v0.10.0

Added

• Native process requests now honor their declared environment and working
  directory. Every spawn tier starts from a small host environment allowlist,
  applies validated guest variables, rejects session-token injection, confines
  relative working directories to the capsule workspace, and can resolve
  HOME=home://... or a home://... working directory after host-side policy
  checks. The native child receives the resolved path, but the process host API
  does not return it directly. Principal-home reads require an
  explicit read capability; the OS sandbox makes writable only the capsule's
  declared home:// write roots for that principal. Recv-driven capsules now install the same
  per-principal home/tmp overlays as interceptor invocations.

• Capsule installation has an explicit non-interactive configuration path.
  astrid capsule install --yes resolves lifecycle fields from repeatable
  --var KEY=VALUE inputs, ASTRID_VAR_<KEY> environment variables, or
  manifest defaults, and fails instead of silently choosing an enum value or
  empty secret when a required value is absent. Secret automation can use the
  environment form so credentials do not appear in process arguments.

• Signed runtime release channels and immutable manifests. Every release records the exact
  runtime and WIT source commits, release-workflow identity, and all four platform archives with
  their sizes, BLAKE3 digests, SHA-256 compatibility digests, and Sigstore bundle
  names. Protected manual promotion advances signed, expiring stable, dev,
  or nightly pointers only to those immutable releases. astrid update
  authenticates the pointer, manifest, and archive; rejects generation rollback,
  same-generation equivocation, expiry, digest drift, and workflow-identity
  drift; and follows deliberate higher-generation rollbacks for self-managed
  installations. An opt-in daily nightly train reuses the same tag-bound signer,
  remains disabled by default, and still requires protected release and channel
  approvals. A merge to main never publishes a release or moves a pointer.

• Operators can enforce a distro for astrid init.
  ASTRID_ENFORCED_DISTRO supplies the distro source and rejects CLI attempts
  to override it. Standalone astrid init requires an explicit --distro;
  Astrid Runtime never chooses a product distro. Closes #1253.

• Passive content-addressed capability-registry primitives. Astrid now has
  exact capability IDs, typed content-bound references, immutable registered
  definitions, deterministic BLAKE3 semantic digests and canonical registry
  manifests. Existing profile persistence, wildcard evaluation, bootstrap,
  socket and wire behavior remain unchanged. Closes #1233. Refs #1228.

• Distro init can grant exactly installed capsules to an explicit target.
  astrid --principal <operator> init --target-principal <target> --grant-capsules ensures the runtime daemon, verifies the operator has
  agent:modify authority over an existing target before provisioning, and
  applies the installed set through the shared admin.agent.modify path.
  Distro capsules require a concrete released version or tag; identity and
  declared version are checked before install mutation, and locks record the
  version and WASM hash that actually landed. Fresh-lock reuse rehashes the
  installed content blob before names become grants. Concurrent provisioning
  of one target is rejected, and recovery commands preserve the operator
  identity. The target defaults to the process principal when omitted; no
  principal name receives special treatment.
  Signed .shuttle grant composition remains deferred and fails explicitly.
  Closes #1195.

• Capability-registry revision 1 now has fixed semantics and BLAKE3 digest
  vectors. All 51 kernel entries bind scope, target kinds, delegability,
  privileged status and provenance. Kernel/admin request mappings and the
  current capsule-side secondary enforcement constants resolve through the
  registry in tests, while the complete role partition is frozen independently.
  Authorization and persisted state remain unchanged. Closes #1235. Refs #1228
  and #1233.

Changed

• Device key IDs now use BLAKE3. The short per-device handle is derived from
  the first eight bytes of BLAKE3(pubkey_hex_bytes). Profile loading already
  treats the stored key_id as informational and re-derives it from the public
  key, so existing local profiles self-heal; device-scoped bearer sessions must
  authenticate again after upgrading.

• Self-managed updates now authenticate the release publisher before any
  archive is extracted or installed. The updater requires a Sigstore bundle
  for the exact archive bytes, verifies it with fresh public-good trust
  material, and pins the certificate to Astrid's release workflow, repository,
  tag, and GitHub Actions issuer. Only an authenticated archive can enter the
  independent BLAKE3 integrity stage; missing, duplicated, malformed, or
  mismatched evidence fails closed with a distinct publisher-authentication or
  integrity error. Homebrew and Cargo installs remain delegated to their
  package managers, and the signed SHA-256 compatibility manifest remains
  available to downstream tooling. Before publishing, release automation now
  requires both Cosign and the updater's native production verifier to accept
  every generated archive and bundle pair. Existing v0.9.x self-updaters cannot
  enforce the new publisher policy retroactively; it applies from the first
  release containing this updater onward. Closes #1250.

• Astrid-owned identifiers now use domain-separated BLAKE3. Invite and
  pair-device token stores carry an explicit schema and invalidate
  legacy SHA-256 records that cannot be rehashed without their raw secrets;
  newly issued bearer tokens use type-specific astrid_inv_ and
  astrid_pair_ prefixes, while fingerprints use an explicit blake3: label.
  CLI key metadata self-heals from the retained public key. Public-key
  fingerprints share a typed derivation primitive, MCP binary pins now carry
  an honest blake3: label, and gateway env-write logs no longer expose
  dictionary-testable fingerprints of low-entropy values. External SHA-based
  protocols such as SRI, Git, and registry checksums remain unchanged. Closes
  #1247.

