v0.13.0

[0.13.0] - 2026-08-25

Added

• Added one deterministic, read-only Plugin Manager plan review projection for
  interactive CLI and TUI adapters. Human output now shows the exact immutable
  plan identity and digest, candidate/prior package graph, Registry or retained
  installed source evidence, every package transition and complete permission
  ceiling, provider and Workspace impact evidence, and the confirmation
  boundary. Machine JSON contracts remain unchanged. The /packages review is
  scrollable and keeps exact apply/cancel controls visible on narrow terminals.
• Added a Linux real-process recovery gate for Runtime Services. The gate
  terminates the Tool and MCP provider processes independently, proves that
  Box replaces the exact provider resource and PID identity while Use preserves
  the Runtime generation, replaces only the exact stale Gateway route, repeats
  HTTP health and standard MCP initialization through fresh generation-fenced
  routes, verifies the sibling Service remains unchanged, and finishes with no
  residual route, receipt, Runtime unit, or PID state.
• Added a Linux real-process qualification gate for the composed A3S Use
  Runtime Service lifecycle. Four caller-owned Tool and MCP processes exercise
  production Box mapping, durable Runtime state, generation-fenced loopback
  relay, private Gateway routing and MCP negotiation, retained N routing after
  N+1 activation, Gateway and lifecycle-host restart, stop/remove drain, exact
  removal, and zero residual routes, receipts, Runtime units, or PIDs. The
  qualification backend requests only Box-advertised resource controls;
  privileged OCI and MicroVM execution remain separate provider gates.
• Added production Linux Runtime Service composition behind the trusted
  plugin_runtime.gateway block. The host starts one durable private A3S
  Gateway on an explicit numeric loopback socket, assigns the same reviewed
  Box provider to Tool Tasks, Tool Services, and Streamable HTTP MCP, derives
  health from the frozen Runtime plan, and maps only Runtime-published
  loopback endpoints. Gateway target UUIDs are deterministically reconstructible
  from final Use receipts; bind, drain, removal, listener ownership, and route
  recovery are exact-generation and idempotent. MCP readiness now performs the
  standard initialize/initialized exchange through the returned Gateway route
  with a proxy-free, redirect-denying client and the shared lifecycle deadline.
  CLI and TUI shutdown explicitly stop the embedded Gateway listener and
  release its durable state-owner lock.
• Added an explicit Linux-only plugin_runtime host configuration for signed
  OCI Tool Tasks. A trusted user ACL or --config file can compose the shared
  A3S Box Runtime provider with exact microvm or sandbox isolation, bounded
  control and polling intervals, and durable provider state. The default
  registry remains empty, workspace ACL cannot select a provider, MicroVM
  execution never falls back to shared-kernel isolation. Runtime Services stay
  unavailable unless the sibling private Gateway block is also configured.
• Added resident, typed A3S Use capability projection for Code sessions. One
  complete Use snapshot cursor, its verified managed MCP servers, Skills,
  provider-qualified Runtime Tool Tasks, digest-bound non-queryable Knowledge
  Surface readiness, dependency-closed Flows, and bounded path-free UI
  bindings now publish through the
  Core atomic Session capability catalog, while every admitted Run acquires a
  fresh, non-clone Use snapshot lease. Generation N Runs keep their N Skill
  registry and upstream lease across an N+1 cutover; new Runs see only N+1,
  stale providers reject admission, and lifecycle drain waits for the final
  admitted Run. Replacement TUI sessions publish the current generation
  asynchronously without copying projected Skills into the compatibility
  registry. UI uses canonical Use surface IDs, versioned dependency-completeness
  evidence, and exact asset digests; missing dependencies or legacy ambiguous
  evidence fail the candidate batch, and N handles retain N bytes and leases
  across N+1. Reviewed provider-qualified Runtime Tool Tasks now publish as
  exact package-sourced Tool values in that same resident batch, so a
  Tool-dependent UI can resolve its canonical edge without a compatibility
  registry double write. Runtime Tool fingerprints participate in projection
  identity and readiness receipts; N to N+1 replacement and disable advance
  the Code catalog once and Runs dispatch only through their pinned Tool value.
  Managed MCP projection preserves canonical surface multiplicity, activation,
  lifecycle identity, file evidence, and transport-specific launch evidence.
  Code rechecks package-confined stdio launchers, accepts HTTP routes only from
  its trusted credential-free loopback Runtime resolver, and completes Core MCP
  preparation before the atomic catalog switch. Dependency-free, Tool-dependent,
  MCP-dependent, and OKF-dependent Native TypeScript Flows now reverify and
  digest-stage their source, preflight through the workspace-local Flow runtime,
  and resolve Tool/MCP/Knowledge-Surface edges inside the same exact package
  before publication. Exact OKF projections for one package surface are
  canonicalized across scopes into one Core readiness value whose digest joins
  the atomic N/N+1 identity; it exposes no query or implicit cognitive-package
  selection authority.
  Compilation failure or cancellation while waiting for the workspace runtime
  lock leaves the visible generation unchanged and no background lock waiter.
  Built-in MCP wrappers and the dynamic multi-scope Knowledge search tool
  remain explicit compatibility paths; search leases and query semantics are
  not inferred from readiness evidence.
• Added the generation-scoped code exec host contract used by A3S Desktop.
  Required hosts negotiate the exact, side-effect-free scoped-v1 flag before
  execution, then Code prepares one atomic managed-MCP/Skill/Runtime-Task/UI
  projection, stops the Use watcher before Run admission, and returns frozen
  Code catalog, Use cursor, surface counts, and Runtime Task count/digest
  evidence. One process-owned Plugin Manager supplies both the reviewed Task
  dispatcher and opaque HTTP MCP endpoint resolver for the complete Session
  lifetime, so a scoped Run cannot compose competing Runtime/Gateway owners.
  Missing, stale, or mixed state fails before model egress; an unavailable
  reviewed provider omits its Task and reports a warning, while managed HTTP
  MCP accepts only a trusted credential-free numeric loopback route. Built-in
  MCP, compatibility Knowledge, Flow, and Plugin Manager presentation surfaces
  remain outside this bounded host. Session close precedes bounded Runtime and
  Gateway shutdown on success, cancellation, and failure.

