v9.0.0

Channel status: crates.io a3s-code-core 9.0.0, npm @a3s-lab/code 9.0.0 (all 8 platform packages), PyPI a3s-code 9.0.0 (bootstrap + native wheels on this release), and Go sdk/go/v9.0.0 are published.

Changed

• Requires a3s-sandbox 0.2.1, whose NativeSandbox is shared across
  threads and applies network grants through &self.
• Workspace lexical FTS links published a3s-vec 0.1.8 (a3s_vec_fts_v1).
  On-disk zvec_rust_fts_v1 generations stay incompatible and are rebuilt.
• The fact log is the only coding control source. send, stream, attachment
  turns, resume_run, and exact recovery choose the next transition with
  a3s-effect (ingest_coding / resume_coding). A stored model turn is not
  sent to the model again. A loop checkpoint does not choose the next model
  call. Confirmation and questions park until a fact and are not settled by an
  in-process oneshot or a timer. A missing tool result is run once on resume.
  A steer is another user.message fact. The tool-round cap is an empty tool
  list on the next completion, not a synthetic user message.

Added

• Meta Harness arbitrary assemble (META-HARNESS2). Ordered
  components: [...] accepts stock parts and host:<id> mounts via
  HostHarnessRegistry / HostHarnessAssembler. Node/Python expose
  Harness.host + components; Go exposes SessionOptions.Harness
  (HarnessOptions, HarnessHost, stock part constants). SDK sessions that set
  harness install BuiltinHostHarnessRegistry, so host:<id> mounts resolve
  from Node, Python, and Go instead of failing closed for lack of a registry. Builtin intent_stamp host component supports
  hermetic and Layer C proofs. F31 kernels (meta_harness.rs,
  completion_attestor.rs) join the ≥95% F-table gate. Live suite:
  test_meta_harness_compose_live_e2e (file/digest/gate oracles only).
• Host-only CompletionAttestor (#160). SessionOptions::with_completion_attestor
  supplies a Passed, digest-bound VerificationReport after the mutation ledger
  digest exists and before the completion gate decides. There is no Observe
  bypass — the gate remains non-bypassable; the attestor is not a tool and is
  not model-grantable. Tip also pairs each mutated path with its ledger content
  digest (MutatedPathRecord) so hosts can re-read and compare like-for-like
  (shape absorbed from community PR #172).
• Meta Harness composition. Hosts compose stock Moore components
  (system, tools, budget, compact, infer) on the single fact log via
  SessionOptions.harness / Node·Python Harness.compose. Depends on crates.io
  a3s-effect 0.1.0. Omit the option to keep the legacy coding_actor tree.
  Permission overlay and completion gate remain Core-owned. Manual:
  META_HARNESS.md.
• DM-PROD1 host qualification harness (dm-prod1-host feature,
  core/examples/durable_memory_prod1_host): Redis VectorIndex with
  index-revision CAS, fenced SET NX EX lease, restart, failover, and drift
  measured against a real OpenAI-compatible embedding provider. Not part of any
  release profile. Runbook:
  DURABLE_MEMORY_PRODUCTION_QUALIFICATION.md.

Fixed

• Honor NO_PROXY / no_proxy on explicit HTTP(S)_PROXY clients used by MCP
  HTTP transports, OAuth, and model HTTP (build_reqwest_client) (#171).
• Python SessionOptions.verifier_enabled getter/setter so hosts can opt into
  the Core read-only verifier (#163).
• Rolling context compaction mechanically re-pins the original ## Goal when
  the summarizer omits it (#174).

Notes

• Channel release, not Enterprise GA. RC b91462d3: L0–L6 and L8 pass;
  Layer C LAYER_C_PASS model=boyue/bailian/deepseek-v4-flash
  (includes test_meta_harness_compose_live_e2e).
• L7 disposition: DM-PROD1 closed with a host pack (all seven dimensions,
  HYGIENE_OK). TB-QUAL1 is waived by product decision (2026-09-26); only a
  diagnostic Harbor trial with a retained native verifier_result exists.
  CAR-01, CAR-03, CAR-04, and CAR-05 are out of scope: A3S Cloud, the
  only party that could certify them, was retired by product decision
  (2026-09-26). The Code-side contracts they describe remain in place. Because
  TB-QUAL1 is waived and CAR is not certified, Enterprise GA is not claimed.
• Apofasi typed decisions stay under [Unreleased] and are not in this cut.