Potbot 0.5.0.dev10 — native Syn Agent deployment

Potbot 0.5.0.dev10 completes the SYN-R04 consumer milestone: one genuine upstream Syn process per Agent, a separate native OS account and encrypted keystore, retained selected identity, and independently verified readiness. Potbot owns installation, sandbox resources and process lifetime; canonical Syn owns identity, adoption, group custody and signing.

Use the official signed Syn 0.3.1 release or a later qualified release with independent source, manifest and authority pins. The complete installer/controller path passed official deployment qualification on Python 3.12 and 3.13: one operator plus two simultaneous Agents, distinct host UIDs and account keys, matching current-group commitment, node and full-keystore-session restarts, outside-process isolation, and locked-store fencing.

A root-owned read-only execution view admits only inventory-verified public runtime bytes while the original installer store stays sealed. Changed or partial views refuse launch. Private temporary storage preserves the permissions required for native credential IPC. Source-preview packaging explicitly excludes private/generated storage, rejects duplicate wheel entries and verifies every shipped Agent-home template file against its source. No rejected local candidate archive was published.

This is the Linux x86-64/WSL Agent profile and remains a development source preview. SYN-R05 still owns Cog admission and the supported Syn messaging integration; group rotation, recovery, upgrades and removal of transitional code retain their later milestones. Provisioning never authorizes Cog execution or replaces an existing identity. Persistent user-host admission and private keystore unlock remain separate from disposable qualification.

Agent deployment guide · Upstream architecture, release pins and measured qualification

Syn source: bb5f458fab11de6de408d19f53cc21524a1f7735
Syn manifest SHA-256: 10da08e7b0af7d32c48a3087e873c2e448e846e2e3aac6ad56df81330267b4f1
Syn authority SHA-256: a47f15e010613c0a839a48f2035b8f71d6f9e46ee3df07ed58487079d56ae216

Potbot source: 2570d4fa2c736f8fd87576138a9ec4cb21ca8c35. The merged tree exactly matches fully tested head d67a0e740b62df5c557ab5ccd569573e1a4e0e3a; all 34 checks passed with one completed conditional skip and no pending/failing jobs. Final full verification and reviewed merge. The configured release workflow builds and clean-installs the exact tagged source before uploading its four declared assets without replacement. Registry publication follows the repository's existing configuration.