v2026.10.0

Added

• Add numbered release candidates on the dev channel without consuming the
  final stable tag. Candidates use binary installation; stable promotion
  remains separate and rejects prereleases.
• Add accountable users for principals and optional shared user WASM fuel-rate
  budgets across their principals. Accounting covers initialization, lifecycle
  hooks, foreground calls and background execution. Unambiguous local ownership
  migrates automatically; existing ownership is preserved, and personal installs
  without configured budgets retain their scheduling behavior. These are
  cooperative fuel-rate budgets with retained debt, not strict instantaneous
  ceilings or limits on all host/subprocess CPU time.
• Add astrid quota set --cpu-rate with decimal SI rate input while preserving
  other quota fields and existing authorization.
• Add principal-scoped capsule update discovery with
  astrid capsule update --check --json. It distinguishes unavailable checks and
  unsupported publisher layouts from current versions without installing or
  granting anything.
• Add signed astrid audit heads snapshots and paged astrid audit export,
  including signing bytes, chain hashes, signatures and retained prune receipts.
  Successful read-only queries do not append new audit entries.
  Chains pruned more than once before this release report their historical
  pruned total as unknown (u64::MAX), rather than an invented exact count.
• Record kernel-mediated HTTP exchanges, capsule tool calls, approval prompts
  and decisions, capability changes, capsule installation and runtime loads.
  HTTP records commit before sending and complete with response commitments;
  credentials are redacted. Manifest-declared secrets can be injected into HTTP
  headers by the host without entering guest memory or audit commitments.
• Add opt-in audit entry format v2 with deterministic CBOR, salted field
  commitments, SHA-256 entry hashes and a dedicated audit key verified through a
  cross-signed key registry. Existing v1 history remains unchanged; v2 chains
  link to it, and enabling v2 refuses subsequent v1 appends.
• Add external audit anchoring watermarks, anchor-status reporting and optional
  archive-before-prune retention. With require_anchor, unanchored history is
  retained even above the storage cap and reported as degraded rather than
  silently deleted. Existing default retention remains available without that
  operator setting.

Fixed

• Use the same runtime compatibility rules for capsule and distro manifests,
  so dev release candidates can load capsules with satisfied stable minimum
  versions while preserving explicit prerelease ordering and version bounds.

• Recover stopped volumes affected by older capsule installers leaving a
  replacement runtime-key sidecar. Preserve the replacement as system-owned
  evidence and restore only the volume's existing identity. Durable recovery
  intent allows interrupted projection to resume, including incomplete Unix
  layout-sentinel staging; unsafe or unrelated leftovers remain rejected.

• Resolve the macOS FSKit callback container on a blocking worker so a stalled
  filesystem permission request does not block unrelated async admin work.
  Canonical-path and private-directory validation remain unchanged.

• Retry transient busy macOS filesystem unmounts within the existing shutdown
  budget. Occupied mounts remain mounted and report the native failure; retries
  do not force unmounts or hide other errors.

• Bound hosted volume dirty-commit extent-map amplification and reclaim
  superseded physical representation metadata and root records during
  compaction. Atomic checkpoints preserve current identities, generations and
  complete compaction evidence across interrupted publication. Explicit KV
  compaction checkpoints pending deltas so overwritten values can be reclaimed.
  Stores compacted with the new checkpoint reader cannot be reopened by older
  readers limited to the initial representation-journal generation.
  Older readers that reject sparse footers fall back to an unbounded header
  scan; the bounded recovery path requires the updated reader.

• Avoid quadratic recovered-index validation while preserving missing-object
  and placement-mismatch checks. Preserve the shared native-mount resource
  directory when retiring a lease so concurrent mount creation can finish.

• Resume legacy environment and secret migration after already-imported source
  scopes have retired, preserving imported values and completion receipts.

• Preserve principal-owned capsule configuration when granting access to an
  existing installation. Inherited assignment and explicit installs are
  serialized; configuration copying is bounded and failed publication rolls
  back newly inherited values.

• Restore the runtime before inspecting capsule signing identity when installing
  into a stopped volume-only home. Inspection excludes concurrent stop, and an
  authenticated connection keeps an ephemeral runtime alive through approval
  and installation. CLI diagnostics remain on stderr instead of creating runtime
  log sidecars before admission or during retirement.

• Wait for acknowledged daemon shutdown and durable finalization before
  identity-checked termination. Stopped principal discovery reports the required
  start instead of waiting on missing readiness metadata.

• Queue concurrent capsule invocations when CPU capacity is temporarily reserved
  and wake them when capacity settles, preserving both principal and accountable
  user limits. Concurrent tool discovery no longer silently loses providers.

• Avoid MUSL daemon allocator contention during parallel capsule compilation
  without reducing compiler parallelism or changing guest CPU budgets.

• Treat completed nonzero capsule sleeps as cooperative watchdog progress while
  keeping zero-duration sleeps and CPU-spinning loops bounded.

• Preserve bounded, ordered IPC streaming delivery during provider bursts.
  Publishers wait for capacity rather than silently dropping deltas or terminal
  events; cancellation, shutdown and capsule retirement fence uncommitted work.

• Recover abandoned native chat turns after cancellation and admit subsequent
  input without letting delayed responses complete a newer turn. Preserve
  management and human-reply ownership, return explicit local refusal responses,
  and validate autonomous timeout completions against their bound turn owner.

• Resolve . and ./file as capsule storage-backed workspace paths while still
  rejecting parent traversal.

• Record host audit calls in order, with signed loss and shutdown-gap accounting.
  Optional write-ahead audit classes deny an effect if its durable entry cannot
  be recorded. Preserve complete physical-compaction evidence while archive
  delivery is pending; exported v2 hashes now match the SHA-256 hashes used by
  their chains, while v1 hashes remain unchanged.

