Ardur v0.2.1-rc.1: release-matrix verification

Ardur v0.2.1-rc.1 — release-matrix verification prerelease

This prerelease exercises #532 P0 from the verified dev merge of PR #534. It is a distribution-pipeline verification snapshot, not a production-release recommendation or a Rust package version bump. The existing CLI reports ardur 0.0.1.

The release workflow is responsible for attaching six binaries for each target:

• x86_64-unknown-linux-gnu
• aarch64-unknown-linux-gnu
• x86_64-apple-darwin
• aarch64-apple-darwin

Verification completed successfully: release-supply-chain run 35425909975, source f775534f9c8ad7d8a6281f9088e01200324a7bf1. All four native build/package/smoke jobs and the aggregate signing job passed. All 52 release assets were independently downloaded: 24 tarballs, one release-level SPDX SBOM, one merged SHA256SUMS, and 26 Sigstore bundles. Every payload checksum and all 26 Cosign verifications passed; local digests for all 52 files also match GitHub's asset metadata. Both macOS packaged CLI smokes returned ardur 0.0.1.

Full lane logs, four downloaded checksum/Cosign outputs, and gate evidence: #532 (comment)

Verification instructions and platform limitations: https://github.com/ArdurAI/ardur-agent/blob/v0.2.1-rc.1/docs/releases.md

macOS binaries are thin and have no Apple Developer ID signing/notarization, by owner decision. Sigstore signing and checksum verification are still mandatory before execution; quarantine handling is documented. The Intel lane uses the separately approved SHA256-pinned static ONNX Runtime 1.28.0 input from csukuangfj/onnxruntime-libs, recorded in the release SBOM with Microsoft license notices inside Intel archives.

This prerelease does not publish a Homebrew formula, npm package, binstall configuration, Windows binary, or universal macOS binary. Those are separate milestones. The existing Docker tag workflow runs independently and is unchanged; registry visibility is not changed by P0.

v0.2.0

v0.2.0

Promoted from dev (tree 4999e53) via PR #475 onto main at 863009db.

Provenance mapping: tag object 144e571c99835fd06ea8eeead9123e88c95e7bc7 → commit 863009db958af285da061f35b734d8d07ad2b12b (the promoted main tip; reachable from main, unlike the beta.1 tag).

Container: ghcr.io/ardurai/ardur-agent:v0.2.0 (digest sha256:b35c104439cf61480fa10d81bd9526ca2ed028f4941f110ec1154d206c32a0eb, same digest as the sha-863009db… tag; attestation published). The package remains private.

What shipped since v0.1.0-beta.2

• Dolt SQL admission gate rewritten as a strict-subset parse boundary (#473): AST-resolved table identifiers, preflight refusals for executable/hash comments and control/non-ASCII characters, a token-level swallowed-separator guard, unmodeled SHOW variants refused, a statement-level purity walk gating both read and write paths against nested DML/INTO at any depth, REPLACE refused. Nine independent review rounds; every guard fault-injected; 77 lib + 14 real-Dolt e2e tests.
• Approval receipts aligned with the admin gate (#472): presented-token forwarding, zero-budget decision receipts, gate/receipt rejection parity.
• rustls 0.23.45 (#474, RUSTSEC-2026-0285).
• docs/current-status.md rebaselined (#468): every slice states shipped vs unshipped; baseline evidence records the pre-gate SHA only.
• Tool-attribution mentions removed from code comments (#476).

What did not ship (open remainders, by design)

#361 delegate_task revocation (Epic 3 in the queue), #364 web.fetch SSRF/timeout/redirect hardening and CDP argument encoding, #363/#362 docs halves, #367 bounded channel queues + orphan modules, #360 concurrency ceiling, #464 OpenAPI duplicate paths, #366 doc/CLI gaps, #357 Qdrant pagination, #352 parallel-step naming. Promotion-review findings filed as #477–#483.

Evidence

All main checks green on 863009db (CI, docker, site-deploy incl. github-pages approval, Trivy, CodeQL). Promotion pre-flight: DCO delta clean (3 pre-listed exemptions), full-delta gitleaks clean, dev file-superset of main.

v0.1.0-beta.2

Beta-hardening release. Closes every finding the v0.1.0-beta.1 reviews generated.

This is a pre-release. See docs/current-status.md for the full release checklist, including the limitations below stated in context.

Supply chain and CI policy (#440)

Builder toolchain re-pinned (#436). The Dockerfile built on the floating rust:1.98-slim tag, which resolved to rustc 1.98.0, while rust-toolchain.toml pins 1.98.1 — so CI-validated artifacts and the released image were built by different compilers. The builder is now pinned to rust:1.98.1-slim at a fixed digest, and a guard test asserts the Dockerfile tag matches the toolchain channel, so the two cannot drift apart silently again. Trivy compared both digests before the bump: 0 added HIGH/CRITICAL findings, 42 resolved.

DCO exemption loophole closed (#435). dco.yml read its exempt-SHA list from the pull request head, so a PR could add its own commits to the exemption list and self-approve. It now reads the list from the base ref and enforces append-only edits with full 40-character SHAs. A narrow same-repo dev → main carve-out keeps the documented promotion recovery path open without reopening the loophole.

