Skip to content

Szpont Engine 0.9.0 — install, inspect, verify

Choose a tag to compare

View all tags
@dalkedev dalkedev released this 10 Nov 11:24
· 11 commits to main since this release
v0.9.0
66012d4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Szpont Engine 0.9.0 makes the first private installation reproducible: guided setup, explicit Discord diagnostics, and a small code goal whose result is checked independently.

What changed

  • npm run setup: private workspace and configuration, hidden token prompt or explicit token file/stdin, all three runner choices, and refusal to overwrite existing installations. Concurrent workspaces of uncertain ownership are preserved.
  • doctor --check-discord: bounded GET-only checks for bot identity, server owner, private forum and reply permissions. No messages or model calls; default diagnostics remain offline.
  • acceptance init / verify: a supplied Git fixture, expected 22/25 RED baseline, independent 25-case verification, and rejection of weakened tests or altered evidence.
  • Native Docker acceptance now runs the actual installer and Codex CLI, checker RED/GREEN controls and the existing sandbox/persistence checks.
  • Fresh Discord guild ownership and role validation fixes false startup rejection from incomplete Gateway caches and rejects stale ownership.
  • Clearer setup, first-goal, Docker and upgrade documentation; permission-sensitive fixtures work under private umasks.

Install

Follow the quick start, setup guide, or Docker guide. The image supports Linux amd64 and arm64 and packages Codex only. Claude Code and OpenCode remain experimental host adapters.

Verified image for reproducible deployments:

docker pull ghcr.io/dalkedev/szpont-engine@sha256:a0a9067b22fc1798ce02efed828313a4f388440174a97fe1115749c8d34867ab

Both runtime architectures carry revision 66012d42dccbdad6b514150f2b20618c09163c10, SPDX SBOM and SLSA provenance. Attached JSON records identify the observed index and runtime digests. The release workflow promoted the tested OCI artifacts without rebuilding.

Verification and limits

Linux CI: 565 engine/script tests and 36 browser tests; an additional 55 permission/snapshot checks run under umask 0077. macOS: 564 PASS and one Linux-only skip. Native container gates test the real sandbox, pinned CLI, installation and synthetic persistent state without networking or credentials.

A separate Linux installation passed setup, real Discord REST diagnostics and installation smoke. Actual Discord intake and failure receipts were verified. The isolated public deployment did not complete a model session: the reused authentication profile required a private MCP context. Same-session model continuation, model-driven supervisor acceptance and multi-day soak remain unverified. No failed job was automatically replayed, and the production service was not restarted for this test. See the measured validation record.

Public SQLite schema remains 6. Preserve a coordinated backup before upgrades. Run setup on the normal service-account host or supported image; UID-remapped agent sandboxes can intentionally fail strict ancestor ownership checks.

The known Node 24 SQLite finding remains open. This release does not claim a patched embedded runtime. Full 1.0 acceptance gates remain in the roadmap.

Assets 4
Loading