Hormuz v1.8.0 - Notarized Mac; Windows preview

Hormuz v1.8.0: notarized Mac companion; Windows preview

The Apple Silicon Mac companion is now available as a Developer ID signed,
Apple-notarized archive. App-owner exit interrupts a stalled initial
credential-helper exchange before client discovery, optimization or gateway
egress. Existing bounded, zeroizing pipes and owned-child/group cleanup are
reused; cancellation returns 130, while invalid credentials still fail closed
with status 1. No worker, dependency, custody, storage, provider-accounting or
automatic-replay change is introduced.

The stable core CLI, policy/evidence, Personal Optimizer, adapter SDK and Aider
contracts are preserved. Current setup/download guides consistently use 1.8.0;
historical release records stay historical. Website changes are version labels,
imports and URLs only; payment paths, hooks/state and layout are unchanged.

Install

Download Hormuz-1.8.0-notarized.zip,
compare its SHA-256 with SHA256SUMS.txt,
extract it and retain normal Gatekeeper checks. Apple Silicon and macOS 14+
are required. The team companion uses manual gateway setup, needs Codex or
Claude Code installed separately, and does not provision a hosted account.
Direct Personal Optimizer use remains the documented terminal setup.

Quit the old app before replacing it. Keep its versioned archive for rollback;
no automatic updater or certified interactive upgrade/rollback is added.

python -m pip install 'PyJWT[crypto]>=2.14,<3' 'hormuz[client,context] @ https://github.com/Xpounder-com/hormuz/releases/download/v1.8.0/hormuz-1.8.0-py3-none-any.whl'
hormuz context resources install
hormuz personal qualify --json

Core archives are checksum-verified, not individually signed. Mac code is
Developer ID signed and notarized. The annotated Git tag is not cryptographically
signed; its creation used the existing OrganizationAdmin creation exception. Immutable
tag update/deletion rules have no bypass actors; no tag was moved, forced or
deleted, and no branch/environment protection was changed or bypassed.

Exact-source evidence

Protected source: 8ff13fa2f75c5542e0093606d457ec4f4d007b52, normal guarded merge of
PR #454. Its tree equals reviewed
head 4d81cd754324dc36e2ae75527f6fde609443b290;
full-head review
was clean and the two prior P2 discussions were normally resolved.

• Exact-main CI:
  full non-PR scope, all 22 actual jobs successful, required aggregate 15.
  Python 3.11–3.14 each report 2,672 tests with 403 explicit skips; skipped
  optional/environment-dependent checks are not execution proof.
• Exact-main Mac:
  15 packaged native tests, zero skips, 53.287s; 64 Swift tests with one opt-in
  Keychain skip; 63 distribution/pilot contract tests; 73 optimizer/relay tests
  with one opt-in client skip, plus separately executed packaged-helper Codex
  conformance.
• Exact-main Website:
  64 Node and 10 Python tests, zero dependency-audit vulnerabilities, build,
  types and 13-route export/link checks; product compatibility publication passed.
  Canonical publication is separately tracked in
  publication PR #39.
• Original core artifact 11511922523, ZIP SHA-256
  581d7c2a2b7369bfe8f6150fba78257e9b3c78a03729572a83756c5c35cd0da1:
  checked before extraction. The original wheel/source verifier passed all
  192 tests, zero skips, 41.303s. Fresh isolated installs of each passed release
  identity, pinned tokenizers, Personal qualification, Aider conformance,
  on-demand bridge refusal and provider-free loopback demo. A source install
  builds internally; only original CI wheel/source bytes are published.
• Original development Mac artifact 11511309759, ZIP SHA-256
  881bd970952bda0752b822463b1998eea17f250f8f1f8641ef4a88c6d6ea0007:
  schema-4 development metadata and synthetic local proof only. Its
  distribution_ready flag remains false; no ad-hoc app ZIP is published.

Signed/notarized Mac

Protected signing run 37693277546,
attempt 1, build 25001, exact source above; team R267LZMUTY, bundle
com.xpounder.hormuz, arm64 only. Original artifact 11515225254, ZIP SHA-256
1707cab47ad40da8ee031689fa5d0f3de37a877db0b539b68e78a90df8fed182,
was checked before extraction. Normal authorized owner approvals were
deployments 6921914419 and 6921996528 by mehrdadxzaker; these are not
independent security/private-operator reviews.

