Truss v0.0.49

Truss v0.0.49

Release closeout: the exact-tag Linux campaign and independent public Mac ARM64 driver30, worker21 and HF62 checks passed. Public verification proof. Actual Lakebase acceptance remains a separate, unrun gate.

Release scope

This release adds explicit managed platform grants for Python embedders and
operators to the v0.0.48 runtime. The selected tuple is Python3.11+,
PostgreSQL18.6, psycopg3.3.6, mini-racer0.14.1, UMF0.10 and Weft0.4.51 with its
exact qualified compiler cohort. Release assets and the package guide are the
delivery channels. The macOS ARM64 campaign at commit 19d7bbe5 and hosted
Linux campaign at commit 4188141f pass on the same exact wheel and native
manifest below. Release completion requires the matching tag's mandatory Linux
campaign and independent public-download
verification, as defined in the
managed grants plan.

The native release label remains truss-catalog-runtime/0.74-candidate; the
selected candidate manifest SHA-256 is
288801f7177338328441b5d3ce9328af31740ebf513f04ea45e30ae316a9f3a4.
The preceding 35fd797b… candidate has the exact local receipts described below;
they do not qualify this audit-accumulation target. Paired native captures
and additive migration packaging are complete. The current native target has
complete selected installed macOS ARM64 and branch Linux qualification below.
Exact manifest identity distinguishes these targets from v0.0.48's c4339ac7…
target. A shared release label alone never establishes compatibility.

The selected Weft0.4.51 dependency is public. Its
asset and packaging verification
binds compiler source 55715373… separately from its release tag/workflow
commit d4b0b985….
The public v0.0.48 input audit
and paired source48 admission
are also complete. The earlier native manifest 35fd797b… macOS campaign passes for its exact
recorded artifacts. The current native target passes both selected installed
macOS ARM64 and hosted branch Linux campaigns below. The final tag campaign and
public verification are separate final release gates.

Highlights and fixes

• Fresh installation accepts tolerated_grantees, a bounded tuple of exact
  existing platform-role names. The default empty tuple preserves strict
  installation. Selected grants and grant options remain in place; immutable
  installation metadata records their native name/OID identities and initial
  access-control-list (ACL) observations.
• Subsequent administration verifies the stored identities. Initial ACL evidence
  remains historical provenance; later grants to selected identities are allowed
  within the explicit trusted platform boundary. Ordinary privileges, private
  defaults, ownership and effective-access checks retain their exact requirements.
• A contained InstallRefused(code="third_party_grant") identifies the unlisted
  role and safe object-class/phase context after confirmed operation rollback.
  The local CLI prints the safe refusal as JSON and exits with status1. Prior
  caller work survives; the caller still owns outer settlement.
• Separately protected activation refuses a nonempty policy with
  unsupported_profile before effects. Ordinary catalog registration, module
  access, mutation, journal and feed workflows remain available within their
  selected profile.
• Strict preparation source verification accounts for ordered routine
  replacements, exact overload signatures and the finite declared ACL profile.
  It preserves declared public and registrar grants while refusing native drift.
• Whole-group audit collection accumulates owners and entries in native arrays
  before the existing JSON construction. This removes repeated JSON copying
  while preserving order, duplicates, nulls, exact owner reduction, limits and
  authorization. The original 10-second SQL and 30-second operation limits and
  independent event budget remain unchanged.

The HF changes described in v0.0.48 remain part of the baseline; this release
adds the managed policy and its integration fixes.

Required actions and migration

Only the latest runtime is supported. Startup never migrates an installation.
Operators must quiesce writers, back up the database and host recovery registry,
and follow the migration guide: inspect
status, prepare and retain the reference, apply it, reconcile uncertain
settlement, and verify before resuming application work. Install the matching
checksum-verified Weft0.4.51 compiler cohort.

The required release lineage retains v0.0.44, shared v0.0.45/46 and v0.0.47 and
now includes the actual published v0.0.48 target. Its checksum-verified wheel
1aedf614… supplies native manifest c4339ac7…; paired America/New_York and UTC captures
admitted its route to native manifest 35fd797b…. The source profile, original migration
manifest 7d165e4a… and all prior migration artifacts retain their exact bytes. The
current migration manifest is
96addcdb95523f478d8f50b0b47198e47a860680c7400dd359711930e837e535.
It retains the preceding manifest 86bcf785… and adds the representation-only audit
collector edge from manifest 35fd797b… to 288801f7…. All four complete routes and
recovery cases pass on the exact macOS ARM64 and hosted Linux artifacts below.

