ALGAL VM9: bounded execution and shared design

ALGAL application VM prerelease: bounded admission and shared product design.

• Recursive compilation shares limits across child occurrences: 1,024 manifest instances, 4,096 cells, 16,384 edges, 64 MiB normalized manifest bytes.
• Handled failures consume work before recovery effects can execute, matching the native runtime.
• Local transport/process inputs reject non-regular files before reading. Bun HTTP transport bounds streamed bytes and body lifetime, with strict UTF-8 admission.
• Initialized host leases avoid redundant bootstrap writes before taking custody in both runtimes. Empty interrupted initialization can finish explicitly; incompatible database state is rejected. Regression checks cover bounded admission, contention, inode preservation and crash takeover.
• algal.dev adopts the shared Hraness design system and standard Hugeicons, retaining inspectable programs, receipts and practical walkthroughs.

Start after verifying and installing the package:

algal doctor
algal demo start ./my-review
algal demo inspect ./my-review
algal demo prove ./crash-laboratory

Open my-review/report.html for the exact approval or denial command. The default decision fixtures are deterministic; process state, journals, crash recovery, and portable verification are real.

Linux x86_64: Ubuntu 24.04/glibc 2.39+. macOS arm64: macOS 14+, unsigned and not notarized. No Bun or Cargo required to run. Python 3 is used by verification/installation helpers. This release does not qualify live coding providers, supply OS isolation, or guarantee exactly-once arbitrary external writes.

Source: 3eb780825bc49eda33af8ba651f475f48c0a37f6. Merged PR31 and successful main CI. Release archives carry build metadata and checksums; verify before installation using the release guide.

ALGAL v0.2.0-vm.8

A native application VM prerelease with stricter admission, safer retained-state reads, race-safe mailbox creation, and less repeated evidence serialization.

• Reject malformed schema declarations before dispatch and enforce the 1 MiB manifest limit on raw and normalized documents.
• Refuse FIFOs/devices and symlinked retained state without hanging; explicit regular-file CLI input symlinks remain supported on qualified Unix targets.
• Admit mailbox names, exact bounds, and the 1,024-mailbox capacity under shared Bun/native custody. Reject oversized retained messages before consuming a delivery.
• Reuse validated canonical evidence bytes for hashing while preserving detached-snapshot admission.
• Explain durable review, checked coding repairs, offline evidence, reusable inbox programs, and model-free CI monitoring in README, the use-case guide, and algal.dev.
• Include source-level compile errors and runtime diagnostics with exact file spans, import frames, structured JSON reports, and nested execution diagrams from the integrated language updates.
• Include opt-in deterministic context elision: bound what the next model call receives while retaining complete tool evidence. This is a byte/context policy, not a token or billing guarantee.

Start with one executable:

algal doctor
algal demo start ./my-review
algal demo inspect ./my-review
algal demo prove ./crash-laboratory

Open my-review/report.html for its exact approval or denial command. Default decisions are deterministic fixtures; process state, journals, owned-process crashes, recovery and offline verification are real. Optional Apple generation uses a separately built bridge. No live coding-provider qualification is claimed by this release.

Upgrade boundary: all concurrent mailbox creators sharing a store must implement this release's admission ABI. Stop older writers before introducing new ones. Preserve unresolved operations and retained evidence. Legacy malformed schema declarations may require their original runtime for verification; see spec/v1/organism.md.

Packages: macOS14+ Apple silicon and Ubuntu24.04 x86_64/glibc2.39+. Unsigned and unnotarized. This is a host-owned application VM, not OS isolation, distributed custody, provider attestation, or exactly-once arbitrary external effects.

Source: a3b30a0b88e040f8fff38f6602e8caf64a8dd2a5 (PR #30). The complete local integration gate passed 617 Bun tests and 172 Rust tests, 61 cross-runtime examples, source/schema/mailbox parity, all five VM demos, and archive/install qualification. Exact merged Linux/macOS checks and security analysis passed. Native package workflow independently qualifies both targets before publication. The tag is protected against update/deletion without bypass actors.

Published package checksums and native build metadata accompany each archive. The marketing site at algal.dev has been checked byte-for-byte against all 81 files in this build.

