006. The release preparation #1002 merged at 57a2e086; #1004 and #1006 merged after it with the owner's approval, and the owner chose to publish from b1469e5a.
• Push CI: run 40321474351 completed with success.
• Release matrix: run 40324830377, dispatched with release_sha equal to the source. It completed with success: 34 jobs passed and 1 job was skipped. An earlier matrix run on 57a2e086 (run 40318961528) was superseded and not used.
• Artifact: release-pack-b1469e5a236e99736c9a63b75fe845f102f81dc0, id 12651196205. Manifest SHA-256: bcdacba174373c3e2e995bda134c00eb415a47bab46077c4319c13700fb6542c.
• After publication, the npm dist.integrity of all nine packages was compared with the SHA-512 values in the manifest. All nine are equal.
• Downstream acceptance (AiphaBee) was not run before publication, by the owner's decision. The AiphaBee paths of #977 (macOS and Windows) and the #978 upgrade run after release, pinned to the published 0.30.2.

npm execution

The account is ancienttwo, with auth-and-writes 2FA. Uploads used npm web authentication, approved once for all nine packages. This local route has no provenance attestation. The dist-tag is latest.

One run uploaded all nine packages, in the plan order cloud-do, core, protocol, client, cloud, keys, cloud-dataplane, server, ui-runtime. The registry records them from 13:24:28 (core) to 13:28:02 (client) UTC. The run waited for registry propagation, read back all nine packages and created the tag. No package was on the registry before this run, and no upload was repeated.

Tag

The annotated tag v0.30.2 points to b1469e5a. The tag object is ea8ba2f8fd035d172cf3c3179ab9160b40d4a7aa. Its message is v0.30.2, a blank line, then sourceGitSha b1469e5a236e99736c9a63b75fe845f102f81dc0. It was created after the readback passed, on 2026-10-26 at 13:29:11 UTC.

Accepted tarballs

Package	Version	SHA-256
@byok-sdk/core	0.30.2	4d81cb07e1636c520bceb66af07f802b89b8cc7d6cc0bf9bcf554014aac6ef35
@byok-sdk/protocol	0.30.2	3524e9177983128cfc86ad25f3c12ff1057527cdc28237806284fe4e99ab5233
@byok-sdk/server	0.30.2	6580e948a72b613f1af02b645474c9e646438eee639d15f8179244d1201989fd
@byok-sdk/cloud	0.30.2	79c2461f133f50bf5bfa554fa21f6aed9d36cb8201eda52da65759bf15028f7d
@byok-sdk/client	0.30.2	f521cf4af4fc24f806f10fad6d18e811434b825cd7f9ec4e9b96ce374f192533
@byok-sdk/cloud-dataplane	0.30.2	62c14009c2a75426a3a691a34f24ee2cb4689bc41e46674455ab72cdaaf3b335
@byok-sdk/cloud-do	0.30.2	bb808d9c568838e6349c07b1d3f4bd58ed476cee5fda52ac3d7a9e9cfbc94c42
@byok-sdk/ui-runtime	0.30.2	f805b3f01bb348dc21d1cfcbc3efb4df87a45d3c744bcf279f8fb81081c936d0
@byok-sdk/keys	0.30.2	7859db18dd2ca0b2ea5ff8609d7706bb25df1395fdaadb02b8c9832bd67435ac

Release boundary

No downstream acceptance ran before publication. The product loop gate (#977) is open: Pi submit_result data against the published 0.30.2, one AiphaBee structured-outcome path on macOS and on Windows pinned to 0.30.2, and the maintainer's gate conclusion. The pre-release Pi measurement (Pi 1.4.0, zai/glm-5.3-flash, 120 trials on ebcb8d96) had 73/120 valid and 63/120 exact results, with no valid result for the oneOf union case or the 64,011-byte case. It is evidence for #977, not the gate result. The #978 acceptance is AiphaBee's upgrade PR by the Host upgrade checklist, after release. Wire v4 comes after 0.30.2 (#925). The E2EE Workers canary and the two-device and browser matrix are not run (#654 E6). The Workers deployment, two physical devices and real runtime calls are not approved (#794). Agent memory W5 and W6 stay open (#605), and the submit_result validation row stays open (#610). The hosted examples are unreleased. npm publication does not deploy a Host.

BYOK SDK 0.30.1 · keys 0.30.1

0.30.1 publication record

Date: 2026-10-24 (UTC).
Status: all nine packages are published on npm latest. The complete registry readback passed.

Changes

0.30.1 is a PATCH release under a one-release exception to the pre-1.0 policy. By that policy it would be a MINOR: it adds public API, gated wire additions and Postgres migration 0028, and it has breaking changes in cloud, client and cloud-do. The owner chose 0.30.x on 2026-10-24 (#872).

