Skip to content

Aleph Skill v2.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Jul 12:36
Immutable release. Only release title and notes can be modified.
v2.1.0
35fbf3e

Aleph Skill v2.1.0

Aleph 2.1.0 ships D Research as a locked internal component, so users install one Aleph package while retaining the full bundled D Research skill surface, subject to the host capabilities and optional dependencies described below. Workspace schema_version and formula_version remain 2.0.0; there is no schema-number migration, but external D Research integrations and previously finalized workspaces must follow the compatibility and migration guidance below.

Highlights

  • Bundles D Research 3.2.0 under components/d-research/ and addresses it portably as aleph-component://d-research.
  • Verifies the component with an annotated upstream tag, commit, Git tree, reproducible source archive, exact snapshot recipe, per-file SHA-256 digests, and a component-tree digest.
  • Routes every Aleph-to-D Research subprocess through one allowlisted gateway with shell=False, filtered environment variables, workspace path controls, timeouts, and output limits.
  • Preserves full D Research ledger functionality, including 14/19/22/23-column contracts, HMAC verification, claim-only evidence import, process/blocker audit records, and portable component_binding receipts.
  • Keeps research and roleplay separated by a sealed packet/receipt boundary. Host-enforced network and tool denial remains mandatory for verified roleplay assurance.
  • Adds byte-exact workspace rebinding, upstream/Aleph canonical dual-run checks, sibling staging, and automatic invalidation of stale finalization artifacts.

Compatibility and behavior changes

  • Users need to install only the Aleph package. Hosts should register the root SKILL.md; Aleph invokes nested D Research internally. Do not invoke components/d-research/SKILL.md as a second Aleph entrypoint.
  • The verified bundle wins by default. D_RESEARCH_SKILL cannot silently override it.
  • Selecting an explicit external installation requires both --external-d-research <path> and --allow-external. Automation that expects an explicit path to be selected must supply both flags and inspect the reported source.
  • A healthy verified bundle remains the default. An incompatible explicit candidate fails closed instead of being hidden by the bundle. When the bundle is unavailable, external opt-in can also admit configured legacy discovery roots.
  • External D Research remains compatibility-limited and cannot receive bundled-verified assurance or privileged secret forwarding.
  • schema_version and formula_version remain 2.0.0; the seven domain packs remain experimental and do not authorize probability claims.
  • Aleph and bundled D Research remain licensed under CC-BY-NC-4.0. See LICENSE, THIRD_PARTY_NOTICES.md, and components/d-research/LICENSE.

Bundled D Research provenance

  • Package: d-research-skill-tools 3.2.0
  • Upstream: d-init-d/d-research-skill
  • Tag: v3.2.0
  • Annotated tag object: 091997d33825a29ed6f30b089c33de9acf897ae3
  • Commit: 8156b460b358636e69d66c10c16800045d258446
  • Git tree: 2a77a48bd98126fec5812398afd98033e03d4709
  • Canonical git archive SHA-256: 7942008985c288dd276bee459de61400662eb5a327febf84ebef9e953f2df1d7
  • Component snapshot SHA-256: aac64ef9ae80f5343818a03cdacdc003b4aee0bf27b0c4798d66ad37ac219bcd
  • Snapshot recipe: all 209 upstream tracked files minus the exact 11 repository-only paths listed in component-lock.json, with included text normalized to LF
  • Bundled snapshot: 198 locked files; D Research package manifest: 196 archive paths

From a clone of the upstream D Research repository, reproduce the canonical archive digest on a POSIX shell with host line-ending conversion disabled and the TAR permission mask pinned:

git -c core.autocrlf=false -c core.eol=lf -c tar.umask=0002 \
  archive --format=tar 8156b460b358636e69d66c10c16800045d258446 | sha256sum

Release CI fetches only the pinned annotated tag into a bare shallow repository, then verifies the tag object, peeled commit, Git tree, canonical archive, snapshot recipe, and every bundled byte before publication.

Upgrade from v2.0.1

Back up each workspace and install or extract v2.1.0 into a clean skill directory. Do not overlay unrelated files or credentials. Resolve commands from the installed Aleph root rather than the current working directory.

