v0.0.4-alpha

The fourth release, and the one where nothing new is offered. No closed set opens, no artefact gains a
key, and no Run behaves differently once it has started. What moves is three checks that decline where
they used to pass, one Journal member that was specified and never written, and one marker reaching
the surface that ranges over the Journal.

go install github.com/TheLoomLabs/hyper/cmd/hyper@v0.0.4-alpha

Upgrading from v0.0.3-alpha

Install the new binary, run hyper project, read the diff. project rewrites the version pin and the
release digest, both land in a file you review, and nothing else on the machine changes. Until you do,
every command Refuses version-pin-mismatch at exit 77 — the gate compares the pinned version
against the binary's for exact equality, and that is working as intended.

Read the three breaking changes below before you upgrade a repository that runs. All three are
static, and a Run re-runs check in full at its start (§6) — so an artefact that checked clean under
v0.0.3-alpha and now does not is a Refusal at exit 77 before Step 1 rather than a surprise
mid-Run. None of them changes what a Run does once it passes.

hyper project also rewrites AGENTS.md, and the orientation an agent reads gained two sentences.
They are under Added.

Breaking

• A request's method: is a literal. An http: block's method: admits no template hole. A hole
  there is hole-illegal at the position rather than at the source — the name inside it is never read
  — which puts method: beside an Auth scheme's parameters as the second of §12's two positions where
  a hole is refused outright. It follows that method: reaches no Operation input, so an input named
  only in a hole there is now manifest-inconsistent like any other input nothing reaches: a
  Manifest that declared an input and spent it on the verb draws two rows where it used to draw none.
  (#279, ADR-0155)
• A method: that is not an HTTP token is refused where it is written. It is one HTTP token —
  RFC 9110's 1*tchar — and a literal that is not one is manifest-inconsistent at
  <op>.http.method. The grammar is the line and the registry is not: a verb no registry names,
  and a verb written in lower case, both still check clean. What fails is a value with a space, a
  slash, a newline or an empty string in it — the shapes that would have gone out on the wire as
  something other than a method. (#285, ADR-0156)
• A Bound is a positive count. A bound: below 1 is refused where it is written:
  bound-not-positive, reported at steps[N].bound on every Step whose Kind admits a Bound at all.
  The zero and the negatives are one code. 1 is the strictest Bound there is, and what this buys is
  that a Journal entry's absent Bound now means this Step declared none and nothing else — it
  could previously have meant a declared zero. (#287,
  ADR-0158)

error_code goes from fifty-three members to fifty-four, gaining bound-not-positive. The set is
closed and a consumer matches on it, so the count is stated here rather than left to be discovered.

Added

• runs says which rows were rehearsals. Every row carries dry_run, read off the Journal entry
  the row is, written always — the bare false included. That is §7's one exception to the absence
  rule, and it is here because this is the one surface where the entry cannot be missing, so a boolean
  is a fact rather than a silence. On the page it is a REHEARSAL column carrying yes where there is
  something to say and nothing where there is not, which is show's reading of the same marker and
  records'. For a consumer: dry_run is a new required member of every runs row, and §9's
  enumeration of what a row carries stays at seven facts — the marker rides on the row as the contest
  does. --outcome still selects a rehearsal on the outcome it has.
  (#289, ADR-0160)
• The orientation says a destroy is how a record is closed, and a 404 is not a reason to withhold
  it. The sentence an agent read named the exception and stopped — an effectful Operation completes
  on 2xx and halts on everything else, a destroy completing on 404 besides — which is true and
  reads as a leniency. A sealed session read it exactly that way: it checked a ref, met the 404, and
  narrowed its destroy away from that Asset, handing back a Store whose Head read alive for a
  resource the world no longer held. A destroy Step writes the Tombstone and nothing else does, so
  there is no second route. The clause now states what the rule is for — retire against what the
  record says you hold, not only against what the world still answers for — and that a check the
  operator has already made is no reason to withhold the Step, the check and the call being two calls
  with nothing holding the world still between them. Nothing about the product changed; this is text.
  (#290, ADR-0161)

