Aionis v0.3.5 Local Runtime Public Beta

Aionis v0.3.5 Local Runtime Public Beta Candidate

Aionis Runtime v0.3.5 is the release candidate for a single-process,
self-hosted Local Runtime. It combines the aggressive AgentContext compaction
repair with continuity, atomic-write, evidence-gate, and projection-recovery
hardening completed after v0.3.4.

This candidate is not GA, a managed multi-tenant service, or a multi-instance
HA release. SQLite is the Lite authority. The local in-memory ANN is rebuilt
from committed SQLite vectors after restart; several Runtime processes require
a shared persistent ANN or cross-instance reconciliation.

Public Contract Changes

• POST /v1/observe accepts an optional durable operation_id and returns
  aionis_observe_result_v1. The semantic memory write, execution state/tree,
  handoff, claims, durable receipt, and embedding/ANN projection intents share
  the SQLite transaction.
• Direct POST /v1/handoff/store accepts the same retry model and returns
  aionis_handoff_store_result_v1. An exact retry returns the stored receipt;
  reusing the ID for different effective content returns HTTP 409.
• Observe responses expose post_commit_projections: semantic commit is
  complete, while embedding and ANN values are scheduled or not_requested.
  Scheduled means durable work exists, not that the external side effect has
  already completed.
• Projection jobs expose pending, running, retry, dead_letter, and
  succeeded backlog states under /health, with separate worker health.
• POST /v1/measure returns evidence_assessment. Manual observations are
  unverified and cannot become export-ready. Client sufficient_evidence and
  evidence_ids claims are ignored by the gate and reported under
  client_claims_ignored.
• Runtime-verified learning/skill export requires paired durable guide
  receipts, task/run binding, ordered effect observations, a trusted Runtime
  verifier receipt, linked positive tool feedback, and complete passing kernel
  metrics.
• SDK 0.3.15 carries the typed observe result, measure evidence assessment,
  execution operation_id, and projection scheduling contracts.
• npm run -s runtime:data -- ... provides v0.3.4 schema preflight/upgrade,
  verified backup/restore, and projection repair. Verify and backup reject
  corrupt execution history and invalid projection payloads.
• Current schema startup validates required columns, primary/unique
  constraints, and critical receipt/projection indexes before business DDL.
• Docker builds one digest-pinned linux/amd64 artifact, smokes that exact
  digest, and only then promotes it to the candidate version tag.

Context And Continuity Changes

• Aggressive standard and full-power guide requests use the canonical bounded
  contract renderer while preserving the active target and safety boundaries.
• A stale execution snapshot cannot silently replace newer state or tree
  history. Revision and continuity history remain consistent.
• Observe is one atomic event rather than a memory commit followed by
  best-effort execution/handoff/claim writes.
• Embedding generation and ANN reconciliation use durable leased jobs with
  generation/CAS completion. A process crash immediately after commit leaves
  recoverable work, and stale workers cannot overwrite newer node state.
• ANN reconciliation reads SQLite truth. A fresh local ANN is rebuilt from
  committed ready vectors on startup.

Candidate Coordinates

Artifact	Version	Planned immutable source ref
Runtime source	v0.3.5	v0.3.5
Docker image (linux/amd64)	ghcr.io/ostinatocc/aionis:v0.3.5	Runtime v0.3.5
aionis	0.3.8	v0.3.8
@aionis/create	0.3.7	v0.3.7
@aionis/sdk	0.3.15	v0.3.15
@aionis/mcp	0.3.7	v0.3.7
@aionis/aifs	0.3.4	v0.3.4
@aionis/claude-code	0.3.5	v0.3.5
@aionis/substrate	0.1.11	v0.1.11

Every tag is paired with an exact source commit in release-train.json. The
final release must resolve every ref to that frozen commit before package
publication. Manifest is outside this train until it has a verifiable source
repository and immutable ref.

linux/arm64 is outside this candidate until the exact platform image passes
an independent runtime smoke gate.

Verification

• Real temporary SQLite and HTTP tests cover stale-snapshot rejection, atomic
  observe rollback, exact operation receipt replay, request-ID conflict, and
  corrupt receipt failure.
• Real child-process tests exit immediately after semantic commit, then verify
  restart recovery of embedding generation and ANN reconciliation.
• Projection tests cover expired leases, side-effect-before-ack failure,
  generation changes, stale ANN reconciliation, poison payload dead-letter,
  provider mismatch, and transactional enqueue failure.
• Evidence-gate tests prove missing/manual metrics and caller-supplied evidence
  claims cannot create export-ready learning or skill candidates.
• Destructive SQLite tests cover projection rollback, broken event chains,
  revision gaps, orphan events, missing current columns/constraints/indexes,
  and backup refusal on corrupt authority state.
• The most recent pre-freeze full Runtime run recorded 919 tests: 915 passed,
  zero failed, and four optional native Zvec tests skipped. Final candidate CI,
  cross-package checkout, Docker smoke, and exact-version smoke remain release
  gates and must be rerun against frozen refs.

Release Safety

• Runtime v0.3.4 remains immutable.
• SQLite remains the Runtime truth source; ANN and Substrate remain derived or
  governed sidecar surfaces.
• scheduled projection status must not be presented as synchronous embedding
  or ANN completion.
• Client evidence claims must not be presented as Runtime-verified evidence.
• Create 0.3.7 must not be published until Runtime v0.3.5 and its Docker
  image resolve because the installer selects that immutable tag by default.
• No package or image is announced until exact-version smoke tests pass.