Scan noise removed (#437). A .gitleaksignore entry covers the two synthetic fixtures the redaction tests use, so scans stop re-reporting known-fake credentials without suppressing anything real.

Tool execution hardening (#441)

New shell.exec tool (#420). shell.run validates an allowlist by prefix against a string it then hands to a shell, so an allowlisted prefix can carry arbitrary trailing commands. shell.exec is the hardened path:

• execs argv directly with no shell, so no metacharacter in any argument is ever interpreted
• matches argv[0] exactly rather than by prefix
• bounds captured output as it arrives, so a long-running allowlisted process cannot exhaust memory
• gives the child a PATH of absolute components only, so the allowlist cannot be defeated by a planted binary earlier in the search path
• tears down the whole process group on timeout (Unix), so a forking child cannot leave descendants running

It declares the same capabilities as shell.run, so it does not widen any existing grant.

Receipt-chain integrity (#442)

Cancellation no longer strands the receipt chain (#422). A turn abandoned mid tool-loop could return success carrying an intermediate round's receipt, leaving the chain ending on a non-final entry. Writing the reproduction surfaced a worse symptom than reported: the returned receipt had empty content. The runtime now returns cancellation rather than a misleading success, and appends a terminal llm.completion.cancelled.v1 marker when at least one round had committed. The marker is cost-neutral, because both chain aggregators sum receipts verb-blind and would otherwise double-count, and reconciliation knows it is intentionally journal-less.

Known limitations

Stated here because they are real and documented rather than discovered later:

• shell.exec is implemented and tested but wired to no server config flag, so it is never registered at boot. Deployments constructing a registry directly can opt in via BuiltinOpts::enable_shell_exec.
• Neither shell tool sandboxes the binary it runs. Cap-token and Cedar authorize whether a tool may be invoked and never see argv.
• The streaming path does not yet record a cancellation marker; an SSE client disconnecting mid tool-loop can still leave the chain ending on an intermediate receipt.
• Windows has no process-tree teardown equivalent; a timed-out process can leave grandchildren running there. No shipped artifact targets Windows today.

Verification

Baseline 18412ae2d5a1c527fb51cbb0b83742cbeee2e109, with CI, docker, and site-deploy all green on that commit. Every merged pull request passed the full required check set with all review threads resolved.

Full changelog: v0.1.0-beta.1...v0.1.0-beta.2

v0.1.0-beta.1

First public beta of Ardur Agent — a fused-substrate agent runtime where every turn threads cap-token authorization, Cedar policy, injection scanning, cost gating, provider dispatch, signed ES256 receipts, bi-temporal memory, and an append-only journal, short-circuiting on first failure.

Highlights

• First-run UX: ardur setup writes a scoped starter Cedar policy; denials explain themselves (#418)
• Operator grants: ardur grant actually enables hardened shell/file/http tools in chat, fail-closed (ARD-457, #419)
• Commit gate for caller-abandoned turns: abandoned non-stream turns release their cost reservation and mint no final receipt (#359, #421; intermediate tool-loop receipts can still survive - see #422)
• Incremental receipt-chain verification and Qdrant snapshot timeout hardening (#355, #371, #424)
• PWA streaming against the fused SSE contract with fail-closed CORS (ARDUR_CORS_ORIGINS, ARD-460, #425)
• GHCR image publishing on v* tags plus a fresh-machine operator runbook (#423)

Release checklist and known gaps

docs/current-status.md is the reviewed release checklist for this tag. Known, disclosed gaps: shell.run's allowlist is a prefix gate, not argv confinement (#420); tool-loop intermediate receipts survive a later-round cancel (#422).

Container image

docker pull ghcr.io/ardurai/ardur-agent:v0.1.0-beta.1

The published image is the exact digest that passed the docker workflow's Trivy HIGH/CRITICAL gate and /healthz container smoke, with GitHub build-provenance attestation. :latest is never tagged.

Supply-chain assets

Attached by the release-supply-chain workflow after publication:

• *.tar.gz — release binaries (x86_64-unknown-linux-gnu)
• ardur-agent-v0.1.0-beta.1.spdx.json — SPDX SBOM
• SHA256SUMS — checksums for all assets
• *.bundle — keyless cosign signature bundles (cosign v3 bundle format; contains signature + certificate)
• GitHub build-provenance attestations for all artifacts

Verify a downloaded asset:

cosign verify-blob \
  --bundle <asset>.bundle \
  --certificate-identity-regexp 'https://github.com/ArdurAI/ardur-agent/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  <asset>

Commit provenance

• Code baseline reviewed: 09b40df (last code change; the two commits after it are docs-only).
• Signed tag v0.1.0-beta.1 points at 7e90bab on dev; all release assets and the GHCR image bind to that SHA.
• main received this exact tree as squash merge 9237e3d (PR #428) — main's tree is byte-identical to the tagged tree, but the tag is not reachable from main's history (squash promotion). Auditors: map artifacts to source via 7e90bab.

Validation

Fresh-machine runbook: docs/fresh-machine.md — offline stub path (no keys), one live provider opt-in, private Slack channel, and published-container smoke.