Fixed

• A Step records the Bound its Expansion was counted against. §7 says a Disposition carries one,
  §7's worked Step file shows "bound": 5, §9 lists it among what show --expansion carries,
  internal/store declared the member — and no Run had ever written one, because the only place a
  Step's selector is built used two of the type's three members. show rendered a BOUND line it had
  been handed a zero for, every time. The guardrail was never affected: the Expansion was counted
  and bound-exceeded Refused exactly as specified, and check read the authored list's length
  offline. What was missing was the record — an entry read after the artefact had moved could not say
  what that Run's Expansion had been held to. The fix reads the Bound with the same reading the
  guardrail uses, two readings of one bound: being able to disagree about what a Step declared. On
  the wire the member's schema moves from minimum: 0 to minimum: 1, which is the breaking change
  above seen from the Journal's side. A bound: on a Step with no over: still records nothing:
  §7 attaches what was counted to what it was counted over, and a guardrail with no Expansion beneath
  it was counted against nothing. (#286)

Documentation

• The process by which the closed sets grow is no longer undecided. ADR-0004 closed the Capability
  set at two and left the process by which the closed set grows without becoming an open one by
  attrition unowned; §12 and §13 both advertised the hole. ADR-0157
  owns it with an admission sentence — a Capability is an effect hyper performs with a credential
  it already has a position for — five criteria as its application, and four candidates assessed as
  its first use. file is recorded as kept on file rather than refused forever.
  (#281)
• A cluster is authorable today, and now the corpus says so.
  docs/research/worked-example-immutable-cluster.md
  provisions one end to end with no new Capability, no new artefact key and no code — provisioned
  configured rather than configured after provisioning — and is frozen at the commit it was written
  against. (#282,
  #283)
• §13 states what a machine's inside costs, and CONTEXT.md's Asset stops overclaiming: what an
  Opaque Operation's effect reached is the command and nothing past it, so the accountability is for
  the process hyper ran and never for the service it started.
  (#284)
• The acceptance seal covers /tmp. Two sealed runs of 2026-09-09 could reach a second hyper at
  the pinned version and ten kilobytes of docs/spec/ under the scratchpad directory an attended
  session is handed. Neither read any of it, and no transcript is in doubt; what was false was the
  claim the harness made about itself. /tmp is a tmpfs in the seal now, with nothing bound back, and
  the assertion was widened with the cover.
  (#292, ADR-0163) That is about how this project
  measures itself and changes nothing you install.
• docs/adr/ holds 163 records.

What is in the release

Four archives — x86_64-linux, aarch64-linux, x86_64-darwin, aarch64-darwin — each holding one
file, hyper, plus checksums.txt, which is sha256sum's own output over all four. There is no
Windows build.

Nobody signed or notarised the macOS archives. Run the binary from a shell and it runs; a copy
downloaded in a browser carries the quarantine attribute the browser set, and Finder will refuse to
open it and offer Move to Trash. That is the attribute, not a verdict on the bytes.

hyper is alpha. It has one built-in Provider, shell, it never updates itself, and the
specification in docs/spec/ is the
authority where the code disagrees with it.

v0.0.3-alpha

The third release, and the one where a Secret sink is written rather than promised.

v0.0.2-alpha accepted --secret-out <path>, performed the Step, wrote the declared-secret field
to the Store as the constant marker, and discarded the value at exit 0. Nothing leaked; the
failure mode was loss, and every guarantee held while the only thing the operator invoked for did
not happen. This release writes the file — and, on the way, decided what the file is.

go install github.com/TheLoomLabs/hyper/cmd/hyper@v0.0.3-alpha

Upgrading from v0.0.2-alpha

Install the new binary, run hyper project, read the diff. project rewrites the version pin and
the release digest, both land in a file you review, and nothing else on the machine changes. Until
you do, every command Refuses version-pin-mismatch at exit 77 — the gate compares the pinned
version against the binary's for exact equality, and that is working as intended.