Apple accepted submission 21a0affa-66dd-44f6-b835-06a7c7beb34e with zero
issues and six ticket entries. Original app ZIP SHA-256:
6447317078a503c14f8f9ed44c53d368983497f84b41e3b69b423ba0594cbcfa.
Independent owner-machine checks passed Gatekeeper, stapled-ticket validation,
nested Developer ID signatures, hardened runtime/no entitlements, architecture
and packaged runtime identity. All 15 native cases passed against this
exact notarized archive in 31.609s, zero skips, using Codex 0.147.0 and Claude
Code 2.1.233 with synthetic loopback gateways and zero paid provider calls.

The original protected static proof intentionally leaves
executable_version_verified and context_helper_runtime_verified false.
The separate local proof sets them true after credential-free execution;
all other proof fields and archive/binary digests match the original.

Signed Linux AMD64 image

Tag-triggered release run 37694457674
passed on its first attempt. Original evidence artifact 11514324139, ZIP
SHA-256 a31a0337d01c68f2feeddf87712b51a85af03ed1a5f5e5d772e1ee568514efb6,
was verified before extraction. Pin:

ghcr.io/xpounder-com/hormuz@sha256:2d29ee4e2cff11b7495c4ddea87615ba47b86902c257d5cc6dc023b69200c753

Two independent no-cache builds reproduced that payload. Public image and
v1.8.0 tag signature verification passed with exact repository/workflow/ref/
source claims and public Rekor evidence. Registry CycloneDX 1.7 (107 components)
and SLSA attestations passed signature/signed-timestamp verification; decoded
subjects match the image digest and SLSA dependencies bind the exact source.
Attestations are not uploaded to or checked against public Rekor under the
unchanged contract; image signatures retain their Rekor requirement.

Trivy 0.74.0 reports 264 total findings, including 55 unfixed high/critical
(53 high, two critical), and zero fixable high/critical. This passes the
existing fixed-version policy, not a zero-vulnerability or production-security
claim. No scanner threshold, dependency override or security gate was relaxed.

Preserved failure/review history

• 4c8a4fd5d602da60b40d3cf78f787622851c9dfd: CI 37619130194 actually failed
  all four Python matrices and package installation on the stale isolated-context
  dependency range. Mac 37619129609 and Website 37619129603 passed on that old head.
• 181d2526ba03728e64d5b9f8c29ff4994d4cb26b: range corrected without weakened
  assertions; CI 37657376868, Mac 37657376296, Website 37657376248
  passed. Substantive review then found two stale documentation boundaries.
• b9fac3e16b520d6e4a1b0bf179e3856c1238ec51: CI 37682184282 and Mac
  37682183293 automatically cancelled on supersession; Website 37682183879
  passed. An invented documentation proof key was corrected to the actual
  executable_version_verified field in the replacement head.
• a946cbf9b8cf828cbf6e457bd13cb93f05650beb: CI 37682409073 and Mac
  37682408616 automatically cancelled on supersession; Website 37682408614
  passed. A bounded current-guide audit corrected three remaining stale examples.
• 4d81cd754324dc36e2ae75527f6fde609443b290: full CI 37683113779, actual Mac
  37683113352, Website 37683113307, and clean full 30-file review passed.
  Required summaries on superseded heads failed closed; cancellation is not a
  new test defect or qualification of the replacement head. No unchanged failed
  workflow was retried or manually waived.

The startup regression was red on the original signed v1.7 archive and green
on fixed code. Local setup errors are recorded separately in
package-verification.json:
test-module/cwd/toolchain selection, sandbox-denied loopback, one read-only
approval-review timeout, uv network timeout recovered through pip with identical
fresh-install checks, and a premature missing-proof invocation before the Mac
artifact download completed. None substitutes for final-source artifacts.

The initial draft asset uploader failed with HTTP 408 (upload body inactivity).
The HTTP/1.1 batch completed the metadata but still failed on the source archive.
Single-file raw uploads recovered the original wheel and source archive; the Mac
ZIP failed both a raw upload (HTTP 408) and a Safari upload. Only those inspected
incomplete upload records were cleared. A paced file-stream upload at 512 KiB/s
then sent all 14,651,687 original Mac bytes, returned HTTP 201 in 28.784s, and
matched the verified original SHA-256. The same draft was retained throughout;
no duplicate release, signing submission or build/verification workflow was
started. Existing successful assets and original artifact bytes were preserved.

Remaining boundaries

Windows stays unsigned unsupported 1.5.0-dev.1 preview. Intel Macs and native
Linux desktop distribution are unsupport...

Hormuz v1.7.0 — native Mac relay development integration

Hormuz v1.7.0: native Mac relay integration; Windows preview

This compatible core/source release connects development Mac launchers to the
existing Rust relay. Stable v1 CLI, policy/evidence, Personal Optimizer, adapter
SDK and Aider contracts remain; storage schemas and provider accounting do not
change. Windows stays an unsigned, unsupported development preview.

