L1ght5p33d v0.2.0 - on-demand workflow companion

L1ght5p33d now connects on-demand workflow downloads, a local approval page, and deterministic execution through OpenAdapt Flow. The AI can find a reviewed workflow, supply inputs, and hand it to the user without controlling every click.

• THEBEST curator signatures, exact artifact hashes, schemas, review consistency, and expiry are checked before use.
• Downloaded workflows expire after 90 days without execution by default; --cache-retention-days accepts 1-3650 days. Active, pinned, modified, and untracked content is protected. Authored copies and receipts remain outside eviction.
• Approval starts with a summary. Full steps, input editing, and an editable local workflow copy are available on demand. Changes invalidate approval; original signed bytes are preserved.
• l1ght5p33d try opens the guided synthetic poster trial. The page reports verified completion, interrupted work, or failure without requiring terminal monitoring.
• MCP adds search_curated_workflows, prepare_task, get_task_status, and get_cache_status. Missing packs are fetched automatically; valid cached packs work without another download.

Installation

Install Python 3.12, extract l1ght5p33d-0.2.0-windows-developer-preview.zip, open PowerShell in the extracted folder, and run:

.\scripts\install-l1ght5p33d.ps1
.\packages\l1ght5p33d\.venv\Scripts\python.exe -X utf8 -m l1ght5p33d try

The ZIP installer uses the committed dependency lock and installs Chromium. The wheel and sdist are also included; nothing has been published to PyPI. See the companion guide for MCP and retention configuration. The v0.1.0 tag and assets remain unchanged.

Validation

• Windows 11 development host: 348 passed, 1 interactive Windows test skipped; formatting, lint, Windows/Linux type checks passed.
• GitHub Ubuntu: 347 passed, 2 skipped; PHP integration, browser fixtures, isolated Kubo transfer, dependency/license/secret scans, archive inspection, and fresh-wheel checks passed.
• GitHub Windows: 348 passed, 1 skipped; all lint/type, fixture, isolated Kubo, dependency/license/secret, package-boundary, and fresh-wheel gates passed.
• Fresh Python 3.12 environment: 55 compatible distributions installed from locked constraints, wheel import and version checked, all three browser fixture actions verified.
• Local dependency audit found no known vulnerabilities; all 92 installed distribution licenses passed policy. Gitleaks found no secrets in downstream history, current source, and built archives; no new exceptions were added.
• Actual public GitHub pack download and signature verification succeeded in the installed companion. Preparing or opening its review page executed no workflow actions.

CI: https://github.com/HiTecHelpLLC/l1ght5p33d/actions/runs/33817950286

Scope and limits

This is a developer preview. The public curated library currently contains one synthetic browser workflow. Live authenticated BandLab importing, native Windows foreground-input qualification, and a second physical Windows 11 installation remain pending. The bundled BandLab sequence is tested against a local fixture. Hosted Ubuntu checks do not certify native Linux desktop or WSL GUI automation.

The existing curator attestation describes its specific earlier Windows 11 test/runtime; it is distinct from this release's tests and from user permission. The review URL is a short-lived capability, not cryptographic proof of human presence: cooperating AI clients must leave the approval click to the user. An unrestricted process under the same OS account is outside the isolation boundary.

THEBEST's website and public P2P register are not deployed. The connected curated source is GitHub. Advanced native catalog/Kubo imports remain outside the managed curated cache. No provider/code is installed by a workflow download, and routine execution makes no model calls.

MIT-licensed history-preserving extension of OpenAdapt Flow; reuses Playwright, pywinauto, MCP, cryptography, and MIDI libraries. Unofficial and unaffiliated with BandLab, Suno, or other automated applications. Artifact integrity hashes are in SHA256SUMS.txt.