Independent downloaded-artifact checks passed: all six files match checksums, archive contents, exact source inputs and embedded build identity. The downloaded macOS executable passed the standalone crash/recovery, exact-approval and detached-evidence smoke again on the host. Linux execution qualification is from the Ubuntu release job.

• algal-v0.2.0-vm.8-aarch64-apple-darwin.tar.gz SHA-256: a43a27bf8421027df84bc8b253f634bda9faca01d9a4d1c1556650273dc33b81.
• algal-v0.2.0-vm.8-x86_64-unknown-linux-gnu.tar.gz SHA-256: a045e305ca7c977cd3a4400692d57c8e2fb690713feb5f105e9da4907c3f147a.

ALGAL v0.2.0-vm.7

Retain a real on-device model decision, stop for human review, and finish later with the model disconnected.

• Private change brief: an optional saved graph asks Apple Foundation Models for a bounded summary and review focus. It holds the exact result for approval or denial. The continuation has no model executor; publication stays in a local mailbox and JSON file.
• One dispatch per Apple effect: the adapter uses a strict client API and does not fall back by silently issuing another generation. A lost response remains uncertain. A non-generating protocol probe rejects incompatible bridges before model admission.
• Portable successful and failed evidence: Bun and native now enforce the same recursive schema subset and choose failure diagnostics in deterministic UTF-8 property order. Cross-runtime checks cover accepted outputs, rejected outputs, and invalid typed inputs.
• Useful uncertainty diagnostics: a blocked process retains the original available executor error in its diagnostic without manufacturing a settled receipt or replaying the operation.
• Standalone workbench and crash laboratory: all VM.6 commands remain available in one native executable, including exact approvals, repeat-approval idempotency, detached evidence verification, and real owned-child crash recovery.

Local qualification completed a real Apple on-device request, exact approval with the bridge unavailable, idempotent repeated approval, and two-generation offline verification in both native and Bun after the source store was removed from its original location. Both runtimes rejected a changed recorded model output. The retained local proof used the final native source inputs; published downloads are separately qualified against their embedded source identity.

The aggregate source gate passed 533 Bun tests (one platform-specific skip), 155 Rust tests, 60 parity cases, recursive schema parity, five VM/recovery demos, 18 private-brief cases, and 17 package/install categories. macOS and Linux CI passed.

The bundled workbench and CI use deterministic fixtures. The optional Apple workflow requires a separately built compatible bridge and an available on-device model. Availability alone is not inference qualification. The Python harness orchestrates the demo; the native VM owns the graph, effects, checkpoint, continuation, and evidence replay.

Schema corrections can change replay of historical receipts affected by the old bugs. Preserve those receipts and their original runtimes. Unsupported schema keywords remain provider hints; see the schema contract.

Read the private brief guide, native workbench guide, and install/verification guide.

Qualified portable targets: Apple silicon macOS 14+ and Ubuntu 24.04 x86_64 / glibc 2.39+. Native semver remains 0.2.0; embedded source identity and the retained package record distinguish prereleases.

These are unsigned, unnotarized prerelease binaries. This is an application VM, not an OS sandbox or a distributed multi-tenant service. Local receipts prove recorded execution, not the truth of generated prose or provider attestation. An uncertain operation is never permission to repeat it.

ALGAL v0.2.0-vm.6 — native workbench and crash laboratory

A native VM you can leave waiting, restart, approve precisely, and verify away from its original host.

• One-binary workbench: algal demo start ./my-review, then open my-review/report.html. Inspect the retained proposal and copy its exact approval or denial command. No Bun, Cargo, checkout, credentials, or web server is needed.
• Real crash laboratory: algal demo prove ./crash-laboratory kills and joins its own VM child at a durable journal barrier. A read recovers without repeating the completed prefix write; an uncertain write remains blocked with unchanged evidence.
• Portable evidence: export the complete recorded process into one file and verify it without the source store, adapter, or model.
• Build identity: doctor identifies the compiled source and Rust inputs. Packaging rejects stale binaries, and the installer retains hash-bound release metadata before atomic replacement.

Decisions in the bundled workbench are deterministic fixtures. The process state, approval boundary, journals, SIGKILL, and receipt replay are real. No live provider or remote publication is part of these demonstrations.

Read the hands-on guide and verification/install guide. Use this release's v0.2.0-vm.6 archives and matching checksums; older packages do not include the workbench.

