Repository navigation
Compose Executor v0.14.40 adds fixed, bounded Catalog inspect/finalize IPC through the existing parser, converter, service factory and hash owners. Delegated launch uses an event-local proof client bound to the exact Stack, while control replies and ordinary CLI/UI execution retain their existing channels. Missing or invalid delegated proof cannot fall back to the launcher Full Key.
Original qualified Go 1.27.3 CI bytes are published without recompilation. Producer/tag target: 1835f8d. Normal PR12 squash merge: 59ce37e. Both share tree 72c0f24d6cce736897bfeb04c2c4bc859baf3afd. The numeric tag is SSH signed. Original gzip SHA-256: fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732.
Official Security40944914789, Builder security40944925295, CodeQL verification40944914785 and CodeQL40944917345, including the final no-new-alert aggregator, passed. Source/product raw and effective reports, actual builder pip proof, SBOMs and a qualification manifest are attached. The evidence bundle preserves the222 exact new Medium header findings against Canonical snapshot90bee5d308a23c63efd692d59fb39e5f05dfdb61, their official raw records, and the official integration setuptools84.1.0 fix evidence. Header-only proof is not a host-kernel claim. The fixed pip wheel and Go dependencies remain unchanged; unknown/full distributions do not inherit the vendor-slice VEX. Earlier failed qualification runs remain recorded.
The matching B3 Engine must enforce the private Catalog proxy boundary, original live actor/Key read+create+update ceiling, private encrypted inputs, human confirmation, exact child graph/ledger and normal deployment readiness. Existing Engine358/Server558 do not provide this B3 integration. Legacy compatibility tests do not establish the new delegated runtime. Unsupported typed graphs remain partial; matching runtime/browser/role/weak-model acceptance is pending. No deployment is performed by this release.