ElastOS Weekly Shipping Report — Week of June 26 – July 3, 2026

[SashaMIT]

ElastOS Weekly Shipping Report — Week of June 26 – July 3, 2026

June 26 – July 3, 2026

The convergence week — three parallel Runtime storylines collapse onto one tree, and the market path goes end-to-end. Runtime spent the prior cycle carrying three separate branches — the 0.5 shell integration (People / Services / Browser-VM / WebRTC), the marketplace-capsule prototype, and the MPEG-DASH media pipeline. This week all three consolidated onto flint-0.5 under a single zero-loss PR (#12), and the follow-on commits are almost entirely restorations, reconciliations, and hardening on top of that unified tree. On top of that base, the marketplace shipped end-to-end in five slices (chain-provider → buy/trade authorities → storefront API → library Acquire → Home wiring), MPEG-DASH / CENC compliance landed alongside DKMS quorum + lifecycle hardening, a six-vector security-audit swarm (T1–T6) closed and its validators were single-sourced, and a full Intent-Proof Loop + Standing-Grants gateway + per-capsule Spend Meter made agent actions provable, revocable, and metered on a single custody surface. In PC2, the 1.4.0 release that was deliberately held last week is now published (Elastos Node Manager as a service-type app, multi-arch packaging, stream-safe gzip), and the ElastOS Launcher v1.4.0 shipped notarized. A feasibility + design pass on bridging ELA from the Elastos mainchain to Base returned a buildable, no-blockers verdict — every limitation has a concrete, production-proven fix. Hyper hardened chat/follow capability isolation and closed a security-audit fix pass. ElacityLabs.com reframed its product narrative around agent-ownership.

flint-0.5 consolidation (PR #12, zero-loss ledger) · marketplace end-to-end in 5 slices · MPEG-DASH / CENC (ELACITY-2283) + DKMS hardening (ELACITY-2282) · 6-vector audit swarm T1–T6 closed + validators single-sourced · Intent-Proof Loop ch1–5b on the Custody Inspector · Standing-Grants gateway (issue/revoke/preview) · per-capsule Spend Meter across microVM/WASM/carrier · PC2 1.4.0 published + ElastOS Launcher v1.4.0 notarized · ELA→Base bridge feasibility locked (buildable, no blockers) · Hyper chat/follow isolation + audit-fix pass · Elacity Bible v1 as narrative canon.

---

Key Links This Week

• Previous report — Week of June 19 – June 26, 2026 (#26)
• Runtime — merged this week — PR ElastOS Weekly Shipping Report — Week of Apr 18–25, 2026 #12: Consolidate all branches into flint-0.5 — marketplace + mpeg-dash + restorations (zero-loss) (merged 2026-07-03)
• PC2 — published this week — PR Release v1.4.0 — Elastos Node Manager, multi-arch packaging, app-layer compression #25: Release v1.4.0 — Elastos Node Manager, multi-arch packaging, app-layer compression (+ Necessary PC2 changes for the Node Manager (service-type app support) #18/Elastos Node Manager app (service-type app — requires #18) #19)
• Active Runtime branches — flint-0.5 · flint · review/0.5.0 · feat/marketplace-runtime · feat/capsule-inspector · w2-consent-source
• Active PC2 branches — main · feature/elastos-node-manager
• Install (PC2 node) — bash <(curl -fsSL https://raw.githubusercontent.com/Elacity/pc2.net/main/scripts/update.sh)
• Install (Runtime) — curl -fsSL https://elastos.elacitylabs.com/install.sh | bash
• Live surfaces — map.ela.city · portal.ela.city

Table of Contents

1. The Big Picture — A Convergence Week
2. Runtime — 0.5 Consolidation onto flint-0.5
3. Runtime — Marketplace Capsule (Slices 1–5)
4. Runtime — MPEG-DASH / CENC Compliance + DKMS Hardening
5. Runtime — Security Audit Swarm (T1–T6 Closures)
6. Runtime — Intent-Proof Loop (ch1–5b) + Custody Inspector
7. Runtime — Standing-Grants Gateway (2c-A/B/C)
8. Runtime — W2 Consent Path CLOSED + Per-Capsule Spend Meter
9. PC2 — 1.4.0 Published (ENM, Multi-Arch, gzip) + ElastOS Launcher v1.4.0
10. Protocol — ELA ↔ Base Bridge: Feasibility Locked, Design Complete
11. Infrastructure — Cost Optimization & Cloud Migration
12. Hyper — Chat/Follow Capability Isolation + Security-Audit Fix Pass
13. ElacityLabs.com — Product-Narrative Reframe & Agent-Ownership
14. Strategic & Narrative Docs — Elacity Bible + FLINT_MASTER_STATUS
15. Convergence Lens — PC2 ↔ Runtime
16. Looking Ahead
17. Summary Statistics
18. Data-Quality & Off-Repo Notes
19. Architecture Alignment — Direction This Cycle