Read the four breaking changes below before you upgrade a repository that runs. Two of them can
turn a Run that completed into a Refusal, one changes what a shell mutate puts in the Store, and
one renames a member on two wires.

Breaking

• An effectful shell Operation records that it ran and not what it printed. The built-in
  shell Provider's mutate, mutate_once and mutate_skip_if_recorded now project exit_code
  and nothing else; read still projects stdout and stderr beside it. A shell mutate's Record
  is an Asset and Compaction never removes one, so a command that printed a credential put it in the
  Store permanently — and shell is the Opaque Capability, where hyper authored the Manifest and
  knows nothing whatever about the command. An exit code is a fact about the call hyper owns.
  Breaking for a Procedure whose require: predicates on an effectful Step's stdout: the path
  now resolves to nothing and the predicate has no root. Reach for a read Step beside the mutate.
  For a credential a command printed before this, rotation is still the only remedy that is one.
  (ADR-0143)
• An empty credential is its own Refusal, on both surfaces. export HCLOUD_TOKEN='' passed the
  §6 gate: the header was composed present and blank, the endpoint answered 401, and that landed as
  failure at 1 — the world resisting — where the invocation was never ready. On an effectful
  Procedure the Steps before the first authenticated one had already run. A credential is now read
  under a closed three: absent Refuses credential-absent, empty Refuses credential-empty,
  set resolves. On both wires present (boolean) becomes presence (the three words) —
  renamed rather than re-typed, so a client written against the boolean finds no member rather than
  reading "absent" as true. (#264, ADR-0145)
• A Run that cannot write a secret Refuses instead of losing it, and --secret-out is a
  directory. <sink>/<nnnn>/<name>/<field>, 0600 under a 0700 directory, holding the value's
  own bytes and nothing hyper added. One Run produces more than one secret in three independent
  ways — two secret-producing Steps in one Procedure, one Step that expands, an Operation declaring
  two secret: fields — so the addressable thing is the triple Step, Record, field, and the shape
  that expresses it with no key to design and no parser to run is the filesystem's. The path must
  not already exist: hyper makes it, which is what puts the mode in hyper's hands and what
  stops an earlier Run's file being read as this one's. Two Refusals guard it, both at Run start and
  both 77: secret-sink-absent, no sink named where a Step declares secret output, and
  secret-sink-unfilled, a sink named that nothing in the Procedure can fill.
  (#266,
  #270,
  #275, ADR-0146, ADR-0148, ADR-0151)
• check refuses a record: fields: value that is not a scalar. §3 has said those values stay
  uniformly scalar since it was written — which is what keeps a mapping there meaning a reference and
  nothing else — and nothing held it: fields: is Open, so the schema declined to have an opinion,
  and the projection reader drops what it cannot read because judging a Manifest is check's work
  and never a reader's. A Manifest that checked clean under v0.0.2-alpha can now fail, under
  schema-mismatch at that field's own position. It is the spelling that cost a sealed session two
  live credentials: {path: $.body.token, secret: true} reads as a marking and is dropped by the
  projection, and the message names where the declaration actually goes.
  (#275, ADR-0151)

error_code goes from fifty-one members to fifty-three, gaining credential-empty and
secret-sink-unfilled. The set is closed and a consumer matches on it, so the count is stated here
rather than left to be discovered.