Improvements

• Development Mac launchers use authenticated loopback access, bounded
  streaming, invocation-only settings and an app-owned lifetime connection
  independent of panels. App exit stops the direct client and cancellable
  optimizer work; restored launchers rebind without accumulating lease-only
  backups or discarding user edits.
• Swift retains Keychain custody. The bounded non-secret launch profile is
  checked under the existing session lock before credential access, so a
  replacement profile cannot supply credentials to an old relay.
• Optimization Off starts no Python helper. On reuses the packaged Python
  optimizer and verified tokenizers on demand. Failed optimization forwards
  original bytes once; uncertain upstream outcomes are not automatically
  replayed. Cold startup remains additional overhead, not a 100 ms end-to-end
  latency promise.
• Ordinary Mac optimizer process groups are cleaned up on success, failure
  and cancellation. Archive proof schema v4 binds the native relay's
  architecture, signature identity and digest; v1.7+ cannot downgrade to the
  historical schemas. Native build setup also handles relative target paths
  and process-local Xcode selection correctly.
• The download site derives labels and release URLs from its existing shared
  version constants. No new frontend state, dependency or abstraction is added.

Install and verify

python -m pip install 'PyJWT[crypto]>=2.14,<3' 'hormuz[client,context] @ https://github.com/Xpounder-com/hormuz/releases/download/v1.7.0/hormuz-1.7.0-py3-none-any.whl'
hormuz context resources install
hormuz personal contract --json
hormuz personal qualify --json

Use SHA256SUMS.txt for the attached archives and evidence files. The wheel and
source archive are checksum-verified, not individually signed.

Signed Linux AMD64 gateway image:

ghcr.io/xpounder-com/hormuz:v1.7.0
ghcr.io/xpounder-com/hormuz@sha256:d921ad03109103473e38b28e371e3782fbc76af09a32a236b67cec4640815974

Pin the digest for deployment and follow
OCI signature verification.

Exact release evidence

• Protected merged-main commit: d93e05b26b9542232089b8104eb6881ffa665607
• Release integration PR: #449
• Final-source correction PR: #450
• Exact-main CI: 37509924841
• Exact-main Mac checks: 37509924380
• Exact-main website checks: 37509924636
• Signed OCI publication: 37513409219
• Wheel SHA-256: 702fc21ff4a6bf6509a6e16f840102d288b53b0114e517679e05ca24d16fdb1e
• Source SHA-256: 2e5417771f8148776af2abf1a28b721434df9ca4026fe64f801ab54faaeed559

package-verification.json binds the original CI artifact and archive hashes
to fresh local core/client/context installations, real tokenizer hash checks,
Personal Optimizer qualification, Aider conformance and the governed loopback
demo. External provider calls were zero.

The metadata-only Mac evidence describes a development ad-hoc archive, not a
customer distribution. Extracted-archive checks use pinned Codex 0.147.0 and
Claude Code 2.1.233 against synthetic gateways: real Codex compaction and
lossless restoration, Claude streaming, exact Off bytes, authentication and
profile refusal, helper failure, and owner-exit cancellation. They do not prove
live-account or clean-machine acceptance. All 12 native extracted-archive tests
passed. Swift ran 64 tests including one explicit opt-in Keychain skip. The
optimizer/relay source suite ran 73 tests with one opt-in client case skipped;
the separate packaged-helper official-Codex test and native client tests passed.

The initial automated review found four issues, all corrected with regressions
before exact-head/main qualification. Superseded/cancelled earlier-head runs
are not release evidence; the recorded latest-head review is a self-review,
not independent approval.

GitHub's runner-assignment incident caused startup-only cancellations in the
original PR #449's non-required summary and original-source main jobs. Original attempts, unchanged-
commit retries and zero-step annotations are retained in
package-verification.json. All 16 required checks passed before the normal
protected merge; the never-started PR summary is not counted as a pass.
Exact-main CI, Mac and website workflows must independently pass before
publication. No compiler/test failure is reclassified and no gate is weakened.
After runner recovery, the original-source Mac tests ran and exposed a Codex
fixture cleanup race; canonical website checks separately failed the dependency
audit. Neither executed failure was waived or retried unchanged. PR #450 patches
sharp to 0.35.5 and source-map-js to 1.2.2, and disables unrelated plugin
marketplace downloads only in two isolated synthetic Codex fixtures. Production
defaults and assertions are unchanged. The final release source is its reviewed,
normally protected merge, with fresh full CI, native Mac and website proof.
Canonical root-site publication is a separate reviewed source-pin rollout.