Qualified targets: Apple silicon macOS 14+ and Ubuntu 24.04 x86_64 / glibc 2.39+. Each archive contains bin/algal, release.json, LICENSE, and smoke.py; the CLI itself needs no Python. The native semver remains 0.2.0, while embedded source identity and the installed package record distinguish prereleases.

These are unsigned, unnotarized prerelease binaries. Checksums and local metadata are not publisher signatures. This is an application VM, not an OS sandbox, hypervisor, distributed custody system, or multi-tenant service. Coding-job reconciliation and repair validation still use the Bun host. An uncertain write is never permission to repeat it.

ALGAL v0.2.0-vm.5 — portable process evidence

Portable execution evidence for the ALGAL application VM.

algal process export review --dir .algal > review.evidence.json
algal process verify-evidence review.evidence.json

A process history can now be checked on another machine using one bounded JSON file and the standalone native executable. Bun and Rust replay the same recorded generations, enforce the same captured head and dependency closure, and report a digest for the complete evidence file. Verification admits no live adapter or host configuration and creates no runnable process.

The end-to-end fixture recovers a repair after caller death, exports from both runtimes, moves the original store/adapter/ledger away, and verifies all four exporter/verifier combinations. It also rejects omitted or forged history and checks unchanged host state. Extracted binary qualification exercises offline evidence without Bun or Cargo.

Evidence establishes internal consistency, not provider truth. It preserves recorded inputs, outputs and capability strings; review before sharing. It does not include host patch attachments or transfer execution custody. Live coding-provider qualification remains separate; the demonstration uses a deterministic durable adapter.

Prerelease targets: macOS arm64 on macOS 14+ and Linux x86_64 on Ubuntu 24.04/glibc 2.39+. macOS binaries are unsigned and not notarized. No Bun or Cargo is required to run; Python 3 is used by the archive verification/installation helpers. Archive checksums and source metadata accompany each package.

ALGAL v0.2.0-vm.4

This prerelease adds explicit recovery of a coding result whose acknowledgement was lost. A v2 Bun host job retains one operation identity, request digest and adapter authority, submits once, and can later retrieve the exact settled result through read-only reconciliation. Existing xcb jobs retain their conservative behavior.

• New job prepare-operation and job reconcile commands and SDK protocol.
• Immutable, bounded observations and patch reservations survive publication crashes. Reconciliation preserves the original uncertainty and never resubmits the coding task.
• End-to-end CI kills a real caller after a deterministic adapter retains completion, recovers one admission, validates the repair once, and verifies the same history in Bun and Rust.
• The combined source also includes selected-branch generation and source-annotated execution diagrams from PR #20.
• Native process and receipt formats remain compatible. Coding-job reconciliation and repair validation use the Bun host; the standalone native binary verifies the resulting portable histories.

The adapter protocol is opt-in. The deterministic fixture qualifies the host path, not a live provider's custody semantics; xcb does not yet implement this protocol. The 16-observation limit fails closed. OS isolation, production provider qualification, and store retention/GC remain separate work.

Native packages: Ubuntu 24.04 x86_64/glibc 2.39+, and macOS 14+ Apple silicon. No Bun or Cargo is needed to run the native kernel. Python 3 is used by verification/installation helpers. Mac binaries are unsigned and not notarized. Checksums and metadata bind each archive to its exact source commit.

Source change: #21

Qualified source: 9a8ad4325e379532316990bcba6c4460b0335b1a. Main CI: https://github.com/hraness/algal/actions/runs/35483247690.

ALGAL v0.2.0-vm.3

This prerelease makes coding repair a durable, inspectable VM workload and adds installable native process-kernel packages.

A host admits one exact clean checkout, a bounded coding attempt, and fixed validation commands. Algal retains the result and patch, resumes independent tests after a wait, and produces a review or rejection packet. Repeated observation does not relaunch coding work. Both runtimes verify the resulting process history offline.

Dispatched deadlines, interrupted responses and unknown coding outcomes remain uncertain. Durable workspace claims prevent another job overlapping unknown work; raw tracked-file fingerprints prevent Git filters from hiding validation drift. No automatic push, merge, provider retry, or generic unknown-result resolution is enabled.

