Runalith 1.0.9-rc.5 (Testing Pre-release)

Runalith 1.0.9-rc.5 — Testing Pre-release

TESTING ONLY — NOT FOR PRODUCTION. This package introduces the Runalith product identity and neutral MCP package naming. It is not an official frozen artifact or a production-readiness certification.

Highlights

• Product, manifest and MCP server identity now use Runalith naming (runalith-agent-orchestrator).
• The package filename uses runalith-1.0.9-rc.5.mcpb. MCPB is a bundle container used by compatible clients; it is not a vendor-specific protocol or feature guarantee.
• Added RUNALITH_DATA_DIR, RUNALITH_WORKFLOW_DB, RUNALITH_EXECUTION_TMP_DIR, RUNALITH_WORKSPACE, RUNALITH_DASHBOARD_HOST and RUNALITH_DASHBOARD_PORT as the preferred environment-variable names. Legacy aliases continue to work. Fresh installs use ~/.runalith/agent-orchestrator; an existing legacy data directory is preserved automatically when no new directory exists.
• Renamed the local packager and acceptance-test command to npm run pack:runalith-mcpb and npm run test:runalith-plugin.
• Added a responsive static project site in site/ and a GitHub Actions workflow to publish it to GitHub Pages.
• Updated architecture, quickstart, dashboard, terminology, benchmark-template and MCP reference documentation to use neutral client/runtime language.

Package and checksum

The current verified build is 324551 bytes with SHA-256 b1bea277f60e355796f5bf945d1f8697f076466d8aa59ff62c4e4f27ea84402f. It was built reproducibly and validated from this source snapshot. Before publishing, the packager is rerun from the final tagged source commit and the hash must match this value. The GitHub release attaches the .mcpb file and a .sha256 sidecar; the release description records the final tag-target commit. Verify the downloaded package with the sidecar before installing it.

Validation scope

The candidate is validated through local regression tests, deterministic package reproducibility, archive validation, package-extracted MCP initialization/tool discovery, all 46 tool schemas, lease-fencing and stdio/shutdown regressions, hybrid workflow E2E, CASE-01 recovery, and the local plugin acceptance harness. The static site is plain HTML/CSS and does not require a backend service.

This evidence does not establish autonomous reasoning quality, live Gateway acceptance, exactly-once external side effects, OS sandboxing, or production readiness. The strict Phase 2 readiness audit remains authoritative for formal deployment/production use and may remain BLOCKED_NOT_READY. None of its official authorization/audit records are bypassed or rewritten by this testing release.

Links

• Runalith project site
• Repository
• Release assets and checksum
• Release policy
• Known issues

Exact release identity

• Tag: v1.0.9-rc.5
• Tag target source commit: 51059fcc1d4cd2187c06a43c9e65d1384c433078
• Bundle: runalith-1.0.9-rc.5.mcpb
• Size: 324551 bytes
• SHA-256: b1bea277f60e355796f5bf945d1f8697f076466d8aa59ff62c4e4f27ea84402f
• Checksum sidecar: runalith-1.0.9-rc.5.mcpb.sha256
• Website: https://nplongx.github.io/runalith/

Readiness boundary

This is a testing-only pre-release, not an official frozen artifact and not approved for production deployment. The strict Phase 2 readiness audit remains BLOCKED_NOT_READY with 8 blockers and execution_permitted=false; official authorization/audit records were not modified. Open formal gates include frozen artifact identity/custody, fresh exact-scope authorization, independent review, CASE-06 policy disposition, host preflight/static release validation, authorization-audit reconciliation, and formal source-tree identity reconciliation. Successful package checks and publication do not waive those gates.

The package was rebuilt from the exact tag-target source tree; two independent validated package builds were byte-identical (45 ordered entries), and the final asset SHA-256 matches the checked release sidecar. Package smoke exposed 46/46 manifest tools, all 46 extracted schemas passed, and the lease-fencing, stdio/backpressure/shutdown, hybrid workflow E2E, CASE-01 recovery, and local plugin E2E checks passed. GitHub Actions CI passed on Node.js 22 and 24. GitHub Pages deploy workflow passed for the site on the same source commit.

Local Agent Orchestrator 1.0.9-rc.4 (Testing Pre-release)

Local Agent Orchestrator 1.0.9-rc.4 (Testing Pre-release)

TESTING ONLY — NOT FOR PRODUCTION. This candidate is an experimental GitHub pre-release under the tiered release policy. It is not the official frozen artifact and has not passed the formal Phase 2 production/deployment readiness audit.

Highlights

• Adds the hybrid-engineering workflow template with dependency-ordered specialist roles, optional pinned custom-role/Agent-Skill overlays, and deterministic syntax checks orchestrated through durable batch execution.
• Hardens immutable-plan validation for deterministic batch commands and working directories, and improves workflow recovery and diagnosis guidance.
• Adds reusable, versioned workflow policy packs and a read-only dashboard view for policy versions, attachments, and plan-bound violations.
• Expands regressions for workflow recovery, lease fencing, typed artifact provenance, MCP stdio framing/backpressure/shutdown, and package reproducibility.
• Improves generated MCP tool-reference parity checks and Markdown link checking, including reference-style Markdown links and an opt-in external URL check.