OCI evidence binds the reproducible published digest to the protected tag,
source commit, public registry, vulnerability gate and keyless GitHub identity.
Image signing uses public Rekor; CycloneDX and SLSA registry attestations use
verified signed timestamps without a Rekor upload. The digest, version tag and
both attestations were independently verified from the public registry.
The release scan found zero high/critical findings with a reported fix;
55 high/critical findings without a reported fix remain.
A passing gate is not a zero-finding security claim.

Platform boundaries and remaining work

Windows remains unsigned, unsupported 1.5.0-dev.1 development preview.
No signed installer or manual Windows qualification is published.

The latest Developer ID signed and notarized Mac app remains
v1.3.0 for Apple Silicon on macOS 14+.
No v1.7 Mac app is submitted to Apple or published here.

This is a partial checkpoint for #341,
not closure. Mac client-descendant containment, abrupt relay-death cleanup,
interactive panel/quit/update qualification and remaining platform integration
are open. Ordinary process groups do not contain deliberately detached
setsid/setpgid processes. #342's
Rust optimizer port is separate; this release reuses the Python optimizer.
Linux native desktop qualification is separate from Linux AMD64 OCI support.
No live-provider savings, independent customer acceptance, new hosted-product
activation or general production certification is claimed.

Hormuz v1.6.0

Hormuz v1.6.0: sign-in and usage improvements; Windows preview

Hormuz v1.6.0 ships compatible core improvements while preserving the stable
v1 CLI and policy/evidence contracts, Personal Optimizer, adapter SDK and Aider
integration. The Python package and signed Linux AMD64 image share one release
identity. Existing SQLite and PostgreSQL storage schemas are unchanged.

Improvements

• Normal browser sign-in redirects directly to the configured identity provider
  with a temporary HTTP-only callback cookie. Approved team membership remains
  required; verified identity alone does not grant gateway access.
• Invitations use a separate /v1/auth/join page, explicit hormuz login --join-team, and development Mac invitation actions. Disabled onboarding
  rejects joining before enrollment, browser opening or polling.
• Hosted development Mac clients use the server-selected client/model profile
  and do not save credentials after failed enrollment. The Python launcher
  validates desktop-managed metadata and rejects unsupported profile fields.
• PostgreSQL secret-usage totals preserve their integer wire contract,
  including an empty usage ledger.
• Both container profiles pin the PCRE2 and Perl Debian security updates by
  checksum. Signed provenance binds both patches. No vulnerability gate or
  reproducibility check was waived.
• Shared website version labels and setup guidance consistently distinguish
  core v1.6.0, the existing signed Mac v1.3.0 archive and Windows preview.

Implementation: #445,
#447, and release
#448.
The earlier #446 internal Mac pilot
is not a newly published signed Mac application.

Install

python -m pip install 'PyJWT[crypto]>=2.14,<3' 'hormuz[client,context] @ https://github.com/Xpounder-com/hormuz/releases/download/v1.6.0/hormuz-1.6.0-py3-none-any.whl'
hormuz context resources install
hormuz personal contract --json
hormuz personal qualify --json
hormuz login --help

The explicit PyJWT requirement upgrades older compatible installations. The
signed image pins PyJWT 2.15.1.

Signed Linux AMD64 image:

ghcr.io/xpounder-com/hormuz:v1.6.0
ghcr.io/xpounder-com/hormuz@sha256:4af4847f219bfc5d4f196079789203098be98a66af46ed1d9ce71a0167798239

Use the digest for deployment. Follow the exact signature and attestation
verification in OCI.md.

Exact release evidence

• Protected merged-main commit: 6c0da94a9aed53e761e18a507a528c98e3cccb69
• Reviewed head: 9ca7a1f0b33b872a17d2086966a56ee51b0a9719; its Git tree equals the release commit.
• Exact-main CI: 37328383935
• Exact-main Mac contracts: 37328383217
• Exact-main Website checks/publication: 37328383304
• Signed OCI publication: 37331667013
• Wheel SHA-256: 4a3d685b203d7d55343597ddbdd3d4fe2495a0e7cae6f302e323c7f126909998
• Source archive SHA-256: 1da0da50653bbbe205818a965a11816e6628eb9f05d4ab12d40f180b14fd05ce

All three exact-main workflows passed on attempt 1. Python 3.11 reported 2,649
tests including 388 skips, with no failures; PostgreSQL compatibility was
qualified separately. The attached
package-verification.json binds the original CI distribution artifact to the
archives, 192 passed isolated package tests and fresh installations of both
archives on macOS ARM64. Each install verified its version, explicit joining
CLI, real tokenizer-resource download/hashes, both token counters, Personal
Optimizer qualification, Aider conformance and the governed-policy demo.
External provider calls were zero. SHA256SUMS.txt covers every attached asset
except itself. The wheel and source archive are checksum-verified, not
individually signed.

