apmx 0.8.0

EXPERIMENTAL prerelease. Native notices and exact downloaded bytes are gated; this is not production certification.

Standalone apmx 0.8.0; candidate commit fae2067a0dc6ff07beda714015ff9e648f41ce63.

Changes in v0.8.0: Audit rows name what they check

• Breaking: the apmx audit row Ingredients is now Dependencies in terminal output, JSON and SARIF (apmx-audit/dependencies) and --explain dependencies; --explain ingredients is gone, with no alias.
• Breaking: the separate Standards row is removed. The same schema validation (in-toto Statement v1, SLSA Provenance v1, in-toto Test Result, CycloneDX 1.5, SLSA VSA v1) runs inside Integrity, so a schema failure is an Integrity failure with the same message. Rows are now Policy, Integrity, Factory, Checks, Dependencies, Revocation, Outputs, Identity.
• The audit JSON schema is apmx-audit/2; update anything that parses rows by name.
• Reference the actions and run.yml at @v0.8.0 or its commit SHA, and re-pin factories.signers[].workflow_sha to git rev-parse v0.8.0^{commit}.

See the v0.8.0 changelog.

What's new since v0.2.0

• Run a factory directory without writing orchestration: APMX derives execution order from the contracts' declared file dependencies.
• Deliver multiple output files together. Handoffs require every declared file, complete passing checks and an intact recorded inventory; the aggregate artifact view retains admitted outputs and the original required inputs/checks.
• Export real patches from private source edits with the bounded artifact tools, without changing the original checkout.
• Discover selected imported skills through native Copilot skill discovery, with clearer package-preparation progress and bounded terminal evidence.
• Try the software-factory example with optional Gherkin/Behave acceptance checks and separate regression checks. Its standalone checker now supports deeply nested Windows file paths with child-only Git configuration.

Compatibility and migration

BREAKING: imported skill metadata. Previously accepted imported skills can now fail admission without a nonempty name and description in SKILL.md. Names must be 1-64 lowercase letters/digits separated by single hyphens, with no leading or trailing hyphen. Selected context names must not collide case-insensitively; unsupported activation metadata is rejected.

Update the authored source package (for example, name: handoff-style with description: Write concise handoffs.), then select its updated revision through the normal dependency workflow, keeping apm.yml and its lock coherent. Do not patch generated apm_modules copies or edit lock digests by hand. Migration guide.

Leaf records use apm-contract-run/0.3 and factory records use apmx-contract-chain/0.2, separating execution from native assurance. Historical records are not rewritten and cannot authorize new handoffs.

Factory execution asks for consent interactively. Automation must pass --allow-host-access --allow-unproven-inputs; these flags do not admit failed or incomplete handoffs. Native execution is not a sandbox. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

Installation and assurance limits

Five native onedir archives include the runtime, LICENSE, NOTICE, release metadata, and the pinned official APM 0.33.0 backend with its complete runtime under libexec/apm. Extract the complete archive; do not move the executable out of its runtime directory.

Git, Copilot CLI, and contract-declared checker tools are external prerequisites. The CI actor is an explicitly hermetic Copilot JSONL protocol fixture, NOT live inference. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

No trusted publisher signature or Apple notarization is provided. macOS may carry PyInstaller's local ad-hoc signature; it is not publisher identity. Checksums prove byte integrity, not publisher authentication. Do not disable platform security to run these binaries.

apmx 0.7.1

EXPERIMENTAL prerelease. Native notices and exact downloaded bytes are gated; this is not production certification.

Standalone apmx 0.7.1; candidate commit a70c1939dddc6f5d7888b76fd5bb8bab3e69e886.

Changes in v0.7.1: A PR cannot rewrite its own gate

Green means accepted by proof, and nothing else.

• Security: the gate templates now run on pull_request_target, so the base branch's copy runs and a PR cannot edit or delete its own audit workflow (on pull_request it could, and the required check turned green). The PR head is checked out as bytes without credentials and nothing from it runs. Update your audit.yml the same way.
• In a pull request, apmx audit never reads policy from the PR's working tree, runs APM's policy discovery in an empty project and refuses a --policy file inside the checkout.
• A PR that carries no factory attestation fails with Not a factory delivery: the check only passes factory deliveries; merge other PRs through your normal review process (for example a ruleset bypass for maintainers).
• Reference the actions and run.yml at @v0.7.1 or its commit SHA.