Forward migration installs an empty strict managed policy on existing admitted
installations. It does not opt them into platform trust. Only fresh installation
selects tolerated identities. Missing, renamed or recreated selected roles refuse;
automatic policy widening or role remapping is unavailable. Administrators must
use a separately reviewed recovery procedure for such drift.

Hold and recovery

Hold on native drift, failed verification or uncertain settlement. Reconcile
the original attempt without resubmitting effects. Pre-commit failure rolls back;
committed changes require a forward fix or the qualified backup
restore/remigration route. Installing an old package is not database rollback.

Qualification and known limits

The installed macOS ARM64 campaign
passes on source 19d7bbe5793e61e4034769a18b1d9a03b5c7e959, with Python3.11.17,
PostgreSQL18.6, psycopg3.3.6 and the exact public Weft0.4.51 Mac cohort from
compiler source 557153731e9f5d0583193a1189a07c6ed485d3d3. Its eight steps cover
module boundaries and 20 allowed/forbidden controls, 21 managed modules/130 tests,
HF62, nine strict protected tests, all 106 migration/recovery tests over four
actual public source wheels, lifecycle controls and the original public workload.
Test campaigns have zero skips, failures or errors. Lifecycle checks preserve
the initial carrier through supported additive evolution, contained unsupported
record-retirement refusal and later selected ACL changes. The independent
UMF commit 5ba77cff / Bun1.4.3 oracle, all 1,206 frozen inputs, identities, installed payload and
owned worker cleanup verify unchanged. The retained-file index
binds 53 original outputs retained losslessly.

The complete hosted Linux branch campaign
passes at source 4188141faf3e51a7a25711a6fc22751cb37c7ae4, using the exact
public Weft0.4.51 Linux cohort from the same compiler source. It includes all
mandatory branch installed regressions, the 21-module/130-test managed campaign,
HF62 and the 106-case migration campaign,
with zero skips, failures or errors in those selected campaigns. Cleanup,
unchanged-input/payload and pinned oracle controls pass. Its publish job is
skipped because this is a branch qualification, rather than a release tag.

Both platforms use wheel
57fd9520a453dcafa52dabe6aa75a143c162593237e80177acaebdbd51202790,
native manifest
288801f7177338328441b5d3ce9328af31740ebf513f04ea45e30ae316a9f3a4
and migration manifest
96addcdb95523f478d8f50b0b47198e47a860680c7400dd359711930e837e535.
All 467 runtime payload files agree across source, wheel, sdist and installed
Mac package. The independent archive SHA-256 is
ae5726d745e6ce52f1229ad1d1b46ca6a5ff55d8cb0bb0aa73751f2dd8fd0eb6;
its corpus retains 62 cases, fixed limits and all 363 prior producer digests,
adding two semantic controls as the 364th producer binding. Each platform's
public workload verifies 1,000 objects, 1,000 edges, 1,000 reads, 200 committed
updates and values after connection reopen, counting 26,122 SQL submissions.
These are selected workload observations; general latency budgets remain
provisional.

The native capture and packaging receipt
records New York/UTC comparison and the additive manifest 35fd797b… → 288801f7… edge. All 21 prior
migration artifacts and original SQL retain their bytes. The private wheel with
manifest 35fd797b… is an intermediate capture fixture, not an admitted public
source. The
bounded diagnostic
records the unchanged whole-group audit case on public48 and native manifest 288801f7… without
relaxing assertions or deadlines. It is not a general performance certificate.

Earlier failures remain unchanged: the first Linux diagnostic
records the corrected fault-injector issue; the second diagnostic
and unchanged rerun
retain the native manifest 35fd797b… audit timeout. The commit 6287e52a macOS receipt
and earlier managed-grants packet
remain historical candidate evidence; they are not reused to qualify native manifest 288801f7….

Exact branch wheel, sdist and corpus containers are retained privately and in
GitHub artifacts subject to retention limits. Their durable hashes and payload
maps identify the tested bytes; they are not permanent public release assets.
The matching tag's mandatory Linux campaign
and independent public verification bind the actual published assets separately.
A release pass must join the final source, wheel, native manifest, compiler and
archive; neither this branch pass nor the Mac pass claims publication.

The retained broad all-discovery diagnostic remains incomplete and unqualified.
It combines historical proof fixtures requiring removed row-home schemas and
opt-in campaigns requiring older exact compiler bundles. It is outside the
current supported release campaign; scoped passes never turn it into a complete
suite pass. Historical failures remain available in the
original diagnostic.

Actual Lakebase service behavior, TLS/token handling and Arras adoption require
their own exact consumer receipts. The local platform stand-in does not qualify
them. Nonempty-policy protected activation, protected-profile migration,
pre-UMF0.10 migration, downgrade and other drivers remain unsupported. Successful
record/relationship retirement and broader performance targets are not added.