Native packages contain the standalone process CLI, source/toolchain metadata, and an offline smoke helper. Ubuntu 24.04 x86_64/glibc 2.39+ and macOS 14+ Apple silicon are qualified. The repair/GitHub hosts require Bun. macOS packages are unsigned and not notarized; checksums are integrity checks, not publisher signatures.

See the repair and native distribution guides in the tagged source for usage, bounds, evidence and remaining limits.

Qualification: 130 Rust tests on macOS and 128 on Linux, 446 Bun tests on Linux (445 plus one platform skip on macOS), 47 cross-runtime parity cases, process handoff/recovery demos, and deterministic repair acceptance. Package qualification covers archive/install behavior and eight release-source trust tests. CodeQL is green after fixing all three release-workflow findings.

Source: PR #19, commit f4900accc0fb410d1ad79bf17795ca4b1f812079. The exact version tag is protected against updates and deletion with no bypass actors. Each published archive is built from that commit and qualified on its native platform before upload.

Repair workflow guide · Native installation and qualification

ALGAL VM preview 2: recovery and PR shepherd

This source preview adds explicit crash recovery across Bun and the independent Rust VM, plus a working PR/CI shepherd.

• Ordered effect journals preserve completed results and host configuration identities. Exact-intent recovery reuses completed effects; uncertain writes remain blocked.
• SQLite custody survives process death without inferring ownership from PID age. Durable events and timers retain delivery deduplication across crashes.
• The read-only PR shepherd waits for real CI, binds evidence to head/base/test-merge revisions, detects changed targets, and emits bounded review or repair packets. Waiting and readiness use zero model calls.

The shepherd watched PR #16 through three durable generations and reached ready after six checks passed. Bun and Rust independently verified all three receipt generations offline with live adapters unavailable. The crash demonstration uses 44 fresh CLI calls and four SIGKILLs, including successful recovery in both directions without repeating a completed write.

Validation passes on Linux and macOS: 374 Bun tests on Linux and 373 on macOS with one explicit Linux-only skip, native formatting/Clippy/workspace tests, 44-example parity, the VM lifecycle demo, and the crash recovery demo. A separate 20-PR public corpus exercises live read compatibility and conservative handling of incomplete policy; it does not claim 20 automated repairs.

PR shepherd guide · Recovery protocol · Merge-commit CI

The preview also fixes an early-stdin-close race in both runtimes: explicit suspension exits now survive broken pipes, and observed stdin delivery failures cannot be accepted as successful commands. See PR #17.

This release contains source only; it does not publish npm packages or native binaries. Automatic coding-job execution, external job reconciliation, and an approved repair-to-merge loop remain future work. ALGAL is a local application VM, not an operating-system sandbox.

Algal VM source preview

This source preview introduces the ALGAL process VM: bounded typed agent programs that persist their identity and history, exit, and resume from verified checkpoints in either the TypeScript or Rust runtime.

The release-review demonstration combines a bounded decision, proposal publication, a host-controlled approval mailbox, and approval-gated local publication. Every CLI command runs in a new OS process. It checks TypeScript-to-Rust and Rust-to-TypeScript continuation, process-scoped idempotency for identical actors, duplicate-message suppression, and offline verification in both runtimes.

In the scripted fixture, the VM performs two decision subprocess calls across two actors and their restarts, versus four for restarting the same manifest without its checkpoint. Idle polling, checkpoint resume, and verification make no additional decision calls. This demonstrates avoided repeated work, not model-quality, latency, token, or dollar measurements.

Run with Bun and Rust installed:

git clone --branch v0.2.0-vm.1 https://github.com/hraness/algal.git
cd algal
bun install --frozen-lockfile
cargo build --locked
bun scripts/vm-demo.ts --native ./target/debug/algal --keep --out vm-report.json

The process contract and VM guide document the lifecycle and limits. This is an application VM, not an OS sandbox. Interrupted effects remain uncertain and require operator reconciliation; arbitrary external effects are not guaranteed exactly once. This preview does not publish an npm package or native binary distribution.

Implemented in PR #15. Linux and macOS validation covers full TypeScript checks, native formatting/Clippy/workspace tests/build, all 44 parity examples, and the 75-command cross-runtime demonstration. The exact release commit is 3c67dacc707dd8f1c8b5195ffe0faafbcab300ef.