See the v0.7.1 changelog.

What's new since v0.2.0

• Run a factory directory without writing orchestration: APMX derives execution order from the contracts' declared file dependencies.
• Deliver multiple output files together. Handoffs require every declared file, complete passing checks and an intact recorded inventory; the aggregate artifact view retains admitted outputs and the original required inputs/checks.
• Export real patches from private source edits with the bounded artifact tools, without changing the original checkout.
• Discover selected imported skills through native Copilot skill discovery, with clearer package-preparation progress and bounded terminal evidence.
• Try the software-factory example with optional Gherkin/Behave acceptance checks and separate regression checks. Its standalone checker now supports deeply nested Windows file paths with child-only Git configuration.

Compatibility and migration

BREAKING: imported skill metadata. Previously accepted imported skills can now fail admission without a nonempty name and description in SKILL.md. Names must be 1-64 lowercase letters/digits separated by single hyphens, with no leading or trailing hyphen. Selected context names must not collide case-insensitively; unsupported activation metadata is rejected.

Update the authored source package (for example, name: handoff-style with description: Write concise handoffs.), then select its updated revision through the normal dependency workflow, keeping apm.yml and its lock coherent. Do not patch generated apm_modules copies or edit lock digests by hand. Migration guide.

Leaf records use apm-contract-run/0.3 and factory records use apmx-contract-chain/0.2, separating execution from native assurance. Historical records are not rewritten and cannot authorize new handoffs.

Factory execution asks for consent interactively. Automation must pass --allow-host-access --allow-unproven-inputs; these flags do not admit failed or incomplete handoffs. Native execution is not a sandbox. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

Installation and assurance limits

Five native onedir archives include the runtime, LICENSE, NOTICE, release metadata, and the pinned official APM 0.33.0 backend with its complete runtime under libexec/apm. Extract the complete archive; do not move the executable out of its runtime directory.

Git, Copilot CLI, and contract-declared checker tools are external prerequisites. The CI actor is an explicitly hermetic Copilot JSONL protocol fixture, NOT live inference. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

No trusted publisher signature or Apple notarization is provided. macOS may carry PyInstaller's local ad-hoc signature; it is not publisher identity. Checksums prove byte integrity, not publisher authentication. Do not disable platform security to run these binaries.

apmx 0.7.0

EXPERIMENTAL prerelease. Native notices and exact downloaded bytes are gated; this is not production certification.

Standalone apmx 0.7.0; candidate commit 315491bff45f653e728c91c7ad1fc07465b97535.

Changes in v0.7.0: One receipt bundle, code-only PRs, central factories

Receipts are one standard in-toto bundle; PRs carry only code; run factories centrally across repos.

• Breaking: every COMPLETE run writes one receipt.intoto.jsonl (SLSA Provenance v1, in-toto Test Results and the CycloneDX 1.5 inventory, one DSSE envelope per line) plus content-addressed evidence/sha256/<hex>. It replaces the v1 receipt/ folder, which is no longer read.
• PRs carry code only. run.yml signs a SLSA Verification Summary over the delivered files and attests the receipt bundle beside it; apmx audit looks the PR's changed files up by SHA-256 in the signer's attestation store and refuses a PR built on a stale base.
• Run factories centrally: run.yml takes target-repository, target-ref, a GitHub App (target-app-client-id, target-app-private-key) or target-token, and deliver: pull-request|branch|bundle. The agent's job never receives a target credential (examples/factory-platform).
• Pin a signer to immutable code with factories.signers[].workflow_sha; the signing certificate's commit or annotated tag object both match.
• apmx audit --explain and --export abom; stages record harness, harness version and models (recorded, not yet enforced).
• Reference the actions and run.yml at @v0.7.0 or its commit SHA.

See the v0.7.0 changelog.