• Refresh linked-worktree build-provenance metrics when the selected commit
  changes, including packed refs. Improve runtime shutdown failure diagnostics
  and keep Windows named-pipe test helpers warning-free.

• Preserve legacy principal-local environment and secret scopes during volume
  migration even when their capsule is absent or shared from another principal,
  including the old no-capsule default scope. Keep its keys visible in environment
  listings without making those values a global fallback.
  Keep retired scope receipts discoverable when a later migration stage is
  interrupted, and refuse retry if a required completion receipt is missing.

• Preserve recognized direct representation catalogues when migrating historical principal stores, including the pre-fleet-owner format, instead of refusing upgrades after their format specification advances.

• Preserve the complete capsule migration error context in boot diagnostics, including the underlying cause of authority and retirement failures.

• Allow regular Finder .DS_Store metadata in legacy SurrealKV directories during layout migration and interrupted retirement, while preserving receipt hashing and rejecting redirected, special, or unexpected entries.

• Preserve resolved capsule references when migrating legacy distro locks written with resolved_ref. New TOML locks consistently use resolved-ref; historical spelling remains readable without accepting unknown or duplicate fields. Preserve the released v1 signature bytes independently of TOML presentation changes so existing signed shuttles remain verifiable.

• Preserve obsolete native capsule directories and stale receipts during migration when a verified durable package already exists, without rejecting the upgrade, downgrading the package, or silently reapproving native content. Bound recovery names for long legacy identifiers and synchronize preserved directory entries before the source removal.

• Stop the verified running macOS filesystem app before replacing its bundle, avoiding activation failures from an old process executing a removed backup. Refuse disruptive replacement while Astrid filesystems are mounted or the app identity cannot be verified.

• Preserve oversized historical principal logs during layout migration without the former 64 MiB importer or 1 GiB log-preflight byte ceilings. File contents remain streamed and verified, with private-path checks, conflict detection, receipts and retry behavior retained.

• Keep an explicitly selected daemon workspace consistent across CLI startup, warm attachment and MCP gateway children without changing relative file arguments or client project context.

• Local invitation redemption with a named keypair now validates the returned fingerprint and activates the redeemed principal's native signing credential, so switching to it authenticates instead of connecting anonymously. Key-store mutations are serialized, and recovery binding is persisted before credential publication. Existing credentials are never replaced, and deleting the named key removes its matching activated credential even when its public sidecar is missing or stale.

• Require global environment-write authority in addition to capsule-install authority before an installation can overwrite or delete shared capsule secrets. Reject unauthorized requests before staging principal configuration.

• Runtime shutdown now tolerates Finder recreating a regular .DS_Store in the
  transient runtime directory during cleanup. It leaves that metadata untouched
  and still fails closed for any other residual file, directory, or symlink.

• Automatic update notices follow the running stable, release-candidate or nightly train and no longer advertise an older version as an upgrade. Explicit channel switches and signed rollbacks remain supported. The dependency lock includes the patched QUIC protocol release already adopted on main.

• Detach daemon boot stderr from piped CLI callers so successful startup returns promptly without changing fresh-home admission. Preserve early startup failure diagnostics in a private temporary log. Refuse aliased Unix start-fence directories and files before runtime mutation. Update the locked optional QUIC protocol dependency to its patched release without enabling QUIC. Closes #2115.

• Report authenticated native request invocation failures promptly to MCP callers instead of waiting for the outer reply timeout. Preserve request ownership, independent fan-out and at-most-once tool invocation; do not replay interrupted calls.

• Show the authenticated principal in MCP ingress-consent prompts and display metadata for legacy and modern clients. Label the caller source honestly instead of presenting it as a unique session identifier.

• Disclose that approved MCP ingress trust persists across reconnects and runtime restarts, and label it as durable in consent metadata for both legacy and async elicitation.

• Embed the selected release source commit in the CLI version output on native, GNU and MUSL builds, including prepare-only builds of an explicitly selected source.

• Report opt-in nested capsule delivery failures promptly to their authenticated publisher without waiting for the successful reply timeout. Closes #2128.

Security

• Update Wasmtime and WASI to 48.0.4, incorporating the September and October
  runtime security updates without changing the runtime major version.
• Prevent self-scoped quota updates from increasing allocations without global
  quota authority, including restricted-device and stale-allocation requests.
• Discard interrupted WASM interceptor instances and deny ordered execution when
  a guest fails before producing a decision.

Install

From source (requires Rust 1.95+):

cargo install astrid

Linux pre-built archive:

tar xzf astrid-*-$(uname -m)-unknown-linux-*.tar.gz
sudo install -m 0755 astrid-*/astrid astrid-*/astrid-daemon \
  astrid-*/astrid-build astrid-*/astrid-emit \
  astrid-*/astrid-storage-provider-fuse /usr/local/bin/

macOS pre-built archive and signed AstridFS app:

ARCH=$(uname -m); [[ "$ARCH" == arm64 ]] && ARCH=aarch64
tar xzf astrid-*-${ARCH}-apple-darwin.tar.gz
sudo install -m 0755 astrid-*/astrid astrid-*/astrid-daemon \
  astrid-*/astrid-build astrid-*/astrid-emit /usr/local/bin/
astrid-*/macos/manage-macos-fskit.sh install
astrid-*/macos/manage-macos-fskit.sh enable

Astrid Runtime does not bundle a product distro. To compose it with a
distro you trust, run:

astrid init --distro <name, @org/repo, path, or .shuttle>

---

With many thanks from the following Astrinauts 🚀

• Johannes Ait
• Joshua J. Bouw
• Pavel Grigorenko