The content-free OCI evidence binds the reproducible published digest, source
commit, protected annotated tag, public registry, vulnerability gate and exact
keyless GitHub signing identity. Image signing uses public Rekor. CycloneDX
SBOM and SLSA registry attestations use verified signed timestamps without a
Rekor upload. The image signature, semantic tag and both attestations were
independently verified from the public registry on macOS.

The release scan found zero high/critical findings with a scanner-reported fix;
55 high/critical findings without a reported fix remain. A passing gate
is not a zero-vulnerability security claim. Initial preparatory scans identified
fixable PCRE2/Perl findings; the pinned updates corrected them before release.

Existing hosted pilot rollout

The existing hormuz-https-preflight pilot was rolled to this exact commit,
deployment dep-db1rlh142hec73e0k1g0. A fresh instance returned HTTP 200 from
/health and /ready; unauthenticated inference was denied. Direct Okta
redirection with a secure HTTP-only cookie and the separate invitation page
passed. Service resources, profile and settings are unchanged; no credentials
or database roles were changed and no new resources were provisioned.

This is bounded pilot verification: no real identity login or paid model request
was made, and independent operator-shell preflight was unavailable because SSH
access was unavailable. It does not certify general production readiness.

Distribution boundaries

Windows remains an unsigned, unsupported development preview. Its Rust
package stays 1.5.0-dev.1. No signed Windows installer is published.
Real authorized sign-in and scoped usage, actual Credential Manager refusal,
physical keyboard/screen-reader/tray and display/DPI checks, clean-machine
installation and connected footprint remain open in
#331 and
#337–#340.
The native Rust governed launch/relay milestone
#341 is also unfinished;
sharing a roadmap version number does not complete it.

The latest Developer ID signed and Apple-notarized Mac archive remains
v1.3.0 for Apple Silicon on macOS 14+.
No v1.6 Mac app was submitted to Apple or published. New Mac UI behavior is
development source/internal-pilot evidence, not that older signed archive.
Linux OCI support remains linux/amd64; native Linux and ARM64 qualification
are separate.

This release does not claim live-provider savings, independent customer
acceptance, a new hosted-product activation or general production certification.

Hormuz v1.5.0

Hormuz v1.5.0: verified improvements; Windows preview

Hormuz v1.5.0 ships verified gateway, packaging and website improvements while
preserving the stable v1 CLI and policy/evidence contracts, Personal Optimizer,
adapter SDK and Aider integration. The Python package and signed Linux AMD64
gateway image use one release identity. Windows stays in development preview.

Improvements

• Gateway desktop enrollment and account-discovery contracts support
  browser-authenticated Mac sign-in. Provider-free tests cover profile binding,
  discovery authorization and session error handling. This is source/runtime
  work, not a newly published Mac UI or an activated hosted sign-in deployment.
• The website uses the Next.js 16.3.8 security update, current setup guidance and
  clearer distribution boundaries. The release-download table remains readable
  through horizontal scrolling on narrow screens.
• Windows development source connects input, output and cost detail cards to
  the shared interaction reducer. Native CI covers detail content, metric
  positions, focus/state transitions and repeat-build identity. Synthetic
  footprint measurements remain preview evidence, not real connected usage.
• The documented Mac pilot configuration can use an existing Render PostgreSQL
  instance with distinct roles. No Render environment, credentials or live
  deployment was changed as part of this release.

Install

python -m pip install 'PyJWT[crypto]>=2.14,<3' 'hormuz[client,context] @ https://github.com/Xpounder-com/hormuz/releases/download/v1.5.0/hormuz-1.5.0-py3-none-any.whl'
hormuz context resources install
hormuz personal contract --json
hormuz personal qualify --json

The explicit PyJWT requirement upgrades older compatible installations. The
signed OCI image pins PyJWT 2.15.1.

Signed Linux AMD64 image:

ghcr.io/xpounder-com/hormuz:v1.5.0
ghcr.io/xpounder-com/hormuz@sha256:6120fa55e51a2362a990fb8b67884008d2bbbc305281d6d9d02e40e8bd4e34af

Use the digest for deployment. Signature and attestation verification is
documented in OCI.md.