1. The Big Picture — A Convergence Week

Three things happened in parallel this week and they were all the same thing: taking a hardened dDRM/runtime stack and pulling its separate workstreams into one coherent, auditable tree — then racing the market, security, and agent-custody stories to a place where all three are visible on a single custody surface.

• The tree unifies. Three branches of parallel work — 0.5 shell integration, marketplace, MPEG-DASH — collapsed onto flint-0.5 under one consolidation PR (ElastOS Weekly Shipping Report — Week of Apr 18–25, 2026 #12). A zero-loss branch ledger ships alongside it, recording every remaining branch's disposition and delete-safety — the merge story is intentionally auditable.
• The market goes end-to-end. In a single push the runtime went KID → ledger-tokenId resolver → buy/trade authorities → /api/market/* + storefront capsule → library Acquire (buy → pin) → storefront wired into Home. The whole path is now dev-buildable — it ties chain-provider ABI, custody chain, and capsule authorities together at the seam that finally exposes them as a product surface.
• Security deepens by tightening the plane, not adding features. A coordinated six-vector audit swarm closed T1–T6 (carrier plane locked read-only, DoS-bounded line reads, IPv4-mapped-IPv6 SSRF fixed, signature-downgrade forgery refused, no auto-redirect follow, charset guard), then a refactor pass single-sourced the SSRF/CRLF/path-traversal validators so the same guards run across every provider.
• Agent actions become provable. A full prover/verifier Intent-Proof Loop landed and mounted onto the Custody Inspector, a Standing-Grants gateway added issue/revoke/preview over a fail-closed store, the W2 consent path closed, and a per-capsule Spend Meter now bounds real spend across microVM, WASM, and carrier act paths.
• PC2 closes out and publishes. The 1.4.0 release deliberately held last cycle is now out — Elastos Node Manager as a service-type app, multi-arch packaging, stream-safe gzip — alongside the notarized ElastOS Launcher v1.4.0. Both close last week's "publish lands next cycle" commitment.

2. Runtime — 0.5 Consolidation onto flint-0.5

The single largest structural move this week. The 0.5 shell integration landed as a coordinated series of grafts — browser-vm native VM engine + session-proof contracts, home people/chat/wallet-surface reconciliation, browser app-gateway/wallet contracts, core authority/provider contract alignment, services registry + remote-exit flows, ops setup/install/reconciliation gates, and inspector approved-provider dispatch — a combined footprint on the order of ~85k insertions across 300+ files.

A restoration pass then took every subsystem that had a subtle drop during the merge and put it back: verified-signer tests, WASM/carrier act-path metering, owned-open windows + open-target sources, localhost body-token redaction, gate-preview schema + inbox-approval + fail-closed scope rules, capsule fail-closed boundary checks, macOS hardware-validation, full-gate verify pass on macOS, and a clippy -D warnings sweep across the workspace.

The consolidation PR itself (#12) landed 2026-07-03, and the zero-loss branch ledger is the audit trail — every branch, its disposition, and a delete-safety marker.

3. Runtime — Marketplace Capsule (Slices 1–5)

Shipped end-to-end in a single push (2026-07-03), following prep work over the prior weekend on feat/marketplace-runtime:

• Slice 1 — chain-provider (8d14230): KID → ledger-tokenId resolver + ABI/protocol ops. The chain identity is now translatable to a marketplace primary key.
• Slice 2 — buy/trade authorities (26abf3c): buy-invariant core + resale/withdraw calldata — the authority model that makes buy/resell fail-closed under the capsule model.
• Slice 3 — storefront capsule + API (2e8c3db): /api/market/* + content-index + storefront capsule + docs. The biggest single feat commit of the week (33 files, +7,790).
• Slice 4 — library Acquire (a2dd4af): the Acquire op (buy → pin) + open handoff. Purchase now leaves the user with a pinned item that opens through the standard capsule path.
• Slice 5 — Home wiring (b12528e): storefront wired into Home routing + dev build. End-to-end.

