sealr 0.1.0-alpha.7: wheel research and distribution contracts

sealr 0.1.0-alpha.7

This seventh development preview completes the non-shipping Python wheel laboratory and turns source-crate and native-archive assumptions into executable distribution contracts. It preserves the Alpha.6 supervised Linux boundary and keeps wheel-specific behavior out of the supported API and CLI.

It remains a preview. The default APIs still run in process, structural ZIP planning is not confined, successful supervised execution is limited to x86_64 Linux with Landlock ABI 3, and this release does not claim supported wheel admission, general process containment, or production readiness.

Wheel research

• sealr.profile.zip.wheel-utf8.v1 is a separately identified repository-only interpretation. It permits ZIP32 Store and Deflate, only general-purpose bit 11, no data descriptors or extra fields, strict UTF-8, NFC names, no dot-component normalization, and lowercase-plus-NFC collision rejection.
• Exhaustive tests cover every 16-bit general-purpose flag value and every 16-bit extra-field identifier. The new profile does not widen the compatibility default or strict ASCII v2 profile.
• A pure bounded evaluator produces one of four outcomes: admitted, denied, unsupported, or infrastructure failure. It validates the outer wheel filename, one matching .dist-info root, WHEEL, Core Metadata, RECORD, .data relocation, generated targets, entry points, executable disposition, and fixed resource ceilings.
• Source, archive-tree, wheel-artifact, scheme-relative install-plan, and target-realization identities use distinct domains. ZIP creator-system and external-attribute facts remain outside sealrTreeV1 and are bound where consumer semantics use them.
• Thirteen minimized hostile wheels cover container, filename, metadata, RECORD, relocation, generated-target, unknown-scheme, and script-rewrite disagreements. Fixture generation and committed bytes are deterministic.
• The predecessor-bound v2 inventory evaluates the same exact 20-wheel pilot through the wheel profile and consumer model. Sixteen artifacts are admitted, two denied, and two unsupported. The report investigates each cluster and does not present the sample as an ecosystem acceptance rate.
• A pinned PyPA installer 0.7.0 bridge consumes only bounded member blobs staged through VerifiedArchive. The regression deletes the original wheel before Python starts, installs an audit hook before importing the installer, rejects every .whl open, validates repeatable member reads and RECORD, and compares the external actions with Sealr's install plan.

Distribution contracts

• Only the sealr library crate is allowlisted for crates.io publication. Every other workspace crate remains non-publishable.
• Required CI pins the exact 47-file cargo package result, extracts the package, checks that package-root README.md and LICENSE bytes match the repository, verifies Apache-2.0 and Rust 1.98 metadata, and builds a separately locked downstream consumer.
• The crate is publication-ready, but the GitHub tag workflow does not publish it to crates.io. The 0.1.0-alpha.* public API remains prerelease and subject to documented breaking changes.
• Native archives have separate exact evidence floors: Ubuntu 24.04 x86_64 with glibc 2.39, macOS 15 arm64 with Darwin 24 and deployment target 15.0, and Windows Server 2022 x64 build 20348.
• Required and release workflows use explicit runner labels and assert the actual host, architecture, ABI, and deployment contract before testing and packaging. Release artifacts remain the same three target archives plus SHA256SUMS and GitHub provenance.
• Target-specific third-party license closures now include the Unicode normalization dependency and continue to exclude first-party workspace packages.

Semantic and identity evidence

• MemberContainerFacts exposes immutable creator-system and external-attribute facts from verified central-directory bytes. It provides the exact PyPA installer 0.7.0 executable predicate without placing consumer-specific mode semantics in the generic tree identity.
• Private SEALRSEM planning and completion records advance to wire version 2 so supervised consumers retain those facts. The public worker protocol remains version 1.
• The immutable Alpha.6 semantic-shadow v1 and v2 files retain their original byte lengths and SHA-256 values. Live tests compare all stable semantic fields while excluding only the historical private-wire plan and frame identifiers, and a separate regression pins the exact current wire-v2 frame and source-bound fact validation.
• The independent identity bundle now carries three profile vectors. Its standalone verifier reproduces the compatibility, strict ASCII v2, and wheel UTF-8 v1 profile digests without linking Sealr.

Verification

Protected main retains one Required CI authority after the exact quality, macOS, Windows, ZipDiff, supply-chain, and real-kernel jobs pass. The quality job also verifies both wheel inventories, hostile fixtures, the real external installer bridge, exact crate packaging, documentation contracts, lockfiles, and optimized package consumers.

Release promotion still requires exact-main required CI, both exact-commit on-demand fuzz jobs, the release-candidate contract, a clean semantic walkthrough, target license closure, immutable-release protection, and staged-release readback before publication.

Important limitations

• No supported wheel API or CLI mode exists. The wheel profile, evaluator, identities, inventory, fixtures, and installer bridge are repository research evidence.
• The 20-wheel pilot is judgmental and too small to establish PyPI prevalence or compatibility. It contains no benign .data or Unicode-path artifact, so those consequences rely on hostile boundary fixtures.
• The external bridge proves one pinned consumer shape. It does not freeze the public API, create a general installer sandbox, or authorize bytecode generation and target-specific post-install hooks.
• apply, apply_with_options, and ordinary CLI execution remain in process. The reduced-authority Linux path is explicit and fail closed.
• Structural parsing and policy planning remain supervisor-side. The worker boundary confines payload verification, stage writes, and later non-retained reads, not interpretation.
• Successful supervised execution requires x86_64 Linux, Landlock ABI 3, and the packaged helper contract. macOS, Windows, other architectures, and lower Landlock ABIs return typed unavailability.
• ZIP64, TAR, compressed TAR, gzip, zstd, and 7z remain unsupported. Receipts and preview tree identities remain unsigned.
• Stable profile locks, portable general-purpose Unicode naming, accumulated assurance history, authenticated recovery, durability evidence, an external security audit, and production support remain roadmap gates.

See the README, wheel profile, wheel inventory, distribution contract, roadmap, and release verification commands for the exact boundary and reproducible checks.