BYOK SDK 0.27.0 · keys 0.12.0

0.27.0 publication record

Date: 2026-10-17 (Asia/Singapore).
Status: all nine packages are published on latest. Complete registry
readback and isolated installation passed.

The owner directed publication of 0.27.0 / keys 0.12.0 while #195 remained
open. This release does not claim Host qualification or production rollout.
It is the first stable wire-v3 train. A v2 daemon and a v3 server do not
interoperate. Hosts and devices must upgrade together.

Source and artifact identity

• Preparation PR: #510.
• Source: cd9772615b928e9e403cade3cf12e014bdc33382.
• Artifact: release-pack-cd9772615b928e9e403cade3cf12e014bdc33382, id
  12101953819, from push CI 39035847776.
• The exact merged-source push CI passed all 24 jobs. The first Windows ACL
  qualification timed out. Only that job was rerun, on the same source and
  with unchanged deadlines, assertions and permissions. Its eight native ACL
  cases, packed installation and canary teardown passed on rerun.
• The original manifest SHA-256 is
  40853105bc3e96d0ba4b27a1b53636616d43d1c7adcfdf37eb271a29276a34e5.
• All nine CI tarballs are byte-identical to the locally verified tarballs.
  Publication used the original accepted CI bytes. No rebuild or repack
  supplied the upload plan.

npm execution

The authenticated npm account was ancienttwo, with write 2FA enabled.
Each upload used browser authentication. This was a local interactive
publication without a GitHub OIDC provenance attestation.

The upload order was cloud-do, core, protocol, client, cloud, keys,
cloud-dataplane, server and ui-runtime. All nine uploads returned success.
The publisher then stopped at step 7 because the registry returned E404 for
server 0.27.0. The first standalone readback returned the same E404.
The second standalone readback passed after registry synchronization.
No upload was repeated.

Registry closure

All nine exact versions are on latest. Their SHA-512 integrities and runtime
dependency maps match the frozen manifest. The isolated npm install closes to
exactly nine SDK package versions. npm ls @byok-sdk/core --all --json
resolves only 0.27.0. Official direct Pi 1.2.0 pins match bun.lock and the
single official pi-coding-agent tarball (1,275 files). No fork manifest was
found. The rc channel remains 0.27.0-rc.2 / keys 0.12.0-rc.2.

Tag and GitHub Release

After complete readback passed, the operator created the annotated tag
v0.27.0 at the exact source above. Its message uses the publisher's format:
v0.27.0, a blank line, then sourceGitSha <sha>.
The pushed tag object is 6f6d9e73f4a22e396da4507debf60e0ec116b180.
GitHub Release v0.27.0
uses that tag and is the stable Latest release.

Accepted artifact hashes

Package	Version	SHA256
@byok-sdk/core	0.27.0	3dc54f327285605cd97d761aef611ddd18444383498d4e515f4fb7b9e19f02a6
@byok-sdk/protocol	0.27.0	ed98dc70aaa33fd2c1125f07374634a0e636375aa9e4c11917dcb109559d0cee
@byok-sdk/server	0.27.0	f3ee0acaca12e8534e3bb9e0f11ecd1bc78bacb4c394a7be9fbe5773515c2b07
@byok-sdk/cloud	0.27.0	900324b6dda900dbffa5c4cb6bcb964559c4bd06448d6fcb5b9cf9cdc6650b1b
@byok-sdk/client	0.27.0	d888f72fd7bb298ab212caa5c0114251f9aaa343545da65b27d8caaf68e2de22
@byok-sdk/cloud-dataplane	0.27.0	37aeaab235762db36caaf7109e5be64a04470c20650c344a8ae64dd3a4ec7d33
@byok-sdk/cloud-do	0.27.0	d8ee8022cb47b87987510652ce5b513f4877518f2ca2a31835ae3521e2954524
@byok-sdk/ui-runtime	0.27.0	378a29e5bda92a5d2baa81389340dd559453b971e831b6f9c939d4a8961118d0
@byok-sdk/keys	0.12.0	35eeea0177ae0b5ccb909fd00e8eb4407f7fc132821ee446e2c47f2f1efade9e

Release boundary

#195 remains open. Synthetic Summary measurements do not prove fixed-artifact
Host acceptance. npm publication does not run Host migrations, distribute
devices or deploy a product.

The first v3 envelope and HTTP prefixes are registered for 0.27.0. The
post-publication compatibility update pins the real registry decoder and
sets floor 0.27.0. #386 remains open until that update is accepted.

See the release notes for the wire and API breaking changes,
migration 0026 and Host upgrade steps.