Exact release evidence

• Protected merged-main commit: 4832405db2b898c65c61bec2de8582b3f548aee5
• Release PR: #444
• Exact-main CI: 36873040054
• Exact-main Website checks: 36873039312
• Exact-main Mac contracts: 36873039517
• Signed OCI publication: 36876134952
• Wheel SHA-256: c0313a92f75ab5d0e352bdedad3aa692ab65d7058073b543c2e864784de20e5a
• Source archive SHA-256: 9d54e7c06a8613857c9ca9b7eb2294ba2065fa792fa62a624b4f014fc7b1ea3b

The attached SHA256SUMS.txt covers every attached release asset except itself.
package-verification.json binds the original CI distribution artifact and
archive hashes to local verification on macOS ARM64: 186 isolated packaged
tests passed; both archives passed fresh installations, real tokenizer-resource
download/hash verification, both token counters, Personal Optimizer
qualification, Aider conformance and the governed-policy demo. External
provider calls were zero.

The content-free OCI evidence binds the reproducible published digest, source
commit, protected tag, public registry, vulnerability gate and keyless GitHub
signing identity. Image signing uses public Rekor; CycloneDX SBOM and SLSA
registry attestations use verified signed timestamps without a Rekor upload.
The image signature and both attestations were independently verified from
the public registry on macOS. The wheel and source archive are checksum-verified,
not individually signed.

The release scan found zero high/critical findings with a scanner-reported fix;
63 high/critical findings without a reported fix remain.
A passing gate is not a zero-finding security claim.

Distribution boundaries

Windows remains an unsigned, unsupported development preview. The native
package stays 1.5.0-dev.1. This release publishes development source, not a
signed Windows installer. Real authorized account sign-in and scoped usage,
actual Credential Manager refusal, keyboard/screen-reader/tray interaction,
display/DPI behavior, clean-machine installation and connected footprint remain
open in #331 and
#337–#339,
with the connected-product acceptance gate in
#340. Preview publication
does not close these issues.

The latest Developer ID signed and Apple-notarized Mac download remains
v1.3.0 for Apple Silicon on macOS 14+.
No v1.5 Mac app was submitted to Apple or published here. Linux OCI support
remains linux/amd64; native Linux desktop and ARM64 qualification are separate.

This release does not claim live-provider savings, independent customer
acceptance, deployment activation or general production certification.

Hormuz v1.4.0

Hormuz v1.4.0: core and signed OCI baseline

Hormuz v1.4.0 preserves the stable v1 CLI and policy/evidence contracts and the
v1.3 Personal Optimizer, adapter SDK, and Aider integration. It aligns the
Python package and Linux AMD64 gateway image at one release version and adds
bounded native-client footprint regression evidence.

Install

python -m pip install 'PyJWT[crypto]>=2.14,<3' 'hormuz[client,context] @ https://github.com/Xpounder-com/hormuz/releases/download/v1.4.0/hormuz-1.4.0-py3-none-any.whl'
hormuz context resources install
hormuz personal contract --json
hormuz personal qualify --json

The explicit PyJWT requirement also upgrades an existing environment that
would otherwise retain an older compatible version. The signed OCI image pins
PyJWT 2.15.1.

Signed Linux AMD64 image:

ghcr.io/xpounder-com/hormuz:v1.4.0
ghcr.io/xpounder-com/hormuz@sha256:78a0f5f7f5c8ec66aece5aab5c534ece79b18277d2e059a7f7304eea5401608d

Exact release evidence

• Protected merged-main commit: 771cc18c54606b015c760c639c1ad0cf3f1ad1f6
• Release PR: #429
• Exact-main CI: 36714489886
• Exact-main Website checks: 36714489256
• Signed OCI publication: 36718102681
• Wheel SHA-256: 140b449c8359e273694b3f858009aca8d5676ab931cb5d14b1c1a9cd6771387b
• Source archive SHA-256: c457766bf0ba1488fbf86010f21f9139ab3e181889e10cd1f717fb3e3419aa03

The attached SHA256SUMS.txt covers every release asset except itself. The
content-free OCI proofs bind the published digest, source commit, protected
tag, registry visibility, vulnerability gate, and signing identity. The wheel
and source archive passed isolated installation and 182 packaged tests.
The OCI scan reports no high/critical finding with a scanner-reported fix;
62 high/critical findings without a reported fix remain. A passing gate is
not a zero-finding security claim.

Distribution boundaries

The latest Developer ID signed and Apple-notarized Mac download remains
v1.3.0 for Apple Silicon.
No v1.4 Mac app was submitted to Apple or published here. The Windows shell is
an unsigned development preview; manual Windows acceptance remains open in
#331. This release does
not claim live-provider savings, independent customer acceptance, or general
production certification.

