Skip to content

Foreman v0.4.0

Latest
Latest

Choose a tag to compare

View all tags
@CharlesHoskinson CharlesHoskinson released this 25 Aug 03:19
v0.4.0
225ac0e

Foreman v0.4.0

Status: release candidate prepared 2026-08-24.

v0.4.0 adds stable project identity, a durable external memory projection,
a hermetic appliance, and a deterministic graph-assisted knowledge plane.
Graph data remains derived state. Foreman remains functional when the graph is
absent, stale, disabled, or corrupt.

Product

  • The project registry gives each repository a stable local identity and binds
    cross-project state to the correct SessionStore.
  • The MemoryIndex adapter supports Qdrant 1.19.0, a pinned local embedding
    model, conditional writes, and isolated projection epochs. NullMemoryIndex
    remains available.
  • The appliance builds pinned control, toolchain, and worker images and uses a
    dedicated rootless Podman service without mounting the operator's default
    engine socket.
  • Graphify 0.9.48 is qualified behind a deterministic publication and
    freshness boundary.
  • The work-DAG projector and graph-context builder produce bounded,
    deterministic artifacts with source citations and explicit degraded modes.
  • The release evaluator uses a canonical 2,000-slot paired run set. No
    observations were available for this release, so the result is
    GRAPH_OFF_UNCOMPUTABLE. All 2,000 slots are recorded as not run. Graph
    assistance stays off by default.

Evaluation artifacts:

  • Run-set SHA-256: 4ec22f4d92a711d4a5cfd04bbbc291550664686525d8278db7d0fddbd6980f36
  • Report SHA-256: db1eb64f906f719c1fd7e4d6ffa5df86f78bbaccb6620b2d38e9660c1aed7335

Windows

The Windows workflow provisions the required MSYS2 flock and SQLite tools
and builds the native launcher. BW-004 is an enforcing focused gate for the
lock and worktree create/merge suites. On MSYS, the lock helper keeps a
command-mode flock child alive because descriptor inheritance does not
serialize independent Bash processes reliably. The broader Bats suite remains a
non-gating measurement until its complete native Windows result is qualified.
The complete Node suite remains a Linux/WSL gate; native Windows runs its
static, runtime-build, register, smoke, and test-runner checks. This release
does not represent the unqualified native Windows suites as fully supported.

The local WSL host does not permit unprivileged PID namespaces
(unshare --pid returns Operation not permitted). The launcher suite records
the corresponding degraded-path skip. The hosted Linux gate retains the
namespace-capable launcher check.

Security decision

npm audit reports four high-severity advisories and no critical advisories.
No compatible automatic fix is available on 2026-08-24:

  • Direct dependency @huggingface/transformers 4.2.0 inherits the
    onnxruntime-node and sharp findings.
  • adm-zip is affected by GHSA-xcpc-8h2w-3j85. A crafted archive can request
    a large memory allocation through the inherited ONNX Runtime package.
  • sharp below 0.35.0 inherits the libvips findings grouped under
    GHSA-f88m-g3jw-g9cj.
  • onnxruntime-node remains affected through its adm-zip dependency.

The v0.4.0 release accepts this residual risk. The MemoryIndex adapter uses a
pinned local text-embedding model, does not accept image input, and has a
network-disabled embedding test. Operators must provision trusted model bytes
and must not use untrusted archives or images at this boundary. A later update
will take compatible upstream releases when they are available. This is a
time-bounded acceptance, not a claim that the dependencies are unaffected.

Verification

The release candidate must pass these checks on unchanged bytes before the tag
is created:

  • npm run verify
  • npm run verify-install -- --skill-root skills/foreman
  • bash skills/foreman/scripts/docs-check.sh
  • strict validation for every active OpenSpec change
  • release coverage for every v0.4 lane and the final release phase
  • the hosted Linux gate, the local WSL gate, and the focused native Windows
    BW-004 gate

The final Git commit, hosted run links, and publication state are recorded in
the v0.4.0 checklist and GitHub release.

Deferred work

The SQLite ontology expansion in graph-store-port is deferred to v0.5. The
files-only GraphStore remains the v0.4 default. Council runtime, deliberation,
MCP transport, broad dogfood work, and graph-default-on promotion also remain
outside v0.4.0.

Final verification

Assets 2
Loading