What's new since v0.2.0

• Run a factory directory without writing orchestration: APMX derives execution order from the contracts' declared file dependencies.
• Deliver multiple output files together. Handoffs require every declared file, complete passing checks and an intact recorded inventory; the aggregate artifact view retains admitted outputs and the original required inputs/checks.
• Export real patches from private source edits with the bounded artifact tools, without changing the original checkout.
• Discover selected imported skills through native Copilot skill discovery, with clearer package-preparation progress and bounded terminal evidence.
• Try the software-factory example with optional Gherkin/Behave acceptance checks and separate regression checks. Its standalone checker now supports deeply nested Windows file paths with child-only Git configuration.

Compatibility and migration

BREAKING: imported skill metadata. Previously accepted imported skills can now fail admission without a nonempty name and description in SKILL.md. Names must be 1-64 lowercase letters/digits separated by single hyphens, with no leading or trailing hyphen. Selected context names must not collide case-insensitively; unsupported activation metadata is rejected.

Update the authored source package (for example, name: handoff-style with description: Write concise handoffs.), then select its updated revision through the normal dependency workflow, keeping apm.yml and its lock coherent. Do not patch generated apm_modules copies or edit lock digests by hand. Migration guide.

Leaf records use apm-contract-run/0.3 and factory records use apmx-contract-chain/0.2, separating execution from native assurance. Historical records are not rewritten and cannot authorize new handoffs.

Factory execution asks for consent interactively. Automation must pass --allow-host-access --allow-unproven-inputs; these flags do not admit failed or incomplete handoffs. Native execution is not a sandbox. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

Installation and assurance limits

Five native onedir archives include the runtime, LICENSE, NOTICE, release metadata, and the pinned official APM 0.33.0 backend with its complete runtime under libexec/apm. Extract the complete archive; do not move the executable out of its runtime directory.

Git, Copilot CLI, and contract-declared checker tools are external prerequisites. The CI actor is an explicitly hermetic Copilot JSONL protocol fixture, NOT live inference. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

No trusted publisher signature or Apple notarization is provided. macOS may carry PyInstaller's local ad-hoc signature; it is not publisher identity. Checksums prove byte integrity, not publisher authentication. Do not disable platform security to run these binaries.

apmx 0.6.0

EXPERIMENTAL prerelease. Native notices and exact downloaded bytes are gated; this is not production certification.

Standalone apmx 0.6.0; candidate commit cadfa207e4645306199ddb85271c5f3e13340924.

Changes in v0.6.0: Accept factory PRs by proof

Review a factory once, then accept its pull requests with one apmx audit workflow step instead of re-reading every generated diff (examples/accept-factory-prs).

• apmx audit needs no flags: locally it audits the newest COMPLETE run; in a GitHub pull request it audits the receipt the PR adds and binds every changed file to a receipt output by SHA-256. --format sarif emits SARIF 2.1.0.
• One policy file for APM and apmx: apmx audit discovers the same apm-policy.yml as apm audit (read from the PR base in a PR) and owns one factories section: approved definition digests, revoked capability content, required signatures and allowed signer workflows. Its rules gate with exit 1; an unreadable policy is INCOMPLETE (exit 2).
• The Identity row verifies the receipt's GitHub artifact attestation with gh attestation verify and rejects unsigned receipts under require_signed.
• apmx check PRODUCER_RECEIPT [FACTORY] reruns a factory's checks on a producer's output bytes with no agent and writes the receipt of record. check is now a reserved word.
• The reusable .github/workflows/run.yml runs produce (agent), check (no agent) and attest (OIDC, no candidate code) as separate jobs. The setup action installs this release only after verifying its SHA-256; the attest action signs a VALID receipt. Reference them at @v0.6.0 or its commit SHA.
• run.yml runs a pinned factory package (factory: owner/repo#ref) against the caller's workspace, and apmx check --from PACKAGE_REF re-checks it; a ref that moves between jobs withdraws the receipt. Its checks-requirements input installs a factory's hash-pinned check tools for the produce and check jobs.
• A PR may apply a factory's patch instead of committing the .diff: apmx audit applies it to the merge-base with strict git apply, and every touched file at head must match.
• apmx --from OWNER/REPO#REF --plan previews a package that is not installed, resolving it in a private temporary workspace without installing anything or calling a model.
• scripts/demo.py prepare --factory-ref OWNER/REPO#TAG prepares the demo kit against a pinned factory package, so it shows the same definition digest as a signed CI receipt.
• Native Windows retries transient antivirus or indexer locks on the bundled APM pin and backend with bounded backoff instead of halting.