• Astrid release archives now use BLAKE3 as their primary integrity
  manifest. Release automation publishes, signs, and attests
  BLAKE3SUMS.txt, while retaining a signed SHA256SUMS.txt compatibility
  manifest for Homebrew and existing downstream tooling. Self-managed updates
  require a strict lowercase BLAKE3 entry and reject absent, malformed,
  duplicate, or SHA-only manifests. Existing v0.9.x installations can still
  cross the boundary through the compatibility manifest. External protocol
  requirements remain unchanged. Closes #1249.

• Project runtime state now uses one validated workspace layout. The CLI
  and daemon default to .astrid, while distributions can select another safe
  relative directory name through --workspace-state-dir or
  ASTRID_WORKSPACE_STATE_DIR. Config, capsule installation and discovery,
  kernel boot, gateway source checks, hooks, and WIT garbage collection share
  the selected layout and reject persistent symlink/reparse redirection anywhere
  in workspace capsule and hook trees before reading them. They never scan both
  project roots. CLI uplinks, including long-lived MCP reconnects, and
  project-sensitive management reads reject a
  daemon booted for a different project or layout; daemon stop remains
  available as a recovery operation.

• Runtime E2E now stages the pinned Unicity AOS monorepo. The workflow
  preserves the AOS Cargo workspace outside the core checkout and supplies
  compatibility directory aliases for the existing runtime harness, replacing
  seven historical per-capsule repository checkouts. Closes #1220.

• Astrid Runtime no longer silently selects a product distro. Standalone
  astrid init and astrid distro apply now require an explicit distro, first-run
  bootstrap only creates runtime state, self-update refreshes only an already locked
  distro, and agent creation no longer carries a product-distro default. Closes #1214.

• Removed residual product distro policy from Astrid Runtime. Standalone
  distro installation now requires an explicit @owner/repo, URL, local
  manifest, or signed .shuttle input; it no longer manufactures a source URL
  from a bare distro name. Background update does not reconstruct a source from
  a lockfile identifier, and runtime guidance, examples, and mutable repository
  links use neutral/current values while published WIT and package identities
  remain unchanged. Closes #1216.

• Daemon status and shutdown now use one typed runtime-control path.
  astrid status propagates daemon connection and response failures instead of
  reporting success, and astrid stop sends its shutdown request through the
  authenticated, correlated uplink client. Closes #1210.

• CLI runtime-control requests now use the shared typed uplink client.
  astrid status, ps, who, and doctor no longer rebuild socket frames or
  parse response envelopes themselves; they use astrid-uplink for the same
  authenticated, principal-bound astrid.v1 control contract that external
  uplinks will consume. Closes #1208.

• Removed the product-branded README image. Astrid's repository front door
  now presents the runtime without Unicity artwork. Closes #1204.

• Astrid's mutable repository identity now points to astrid-runtime. Current
  documentation links, release automation, the WIT submodule origin, and the
  self-update default use the Astrid Runtime organization, while published crate,
  WIT, tag, artifact, and binary identifiers remain compatible. Closes #1202.

• Astrid's MCP bridge now uses RMCP 2.2. The client and server adapt to RMCP's current content and elicitation APIs while preserving existing roots and sampling support. The CLI prompt also follows terminal color preferences, including NO_COLOR. The reviewed dependency refresh includes updated cryptography, signal handling, random-source, regex, ignore, and WebAssembly component tooling dependencies; astrid-core remains on TOML 0.8 because its public error types expose that API, and the optional SurrealDB backend remains on 3.1.5 pending a dedicated storage migration. Closes #1193.

Fixed

• astrid secret list no longer reports an empty configured marker as a
  second legacy secret. Secret-typed capsule fields may retain "" in their
  env JSON to record completed configuration while the credential lives only in
  the principal file-secret store. Listing now omits that valueless marker but
  continues to flag every non-empty secret-typed env value as legacy plaintext.

• Offline init no longer performs the cached release check. astrid init --offline and astrid distro apply --offline skip update discovery before
  command dispatch, so their no-network contract covers the complete CLI
  invocation rather than only distro and capsule resolution.

• Invite commands accept every token the runtime can issue. invite redeem
  and invite revoke now treat a leading hyphen in an opaque base64url token as
  token data instead of misparsing it as an unknown option.

• Security Audit now uses a reproducible cargo-audit installation. CI installs
  cargo-audit 0.22.2 with its published lockfile before invoking the pinned RustSec
  action, keeping the advisory scan compatible with the repository toolchain.
  Closes #1245.

• astrid chat now remains readable on light and dark terminal themes. Primary chat text, user input, and the cursor inherit the terminal's configured foreground instead of forcing white or gray; assistant and running-tool bullets follow the same foreground. Closes #1178.

• The CLI no longer includes unused Syntect XML and YAML loaders. Its embedded default syntaxes and themes do not need runtime plist or YAML loading, so the dependency graph now excludes quick-xml and yaml-rust; their obsolete Cargo Audit exceptions are removed. Closes #1190.

Install

From source (requires Rust 1.95+):

cargo install astrid

Pre-built binaries:
Download the archive for your platform, extract, and add to PATH:

tar xzf astrid-*-$(uname -m)-*.tar.gz
sudo mv astrid-*/astrid astrid-*/astrid-daemon astrid-*/astrid-build astrid-*/astrid-emit /usr/local/bin/

Astrid Runtime does not bundle a product distro. To compose it with a
distro you trust, run:

astrid init --distro <name, @org/repo, path, or .shuttle>

---

With many thanks from the following Astrinauts 🚀

• Joshua J. Bouw