Conductor Runner 0.0.1-beta.8

Runner beta release

Version: 0.0.1-beta.8. Tag: v0.0.1-beta.8.
Public repository: https://github.com/ConductorCI/runner.

Beta.8 requires manifest v6 and protocol.step-execution.v2. It adds stable
step keys, bounded retries for process tasks, protected execution namespaces,
read-only task-attempt metadata and atomic successful exports/output completion.
Scalar retry: 3 permits four total executions. Retries share one step deadline,
retain the concurrency slot and never repeat host, protocol or logging failures.
Only manifest v6 executes; earlier manifests are rejected. This requires the
matching application API and artifact schema 3, and recompilation of saved YAML
before use. See the execution contract.

Publish and verify this immutable runner release before adopting its source pin
in the application or building an AWS image. Existing beta.7 instances, image
revisions and pipelines remain pinned until the coordinated application cutover.
Built-in packages retain their beta.4 minimum because their handler interfaces
remain compatible; the new application requires the execution-v2 capability.
Portable bundle schema 2 and the pinned Go/Node toolchains are unchanged.

Beta.7 rebuilds the worker and lifecycle manager with the supported Go 1.26.9
security toolchain. This includes the October 8 fixes for excessive HTTP/2
SETTINGS processing (CVE-2026-78669), HTTP Range parsing (CVE-2026-78667), and
TLS ECH extension memory amplification (CVE-2026-97031). The HTTP/2 advisory
includes clients, making the fix relevant to the runner's outbound HTTP use.
See Go's release notes and
HTTP/2 advisory.

Task protocols, manifest formats, bundled Node version, and built-in beta.4
minimum runner versions remain compatible. Rebuild all six portable targets,
run the canonical vulnerability gate, and import the immutable release pin into
the application. Build the pinned govulncheck v1.6.0 with Go 1.26 or newer so it
can load the new standard library. Existing version tags and published assets
remain unchanged.

Beta.7 also retries brief Windows sharing/locking errors and concurrent atomic
replacement when reading manager heartbeat files. Each retry reopens and
revalidates the file; malformed files and failures that persist through the
bounded retry window still fail closed. This prevents a valid heartbeat update
from intermittently stopping worker startup or triggering a drain.

Beta.6 gives every executed action a five-line Pool/Runner/Step/Task/Version
header, one succeeded/failed/cancelled result line, and a final Finished: <Task>
record. The JavaScript host and SDK expose ctx.setResult so handlers can supply
result detail without duplicating terminal output. Runner timeouts, cancellation
and output failures take precedence over a handler's reported success. Host health
is sampled at each task; persistent warning kinds are annotated once per job.

The manager now explains commands and maintenance outcomes, discovers its own
installation folder for everyday commands, and prints a readable update summary.
Scripts that consume check-update JSON must add --json. Install and uninstall
still require an explicit --target; services and PATH are managed separately.
Custom packages using ctx.setResult must require runner beta.6 or later. Built-in
shell packages retain an older-host fallback and their beta.4 minimum requirement.

Beta.5 batches adjacent plain output, retries transient delivery failures during
execution, and preserves the observed child exit code when log delivery fails.
The service journal records the closing result even when the API cannot accept
the footer. The application companion change recovers missing closing summaries
from durable step status and refreshes an open log view when its job ends.
This is a compatible bug fix: built-in task minimum versions remain beta.4 and
the task log protocol and manifest schema versions do not change. Publish a new
immutable prerelease, reconcile the application pin, and upgrade the API/frontend
and runner before claiming the corrected behavior is live.

Beta.4 added runner-owned headers, author identity and final task messages for
all actions, with acknowledged attempt sequences and a sealed output drain.
Read task log boundaries for the protocol, failure
limits and coordinated API rollout.

Beta.3 changed the pre-release worker contract to runner throughout the CLI,
configuration, package metadata, API routes, services and SDK. Use it with the
matching Conductor API/database/frontend/MCP maintenance cutover. Existing beta
tags and assets remain immutable.

Worker and manager binaries are conductor-runner and
conductor-runner-manager. Sources live in cmd/conductor-runner/ and the other
matching command directories. The private Go module and packages use runner
names. Built-in task packages declare minRunnerVersion: 0.0.1-beta.4.

Coordinated upgrade

Stop old API admissions and workers after accepted work settles. Apply the
application runner-terminology migration, deploy its matching API, frontend and
MCP, then install this runner release. Update service commands, local config and
environment names. Re-register when an old identity/configuration layout remains.
The old manager cannot discover the renamed /api/v1/runners/updates endpoint;
this release requires a manual cutover. Custom task archives must use
minRunnerVersion. User scripts that referenced previous worker environment
names need corresponding edits.

Beta.8 accepts only job manifest version 6; portable bundle schema 2 is unchanged.
Old API/worker pairs are not supported across this cutover. Do not weaken version,
signature, hash, or capability checks to mix incompatible releases.

Portable release

Run tools/scripts/ci/Invoke-RunnerUnitTests.ps1, then build from a clean commit
with tools/scripts/runner/Build-Distribution.ps1 -Target All. While developing,
use -AllowDirtySource and do not publish those dirty-source artifacts.

The release contains Windows ZIP bundles and Linux/macOS tar.gz bundles for
amd64 and arm64, six managers, twelve SHA-256 sidecars, SHA256SUMS and
release-manifest.json. Node and its license are included in every bundle.

Publish the 26 files directly under dist/ as GitHub prerelease assets. Verify
the manifest source commit is the tagged commit, sourceDirty is false, and all
asset digests match. Keep generated distributions and credentials out of Git.

Native MSI/pkg/deb/rpm packages require native validation and signing identities
from native-release-checklist.md; portable cross-builds do not prove them.

Approval and publication

Use ConductorCI for release orchestration. A release job requires a Windows
runner with the pinned Go and Node toolchains and vulnerability scanner. Run the
canonical runner gate, build all six targets from the exact clean source commit,
then invoke tools/scripts/runner/Publish-GitHubRelease.ps1. The publisher verifies
all 26 asset digests before publishing the prerelease. Pass PromoteLatestApproved
only after explicit approval. ConductorCI pipeline setup is deferred; no automatic
publication trigger is configured in this repository.

Version tags (such as v0.0.1-beta.3) and published assets are immutable.
latest-approved is a lightweight, movable tag for the most recently approved
release commit. It moves only after verified publication, with an explicit lease
that prevents overwriting a concurrent promotion. An approved beta remains a
prerelease; the approval tag does not change its compatibility or channel.

Consumers should resolve latest-approved to the immutable version tag and use
that version's release assets. Source pins and installation manifests must
record the exact version/commit rather than pinning the movable alias.

The publisher uses GitHub REST release IDs for draft creation and binary uploads.
Interrupted draft uploads reuse assets with matching size and digest. Published
assets are immutable; CI-only fixes after a release require a new version for
a subsequent release from a different source commit.