piwork-microvm v0.2.0

piwork-microvm v0.2.0

Bundles original Piwork 0.0.10 at commit 29e3471e02e53094c1e1f427a88de6a2a24fb963, unmodified.

Changes

• Add native Windows/Linux desktop launchers with English and Simplified Chinese, persistent installation selection, real startup status, safe shutdown and local log export.
• Bundle the frozen upstream Core input 29e3471e02e53094c1e1f427a88de6a2a24fb963 (upstream-declared version remains 0.0.10) and propagate custom UI/Core HTTP ports. Port 7172 remains reserved for internal Agent RPC.
• Verify Desktop administrator fault/gap log export, copied-installation recovery and clean stop on Linux/KVM and native Windows/WebView2/WHPX.

Artifacts

Choose GUI for the desktop launcher, or CLI for terminal use. All binaries include QEMU and the locked Guest payload; no QEMU or Docker installation is needed on the host.

File	Entry	Platform	Bytes	SHA256
piwork-microvm-v0.2.0-linux-amd64	CLI	linux/amd64	392789727	5d6938b4c60d53bda51c25a98b44e690c1fd41f8f1bec8dd02b34094f45a288c
piwork-microvm-v0.2.0-windows-amd64.exe	CLI	windows/amd64	409597985	81f17781d09b5495f83f52390bd0858043d84ba727ace642139dbfe9b29c5be5
piwork-microvm-gui-v0.2.0-linux-amd64	GUI	linux/amd64	397127309	ce9ba8bbd43624b5170bfbeb1d6a9d166206f8bd2127bbff0f4c9c776835d20e
piwork-microvm-gui-v0.2.0-windows-amd64.exe	GUI	windows/amd64	414813324	c574f4b7955a01fa9ad11419b05e5469594b24dbdeeb04fb434bd1e4310c0027

Verify downloads with the matching .sha256 files or SHA256SUMS.

Verification

The status table below refers to real-provider model acceptance, which was not performed for these locked inputs. Focused integration acceptance passed on both hosts: record. Custom HTTP ports were checked only on Linux; the full historical GUI/network/deployment matrices were not rerun.

Release checks passed: Go/Python tests, launcher/controller race tests, native desktop-tag tests on both platforms, strict OpenSpec validation, CLI version checks, final Linux/Windows GUI About checks, and all four bundle/input identity checks.

Acceptance evidence covers the locked inputs, not these artifact bytes: the Guest ext4 rootfs is regenerated with fresh UUIDs on every build, so artifacts are not byte-reproducible. Verify downloads with the checksums in this manifest.

Platform	Status	Evidence
linux	not-verified	no real-provider acceptance evidence recorded for the locked inputs
windows	not-verified	no real-provider acceptance evidence recorded for the locked inputs

Corresponding source

This release distributes binaries and a Guest image that include GPL and LGPL components. The written offer below covers every component listed here.

Component	License	Source
Linux 6.6.159, unmodified	GPL-2.0	https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.159.tar.xz, sha256 7206727244da5d85f4a03758d29e1c0673f2f01877793f494c0f3638c46b8fa5
QEMU 10.0.8, modified by 2 patches	GPL-2.0	https://download.qemu.org/qemu-10.0.8.tar.xz, sha256 e038542a698b003605f4982d469d9f55ad17ea8172ebe2b92e97e3a675aa338f, plus the attached qemu-patches.tar.gz
qboot ROM	GPL-2.0	roms/qboot in the QEMU source archive above, sha256 9b9dfc6c25740d6225625570d71cab6805cc9216e68c8932e343266daaeb8c4b
libfdt / dtc, linked into QEMU	GPL-2+	dtc/ in the QEMU source archive above
BusyBox, in the Guest initramfs and rootfs	GPL-2.0	the busybox-static source package at Debian snapshot 20261018T000000Z
167 Debian packages in the Guest rootfs	GPL and LGPL mix	source packages at Debian snapshot 20261018T000000Z; the installed list is usr/share/piwork-guest-packages.txt inside rootfs.ext4
MinGW-w64 runtime libraries in the Windows QEMU	GPL-3.0 with the GCC runtime exception, or LGPL	the source packages recorded in provenance/windows-toolchain.lock.json
Shared libraries shipped beside QEMU (qemu/lib/*.so, *.dll)	LGPL-2.1+, BSD or GPL-2+	shipped with the artifact; source as listed above

Written offer: the complete corresponding source for every GPL and LGPL component listed above is available on request for three years from this release date (GPL-2.0 section 3(b)).

Known limitations

• Linux x86-64 requires working KVM. The Linux GUI also requires GTK 3 and WebKitGTK 4.1 system runtimes; Linux GUI validation used WSLg with GTK 3.24.49 and WebKitGTK 4.1 2.50.4.
• Windows x86-64 requires firmware virtualization and enabled WHPX. The GUI requires Microsoft Edge WebView2 Runtime. Native validation used Windows 11 Home build 26200 and WebView2 137.0.3296.93; other Windows versions are not verified.
• No real AI provider call was verified for the current locked input. API keys and model setup remain the user's responsibility in the existing Piwork workbench.
• Guest state lives in state.qcow2; host directory sharing is not provided. Keep backups before upgrading an existing installation.
• GUI dependency license texts and their missing-text index are included under provenance/gui-licenses/; THIRD-PARTY-LICENSES.tar.gz provides all shipped provenance/QEMU license texts for reading without booting or extracting the executable.
• License texts for the Guest rootfs packages and BusyBox ship at provenance/guest-licenses/ inside the artifact and in guest-licenses.tar.gz, so they can be read without booting the VM; all 167 Guest packages have a text. Kernel and QEMU license texts ship alongside in provenance/ and qemu/licenses/.
• Windows artifacts are unsigned, so SmartScreen may warn on first run.
• Acceptance evidence is recorded against the locked inputs, not against these artifact bytes; see Verification above.