See the v0.6.0 changelog.

What's new since v0.2.0

• Run a factory directory without writing orchestration: APMX derives execution order from the contracts' declared file dependencies.
• Deliver multiple output files together. Handoffs require every declared file, complete passing checks and an intact recorded inventory; the aggregate artifact view retains admitted outputs and the original required inputs/checks.
• Export real patches from private source edits with the bounded artifact tools, without changing the original checkout.
• Discover selected imported skills through native Copilot skill discovery, with clearer package-preparation progress and bounded terminal evidence.
• Try the software-factory example with optional Gherkin/Behave acceptance checks and separate regression checks. Its standalone checker now supports deeply nested Windows file paths with child-only Git configuration.

Compatibility and migration

BREAKING: imported skill metadata. Previously accepted imported skills can now fail admission without a nonempty name and description in SKILL.md. Names must be 1-64 lowercase letters/digits separated by single hyphens, with no leading or trailing hyphen. Selected context names must not collide case-insensitively; unsupported activation metadata is rejected.

Update the authored source package (for example, name: handoff-style with description: Write concise handoffs.), then select its updated revision through the normal dependency workflow, keeping apm.yml and its lock coherent. Do not patch generated apm_modules copies or edit lock digests by hand. Migration guide.

Leaf records use apm-contract-run/0.3 and factory records use apmx-contract-chain/0.2, separating execution from native assurance. Historical records are not rewritten and cannot authorize new handoffs.

Factory execution asks for consent interactively. Automation must pass --allow-host-access --allow-unproven-inputs; these flags do not admit failed or incomplete handoffs. Native execution is not a sandbox. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

Installation and assurance limits

Five native onedir archives include the runtime, LICENSE, NOTICE, release metadata, and the pinned official APM 0.33.0 backend with its complete runtime under libexec/apm. Extract the complete archive; do not move the executable out of its runtime directory.

Git, Copilot CLI, and contract-declared checker tools are external prerequisites. The CI actor is an explicitly hermetic Copilot JSONL protocol fixture, NOT live inference. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

No trusted publisher signature or Apple notarization is provided. macOS may carry PyInstaller's local ad-hoc signature; it is not publisher identity. Checksums prove byte integrity, not publisher authentication. Do not disable platform security to run these binaries.

apmx 0.5.0

EXPERIMENTAL prerelease. Native notices and exact downloaded bytes are gated; this is not production certification.

Standalone apmx 0.5.0; candidate commit 6f9e7e4f444451c2dc810c13fef5c2016517177d.

Changes in v0.5.0

• Run a five-stage source factory that captures the consumer project implicitly and delivers checked code and documentation patches without per-file workspace declarations.
• Opt in to bounded repair with fixed inputs and checks, a shared deadline and retained rejected attempts; contracts without a budget remain single-attempt.
• Run the same source factory through the native OpenCode 1.2.24 profile as well as native Copilot.
• Every COMPLETE run delivers an unsigned receipt (CycloneDX 1.5, in-toto/SLSA and Test Result evidence) under receipt/, formerly evidence/. Receipt export failure returns command exit 23 without changing the recorded COMPLETE outcome.
• Verify a receipt with apmx audit <receipt-dir>, delegated to the bundled APM. audit is now a reserved word; run a directory named audit as ./audit.
• Bundle official APM 0.33.0, which fails preparation before any producer launches when a packaged contract's publisher ref is unavailable or incompatible with a consumer pin.
• Default run output and --plan are compact: long check excerpts and harness stderr lines are condensed, and full details remain under --verbose and in the retained transcript.
• The five-stage software-factory example can repair out-of-profile patches and documentation link mistakes within declared build and documentation budgets.
• Ctrl+C during a POSIX agent run is a cooperative stop that still confirms cleanup only once the process group is gone.
• apmx's internal Git operations no longer start Git's background maintenance, which could change a captured .git while it was copied and halt the run.

See the v0.5.0 changelog.

