runner v0.26.0-alpha.2

v0.26.0-alpha.2

Runner v0.26.0-alpha.2 adds the explicitly selected retained-column/1
Base consumer for Agent v0.11. It uses the published Spec v0.3.0-rc.2
contract at bcac15b7537ce21879201b5e5dfe795496225121. The Spec's maturity
remains draft. This prerelease does not change ordinary Runner input routes
or claim Extended Runner support.

Selected retained columns

Authenticated retained-column routes require an exact installed contract selector
before reading the request body. The selector remains bound through preparation,
release/run persistence, restart and offline verification. It cannot install a
new trusted profile, producer, expected Spec identity or signing authority.

All five conversions and eight research types retain their original raw values,
complete original declaration inventory and provenance. Base limits apply to
complete artifacts; lower trusted capability limits remain effective. Existing
independent depth, numeric, count and binding-document bounds remain in force.
Converted basis pointers are distinct and sorted; selected lineage follows the
contract's fact-then-evidence order. Generated frames in CASE context refuse.

The selected route additionally admits Runtime's existing Core 0.3.0 Base
evaluator. Selected and ordinary 0.2.0-draft remain supported. Evaluation and
replay must report the evaluator version from the same retained release pack;
unknown or mismatched reports refuse. Manual and workflow paths are unchanged.
See the contract and transport details.

Offline verify-preparation --capabilities now declares interface version 2 and
report capability version 2 for the explicit selected contract and its additional
selection/profile refusal codes. Discovery remains a sole-flag operation. Ordinary
verification bounds, report members, exit statuses and canonical findings remain
unchanged; selected verification requires an exact --conversion-contract.

Operator and producer scope

Use an explicitly compatible Runtime and separately approved producer profile
for selected generated inputs. Ordinary inputs keep their existing configuration.
The usual upgrade backup and workspace care in
State and backups still applies.

The selected consumer checks original snapshot/frame consistency, the exact
producer tuple, signature, request commitment and freshness. The future Desk
adapter must independently implement original-history inventory validation and
its grant/stdout bounds. Runner's signed test producer and preparation-only
synthetic corpus do not establish that Desk cutover or producer compliance.

Validation and publication gates

Selected interoperability uses published Runtime
v0.39.0-alpha.2,
commit 57c854abb9ace8a91013a75ab688bd70d063797c. CI pins this companion
separately from historical ordinary and earlier Runtimes, and requires both
selected Core 0.2 and Core 0.3 lifecycle tests to run and pass. These tests cover
SQLite first-save/restart, signed preparation binding, exports 2/3/4/5 and offline replay.
Published synthetic fixtures cover their applicable conversion, capability,
producer-consistency and preparation owners; partial synthetic exports do not
establish full release/chain/sidecar authenticity.

Release qualification requires the stable Runner checklist, exact-head CI and
independent review. Tag-time evidence, archive smoke, checksums, attestations and
publication verification follow the release procedure.
No Windows archive is released.

CI budget correction and release status

The Runner CI jobs now have a bounded 60-minute execution budget. The sequential
unit check keeps its existing 3000-second aggregate limit, and every race-test
invocation keeps Go's default 600-second package timeout. Test selections,
40 MiB boundary fixtures, refusal assertions and release evidence requirements
are unchanged. The larger outer budget provides headroom for the observed
sequential workload; it does not guarantee execution time.

The signed annotated v0.26.0-alpha.1 tag remains unchanged and has no published
release. Its release attempt refused CI evidence because the Linux runner
identity differed; the fresh main CI attempt then reached the macOS job's
25-minute execution limit before completing its checks and evidence capture.
The cancellation establishes the outer timeout; it does not diagnose a product failure.
This correction requires a new version and tag; v0.26.0-alpha.1 is not moved or reused.

Publication of v0.26.0-alpha.2 requires independent review and
complete exact-commit main CI evidence from one successful attempt, followed by
the normal tag-time evidence admission, archive and publication gates. Earlier
green jobs and jobs from different attempts cannot be combined to qualify it.