Capsulith 0.3 · Native pixels, preserved

Open a PNG or QOI image in a browser, run the original compiled ARM64 codec instructions, inspect the returned pixels and take the file away. Preserve the initialized pixel heap, close its worker, then restore and free it in a fresh instance.

Try the native image workbench · Source and Node commands · Reviewed change

PNG comparisons use browser-imported RGBA; a separate native decode must match every byte. QOI-only inputs do not have an independent source-pixel comparison. Inputs are bounded to 256 pixels per dimension and 1 MiB. Saved JSON contains the actual pixels and native descriptor; sharing is voluntary.

Download the Python wheel for the full local extraction/object/image Studios, or the image workbench ZIP for independent browser/Node execution without the original dylib, compiler, Python package or account. Serve the whole ZIP folder through localhost HTTP or HTTPS. The ZIP includes original runtime code, complete corresponding Unicorn.js backend source/build scripts, unchanged QOI source and all notices.

All three hosted environments pass 44 Python and 55 Node tests, including isolated installed delivery. Eight image cases match original native execution and an independent source rebuild; local independent FFmpeg decoding matches their pixel bytes. Actual browser checks cover PNG encode/fresh decode, saved-state reopening, restore/free, downloads, cancellation, pixel selection and mobile layout. Detached ZIP execution reproduces 49,152 RGBA bytes and 44,561 QOI bytes exactly.

This is a known-source prepared ARM64 component demonstration, not a new codec, universal recovery, a native-performance benchmark or emulator security isolation. QOI belongs to Dominic Szablewski and contributors; CPU emulation is supplied by Unicorn/Unicorn.js. Their licenses and credits remain intact. Development and review used Codex.

Capsulith 0.2 · Native objects that travel

Capsulith 0.2 carries initialized native objects into portable Node and browser workers. Extract named ARM64 methods, declare their contracts, retain owned heap and caller memory, checkpoint at a method boundary, and continue after the first worker or process has ended. Original instructions and stable guest addresses preserve stored pointers; object layouts remain opaque.

Try the keyless Object Studio and press Run lifecycle. The real compiled LZ4 example creates a stream, compresses 65,536 bytes, saves its dictionary, releases the original input, ends its worker, restores and compresses an unseen 32,768-byte packet, then frees the heap. Its 8,459/6,795-byte outputs match independent native recordings. A fresh stream produces 8,355 bytes. These are finite byte-equivalence controls, not a performance or arbitrary-component claim.

• Python wheel: local artifact extraction and both Studios.
• Source distribution: full product, tests, reproducible native controls, images and tooling.
• Initialized LZ4 ZIP: compiled methods, actual browser-captured dictionary checkpoint, start/continue operation programs, independent Studio, Node runner, backend source/build scripts, licenses and an exact manifest. Run node run.cjs continue.json --checkpoint checkpoint.json without the original binary or extraction package.
• Object Studio ZIP: standalone guided browser proof and generic contracts/memory controls. Serve it locally over HTTP to use workers.
• SHA256SUMS.txt: checksums for all four packages.

The final source passed 43 Python and 44 Node tests on Linux Python3.10/Node20, Linux Python3.14/Node24 and macOS Python3.14/Node24, including fresh installed-wheel/source-bearing export checks. macOS independently reproduced the known native comparisons. Local and GitHub AI-assisted reviews produced real corrections for quota inheritance, method contracts, cancellation, large valid checkpoints, reference endpoints, duplicate names and incremental output bounds.

Existing schema1 function capsules remain supported. Object scope is prepared ARM64 Mach-O direct closures, integer/reference contracts and six bounded memory models. Indirect calls, writable static state, relocated static pointers, OS dependencies and arbitrary CPU/stack snapshots are unsupported. Checkpoints include retained caller bytes; inspect them before sharing. Identity digests detect changes and do not authenticate origin. Original rights, GPL runtime/backend source and BSD specimen notices are preserved. No emulator isolation or universal equivalence claim is made.

Tested head 36ac40f5fa92c380ee2c1b09b9d9f00bd579942a and merged source dc907c8cc50ecd216822d005ddcb421314c16f6b have the same Git tree. See PR #1 and release gates.

Capsulith 0.1: compiled features, portable calls

Capsulith turns a supported compiled native function into a portable callable capsule. It retains original ARM64 instructions, gathers direct helpers and readonly data, exposes dependencies and execution evidence, and runs from Node or a browser without the original application.

This release includes a local upload/extract/contract Studio, bounded worker execution and cancellation, original-byte/disassembly inspectors, independently runnable Node/browser exports, real LZ4 and independently compiled xxHash specimens, original notices and the pinned emulator's full upstream source/build scripts.

Verified at e6bd3f1: all three release-gate jobs passed. Each ran27 Python tests,14 Node tests including128 independently native LZ4 controls,1,100 actual xxHash Wasm calls across two optimization builds, and a clean installed-wheel/portable-export check. macOS additionally rebuilt both native xxHash controls and verified4,400 native calls. Actual local Studio execution and downloaded portable LZ4 output also matched controls. These finite checks support the declared scope, not universal correctness.

Start with the wheel: python3 -m pip install capsulith-0.1.0-py3-none-any.whl, then capsulith studio and open http://127.0.0.1:6359. Python3.10+ and Capstone are needed for extraction; Node20+ is needed for CLI execution. The portable ZIPs need only Node or an HTTP-served browser. Run node run.cjs inside either ZIP, or serve its index.html. No API key or paid service.

First scope: zero-preferred-base ordinary ARM64 Mach-O dylibs with function-start metadata, direct control flow, static non-relocated readonly data and caller-declared integer/buffer contracts. Unsupported state/imports/relocations/indirect control receive diagnostics. No inferred ABI, source reconstruction, whole-application cloning or emulator security-isolation claim. Artifact hashes describe provenance, not authenticity.

GPL-2.0-only combined runtime, established Unicorn/Unicorn.js emulation credited, BSD LZ4/xxHash notices preserved. Exact pinned upstream emulator source/build scripts accompany the unchanged published bundle; a byte-identical local backend rebuild is not established. Development assisted by Codex. No outside adoption or achievement badge is claimed.