What's new since v0.2.0

• Run a factory directory without writing orchestration: APMX derives execution order from the contracts' declared file dependencies.
• Deliver multiple output files together. Handoffs require every declared file, complete passing checks and an intact recorded inventory; the aggregate artifact view retains admitted outputs and the original required inputs/checks.
• Export real patches from private source edits with the bounded artifact tools, without changing the original checkout.
• Discover selected imported skills through native Copilot skill discovery, with clearer package-preparation progress and bounded terminal evidence.
• Try the software-factory example with optional Gherkin/Behave acceptance checks and separate regression checks. Its standalone checker now supports deeply nested Windows file paths with child-only Git configuration.

Compatibility and migration

BREAKING: imported skill metadata. Previously accepted imported skills can now fail admission without a nonempty name and description in SKILL.md. Names must be 1-64 lowercase letters/digits separated by single hyphens, with no leading or trailing hyphen. Selected context names must not collide case-insensitively; unsupported activation metadata is rejected.

Update the authored source package (for example, name: handoff-style with description: Write concise handoffs.), then select its updated revision through the normal dependency workflow, keeping apm.yml and its lock coherent. Do not patch generated apm_modules copies or edit lock digests by hand. Migration guide.

Leaf records use apm-contract-run/0.3 and factory records use apmx-contract-chain/0.2, separating execution from native assurance. Historical records are not rewritten and cannot authorize new handoffs.

Factory execution asks for consent interactively. Automation must pass --allow-host-access --allow-unproven-inputs; these flags do not admit failed or incomplete handoffs. Native execution is not a sandbox. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

Installation and assurance limits

Five native onedir archives include the runtime, LICENSE, NOTICE, release metadata, and the pinned official APM 0.33.0 backend with its complete runtime under libexec/apm. Extract the complete archive; do not move the executable out of its runtime directory.

Git, Copilot CLI, and contract-declared checker tools are external prerequisites. The CI actor is an explicitly hermetic Copilot JSONL protocol fixture, NOT live inference. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

No trusted publisher signature or Apple notarization is provided. macOS may carry PyInstaller's local ad-hoc signature; it is not publisher identity. Checksums prove byte integrity, not publisher authentication. Do not disable platform security to run these binaries.

apmx 0.4.2

EXPERIMENTAL prerelease. Native notices and exact downloaded bytes are gated; this is not production certification.

Standalone apmx 0.4.2; candidate commit 00928304850d70d36213da2d0230ac31d7d56fb1.

Changes in v0.4.2

Make the Windows logger presentation tests assert dim styling on actual elapsed-time metadata instead of a platform-dependent trailing line position. Use path-safe labels for native, LF and CRLF output variants while preserving exact newline translation, byte-identical transcript and finalization coverage.

No GitHub release or native assets were published for v0.4.1. Its immutable public source tag remains unchanged and records the failed release-preparation candidate. These v0.4.2 archives are fresh builds and do not reuse, repack or relabel v0.4.1 assets. The earlier v0.4.0 tag and failed-candidate record also remain unchanged.

What's new since v0.2.0

• Run a factory directory without writing orchestration: APMX derives execution order from the contracts' declared file dependencies.
• Deliver multiple output files together. Handoffs require every declared file, complete passing checks and an intact recorded inventory; the aggregate artifact view retains admitted outputs and the original required inputs/checks.
• Export real patches from private source edits with the bounded artifact tools, without changing the original checkout.
• Discover selected imported skills through native Copilot skill discovery, with clearer package-preparation progress and bounded terminal evidence.
• Try the software-factory example with optional Gherkin/Behave acceptance checks and separate regression checks. Its standalone checker now supports deeply nested Windows file paths with child-only Git configuration.

Compatibility and migration

BREAKING: imported skill metadata. Previously accepted imported skills can now fail admission without a nonempty name and description in SKILL.md. Names must be 1-64 lowercase letters/digits separated by single hyphens, with no leading or trailing hyphen. Selected context names must not collide case-insensitively; unsupported activation metadata is rejected.

Update the authored source package (for example, name: handoff-style with description: Write concise handoffs.), then select its updated revision through the normal dependency workflow, keeping apm.yml and its lock coherent. Do not patch generated apm_modules copies or edit lock digests by hand. Migration guide.

Leaf records use apm-contract-run/0.3 and factory records use apmx-contract-chain/0.2, separating execution from native assurance. Historical records are not rewritten and cannot authorize new handoffs.

