v0.1.0b3 — externally visible contracts

Beta 3 — the externally visible contracts release.

kvm-pilot's safety internals (effect-class gates, signed single-use approval receipts, typed outcomes, audit trail) were already ahead of the MCP ecosystem. b3 makes them legible from the outside — the contracts agent hosts actually build policy on. Distilled from the 2026-07-13 competitive gap analysis (#194).

Highlights

• Per-tool MCP annotations (#195). Every tool now declares all four hints (readOnly / destructive / idempotent / openWorld) explicitly, and a regression test fails CI if a tool ever ships without them. Clients auto-approve, parallelize, and render confirmation UI off these bits — and the spec defaults treat an unannotated tool as maximally dangerous and internet-reaching, which misrepresented our LAN-only surface. Notable precision fixes: mount_iso/eject/file_firmware_report are reversible writes, not destructive ops (their MEDIA / EXTERNAL_WRITE gates and approvals are unchanged); classify_screen/wait_for_state are flagged open-world because the server-side vision backend may be a cloud VLM — with a local VLM nothing leaves your network.
• KVM_PILOT_MCP_READ_ONLY=1 (#196). A true least-privilege launch posture, enforced by three independent layers: destructive tools are not registered at all, every effect gate is force-closed regardless of ALLOW_*, and every driver is built with a deny-all confirm — so a registration bypass fails closed instead of mutating (tool filtering alone is not enforcement). The documented trust ladder for a new fleet: READ_ONLY → DRY_RUN → per-effect ALLOW_*, one gate at a time.
• Official MCP registry (#197). The server publishes as io.github.dustintrap/kvm-pilot — this release carries the ownership marker and the release pipeline now keeps the registry listing in step with PyPI automatically.

Also

• The getting-started guide now starts new users on the read-only rung and closes the loop: kvm-pilot test-report + a two-minute hardware report is how a device+firmware combo earns its row in the Hardware-Compatibility matrix. Success or failure both count.
• README links on PyPI are absolute again (#193).

Install: pip install --pre kvm-pilot · Getting started · Full details in the CHANGELOG.