Added

• secret: is named on every surface that renders an Operation. Four rendered one and none named
  the key it declares secret output under — a gap measured rather than guessed: a sealed session that
  had to author one got the spelling wrong and spent thirteen Bash calls finding it, eight of them
  strings and nm over bin/hyper, which is a user's own reading of a tool that ships no
  specification on their machine. provider's summary gains a clause, operation's derived block
  gains secret_fields, review marks the Operation's key line and indexes it under a SECRET
  flag, and the orientation hyper project writes states where the key goes and where it does not.
  The next sealed run authored it correctly at its twenty-first call and went looking nowhere.
  (#276, ADR-0152, ADR-0153)
• A Target declaration may withhold a variable hyper has no position for. hyper removes a
  credential from a shell child's environment by the position it occupies — a declaration's
  credential slot — so a secret the repository never named passes to any command and appears on no
  surface. The process environment is the interface every secret manager speaks, so wrapping the
  invocation is the vault integration hyper has, and op run -- hyper run leaves the wrapper's own
  token beside the one it fetched — strictly more powerful than the credential it was there to
  produce. withhold: is a list of plain variable names; the set a child is denied is the union over
  every declaration in the repository of the slots and the withhold: entries. It grants nothing,
  which is what makes it cheap. (ADR-0144)
• A skipped member's absent secret is a line in the Run's report. A skip-if-recorded Step whose
  member the Store already holds concludes without a call, produces no value, and so leaves nothing
  in the sink for that member. check gains no member for the combination — the rule would refuse a
  Manifest that works, and mint a credential only where we hold no record of one is a thing an
  author means — so the Run says it instead, per member, where a Step that skipped two and called for
  one would otherwise render ran and be byte-identical to a Step that wrote all three.
  (#273, ADR-0150)

Fixed

• probe no longer renders a declared-secret field. ADR-0017 argued the wire is visible from the
  request — a Probe is read Kind against local, holds no credential and writes no Record — and a
  secret: field is a second position that arrives in the response. It reached the FIELD/VALUE
  table and probe_result.response: a terminal, an Actions log, and the tool result an agent reads
  back. The projection now carries the constant marker in each declared position, which is the
  suppression a Run already makes on the way to the Store, and the response object is withheld whole
  rather than blanked at the positions secret: names. (ADR-0142)
• OperationInfo answers declares secret output once. Three members carried the fact, two
  callers read different ones, and a comment named the wrong one as canonical. One member answers it
  now and the reading is derived. Visible only in this: a secret: item that is not a name no longer
  draws cadence-secret-output beside the schema-mismatch it earns — a declaration the walk could
  not read states nothing. (#278, ADR-0154)

Documentation

• The README carries every command with its flags, and the MCP server wired the way it actually
  goes in.
• SECURITY.md says what the vault integration is: the process environment, and a wrapper around
  the invocation — which is what withhold: above exists to make safe.
• §9's two-member Refusal example renders what hyper prints, and neither §9 nor the run tool's
  schema describes a 0600 write that nothing performed.
• docs/adr/ holds 154 records.

What is in the release

Four archives — x86_64-linux, aarch64-linux, x86_64-darwin, aarch64-darwin — each holding
one file, hyper, plus checksums.txt, which is sha256sum's own output over all four. There is
no Windows build.

Nobody signed or notarised the macOS archives. Run the binary from a shell and it runs; a copy
downloaded in a browser carries the quarantine attribute the browser set, and Finder will refuse to
open it and offer Move to Trash. That is the attribute, not a verdict on the bytes.

hyper is alpha. It has one built-in Provider, shell, it never updates itself, and the
specification in docs/spec/ is the
authority where the code disagrees with it.

v0.0.2-alpha

The second release, and the first one you can install without a linker flag.

v0.0.1-alpha read its version from -ldflags and nothing else, so
go install github.com/TheLoomLabs/hyper/cmd/hyper@v0.0.1-alpha produced a binary reporting
hyper unknown that Refused every repository it was pointed at. From this release the flag is
optional, and the plain command works:

go install github.com/TheLoomLabs/hyper/cmd/hyper@v0.0.2-alpha

Upgrading from v0.0.1-alpha

Install the new binary, run hyper project, read the diff. project rewrites the version pin
and the release digest, both land in a file you review, and nothing else on the machine changes.
Until you do, every command Refuses version-pin-mismatch at exit 77 — the gate compares the
pinned version against the binary's for exact equality, and that is working as intended.