Hormuz v1.3.0

Hormuz v1.3.0: Personal Optimizer

Hormuz v1.3.0 adds a terminal-first Personal Optimizer while preserving the
v1 CLI and policy/evidence contracts.

One developer can connect a supported coding agent directly to an existing
provider account without creating an organization, running PostgreSQL, or
deploying a Hormuz server. Direct mode keeps the provider credential in the
operating-system keyring, launches the agent through an authenticated loopback
relay, applies only qualified lossless local transforms, and records bounded
content-free measurements.

Install and verify

python -m pip install 'hormuz[client,context] @ https://github.com/Xpounder-com/hormuz/releases/download/v1.3.0/hormuz-1.3.0-py3-none-any.whl'
hormuz context resources install
hormuz personal contract --json
hormuz personal qualify --json

The initial supported surface is terminal use on Apple Silicon with macOS 14
or newer. Codex CLI 0.148.0 is the pinned first agent. The release also includes
the versioned adapter SDK and an Aider 0.86.2 integration. See the packaged
Personal Optimizer guide for direct and managed connect/run/control commands.

The signed and notarized macOS download is Hormuz-1.3.0-notarized.zip.
The signed OCI image is:

ghcr.io/xpounder-com/hormuz:v1.3.0
ghcr.io/xpounder-com/hormuz@sha256:005eafa1bf576f906c54463fc8ea44cb5308a6792dae0e52c02eaedff7f2f561

Exact release evidence

• Protected merged-main commit: cc5f5c1d38b4732823496240bbb4ace309a6240d
• Release PR: #424
• Exact-main CI: 36496327080
• Exact-main Mac checks: 36496326741
• Exact-main Website checks: 36496326704
• Signed/notarized Mac distribution: 36497704569
• Signed OCI publication: 36497731712
• Wheel SHA-256: c57239b2da739c84773fc8211e30254693eeb2da8f90e45bd07529fc1debc1e7
• Source archive SHA-256: da1570b3b78f37e088031034b35b585f3843a3a7e4df13168f47b5a8b71790ca

SHA256SUMS.txt covers every attached release asset. The attached content-free
proofs bind signing, notarization, package reproducibility, SBOM, provenance,
and the OCI digest to the release commit.

Claim boundary

Provider-free qualification establishes the software and distribution
boundary. This release does not claim live-model quality, provider-bill
reduction, independent fresh-machine or customer acceptance, retention,
willingness to pay, or completion of the separate portfolio and native
roadmaps. Those are post-release evidence and commercial-validation questions,
not installation or publication prerequisites.

Hormuz v1.2.0

Hormuz 1.2.0 adds opt-in, client-side context optimization and a signed Apple Silicon companion while preserving the v1 policy, identity, budget, redaction, and metadata-only evidence contracts.

What is new

• Local context optimization, Off by default. A per-profile toggle enables four bounded, lossless representations for repetitive structured tool results. Selection, token estimates, and encoding happen on the user's device. The gateway reconstructs the selected request in memory before applying its existing secret inspection, policy, budget, routing, and accounting controls.
• No new content store or optimization telemetry. Unsupported, malformed, oversized, non-beneficial, or failed transformations use the ordinary request path. Request handling does not download tokenizer resources.
• Apple Silicon companion. The direct-download app is Developer ID signed, hardened-runtime enabled, notarized, stapled, and Gatekeeper verified. It packages the matching arm64 context helper and both digest-verified tokenizer resources, so Mac users do not install Python.
• Hosted reliability controls. The governed gateway keeps bounded streaming, cancellation without replay, one-hop same-protocol failover for eligible pre-response provider errors, PostgreSQL-backed sessions, and latency/pressure counters.

Install

macOS companion

Download Hormuz-1.2.0-notarized.zip, extract it, and move Hormuz.app to /Applications.

Supported Mac boundary: macOS 14 or later on Apple Silicon (arm64). Intel Macs are unsupported and were neither built nor tested. There is no automatic updater yet; upgrades use versioned archives.

The notarized archive SHA-256 is:

0a18536765245a3b2510644303a0a4ce253af2ab4d08168e129feb9d7e2501f0

Source

git clone --branch v1.2.0 --depth 1 https://github.com/Xpounder-com/hormuz.git
cd hormuz
python3 -m venv .venv
source .venv/bin/activate
python -m pip install --editable .
hormuz demo

For the optional source-installed local optimizer:

python -m pip install '.[context]'
hormuz context resources install

The gateway itself does not need the context/tokenizer extra.

