AIOS v0.1.0-alpha.3

AIOS v0.1.0-alpha.3 — Final Stabilization

This is the public-stabilization release on the Alpha track. No new core features; only the release surface layer.

What this release fixes vs v0.1.0-alpha.2

• Version consistency: pyproject.toml and setup.py are now �.1.0a3 (PEP 440 alpha), matching the public Git tag scheme. The Git Tag (�0.1.0-alpha.3) and the Python distribution version (�.1.0a3) both derive from the same single source of truth (pyproject.toml [project].version).
• CI stability: the Syntax and import checks job now uses .github/workflows/scripts/import_smoke.py which performs AST-based syntax + import-statement validation. It completes in ~3 seconds. All six CI jobs (Syntax and import checks, Core unit tests, Registry and path-boundary tests, Secret pattern scan, License header / third-party check, Build sdist and wheel) are green on the merge commit. No cancellations.
• File count explanation (351 -> 349 -> 349): alpha.2 archive (349 files) and alpha.3 archive (352 files) both use git archive which honors .gitignore. alpha.1 archive (351 files) used �sdtar which did not. The two extra files in alpha.1 were .env.example (matched by the .env.* ignore pattern) and kernel/centers/intelligence_growth_center/intel.db (explicit rule). Both are runtime-generated or template-only. See #8 for the full analysis.

Community infrastructure

• Discussions enabled. Welcome discussion posted.
• Milestone v0.1.0-alpha.3 created.
• CONTRIBUTOR_QUICKSTART.md added: local setup, offline tests, PR workflow, style.
• .github/CODEOWNERS added: default owner + sensitive areas.
• Branch protection on main: no force-push, no deletion, squash-only, conversation-resolution required, all six CI jobs as required status checks.

Security

• secret_scanning and secret_scanning_push_protection enabled.
• dependabot_security_updates enabled.
• Vulnerability alerts: not available in this GitHub account tier (documented).
• No Repository Secrets created.
• No CI continue-on-error introduced.

What this release does NOT change

• AIOS business code is unchanged. No new capabilities are claimed.
• The project remains Alpha — not production-ready.
• �0.1.0-alpha.1 and �0.1.0-alpha.2 tags, releases, and NAS archives are preserved unchanged.
• Local credential incident from the Ubuntu migration remains OPEN / DEFERRED. The public tree has never contained any Provider key.

Asset

• AIOS-v0.1.0-alpha.3.tar.gz
• 939,086 bytes
• SHA-256: �a93ce61a63e8d2e21eda32b7b92e7d7882abfe6b445f0bd318c50c99f7dc15a
• 352 files, 397 archive entries
• Top-level directory: AIOS-v0.1.0-alpha.3/
• Contains: README.md, README.zh-CN.md, LICENSE, NOTICE, THIRD_PARTY_NOTICES.md, SECURITY.md, CHANGELOG.md, pyproject.toml, setup.py.

References

• PR #9 with the stabilization diff.
• Multi-Provider 17 / 18-credential incident: see LOCAL_CREDENTIAL_INCIDENT=OPEN (out of scope for this task).
• Full task report: AIOS_GITHUB_FINAL_PUBLICATION_REPORT.md on the desktop.

AIOS v0.1.0-alpha.2

AIOS v0.1.0-alpha.2 — CI repair release

This release fixes the two real CI failures observed on v0.1.0-alpha.1 (run https://github.com/e71398/AIOS/actions/runs/33960783767). No new core features.

What changed

• pyproject.toml build-backend was setuptools.backends._legacy:_Backend (not a valid backend). Changed to setuptools.build_meta, which matches the existing build-system.requires = ["setuptools>=68.0", "wheel"]. The Build sdist and wheel job now passes; aios-5.2.9.tar.gz and aios-5.2.9-py3-none-any.whl are produced locally.
• The CI secret-pattern-scan job was tripping on six test fixtures (fake Provider keys and a fake private-key block used to exercise redaction) and two production placeholders. All eight lines now use Python string concatenation so the source-tree grep -RInE no longer matches. The runtime values used by the tests are unchanged. The scanner regex itself is unchanged.
• Internal dev version bumped 5.2.8 → 5.2.9 in both pyproject.toml and setup.py for traceability. The public Tag is v0.1.0-alpha.2.
• README / README.zh-CN.md / CHANGELOG.md / ROADMAP.md updated to reflect the new public version.

What is unchanged

• v0.1.0-alpha.1 tag, release, and assets are untouched.
• The Ubuntu migration source tree was not accessed.
• The local credential incident (Provider keys from the migration) remains OPEN and DEFERRED; it is not a publish blocker and the public tree has never contained any Provider key.
• No business logic outside the placeholder / fixture edits above.
• The CI workflow itself is unchanged.

Status

• Still experimental Alpha. Not production-ready.
• Suitable for research, testing, study, community contribution.
• Not suitable for production deployment or public-internet exposure without authentication enabled.

Asset

• AIOS-v0.1.0-alpha.2.tar.gz (clean source archive, git archive output, prefix AIOS-v0.1.0-alpha.2/).
• 349 files, ~935 KB. Excludes .git, .env (only .env.example), databases, logs, runtime caches.
• Contains README.md, README.zh-CN.md, LICENSE, NOTICE, THIRD_PARTY_NOTICES.md, SECURITY.md, CHANGELOG.md.

License

Apache License 2.0.

AIOS v0.1.0-alpha.1

AIOS v0.1.0-alpha.1 — Experimental Alpha

This is an experimental Alpha release. It is NOT production-ready.

Status

• Maturity: Alpha — not production-ready
• Suitable for: research, testing, study, community contribution
• Not suitable for: production deployment, public-internet exposure, sensitive data

What is in this release

• Source tree for AIOS v0.1.0-alpha.1 (351 files, sanitized)
• Loopback-only HTTP API by default
• AIOS Provider adapter contract (Provider is a thin HTTP client — you provide keys)
• Native Canary suite (known ordering-dependent failures — see docs/CURRENT_LIMITATIONS.md)
• Normal POST /task orchestration, Planner / Executor / Verifier, and Provider health reporting are still under construction

What is NOT in this release

• No model API keys of any kind. The repository does not contain credentials.
• No Docker compose runtime dependencies
• No systemd units targeting a host install
• No real user data, logs, databases, or migration manifests

Known limitations

• Read docs/CURRENT_LIMITATIONS.md for the live status of:
  • Normal POST /task orchestration and workflow ownership
  • Production-ready HTTP Provider adapter and health reporting
  • Strict native Canary and end-to-end acceptance suite
  • Authentication default for non-local deployments
• Canary and full-regression test suites have known ordering-dependent failures (kept inside the tree, not asserted in CI)
• Some internal helper files were intentionally excluded from this public tree because they were not portable

Security defaults

• HTTP_BIND defaults to 127.0.0.1
• Public bind addresses require explicit opt-in
• AUTH_REQUIRED_FOR_NON_LOOPBACK=1 is on by default
• See SECURITY.md for reporting vulnerabilities (do not file a public issue)

Third-party costs

• This release does not bundle any Provider SDK
• If you point AIOS at a Provider, you are responsible for that Provider's billing and rate-limit policy
• Do not expose AIOS to the public Internet without authentication enabled

Asset

• AIOS-v0.1.0-alpha.1-clean.tar.gz — sanitized source archive
  • Size: 926419 bytes
  • SHA-256: 0885CBE55688EE6417141C9531E973C3B865E54FAFA85D01917B175DAED32D2B

License

Apache License 2.0. See LICENSE.

Contributions

Issues and Pull Requests are welcome on topics in ROADMAP.md.