Complementary work: the creator capsule UI + media-provider + gateway creator route + marketplace contracts (4218c52, the producer side), the buy → download → open parity flow — acquire, vault, typed-folder placement + reveal/status fixes (33254f9, the consumer side), reserved market/object/operator-drive-adapter registry names with a manifest-scan invariant test (1fc2a14), and race-free epoch-kill + registered red-team findings from concurrent testing (dd7ec4b).

4. Runtime — MPEG-DASH / CENC Compliance + DKMS Hardening

Two ELACITY tickets landed 2026-07-02:

• 238e1e5 — ELACITY-2283 — MPEG-DASH / CENC compliance for media assets.
• 939e44a — ELACITY-2282 — DKMS quorum reliability + host-independent tests.
• 6798942 — hardening pass on both (DKMS lifecycle + CENC/socket safety from code review), plus CI verify-ci/verify-capsules recipes.

Follow-on: the DKMS protocol now rejects unknown fields on the Status/Shutdown variants outright (aligning with the fail-closed posture the rest of the runtime uses). During the 0.5 merge, two things the MPEG-DASH squash had dropped were measured back in — measured transcode-progress reporting and epoch-based operator termination (B2a). Docs crystallized the dKMS access model: the on-chain token is the gate, with no per-user allow-list.

5. Runtime — Security Audit Swarm (T1–T6 Closures)

A coordinated audit sweep on 2026-07-02 closed six vectors inside a short window, then a refactor pass single-sourced the shared validators:

• T1 — carrier auth plane locked read-only: unauthenticated provider_invoke restricted to read-only ops.
• DoS bound — bound line reads on the unauthenticated inbound + client response paths.
• T3 — SSRF via IPv4-mapped IPv6 blocked in exit/net providers.
• T4 — signature-downgrade forgery: verify_chain now refuses.
• T5 + T6 — no auto-redirect follow (T5) + carrier-operation charset guard (T6).
• Refactor — single-source the SSRF/CRLF/path-traversal validators, making T3/T5/T6 non-recurring by construction, and record the swarm + closures in the known-gaps registry.

Adjacent hardening: boot-critical CEK-escrow registration is now fail-loud (AUD-6), with the warn-swallow that hid it registered in KNOWN_GAPS; and the supervisor got two carrier-reliability fixes (dead-carrier reap via a pending-safe liveness probe; microVM carrier bridge/socket leaks). A live incident — an ElastOS home lockout — was also unbricked, with attached host sessions now carrying an honest identity.

6. Runtime — Intent-Proof Loop (ch1–5b) + Custody Inspector

A whole prover/verifier loop for agent actions, built in one long session and then mounted onto the Custody Inspector:

• Design — the intent-proof loop: a prover/verifier for agent actions.
• ch1 — the two signed records + fail-closed verifier matrix.
• ch2 — emit intent / denied / reconciled onto the signed audit chain.
• ch3 — derive the standing envelope from a real CapabilityToken.
• ch4 — run_intent_gate: the fail-closed enforcement orchestrator.
• ch5 — project the verdict as a third independent custody channel.
• ch5b — per-capsule intent-proof tally + AuditLog query (the live data), made presence-aware (absent ≠ falsely-clean).

Custody Inspector mount: one tested display contract for every shell (custodyDisplayRows) → mount the Custody panel → intent-proof custody channel live end-to-end. Additional custody plumbing: request_act intake fails closed on undeclared ops; inspect/self aligned to the live fail-closed self-tier; security-critical sub-providers pinned first-writer-wins; and 0.5 approved-provider dispatch grafted onto the inspector and made live on production registrations.

7. Runtime — Standing-Grants Gateway (2c-A/B/C)

Built end-to-end in a single session — six commits, one closed subsystem:

• fe9211f — StandingGrantStore: the fail-closed issue/revoke registry (the store).
• 19e3e9c — dispatch_standing_act: run a self-declared act through the gate (the dispatch).
• f30646b — end-to-end proof: a real token runs the agent, revocation shuts it down (the proof).
• 95f2f7b — StandingGrantService: the API-facing seam.
• e6609d3 — shell-only issue/revoke standing-grant HTTP verbs (the write verbs).
• c7b61a8 — read-only signed-intent preview verb — dry-run the gate (the read verb).

