BoundedCode v0.1.0-alpha.5

BoundedCode v0.1.0-alpha.5

Security fixes, and releases you can verify.

This alpha fixes the defects found in the public-launch
readiness audit. Two of them let an
agent's work reach past BoundedCode's policies on the host. It also moves
to Go 1.27.2, which fixes eight standard-library vulnerabilities.

It is the first release built and attested in CI. You can check that each
file was built from this tag by this repository's workflow, and you can
rebuild it byte for byte.

The feature set is that of v0.1.0-alpha.4. The local
default, Qwen3.6-35B-A3B on Linux with an NVIDIA GPU, is still the only
validated configuration.

Security

• Nested repositories.
  • Before: host git ran commands configured inside a git repository
    that the agent created in its worktree. Once such a repository was
    recorded as a gitlink, its own filter drivers ran on the host during
    checkpoint commits.
  • Now: host git ignores submodules, and a checkpoint refuses a
    worktree that holds a nested repository.
• Quoted file names.
  • Before: names that git quotes (non-ASCII characters, ", control
    characters) did not match the protected-path, secret-path and deny-path
    policies. A new .github/workflows/cié.yml passed the diff-scope check.
  • Now: changed-file lists are read NUL-separated and unquoted.
• Go 1.27.2. It fixes eight standard-library vulnerabilities reachable
  from BoundedCode, in net/http, its HTTP/2 transport, crypto/tls and
  mime/multipart (GO-2026-6603 to GO-2026-6617). The release binaries are
  built with it.

Verification

• Go behavioural evidence.
  • Before: a test that failed on the base, but was skipped, failed or
    did not run on the change, counted as evidence.
  • Now: each attributed test must also pass on the change.

Installation and first run

• bcode setup --check exits non-zero while any step is missing.
• Linux with an NVIDIA GPU but no CUDA toolkit: set-up downloads the
  pinned prebuilt CUDA build of llama.cpp, instead of starting a source
  build that fails.
• Cloud provider: the task contract (and its ambiguity check) now uses
  it. It was silently skipped before.
• The installers are more careful:
  • install.sh refuses to replace an unrelated bcode or boundedcode
    (BC_FORCE=1 overrides) and replaces the binary atomically.
    install.ps1 stages files before replacing them.
  • Both warn when another bcode comes first on PATH, fall back to the
    releases feed when the GitHub API rate limit is hit, and accept a
    mirror (BC_DOWNLOAD_BASE).
  • install.ps1 no longer closes your PowerShell window when it fails.
• Smoke tests for the installers on Linux, macOS and Windows, and for a
  first task end to end, now run in CI.

The CHANGELOG lists every change.

Releases you can verify

• Built in CI. A release workflow builds the release from the tag
  with make dist, after the tests. It creates a draft, which the
  maintainer reviews and publishes.
• Attested. Every file carries a build-provenance attestation (SLSA,
  signed through Sigstore). To check one:

  gh attestation verify boundedcode-linux-amd64 -R akynte/boundedcode

• Reproducible, SBOMs included.
  • The SBOMs now take their creation time from the commit, and each
    target has its own document namespace.
  • Rebuilding from the tag with the Go version in go.mod reproduces
    every binary and SBOM. The licenses archive also matches when rebuilt
    under umask 022, as on the CI runner: at this tag, its permission
    bits still follow the umask. Later releases normalise them.
  • The steps are in
    Verifying a release.
  • Earlier releases: v0.1.0-alpha.4's binaries and licenses archive
    were already reproducible; its SBOMs were not.

Evidence published since alpha.4

• Comparative evaluation:
  BoundedCode vs. the same OpenHands agent, model and sandbox without it,
  on 8 pre-registered public tasks.
  • Results: hidden tests passed 7 of 8 vs. 6 of 8. No difference in
    success is shown, and BoundedCode took about twice the time and tokens.
  • What is published: the protocol, the scripts, the raw results, the
    deviations and the negative results.
• Evidence demo: a reproducible
  demonstration of behavioural verification. It includes a recorded real
  local-model run.

Benchmarks for this release. The release checklist asks for a benchmark
re-run. The task benchmark is the comparative evaluation:

• Same code. Its 24 agent runs and 16 gate replays used a build of
  commit 86c123d. Since then, no product code has changed except the Go
  version.
• Speed not re-measured. bench infra was not re-run: llama.cpp and
  the model are unchanged since alpha.4.

Contributing

• Issue forms for bugs, installation problems, platform reports, wrong
  verification results, feature proposals, model reports and evaluation
  results.
• Contributor onboarding, with first
  issues taken from observed defects.
• Submitting an evaluation result.
• CI now lists skipped tests, and shows macOS and Windows test failures
  instead of hiding them.

Upgrade notes

• Building from source needs Go 1.27.2 or later (go.mod).
• Tasks with nested repositories. Some tasks now fail at their
  checkpoint commit with "nested git repository … refusing to run host git
  on it", naming the directory:
  • Which tasks: those where a git repository appears inside the
    worktree, for example one the agent created or cloned, or a submodule
    it checked out.
  • Unaffected: task worktrees start without submodules checked out.
• setup --check in scripts. Scripts that run bcode setup --check
  must accept a non-zero exit while set-up is incomplete.

Known limitations

1. macOS and Windows remain experimental. Their unit tests do not pass:
   5 packages fail on macOS and 14 on Windows. Four of the causes are
   filed as good first issues.
2. Earlier limitations. The limitations of
   v0.1.0-alpha.4 and
   v0.1.0-alpha.3 still apply.

Please report what you find, using the
issue forms.

Assets

• Binaries: boundedcode-linux-amd64, boundedcode-linux-arm64,
  boundedcode-darwin-amd64, boundedcode-darwin-arm64,
  boundedcode-windows-amd64.exe and boundedcode-windows-arm64.exe.
  They are static (CGO disabled).
• SHA256SUMS: checksums, verified by the installers.
• SBOM-<os>-<arch>.spdx.json: an SPDX 2.3 software bill of materials
  for each binary.
• boundedcode-v0.1.0-alpha.5-licenses.tar.gz: LICENSE, NOTICE,
  THIRD_PARTY_NOTICES.md, and the license texts of every Go module
  compiled into the binaries (LICENSES/go) and of the upstream
  components (LICENSES/upstream).
• Attestations: a build-provenance attestation for each of the files
  above, stored with GitHub.

Model weights are not distributed. Download them with bcode setup or
bcode model fetch, from their publisher at a pinned revision, and review
their license.