• Client: a daemon paired as an E2EE member uses real member keys. byok-agent pair --e2ee enrolls the member (#861). The daemon handles the e2ee.key_package.available notice (#863), seals with the member keyring (#866) and rotates a scope epoch before it seals (#877). The device can rotate its own member KEM key, as an interim step before E5b-2 (#885). The daemon advertises sealed-payload-v1 only while its member is verified and the deployment declares e2ee.member (#654 E2d).
• Cloud and cloud-dataplane (breaking): the Host shreds a sealed scope. Postgres needs migration 0028_e2ee_scope_shred.sql (#857). The three E2EE member writes take a single-use proof requestId of at most 120 characters (#860, #901). TenantStores gets the required member objects (#859).
• Cloud and client: the cloud accepts a sealed terminal or artifact by ciphertextRef and advertises sealed-output-ciphertext-ref. The daemon uploads a sealed output that is larger than the inline frame and sends it by reference (#859, #867, #908).
• Client, protocol, server and cloud: a failed task carries failure.class and failure.resetsAt when the server advertises runtime-failure-class (#869, #894, #900).
• Client: an ordinary Agent offer can select agentMemory: 'read-write-if-admitted' (#833, #880). Claude, Codex, Grok and Hermes send message drafts (#870, #893). The opt-in Claude option agentUserContext: 'excluded' keeps the user's own MCP servers, CLAUDE.md files, rules and auto memory out of an Agent task (#871, #873, #887, #904).
• Client (breaking): the Claude, Codex and Grok adapters now always yield message_draft_delta items on Session.events. The CHANGELOG calls this a type change, but a consumer that rejects unknown event types fails at run time, even when it compiles. Accept or skip these items (#870).
• Client, cloud-do and keys (breaking): the nine official Pi packages are pinned to exactly 1.4.0, and the private OAR source moves to 0.71.0. pi-durable 1.4.0 migrates SQLite stores to schema version 2, so there is no rollback to Pi 1.3.0 past this release (#909).
• Examples: K8 closes the downstream gaps #879, #881, #882, #884 and #886. The Host owns persona projections in external team mode (#898, #903). The Host narrows the outcome offer of new Turns, with at most 16 confirmable actions (#892, #895, #914). Host intents have named handlers, and the owner call failStuckIntent ends a stuck intent (#891, #914). K8 rules import from the I/O-free K4 ./canonical entry (#905), and a vendor contract is checked against the import graph (#888). The changes of #882 and #884 are breaking for a Host that copies K8. Seat ContextPacks read room messages from a Host authority (#899, part of #883). The hosted reference H adds S1 to S8 and stays unreleased (#793).

See the CHANGELOG and the release notes for the full scope and the upgrade notes. The release tracker is #872.

Source and accepted artifacts

• Source commit: 142acbe24e4c7bb453f5bbd29cbfe6c60a7e0670 on main, the merge of #916.
• Push CI: run 40118464326 completed with success.
• Release matrix: run 40118500872, dispatched with release_sha equal to the source. It completed with success: 33 jobs passed and 1 job was skipped as expected.
• Artifact: release-pack-142acbe24e4c7bb453f5bbd29cbfe6c60a7e0670, id 12570192890. Manifest SHA-256: 35920114cc7091d2bf6ebd4008c0c90f0080c46bccd67a04730e77add4450f5a.
• Downstream acceptance (AiphaBee) passed on macOS with the nine CI tarballs from this artifact. Their SHA-256 and SHA-512 values match the manifest.
• After publication, the npm dist.integrity of all nine packages was compared with the SHA-512 values in the manifest. All nine are equal.

npm execution

The account is ancienttwo, with auth-and-writes 2FA. Uploads used npm browser authentication. This local route has no provenance attestation. The dist-tag is latest.

One run uploaded all nine packages. The registry records them from 19:08:59 to 19:12:31 UTC. The run waited for registry propagation, read back all nine packages and created the tag. No package was on the registry before this run, and no upload was repeated. The dry run before it uploaded nothing.

Tag

The annotated tag v0.30.1 points to 142acbe2. The tag object is 3a353111e902a1984335fe42a9b27252474b6868. Its message is v0.30.1, a blank line, then sourceGitSha 142acbe24e4c7bb453f5bbd29cbfe6c60a7e0670. It was created after the readback passed, on 2026-10-24 at 19:13:29 UTC.

Accepted tarballs

Package	Version	SHA-256
@byok-sdk/core	0.30.1	af414ea089617a1e408137597a9837c7a2c6aff1c90ed3d2634a221d6e1d10c0
@byok-sdk/protocol	0.30.1	f0e80e6f611de81333e9b65f44ced2fe08097d6c6f61ee933d025bf1e159d8b0
@byok-sdk/server	0.30.1	ac03038d0dd10ed647626454afca4430ccd5554994d85065a8b2043fa11c424b
@byok-sdk/cloud	0.30.1	588fa1c8a710ca220fa5fde0a4ac5155ab3533842c4b9e9295a0632623b298db
@byok-sdk/client	0.30.1	ea3c3562690a3e2980f362b27178693d5252241f5ee7033424ae9df80ed9d64a
@byok-sdk/cloud-dataplane	0.30.1	21350063ca141578f5b16d747852e22d8be49f4da68bb249bbd30cc581461c5d
@byok-sdk/cloud-do	0.30.1	78128cae022f03c359faeaa743952da082efbcf37210b9d26505114ddfb3aec4
@byok-sdk/ui-runtime	0.30.1	c1eb068d5f943db8a365bb079094a3383195a235f259b22d1f9ed9c51ca064f2
@byok-sdk/keys	0.30.1	26fc3ecae193ffdac7cf8ca35c5ffb929602fc7edb96dd87525a7dca13512d30

Release boundary

AiphaBee accepted this release on macOS only. Windows code relies on the required windows-latest CI. The E2EE member flows were not run on two physical devices (#794), and no browser tests ran (#654 E6). A terminal sent by ciphertextRef that the Host refuses for good reaches the Host as no terminal; the journal replace operation comes in a later release. Live provider runs were not part of this release: real Windows runs of Hermes (#608, #712), the submit_result success rate (#610) and a live Pi provider turn on 1.4.0 (#909). On Windows, Agent memory makes no claim for an OS crash or a power loss (#605). #883 and #793 are only partly done and stay open. The hosted example H is unreleased and has no migrations (#793). npm publication does not deploy a Host.