Validation recorded for the candidate

• Two independent validated package builds were byte-identical.
• Bundle MCP initialization and tool discovery passed: 46/46 manifest tools.
• Extracted-package tool-schema validation passed: 46/46.
• Package-path lease-fencing, stdio framing/backpressure/shutdown, hybrid-engineering E2E, CASE-01 recovery, and local plugin E2E checks passed.
• Repository-level documentation and regression checks recorded for the source commit are listed in the candidate review dossier.

Release artifact

• Filename: chat-on-steroids-local-orchestrator-1.0.9-rc.4.mcpb
• Size: 324541 bytes
• SHA-256: bfb68c11317dc394f6d1ea85368a801dc9f6f473974e34e96d02736747776552
• Source identity: release tag v1.0.9-rc.4 (the archive and source inventory were built from the tag target commit).
• Checksum sidecar: chat-on-steroids-local-orchestrator-1.0.9-rc.4.mcpb.sha256
• Candidate inventory: benchmarks/plugin-workflow-benchmark/phase2-candidate-inventory-v1.0.9-rc.4-20261019.json (supplemental evidence only; marked unapproved and not an independent review or authorization record).

Download the .mcpb and .sha256 sidecar from this release and verify them together before installing. The package is not the official frozen artifact.

Limitations and release status

• The formal Phase 2 readiness audit remains BLOCKED_NOT_READY for production/deployment use. Outstanding blockers include official frozen-artifact custody, independent review, fresh exact-scope authorization, CASE-06 policy disposition, host preflight/static deployment validation, and authorization-audit reconciliation. This pre-release does not claim any of those gates passed.
• No production-readiness claim is made. This candidate passed local package runtime smoke, 46/46 tool discovery/schema checks, package regressions and local plugin E2E, but it has not undergone an independent installation-and-acceptance test against a live OpenClaw Gateway for this exact RC. Real Gateway-backed integration acceptance remains a separate gate.
• The strict Phase 2 BLOCKED_NOT_READY result remains in force for formal deployment/production release. Under the tiered release policy, that audit result does not alone veto a testing pre-release once minimum checks pass. Do not describe outstanding formal gates as passed, edit official audit/authorization records, or claim production readiness.

Exact release source and supplemental inventory

• Release tag target commit: 2bbeb84e0b911d8a4826516064c4c67bee1006d0
• Candidate inventory asset: phase2-candidate-inventory-v1.0.9-rc.4-20261019.json
• Candidate inventory SHA-256: 28100d72e695873a3064a0ca9668488a7da1ed5cfd96477b34f7eacf563fe0c9
• Inventory status: unapproved candidate evidence only; it is not an independent review, formal authorization, or production approval.

Formal readiness status

The latest strict Phase 2 readiness audit returned BLOCKED_NOT_READY with 8 blockers and execution_permitted=false. The audit did not mutate official records. Its blockers include the missing official frozen artifact, fresh exact-scope authorization, independent review, CASE-06 disposition, host preflight/static validation, authorization-audit reconciliation, and its formal source-tree identity check. The package/source entry inventory and runtime testing passed for this testing candidate, but this pre-release does not convert the formal audit result into a pass.

Local Agent Orchestrator 1.0.9-rc.1 (Pre-release)

Local Agent Orchestrator 1.0.9-rc.1 — pre-release

This pre-release candidate is intended for controlled testing. It is not a production-readiness certification and does not replace the frozen 1.0.8 release artifact.

What's included

• Durable local SQLite workflow state and immutable, structurally validated workflow plans.
• Explicit proposal/plan approval and separate execution approval.
• Dependency-aware local task flow, typed artifacts and evidence validation.
• Recovery, terminalization, lease-fencing, and MCP stdio shutdown/backpressure hardening.
• MCP manifest/package/runtime version alignment (1.0.9-rc.1).

Validation performed

• Full package builder against the extracted archive, including MCP initialize and tools/list (33/33 tools).
• Extracted tool-schema contract: 33/33.
• Lease-fencing and stale-owner/terminal-parent regression tests.
• MCP framing, strict UTF-8, bounded backpressure, graceful shutdown and EOF regressions.
• CASE-01 crash/restart, SQLite readback, snapshot lineage and full local plugin E2E.
• Two independent package builds were byte-for-byte identical.
• GitHub Actions CI passed for Node.js 22 and 24 on the source commit.

Requirements

• Node.js >=22.13.0
• An MCPB-compatible host with local plugin installation support.

Known limitations

• No claim of production readiness or autonomous model-worker quality.
• Formal release identity/authorization, independent candidate review and CASE-06 policy disposition remain blocked.
• Native OpenClaw Gateway-backed E2E and external-delivery exactly-once guarantees are not established.
• This package is local-only; it does not include cloud workers, remote runners or external model APIs.

Verify the artifact

Compare the SHA-256 in the accompanying .sha256 file before installation. Test in an isolated profile/workspace and do not use it for production workloads.