Factory execution asks for consent interactively. Automation must pass --allow-host-access --allow-unproven-inputs; these flags do not admit failed or incomplete handoffs. Native execution is not a sandbox. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

Installation and assurance limits

Five native onedir archives include the runtime, LICENSE, NOTICE, release metadata, and the pinned official APM 0.30.0 backend with its complete runtime under libexec/apm. Extract the complete archive; do not move the executable out of its runtime directory.

Git, Copilot CLI, and contract-declared checker tools are external prerequisites. The CI actor is an explicitly hermetic Copilot JSONL protocol fixture, NOT live inference. Complete validated and finalized execution yields COMPLETE (0), not isolation or certification. Incomplete work remains UNPROVEN (21); rejection 20; halt 22.

No trusted publisher signature or Apple notarization is provided. macOS may carry PyInstaller's local ad-hoc signature; it is not publisher identity. Checksums prove byte integrity, not publisher authentication. Do not disable platform security to run these binaries.

apmx 0.3.2

EXPERIMENTAL prerelease. Native notices and exact downloaded bytes are gated; this is not production certification.

Standalone apmx 0.3.2; candidate commit 046520f2b57017684b9bc5b15913c72916366a63.

Changes in v0.3.2

Use the declared target's path-component ordering for native inventories, rather than the verifier host's ordering. Keep exact whole-inventory equality, record multiplicity, case-sensitive path identity and every hash/format/symlink field. Stored manifests are never reordered or rewritten.

All five v0.3.1 native builds and smoke matrices passed, but Linux draft staging stopped before release creation on a Windows inventory-order false alarm. This is separate from the v0.3.0 factory smoke fixture path comparison corrected in v0.3.1. The v0.3.0 and v0.3.1 tags and archive evidence remain unchanged. These v0.3.2 archives are fresh builds, not repacked or relabeled earlier artifacts.

What's new since v0.2.0

• Run a factory directory without writing orchestration: APMX derives execution order from the contracts' declared file dependencies.
• Deliver multiple output files together. Handoffs require every declared file, complete passing checks and an intact recorded inventory; the aggregate artifact view retains admitted outputs and the original required inputs/checks.
• Export real patches from private source edits with the bounded artifact tools, without changing the original checkout.
• Discover selected imported skills through native Copilot skill discovery, with clearer package-preparation progress and bounded terminal evidence.
• Try the software-factory example with optional Gherkin/Behave acceptance checks and separate regression checks. Its standalone checker now supports deeply nested Windows file paths with child-only Git configuration.

Compatibility and migration

BREAKING: imported skill metadata. Previously accepted imported skills can now fail admission without a nonempty name and description in SKILL.md. Names must be 1-64 lowercase letters/digits separated by single hyphens, with no leading or trailing hyphen. Selected context names must not collide case-insensitively; unsupported activation metadata is rejected.

Update the authored source package (for example, name: handoff-style with description: Write concise handoffs.), then select its updated revision through the normal dependency workflow, keeping apm.yml and its lock coherent. Do not patch generated apm_modules copies or edit lock digests by hand. Migration guide.

Scalar contracts and single-contract invocations remain supported. Scalar run records retain apm-contract-run/0.1; multiple-output inventories use apm-contract-run/0.2. Existing saved runs are not rewritten.

Factory execution asks for consent interactively. Automation must pass --allow-host-access --allow-unproven-inputs; these flags do not admit failed or incomplete handoffs. Native execution is not a sandbox, and complete passing checks still yield UNPROVEN (21), not VERIFIED.

Installation and assurance limits

Follow the native installation guide for checksum verification and platform-specific setup.

Five native onedir archives include the runtime, LICENSE, NOTICE, release metadata, and the pinned official APM 0.30.0 backend with its complete runtime under libexec/apm. Extract the complete archive; do not move the executable out of its runtime directory.

Git, Copilot CLI, and contract-declared checker tools are external prerequisites. The CI actor is an explicitly hermetic Copilot JSONL protocol fixture, NOT live inference. Passing native checks yield UNPROVEN (21), rejection 20, operational halt 22.

No trusted publisher signature or Apple notarization is provided. macOS may carry PyInstaller's local ad-hoc signature; it is not publisher identity. Checksums prove byte integrity, not publisher authentication. Do not disable platform security to run these binaries.