Fixed

• A build with no -ldflags reports the version the toolchain recorded rather than
  unknown. Go has been carrying the module version in debug.ReadBuildInfo all along and
  hyper was walking past it. The flag still wins wherever it is given, so nothing about a
  release's own archives changes. A build from an edited tree still reports +dirty and a build
  from an untagged commit still reports a pseudo-version, and both still Refuse the pin gate —
  what changed is which builds have an answer, not what the pin accepts.
  (#263, ADR-0138)
• Every archive in this release is stamped from a clean tree. scripts/release.sh built one
  platform and archived it before building the next, and because Go reads vcs.modified from
  git status in the module root, the first tarball landing in the checkout made every build
  after it dirty. Three of v0.0.1-alpha's four archives report commit …-dirty from a clean
  release. All four of this one report false.
  (#261, ADR-0136)
• A destroy over several Records records what each of them answered. answered held one
  value per Step, so a 204 then a 404 and a 404 then a 204 left byte-identical Stores, and
  a 404 then a 500 left a Tombstone whose 404 had been overwritten. It is now a list, one
  entry per member that was not answered the ordinary way, each naming its member.
  (#252)
• A failed Comparison no longer publishes an empty fence on a green job. The projected
  workflow's step took tee's exit status rather than hyper's, so a Comparison that did not
  render could not fail and left two backtick lines with nothing between them. The step now reads
  ${PIPESTATUS[0]} and writes one line naming the Comparison that did not render and its code.
  A Run that reached the world is not reddened by a rendering produced afterwards.
  (#259)
• The projected job's deepen step no longer fetches the Store's whole history on every Run.
  A bare git fetch --unshallow inherits the runner's wildcard refspec and took the Store branch
  complete each time — the exact cost fetch-depth: 0 was declined to avoid. It names one ref
  now, which stops the wildcard and still deepens the code branch.
  (#258, ADR-0134)
• release-artefact-absent no longer asserts what it could not establish. The Refusal named
  two remedies — publish a release, or install a released hyper — and both are false against a
  release that is published but private, which answers 404 exactly as an absent one does. The
  remedy now turns on whether the checksums file was read at all, and where nothing arrived it
  names the third possibility rather than resolving it.
  (#254)

Added

• The Cadence gloss says when a repeating minute is a promise the executor drops. A fixture
  declaring */5 * * * * was watched for twenty-five hours and delivered 2.5% of what it
  declared, sustained across eighteen hours with no recovery and clustering across four
  independently-scheduled files. review, check and project now render a third fact wherever
  a Cadence's minute field selects more than one value.
  (#260, ADR-0139)
• A require: rooted at a Step that produced several Records is asked of all of them, and
  the halt says how many the root held and how many satisfied the test. That was always the
  reading; §3 states it now, and the halt is where an author who meant one Record can see that
  they wrote the population read.
  (#251)

Documentation

• The README is half the length, leads with what hyper is and how to install it, and hands
  the rest off by name. Install detail — checksums, macOS, source builds, and the three version-pin
  Refusals — is docs/install.md.
• docs/adr/ has an index. 141 records with a dozen marked as the way in, held complete by a
  case rather than by a count somebody remembered to update.
• Release notes are now written into the repository and published from it, which is what you are
  reading. ADR-0141.

What is in the release

Four archives — x86_64-linux, aarch64-linux, x86_64-darwin, aarch64-darwin — each holding
one file, hyper, plus checksums.txt, which is sha256sum's own output over all four. There is
no Windows build.

Nobody signed or notarised the macOS archives. Run the binary from a shell and it runs; a
copy downloaded in a browser carries the quarantine attribute the browser set, and Finder will
refuse to open it and offer Move to Trash. That is the attribute, not a verdict on the bytes.

hyper is alpha. It has one built-in Provider, shell, it never updates itself, and the
specification in docs/spec/ is the
authority where the code disagrees with it.

v0.0.1-alpha

Full Changelog: https://github.com/TheLoomLabs/hyper/commits/v0.0.1-alpha