v0.1.0-alpha.3

AgentOS v0.1.0-alpha.3

A correctness and containment release. Unlike alpha.2, which touched only
supply-chain metadata, this one changes runtime behaviour: agent ids no longer
reach the filesystem unfiltered, trace and vault writes are durable, and the
plugin sandbox now has a committed test suite proving its boundaries hold.

Security

• Agent ids can no longer steer a write outside the data directory. Ids
  flow into persistence, and trace_path built its path by interpolating the
  id straight into data_dir/traces/{id}.json. An id containing ../ walked
  out of the data dir. Both journal_path and trace_path now flatten
  anything outside [A-Za-z0-9_-] to _, which is sound precisely because an
  id is an opaque label — nothing meaningful is lost by collapsing separators
  that were never part of the identity. AgentId carries a doc comment saying
  it is deliberately not a path, and recording the one trap for later: if ids
  ever need real structure, the flattening has to be replaced by
  canonicalise-then-contain, not widened in place, or distinct ids silently
  collapse onto one file. (#111)

• Four expression injections removed from the workflows, and the class is now
  audited automatically. ${{ ... }} is substituted into a run: body as
  text before bash parses it, so values that looked like variables were program
  text. All four now pass through env:. A workflow-audit job re-checks this on
  every change so the fix does not decay. (#97)

• The unauthenticated-bind guard has a regression test. The guard that stops
  the runtime binding a non-loopback address without authentication was
  previously only exercised by hand. (#114)

Correctness

• Trace and vault writes are closed and flushed. Both wrote through handles
  that were dropped without an explicit flush, so a process exiting promptly
  after a write could lose it. Data that exists to be replayed later is
  worthless if it is not on disk. (#120)

• BusClient.connect() works on Node. The TypeScript SDK assumed a global
  EventSource, which browsers provide and Node does not, so the documented
  entry point threw immediately outside a browser. It now resolves an
  implementation explicitly. (#113)

Features

• Google Gemini is supported through its OpenAI-compatible endpoint. No new
  provider abstraction — Gemini is reached through the existing OpenAI client
  path against Google's compatibility surface. (#99)

Testing

• The plugin sandbox boundary suite is committed. Ten tests covering what
  the sandbox is supposed to deny: filesystem access, network access, WASI
  availability, memory growth past the limit, an infinite loop stopped by fuel,
  and a trap contained rather than unwound into the host. Getting the fuel test
  passing exposed a real defect rather than a flaky assertion: invoke()
  formatted wasmtime errors with {e}, which prints only the outer "error while
  executing" line and drops the trap reason underneath. Every plugin failure —
  fuel exhaustion, memory limit, explicit trap — arrived looking identical.
  Formatting with {e:#} keeps anyhow's cause chain, so the reason survives to
  the caller. (#116)

• Supervisor rejection and shutdown paths are covered. (#108)

Build and CI

• The Rust toolchain is pinned, so the gates are reproducible and a new
  compiler's lints cannot turn main red without a deliberate change. This had
  already happened once: a newer Clippy's result_large_err failed unrelated
  pull requests. (#115)
• The check script and coverage pipelines now fail the job instead of
  reporting a problem and exiting green. (#118)
• The dashboard image is built and smoke tested in CI. (#125)
• CI and the dashboard image moved to Node 24 LTS, then the dashboard image to
  node:26-alpine. (#119, #72)

Dependencies

wasmtime 46.0.2 → 47.0.3, serde 1.0.229, clap 4.6.6, futures-util 0.3.34,
tokio-stream 0.1.19, async-trait 0.1.92, http-body-util 0.1.5, jsdom 30, plus
GitHub Action digest updates. All arrived through Dependabot with CI green.

Still not production

Unchanged from alpha.2: the built-in APIs are trusted-network interfaces.
Deployments still need authentication, authorization policy, TLS termination,
secret injection, backups, and network segmentation in front of them.