Docs pinned the standing-grant verbs (issue/revoke/preview) and stated the revocation semantics precisely (no over-claim).

8. Runtime — W2 Consent Path CLOSED + Per-Capsule Spend Meter

The W2 consent path closed as a coherent arc (steps 6–11): the grant reads the binding (the affordance-consent enforcement crux) → validate-and-consume endpoint + canonical consent identity → a ValidatedAffordanceGrant witness gates consent dispatch (compiler-enforced) → signed AffordanceGrantReceiptV1 + blocking audit → end-to-end affordance-consent journey + fail-closed branches → consent-path invariants pinned in the alignment gate (CLOSE W2). The gateway now returns a consent-request for gated affordances instead of a flat 403, and the consent-broker was named at its seam.

The per-capsule Spend Meter landed and wired metering across the three carrier act paths — microVM, WASM, and act-over-MCP — with provider-reported variable cost bounding real spend rather than call count. Projections expose a read-only BudgetSnapshot and a capsule live-budget view on the inspector, verified with a 7/7 spend+audit pass on a real nested-KVM act-emitter fixture.

9. PC2 — 1.4.0 Published (ENM, Multi-Arch, gzip) + ElastOS Launcher v1.4.0

The PC2 1.4.0 release that was deliberately held last cycle for a coordinated publish is now out (PRs #25/#19/#18, all merged 2026-06-26 just before last week's report cutoff):

• e469a2d — perf(server): gzip text responses with a stream-safe filter (skips SSE, range/206, already-encoded).
• 958071d — stage the production registry entry + flip procedure (playbook written).
• 5c9f4a5 — bump to 1.4.0 (ENM, multi-arch packaging, app-layer compression).
• f5b0562 — Merge PR Release v1.4.0 — Elastos Node Manager, multi-arch packaging, app-layer compression #25 (feature/elastos-node-manager) into main.

Alongside it, ElastOS Launcher v1.4.0 published — Apple-notarized and stapled, with a CI notarize step that now waits for Apple's verdict and fails on rejection, plus the first-run macOS fix (Command Line Tools are installed before the first git step, so a clean Mac no longer shows a false "Error" during setup).

On the ENM store flip: the production registry entry is now live on both supernodes (the staged flip playbook was executed this cycle). Elastos Node Manager installs and runs on nodes updated to 1.4.0 (x64/arm64 Linux, ≥4 GB RAM) — the catalog entry is a pointer, and the service depends on the 1.4.0 node code, so update via the install one-liner above to use it.

10. Protocol — ELA ↔ Base Bridge: Feasibility Locked, Design Complete

A focused feasibility + design pass on bridging ELA from the Elastos mainchain to Base landed this cycle. Verdict: buildable — no blockers. Every limitation surfaced has a concrete, production-proven fix.

• Trustless reads of Base. Council nodes can't afford to run Base full nodes, and trusting an RPC provider would let a lying server fake a burn and drain the vault. A source audit of Helios (the light client) found it only trusts the sequencer signature — L1 finality isn't wired in. Fix: a two-layer check in the relay daemon — Helios rejects dishonest RPCs instantly, and every withdrawal is re-verified against Base's finalized state root on Ethereum L1 before it is co-signed (the same technique used by Herodotus, Across, and OP-Stack itself). Cost: withdrawals settle in ~1 day; per-council-node hardware stays ~$0.
• Council rotation reaching Base. Base contracts must know the current 12 council members automatically, every election, with no coordination or special members. The mainchain already guarantees this better than hoped: NextTurnDPOSInfo is mandatory every rotation (blocks are invalid without it) and carries exactly the node keys Base needs. Five quirks (e.g., an unvalidated WorkingHeight; the 36-key confirm set differing from the 12-key council set) are all absorbed by contract-design rules — no mainnet code changes required.
• Reusing the bridge machinery. A source audit confirmed the Arbiter's 9-of-12 co-sign withdrawal engine reuses unchanged; the new work is a ~2,000-line Base driver plus ~100 lines of wiring — exactly as budgeted.
• Contract completeness. Further along than the docs implied: 58/60 tests passing, and the finality verifier has already validated a real mainnet Confirm through the real P-256 precompile on a Base fork. Remaining gaps: automatic rotation (executeRotation) and the governance module.
• Novelty risk. No one has bridged a DPoS chain to EVM using P-256 before — but the architecture is battle-tested Axelar / Gravity-Bridge, just on a different curve, and every target chain (Base, Arbitrum, Polygon, and now Ethereum L1) ships that curve's precompile natively.