Bash

export ALEPH_SKILL_ROOT="$(cd "/absolute/path/to/aleph-skill" && pwd -P)"
export ALEPH_WORKSPACE="/absolute/path/to/workspace"

python "$ALEPH_SKILL_ROOT/scripts/preflight.py" --json
python "$ALEPH_SKILL_ROOT/scripts/research_gateway.py" research:preflight --json
python "$ALEPH_SKILL_ROOT/scripts/research_gateway.py" research:manifest --json
python "$ALEPH_SKILL_ROOT/scripts/research_gateway.py" research:route --json

PowerShell

$env:ALEPH_SKILL_ROOT = (Resolve-Path 'C:\absolute\path\to\aleph-skill').Path
$env:ALEPH_WORKSPACE = (Resolve-Path 'C:\absolute\path\to\workspace').Path

python "$env:ALEPH_SKILL_ROOT\scripts\preflight.py" --json
python "$env:ALEPH_SKILL_ROOT\scripts\research_gateway.py" research:preflight --json
python "$env:ALEPH_SKILL_ROOT\scripts\research_gateway.py" research:manifest --json
python "$env:ALEPH_SKILL_ROOT\scripts\research_gateway.py" research:route --json

The package preflight must report top-level status: pass together with d_research.status: available, d_research.source: bundled, d_research.path: aleph-component://d-research, and d_research.lock_ok: true. Each gateway probe must exit successfully, report status: ok, and retain the bundled component_binding. A successful process exit alone is not sufficient evidence of a verified bundle.

Every finalized v2.0.1 workspace needs revalidation because validator_version changes from 2.0.1 to 2.1.0; old version-bound receipts are stale even when the workspace does not use an absolute D Research path. Preserve the original as the rollback copy and create a separate, non-overwriting working copy. For a workspace that does not need rebinding, select that copy and begin with draft validation:

Bash revalidation without rebinding

export ALEPH_TARGET_WORKSPACE="/absolute/path/to/workspace-v2.1-revalidate"
test -d "$ALEPH_TARGET_WORKSPACE"
python "$ALEPH_SKILL_ROOT/scripts/validate_simulation_artifacts.py" --workspace "$ALEPH_TARGET_WORKSPACE" --mode draft --write-report --json

PowerShell revalidation without rebinding

$env:ALEPH_TARGET_WORKSPACE = (Resolve-Path 'C:\absolute\path\to\workspace-v2.1-revalidate').Path
python "$env:ALEPH_SKILL_ROOT\scripts\validate_simulation_artifacts.py" --workspace "$env:ALEPH_TARGET_WORKSPACE" --mode draft --write-report --json

For a workspace that stores an absolute external D Research path, first run the non-mutating equivalence check. The rebinder writes a sibling <workspace>-bundled-bind directory and never mutates the source workspace.

Bash migration

python "$ALEPH_SKILL_ROOT/scripts/migrate_workspace.py" --source "$ALEPH_WORKSPACE" --bind-bundled-d-research --check --json
python "$ALEPH_SKILL_ROOT/scripts/migrate_workspace.py" --source "$ALEPH_WORKSPACE" --bind-bundled-d-research --json

export ALEPH_TARGET_WORKSPACE="${ALEPH_WORKSPACE}-bundled-bind"
python "$ALEPH_SKILL_ROOT/scripts/validate_simulation_artifacts.py" --workspace "$ALEPH_TARGET_WORKSPACE" --mode draft --write-report --json

PowerShell migration

python "$env:ALEPH_SKILL_ROOT\scripts\migrate_workspace.py" --source "$env:ALEPH_WORKSPACE" --bind-bundled-d-research --check --json
python "$env:ALEPH_SKILL_ROOT\scripts\migrate_workspace.py" --source "$env:ALEPH_WORKSPACE" --bind-bundled-d-research --json

$env:ALEPH_TARGET_WORKSPACE = $env:ALEPH_WORKSPACE + '-bundled-bind'
python "$env:ALEPH_SKILL_ROOT\scripts\validate_simulation_artifacts.py" --workspace "$env:ALEPH_TARGET_WORKSPACE" --mode draft --write-report --json

Inspect migration-bind-report.json and the draft validation report before continuing. Rebinding rewrites component identity and deliberately removes the stale artifact index, validation receipt, quality receipt, and finalization.