OCI

The release workflow publishes the signed Linux AMD64 image as ghcr.io/xpounder-com/hormuz:v1.2.0. Use the immutable digest recorded in oci-release-summary.json for deployment; Hormuz does not publish a mutable latest contract.

Release evidence

Every source-bound gate below is tied to commit d854a5a453fcbe20cb3f4c1e261e146f2da93855:

• Exact-main CI, packaging, PostgreSQL, Kubernetes, HA/DR, OCI reproducibility, and required aggregate: run 34440663968.
• Signed/notarized Mac workflow, build 22001: run 34440714449.
• Clean Apple Silicon installation on macOS 26.6.2: no developer tools, downloaded-file quarantine retained, Gatekeeper accepted the notarized Developer ID, packaged helper ran, and the installed app launched. See macos-clean-install-proof.json.
• Exact live Render deployment proof: run 34440856263.
• OpenAI-only restart/recovery, streaming, cancellation, failover, latency, and pressure qualification: run 34441969680.
• Signed OCI release, reproducibility, runtime, supply-chain, and registry verification: run 34495397059, digest sha256:2f9c619c184139032c8af6782a2229b56e5f28980bfded5c5da14e620577b4b1.

The accepted paired OpenAI evaluation used 12 synthetic cases with five repetitions per arm through the local helper and the governed gateway. Native reconstruction was exact for all 12 fixtures. On the clean retry, the compact arm passed 59/60 tasks (98.33%) versus 52/60 (86.67%) for the original arm, with zero compact-only paired regressions. Reported total tokens fell from 51,103 to 30,420 (40.47%). P95 latency fell from 7.01 seconds to 3.92 seconds; median latency was 1.53 seconds compact versus 1.40 seconds original. The attached content-free evidence retains the investigated first run and accepted retry. These bounded synthetic results are not a statistical no-regression, invoice-savings, or SLA claim.

SHA256SUMS.txt covers every other attached file. The JSON evidence assets are content-free and include source, signature/notarization, deployment, provider qualification, context-evaluation, and OCI supply-chain results. Synthetic manifests/outcomes and credentials are not published.

Boundaries

• Live provider qualification for this release is OpenAI-only. No paid Anthropic evaluation was run, and this release does not claim same-candidate Claude Code/Anthropic qualification.
• The hosted reference is one Render instance in one region. It demonstrates bounded pilot operation and measured failover behavior; it does not carry an availability or latency SLA.
• The pinned Trivy scan reported 5 critical and 55 high findings in the reference image; all 60 lacked a scanner-reported fixed version. The current policy blocks high/critical findings when a fixed version exists, so this run passed with 0 fixable high/critical findings. See oci-supply-chain-summary.json; this is not a claim that the image is vulnerability-free.
• The Kubernetes/Helm, Compose, and recovery profiles are verified references, not general production certification.
• No independent security certification, accessibility certification, or customer acceptance is claimed by this software release. Those remain separate commercial-pilot gates.
• The gateway operator can read submitted request content as needed to govern it; local compaction is an encoding and optimization, not encryption.

Hormuz v1.0.0

Hormuz v1.0.0 promotes the immutable, gate-tested source archive without rebuilding or copying it.

Canonical source archive: hormuz-1.0.0.tar.gz

Candidate manifest: hormuz-v1.0.0-candidate-manifest.json

• Candidate tag: candidate-v1.0.0-2c3b16c1742ee76032a33f3714492a8d8515c5291d4d57520441882cd8bc5b5a
• Source archive: sha256:2c3b16c1742ee76032a33f3714492a8d8515c5291d4d57520441882cd8bc5b5a
• Gate evidence: sha256:9567944e1913a1dc7be9b516201127fb70c29018a31cba37db0fa6819af84dbc
• Source commit: 2fc0605252e41f731c85cc9146fbff6eb3b34669

The final GitHub Release intentionally carries no copied assets; the digest-addressed candidate release remains the canonical immutable custody object.

Hormuz v1.0.0 frozen candidate

Immutable candidate custody only; this is not the final v1.0.0 release. Candidate: sha256:2c3b16c1742ee76032a33f3714492a8d8515c5291d4d57520441882cd8bc5b5a. Gate: #173. Use tools/promote_v1_candidate.sh only after the real gate passes.

Hormuz v1.0.0 frozen candidate

Immutable candidate custody only; this is not the final v1.0.0 release. Candidate: sha256:6b7efef434c1314cd095da964db669a273761a2d9e158f4a6bee5ccbd9e7e644. Gate: #173. Use tools/promote_v1_candidate.sh only after the real gate passes.