Next step: build executeRotation and rehearse it against a real rotation transaction from our own testnet — the biggest remaining gap, and the one only we can test because we own the chain.

11. Infrastructure — Cost Optimization & Cloud Migration

A deliberate infrastructure right-sizing landed real, recurring savings this cycle — driven mostly by moving the public RPC stack off managed cloud onto the two-region bare-metal introduced last cycle, plus retiring services no longer needed.

• Retirements. ECO-chain services were terminated mid-June ($300/mo) and the AWS-hosted RPC services near month-end ($200/mo), bringing June's AWS bill to $4,503.66, down from May's $5,021.
• The big move. With RPCs now served entirely from self-hosted bare-metal (two-region), July's AWS bill drops to $2,789.15 — a ~$2,232/mo reduction on AWS alone.
• Net effect (incl. the new bare-metal boxes):

Line	May	June	July (projected)
AWS	$5,021.00	$4,503.66	$2,789.15
Bare-metal (Hetzner)	—	—	$392.00
Total / month	$5,021.00	~$4,503.66	$3,181.15

Next month's full infrastructure cost is $3,181.15/month — $1,839.85/month lower than May (~36.6%), even after adding the bare-metal servers that made the AWS cut possible.

The bigger picture. Monthly infrastructure ran ~$12,000/month before the current leadership arm took over operations — that figure is the true baseline for how far the stack has been optimized. At $3,181.15/month, that's an $8,818.85/month reduction (~73.5%) versus the pre-leadership run-rate, with more to come as the AWS exit continues. Recent months are the tail end of a sustained downward trend, not a one-off cut:

Reference point	Monthly cost	Reduction vs baseline
Pre-leadership baseline	~$12,000.00	—
May (AWS only)	$5,021.00	~58.2%
July (projected, AWS + bare-metal)	$3,181.15	~73.5%

• What's left. Standing the Elastos mainchain testnet back up is the last piece to complete the server set; after that, the plan is to migrate remaining Essentials services off AWS to cheaper/better providers (e.g., OVH).
• Testnet server. A separate single netcup box is stood up as a private internal test server for the upcoming Base ↔ ELA testnet (§10); whether one server suffices for public use will be known once Base ELA testing begins.

12. Hyper — Chat/Follow Capability Isolation + Security-Audit Fix Pass

Hyper-Android — the Hyper messaging/social/calls capsule built on the same runtime — had a strong assurance week, tightening the trust boundary between following someone and being able to message them:

• Hard follow/chat isolation — a follow now grants zero chat capability; chat is gated fail-closed with iOS parity, and deleting a chat revokes the chat capability (with BLOCK as the deliberate sever and soft-delete kept recoverable).
• Security-audit fix pass — media revocation, follow/chat UX isolation, and a DM key-merge alarm; followers self-heal duplicate records so an accept sticks across restart; and inbound messages are never hidden (any received DM surfaces and enables chat).
• Slimmer links — distinct binary-packed hyper:chat and hyper:follow schemes, ~30% smaller QR codes at the same security.

13. ElacityLabs.com — Product-Narrative Reframe & Agent-Ownership

ElacityLabsWeb reframed the public product story this cycle: the ElastOS / Exchange product section was rebuilt around an agent-ownership narrative, a merch-store surface was staged, and a large asset cleanup pruned orphaned marketing images, optimized the OG image, and refreshed the sitemap. (Automated X posting was paused pending a link fix.)

14. Strategic & Narrative Docs — Elacity Bible + FLINT_MASTER_STATUS

• Elacity Bible v1 (b419da2) — a unified narrative canon for Elacity, ElastOS, and Elacity Labs.
• FLINT_MASTER_STATUS (87e9f7c) — the consolidated goal: three tiers, merge-readiness, intent-proof ledger.
• Living roadmap (a013b42) — a single living map reconciling adoption wedges + ESP wedges (W0–W7), strategy, W2 status, and branch structure.
• PDR — ElastOS the Sovereign Computer (824a0e8) and a W2 consent-act-path approval-ready plan (083174f).
• A branching-strategy skill for the team's AI agents (Claude / Cursor / Codex), plus an honest tracking doc for the remaining UI/shell integration gaps.