For either upgrade path, re-run every affected original lifecycle command against ALEPH_TARGET_WORKSPACE, including compile/run/replay, sensitivity, or hindcast where applicable. Aleph cannot infer the scenario-specific arguments for those commands. Render a fresh report before rebuilding final receipts.

After those workspace-specific stages succeed, complete the lifecycle:

Bash finalization

python "$ALEPH_SKILL_ROOT/scripts/render_simulation_report.py" --workspace "$ALEPH_TARGET_WORKSPACE"
python "$ALEPH_SKILL_ROOT/scripts/finalize_simulation.py" --workspace "$ALEPH_TARGET_WORKSPACE" --json
python "$ALEPH_SKILL_ROOT/scripts/validate_simulation_artifacts.py" --workspace "$ALEPH_TARGET_WORKSPACE" --mode final --require-report --write-report --json
python "$ALEPH_SKILL_ROOT/scripts/evaluate_simulation_quality.py" --workspace "$ALEPH_TARGET_WORKSPACE" --threshold 90 --enforce --json

PowerShell finalization

python "$env:ALEPH_SKILL_ROOT\scripts\render_simulation_report.py" --workspace "$env:ALEPH_TARGET_WORKSPACE"
python "$env:ALEPH_SKILL_ROOT\scripts\finalize_simulation.py" --workspace "$env:ALEPH_TARGET_WORKSPACE" --json
python "$env:ALEPH_SKILL_ROOT\scripts\validate_simulation_artifacts.py" --workspace "$env:ALEPH_TARGET_WORKSPACE" --mode final --require-report --write-report --json
python "$env:ALEPH_SKILL_ROOT\scripts\evaluate_simulation_quality.py" --workspace "$env:ALEPH_TARGET_WORKSPACE" --threshold 90 --enforce --json

When a research ledger has an HMAC sidecar, set D_RESEARCH_LEDGER_KEY in the environment before any step that verifies the ledger. Never place the key in the workspace or command line.

If --check reports COMPONENT_DRIFT, do not force the rewrite. Keep the workspace unchanged and either align the external installation byte-for-byte with the pinned snapshot or continue using the untouched v2.0.1 environment. External compatibility mode is intended for legacy and development fallback; request an explicit candidate with both flags, then trust the reported source rather than assuming that the candidate replaced a healthy bundle:

python "$ALEPH_SKILL_ROOT/scripts/preflight.py" --external-d-research "/absolute/path/to/d-research" --allow-external --json

Rollback to v2.0.1

The preferred rollback is to reinstall v2.0.1 from its verified ZIP in a separate clean skill directory and return to the untouched pre-bind workspace. The v2.1 rebinder creates a sibling workspace specifically so this source remains available. Verify the restored external D Research installation with the v2.0.1 command surface.

Bash rollback preflight

export ALEPH_201_ROOT="$(cd "/absolute/path/to/aleph-skill-v2.0.1" && pwd -P)"
export D_RESEARCH_ROOT="$(cd "/absolute/path/to/d-research" && pwd -P)"
python "$ALEPH_201_ROOT/scripts/preflight.py" --d-research "$D_RESEARCH_ROOT" --json

PowerShell rollback preflight

$env:ALEPH_201_ROOT = (Resolve-Path 'C:\absolute\path\to\aleph-skill-v2.0.1').Path
$env:D_RESEARCH_ROOT = (Resolve-Path 'C:\absolute\path\to\d-research').Path
python "$env:ALEPH_201_ROOT\scripts\preflight.py" --d-research "$env:D_RESEARCH_ROOT" --json

Do not point v2.0.1 at a workspace whose execution.d_research.path is aleph-component://d-research: v2.0.1 has no bundled-component URI, component lock, or bind/unbind protocol. If the original workspace is unavailable, there is no automatic downgrade migration. Restore a real compatible external D Research path, then regenerate the D Research import receipt, quality output, and finalization receipts with v2.0.1 before requiring a clean final validation.

