sealr 0.1.0-alpha.13: supervised wheel handoff and exact Poetry 2.4.2 fixture

sealr 0.1.0-alpha.13

Release date: 2026-08-31.

This thirteenth development preview releases the completed wheel-consumer path built after Alpha.12. It adds full-integrity supervised prefix reads, a packaged public-API-only PyPA WheelSource handoff for exact installer 1.0.1, and one exact repository-owned Poetry 2.4.2 update fixture. Parser breadth, the ZIP32 compatibility default, and the explicit format selections released through Alpha.12 do not change.

Alpha.13 remains a preview. It is useful for evaluation, integration work, and adversarial testing, but it is not ready to protect a production host from arbitrary hostile archives. Evidence remains unsigned, the verifier cannot authenticate the archive that contains it, the authenticated Linux worker remains limited to supported ZIP32 records, no independently maintained project has adopted Sealr as authority, and no external security audit has completed.

Full-integrity supervised prefix reads

• Worker-backed VerifiedArchive::read_member_prefix binds a distinct private request to the exact source, accepted plan, completion, member, originating effect, and caller prefix cap.
• The worker streams the complete Store or Deflate member. The supervisor retains only the requested prefix and independently requires exact EOF, complete size, CRC32, SHA-256, correlated success, clean exit, and reap before releasing bytes.
• Private helper feature generation 2 rejects an older helper before source transfer. Existing full-read record bytes, bootstrap ABI 1, and public worker protocol v1 remain unchanged.
• Required evidence covers zero, short, exact, oversized, and effectively unbounded caps; Store and Deflate; cross-kind rejection; size, CRC32, SHA-256, and retained-length lies; discarded-tail corruption; cancellation; timeout; crash recovery; clones; repeated reads; and descriptor and child cleanup.
• The extracted-package consumer evaluates a supervised .data/scripts wheel through prefix classification without an in-process fallback.

This is complete-stream integrity with bounded prefix retention. It is not a claim that arbitrary formats run in the authenticated worker. ZIP64, TAR, and 7z selections still fail closed there without fallback.

Packaged public API handoff

• The copyable handoff depends only on the public sealr crate and pins PyPA installer 1.0.1 exactly. It enables no internal Sealr feature and depends on no other workspace crate.
• Rust authenticates the native packaged worker, admits the wheel through the supervised portable UTF-8 profile, and requires the separately packaged verifier to accept canonical view v2 and receipt v3 against the live source.
• Rust retains the exact wheel plan and stages only bounded verified member blobs. Python receives a reduced SHA-256-bound manifest and opaque blobs. The canonical receipt and manifest digests are supplied out of band. Python never receives the wheel path or wheel bytes.
• The private wheel source is removed before the post-admission installer bridge starts. Python verifies the closed manifest, each blob, RECORD, the exact installer distribution, and repeated WheelSource reads before writing into five fresh scheme roots.
• Rust independently rejects links, missing or extra outputs, executable-mode drift, and realization-identity drift.
• Required CI builds the example inside Cargo's extracted .crate, copies it into an isolated project that resolves Sealr only to that extraction, and runs a mixed Store-and-Deflate fixture from supervised inspect and materialize origins with exact identity parity. A third end-to-end run uses the real pinned installer wheel.

This closes the repository copyability gate. It is repository-owned mechanism evidence, not independent external adoption.

Exact Poetry 2.4.2 repository fixture

• The fixture pins Poetry 2.4.2 and its complete 47-wheel acquisition set for Ubuntu 24.04 x86_64 CPython 3.12 by exact SHA-256.
• Poetry starts first and validates the selected wheel against its lock hash before the injected executor begins Sealr preparation. Alpha.13 does not claim that the source is deleted before Poetry starts.
• PREPARED follows supervised admission, independent canonical-evidence verification, wheel evaluation, bounded staging, private-source deletion, exact target-interpreter validation, and a target-read-only preflight. The old distribution remains installed at this boundary.
• Both Poetry's real update uninstall and every target write occur only after PREPARED.
• A digest-bound permit resumes the packaged handoff. After PREPARED, the host adapter and installer bridge deny .whl opens. This audit is not a process-wide claim about every Poetry component.
• The adapted update produces 13 audited files, matches the pinned realization identity, and matches the stock control's complete non-bytecode target snapshot.
• EOF at the PREPARED gate preserves the complete old target. A symlinked output ancestor and a physical path-antichain violation are denied before PREPARED or uninstall without changing the target or an outside sentinel.

This proves one exact private Poetry injection seam and environment. It is not general Poetry support, a public Poetry extension contract, or evidence that other Poetry versions, Python versions, platforms, install modes, or dependency operations behave identically.

Distribution and assurance

• This is a GitHub-only prerelease. It does not publish the sealr crate or another crate to crates.io.
• The release contains three native archives plus SHA256SUMS. GitHub build provenance attests the native archives. Every native archive contains the sealr CLI and independent sealr-identity-verifier; the Linux archive additionally contains the authenticated helper and its manifest.
• The source package contract includes the compact handoff example, exact Python requirement, and standalone Cargo manifest template. The detailed fixture generators, hostile mutations, and identity pins remain repository tests.
• Compiler-accurate public API discovery continues to compare current code with the authenticated Alpha.12 package and retains zero expected warning debt. Alpha.13 does not rewrite that predecessor evidence or its promotion history.
• No interpretation profile, policy, evidence schema, tree identity, wheel-consumer digest, or default handoff format changes in this release. The Poetry fixture uses its own repository-private handoff revision without changing the default v1 output.

Important limitations

• Canonical evidence is deterministic and independently checked but unsigned. It does not authenticate a signer or its enclosing release archive.
• The identity verifier checks evidence bindings and the format-neutral content root. It does not execute codecs, run a second archive interpretation, or reconstruct the live format-specific layout root.
• The supported supervised worker path is x86_64 Linux and ZIP32 only. Other platform containment and broader semantic records remain future work.
• The packaged handoff and Poetry fixture use exact pinned components and repository-controlled oracles. They do not establish external operational ownership.
• Public API stability is not promised. This release does not make Sealr production-ready or complete the stable-release trust gates.

What comes next

1. Obtain one separately maintained publisher, registry, build backend, or installer that treats the admitted capability and independently verified evidence as authoritative and never reopens the source archive.
2. Continue targeted benign Unicode and descriptor-bearing wheel compatibility evidence, stable API and identity review, measurable trusted-computing-base work, scheduled assurance history, and independent security review.
3. Resume the parked 7z LZMA member and packed-header work only after the usefulness, compatibility, and review milestones justify more parser breadth.