15. Convergence Lens — PC2 ↔ Runtime

Concern	PC2 (pc2.net)	Runtime (elastos-runtime)
Release cadence	1.4.0 published + ENM store flip; then quiet	Massive integration cycle: flint-0.5 consolidation (PR #12)
Custody / trust plane	Fail-closed Ed25519 verify for service-type installs	Intent-Proof Loop ch1–5b + Custody Inspector mount
Capability / consent	Same-origin backend proxy, doubled-Authorization fix	W2 consent path CLOSED (6–11) + Standing-Grants gateway
Metering	ENM operator UI	Per-capsule Spend Meter across microVM / WASM / carrier
Security posture	Stream-safe gzip filter	6-vector audit swarm T1–T6 + validators single-sourced
Media path	(out of scope this cycle)	MPEG-DASH / CENC (ELACITY-2283) + DKMS quorum (ELACITY-2282)
Marketplace	ENM service registry live	Storefront capsule end-to-end (slices 1–5) + creator capsule

Both repos are moving on the same beat: PC2 crystallized ENM as a shipping service and this cycle closed out the release and flipped the store live; Runtime consolidated three parallel branches into a coherent 0.5 tree and raced the marketplace + security + intent-proof story onto a single custody surface. Both converge on the same picture — capsules whose authorities, consent, custody, and metering are all fail-closed and independently auditable.

16. Looking Ahead

• ENM post-flip smoke + fleet update. The store entry is live; watch installs land cleanly as nodes roll to 1.4.0, and keep the roll-back path (staged registry backups) ready.
• Marketplace slice 6+. Buyer/seller trust surfacing on Home — wire the Custody Inspector's intent-proof tally into storefront listings so buyers can see a seller's fail-closed record before Acquire.
• Close the "restore(x): lost in the 0.5 merge" list. Several targeted restorations landed; the zero-loss ledger tracks the remainder. Target: zero open restoration items by next weekly.
• Intent-Proof ch4b + remaining inspector channels — the two remaining channels in the loop.
• Extend the single-sourced validators to any provider not yet on the shared path, and run a second audit swarm against the freshly integrated 0.5 surfaces (People / Services / Browser-VM / WebRTC).
• DKMS follow-on — remove any lingering per-user allow-list vestiges now that the on-chain-token access model is documented.
• ELA ↔ Base bridge — build executeRotation. With feasibility locked (§10), the next step is the automatic council-rotation entrypoint, rehearsed against a real rotation transaction from our own testnet — the biggest remaining gap, and the one only we can test because we own the chain.
• Runtime v0.5.0 review → tag. review/0.5.0 is open; close the review and cut the tag (latest published Runtime tag is still v0.4.0).
• ElastOS Launcher universal macOS build — a PR is open switching the launcher to a single universal (Intel + Apple Silicon) binary with a CI arch assertion, for the next launcher tag.
• Finish the server set + continue the AWS exit (§11). Bring the Elastos mainchain testnet back up to complete the set, then migrate remaining Essentials services off AWS to cheaper/better providers (e.g., OVH); confirm the single netcup testnet box is sufficient once Base ELA testing begins.

17. Summary Statistics

Window (UTC): 2026-06-26T14:58:47Z (previous report #26 createdAt) → 2026-07-04 (~7 days).

Repository (active branch)	Commits	Insertions	Deletions
elastos-runtime — flint-0.5 (all-branch dedup)	177	~134,424*	~8,934
pc2.net — main (1.4.0 close-out)†	5	244	12
Hyper-Android	~17	1,168	112
ElacityLabsWeb	43	3,838	18,320‡

*Runtime insertions are dominated by the flint-0.5 consolidation (PR #12), which grafts ~85k lines of the 0.5 shell integration onto the tree; commit count + narrative are the truer effort signal.
†PC2's five 1.4.0 commits landed 2026-06-26, just before last week's report cutoff, and were deliberately held for a coordinated publish — reported here as this cycle's release news, not fresh code.
‡ElacityLabsWeb deletions are marketing-asset pruning (orphaned images / OG optimization), not regression.

• PRs merged in window: Runtime ElastOS Weekly Shipping Report — Week of Apr 18–25, 2026 #12 — Consolidate all branches into flint-0.5 (2026-07-03); PC2 Release v1.4.0 — Elastos Node Manager, multi-arch packaging, app-layer compression #25/Elastos Node Manager app (service-type app — requires #18) #19/Necessary PC2 changes for the Node Manager (service-type app support) #18 — Release v1.4.0 / ENM service-app / service-app support (2026-06-26).
• Releases / tags in window: PC2 v1.4.0 published; ElastOS Launcher v1.4.0 published (notarized). Runtime latest tag remains v0.4.0 (review/0.5.0 open, not yet tagged).
• Combined PC2 + Runtime: 182 commits, ~134,668 insertions, ~8,946 deletions.