Archive the v2.1.0 component-lock.json separately if it is needed for audit comparison; do not copy it into a v2.0.1 skill directory. The workspace schema remains 2.0.0, but component-bound receipts and finalized artifacts are version-sensitive.

Security and operational limits

  • Node.js, Playwright, Chromium, Python extras, browser binaries, credentials, and node_modules are not bundled and are never auto-installed.
  • Missing optional capability produces an explicit degraded, delegated, or structured-blocker result; it never becomes fabricated evidence.
  • Environment filtering is defense in depth, not a portable OS sandbox. A host that cannot enforce roleplay network/tool denial must remain below verified assurance.
  • Browser smoke is tested separately from no-browser behavior so delegated cases cannot be reported as browser success.
  • External compatibility mode remains limited; diagnostic scores cannot override hard assurance gates.

Verification results

The tagged release workflow completed successfully with 19 verification jobs plus publication:

  • Ubuntu 24.04, macOS 15, and Windows 2025 on Python 3.10, 3.11, 3.12, and 3.13
  • D Research no-browser acceptance on Node.js 18, 20, and 22
  • Real Chromium smoke through the Aleph gateway
  • Strict Ruff, mypy, coverage, lifecycle, adversarial, replay, adapter, domain-pack, package, component-lock, and upstream-provenance gates
  • Two independent manifest-exact builds compared byte-for-byte before publication
  • GitHub build-provenance attestation bound to refs/tags/v2.1.0

The provenance records are stored by GitHub's attestation service rather than attached as separate release files.

Runtime host-contract forward checks were also completed read-only with Grok Build (grok-4.5), OpenCode through Ollama Cloud (glm-5.2, kimi-k2.6, minimax-m3), and Cline Pass (glm-5.2, kimi-k2.6, kimi-k2.7-code, minimax-m3). These checks validate packaged routing and safety-contract interpretation; they do not grant simulation assurance or calibrate a domain pack.

Published asset SHA-256 digests:

  • aleph-skill-v2.1.0.zip: 38dd834b1fcbdc59c505f6d841b7bd1218ef9c225f429d48793d7fc6da267be4
  • distribution-manifest.json: 5fac608584485c3859556c8df54ab8ac97eda5a2c8a3f7403f6556574ca094c0
  • SHA256SUMS.txt: d1397850bfb67a150fcf713bf587199064a104378b171242b1d34237b3e18ec1

Verify the downloaded ZIP and manifest from a directory containing all three assets:

sha256sum -c SHA256SUMS.txt
gh attestation verify aleph-skill-v2.1.0.zip \
  --repo d-init-d/aleph-skill \
  --signer-workflow d-init-d/aleph-skill/.github/workflows/release.yml \
  --source-ref refs/tags/v2.1.0
for asset in distribution-manifest.json SHA256SUMS.txt; do
  gh attestation verify "$asset" \
    --repo d-init-d/aleph-skill \
    --signer-workflow d-init-d/aleph-skill/.github/workflows/release.yml \
    --source-ref refs/tags/v2.1.0
done

PowerShell users can verify every line fail-closed:

Get-Content .\SHA256SUMS.txt | ForEach-Object {
    if ($_ -notmatch '^(?<hash>[0-9A-Fa-f]{64})\s{2}(?<file>.+)$') {
        throw "Malformed checksum line: $_"
    }
    $expected = $Matches.hash
    $file = $Matches.file
    $actual = (Get-FileHash -Algorithm SHA256 -LiteralPath $file).Hash
    if ($actual -ne $expected) {
        throw "SHA-256 mismatch: $file"
    }
    "OK: $file"
}

@('aleph-skill-v2.1.0.zip', 'distribution-manifest.json', 'SHA256SUMS.txt') | ForEach-Object {
    gh attestation verify $_ `
        --repo d-init-d/aleph-skill `
        --signer-workflow d-init-d/aleph-skill/.github/workflows/release.yml `
        --source-ref refs/tags/v2.1.0
    if ($LASTEXITCODE -ne 0) {
        throw "Attestation verification failed: $_"
    }
}

See the full changelog and the v2.0.1...v2.1.0 comparison for the complete change set.

Assets 6
Loading