Changed

• Switched the Linux Box 3.2.0 runtime and qualification dependencies and the
  Use 0.3.3, Use Core 0.2.4, Use Extension 0.3.3, Runtime 0.3.0, and Gateway
  1.1.1 architecture graph from temporary source revisions to immutable
  crates.io releases, so packaged A3S Code builds resolve only published
  dependency artifacts.
• Ordinary a3s code exec now discovers an already-ready A3S Use installation
  without downloading or mutating component state. A compatible installation
  receives the same scoped managed-MCP/Skill/Runtime-Task/UI projection; a
  missing installation keeps the previous no-Use behavior. An incompatible
  optional runtime is skipped only after its watcher has stopped and both the
  Session capability catalog and dynamic-tool names are proven unchanged.
  Required Desktop execution remains fail-closed, and cancellation during
  preparation retains the typed operation.cancelled result.
• Upgraded the fenced managed Workspace host capability contract to protocol
  v6 and pinned the exact Code, Use, Runtime, Flow, and Memory dependencies
  required by the typed snapshot-lease integration. Reviewed enablement now
  validates the receipt schema exported by Use instead of duplicating its
  version locally. OCR remains a host-built-in overlay because its current ONNX
  Runtime ABI conflicts with the optional local-embedding ABI; its verified
  Skill still participates in the Code atomic catalog, with host fingerprints
  preventing same-cursor updates from being skipped.

Fixed

• Made asset roots, local repository URLs, home-directory discovery, OKF paths,
  and structured CLI path assertions portable across Windows, macOS, and Linux.
• Normalized the embedded managed-model ACL to canonical LF bytes before digest
  verification and gave asynchronous test fixtures bounded CI-ready startup
  budgets without changing production timeouts.