DS Agent v1.3.0

DS Agent v1.3.0 publishes Step 3 exact-task grouped authorization from exact main commit 4eab7f90dba81bbc70ad7076b6e42186f1383121.

Exact-task authorization

• A normal queued chat task may carry a bounded descriptive capability proposal; only the local Kernel validates/freezes the same Goal and derives the manifest, risk, and preview.
• The matching chat message displays one Kernel-derived authorization card for that exact task.
• Approve, reject, and revoke bind the exact task, group, projection, manifest, preview, revision, fingerprint, hash, expiry, scope, and target; per-capability audit remains durable.
• Approval creates exact authority only. It does not execute a Tool, resume a task, create an external effect, or mark the Goal complete.
• Malformed, stale, cross-task, scope/target-changed, expired, rejected, revoked, tampered, secret/path/provider-reference/claim/token input fails closed.

This release does not add automatic task execution/resume, an Office golden path, connector or Computer Use expansion, background external writes, or production account access.

Reproducible Windows package

The previous independent builds were blocked because GNU COFF symbol/string tables embedded target-specific temporary paths, PE headers contained build timestamps, and NSIS stored payload mtimes. v1.3.0 strips the target-path-bearing symbol table, omits linker PE timestamps, and excludes variable payload mtimes from NSIS.

Two final fresh, distinct CARGO_TARGET_DIR builds were byte-identical:

• ds-agent.exe: 34,253,824 bytes
• application SHA-256: 342C0DABDB9AD3401496E8F7A11D63841CECD604AADBC3B18CAE5EDC3AE997AA
• DS.Agent_1.3.0_x64-setup.exe: 11,323,811 bytes
• installer SHA-256: 7EB672A7AE1030AF992A84169FED696636FAB46AEA3CEB4EC96A37FDF9EA27ED

Verification

• PR: #13
• exact-head CI: https://github.com/Lee-take/dsagent/actions/runs/29692206206
• exact-main CI: https://github.com/Lee-take/dsagent/actions/runs/29692666798
• exact main/tag target: 4eab7f90dba81bbc70ad7076b6e42186f1383121
• full local release gates passed, including 957 discovered Rust tests (950 passed, 7 documented live/installed prerequisite tests ignored), frontend production build, release-source, offline release-local, formatting, secret/source/binary checks, and two independent NSIS builds

Unsigned release

Both the application executable and installer are intentionally Authenticode NotSigned; there is no signer. Windows may show Unknown publisher or Microsoft Defender SmartScreen. Download only over HTTPS from this Release and verify the exact byte size and SHA-256 above before running it.

The SignPath Foundation application remains submitted and approval is pending. This Release is not represented as signed or SignPath-approved. If signing becomes available later, it begins with a subsequent new version and does not replace this immutable tag, Release, or asset.

No real API key, production account, paid API, production tenant, installed DS Agent overwrite, or external target was used in release verification.