18. Data-Quality & Off-Repo Notes

• Attribution. All work this cycle is reported as the Elacity team's output, without individual names. Commits authored under the name "Claude" are AI-pair-programmed under the team's direction and review — counted as real shipped work, attributed to the team.
• Windowing. Cutoff = the previous report's (#26) createdAt (2026-06-26T14:58:47Z). Counts are on the most active in-window branch per repo; cross-branch shared history is deduped by SHA. Runtime and PC2 stats were verified against live git/PR data this run; private-repo diffs were computed from base…head compares.
• Line-count caveats. Runtime totals include the large 0.5 consolidation graft and vendored/generated content; ElacityLabsWeb's large deletions are asset cleanup. Commit counts + narrative are the truer signal.
• ELA ↔ Base bridge (§10) is a feasibility + design R&D workstream reported from team context; its contract work (58/60 tests, P-256 finality verifier on a Base fork) lives outside the two repos measured in §17, so it carries no commit-count row.
• Infrastructure figures (§11) are operator-reported monthly cloud/bare-metal costs (AWS billing + provider invoices), not repo-derived; July's AWS line is a projection based on the completed RPC migration and service retirements. Rounded $300/$200 retirement figures and the ~$12,000 pre-leadership baseline are approximate anchors; the May/June/July totals are exact.
• Off-repo context (travel, conferences, ecosystem and partner conversations, founder presence) is summarized at a high level in §19 and may be expanded in a human pass before/after publish.

19. Architecture Alignment — Direction This Cycle

Beyond the code, the cycle sharpened the direction the team is building toward — and the week's work maps cleanly onto it:

• Capsules are the unit; the runtime is a small, frozen, audited secure messenger. Keep the core minimal and add capability through capsules, not by growing the runtime. This week's per-capsule Spend Meter (§8), the intent-proof custody channel (§6), and the marketplace shell capsule that holds no authority (§3) are this principle in code.
• The runtime is the single source of truth; shells are free to multiply. Different front-ends — classic desktop, agentic, Hyper — interoperate because they obey the same runtime, namespaces, capsules, and carrier. That is exactly why Hyper (§12) and the encapsulated Browser VM can be different surfaces on one engine.
• Fail-closed, independently auditable authority everywhere. Consent, custody, metering, and install-time verification all default to fail-closed and produce their own audit trail — the through-line across the W2 consent close, the Standing-Grants gateway, the Intent-Proof Loop, and PC2's service-type install verify.
• Own the stack, not the subscription. The cycle's public narrative work (§13, and a widely-shared piece on AI ownership and sovereignty) reinforces the thesis the whole architecture serves: a computer you own, data that stays capital rather than training fuel, and keys/identity no policy can revoke.
• Ship a few things that truly work, then beta, then audit. A handful of real end-to-end capsules — supernode/BPoS (ENM), marketplace, media, Hyper — running daily, with community beta for momentum and external auditing before a "safe and finished" release.

Off-Repo — Ecosystem & Travel

The team was on the ground at the AI Engineer World's Fair in San Francisco this week (engineering track), and it doubled as both a networking and a learning trip:

• Networking. Conversations ran the full width of the field — from grassroots and local-AI builders through to people working at the major frontier labs, plus a notable amount of energy around robotics and edge/on-device compute. The recurring thread most relevant to us: the personal-compute → IoT / robotics peer-to-peer link — validating ElastOS runtime + Carrier as an edge-to-edge networking layer for real devices (screens, DePIN boxes, small chips / dongles), blockchain-optional. That's a commercial direction worth pursuing over the coming months.
• Learning. The Local-AI track — running your own models, on-device inference, privacy, sovereignty, full control — was one of the busiest rooms at the fair, a visible shift from a fringe interest two years ago to a first-class agenda item now. It's direct external validation of the "own the stack, not the subscription" thesis the architecture is built to serve: as access to frontier models becomes something a policy memo can gate or revoke, the durable capability is the one running on hardware you control, with data and keys that stay yours.

---

Cadence: weekly updates. Previous report — Week of June 19 – June 26, 2026 (#26).