v1.0.0-rc.1

Sworn v1.0.0-rc.1

Sworn is the team that carries a Baton delivery from an approved plan to a
checked merge. This release candidate is the first public build of the complete
autonomous delivery loop.

What ships

• The Planner, Implementer, Captain, Verifier, and merge journey.
• Parallel independent tracks, with one ordered worker on each track.
• Safe pause, resume, retry, takeover, cancellation, and restart recovery.
• A terminal view, JSON output, and local browser board backed by the same
  saved run.
• Codex CLI, Claude Code CLI, OpenAI Responses, OpenAI-compatible Chat
  Completions, DeepSeek, Gemini, Bedrock Runtime, and Bedrock Mantle
  connections.
• Local evaluation records and optional OpenTelemetry output for monitoring
  quality, time, tokens, retries, and recovery.
• Baton v1.0.0-rc.12, including its autonomous-engine conformance suite.

The Sworn orchestrator

Model output is not always shaped exactly as expected. Sworn now has a small,
bounded recovery layer that can resume a worker, ask the Captain, retry an
operational step, or pause one track for a person.

It cannot approve work, invent a Captain decision or Verifier verdict, or
merge. It keeps routine interruptions moving without weakening Baton's
delivery checks.

Install

Sworn currently ships for Linux x86_64:

brew install --cask swornagent/tap/sworn

The GitHub release also includes
sworn-v1.0.0-rc.1-linux-amd64.tar.gz and checksums.txt. See the
installation guide
for verification, direct installation, upgrades, and runtime requirements.

Current limits

• The operator supplies an approved Baton plan, run manifest, AI connection
  configuration, credentials, and approval.
• Production model execution needs Linux x86_64, Git, root-owned
  /usr/bin/bwrap, and unprivileged user namespaces.
• This is a release candidate. Use it to evaluate real delivery work and
  report rough edges before v1.0.0.

Sworn v0.2.0

Sworn v0.2.0

Released: 2026-07-21

v0.2.0 is the first packaged milestone from Sworn's greenfield architectural
v1 kernel. It establishes a small, deterministic trust core and a real bounded
delivery vertical without claiming the complete autonomous loop.

Architectural v1 and identifiers such as sworn-run-config-v1 describe the
kernel and wire-schema generation. They are intentionally independent of the
v0.2.0 SemVer package identity.

What ships

• One transactional SQLite control truth for commands, events, immutable
  records, external effects, and the read-only board projection.
• An embedded, checksummed Baton v1.0.0-rc.1 snapshot pinned to commit
  dd41dcc8c46def2f8b7b86a4f9acd26aeb486667.
• Exact Baton plan, authenticated authority, repository, candidate, evidence,
  and admission bindings that fail closed on unknown or ambiguous facts.
• A contained Linux execution boundary with finite resource and output limits,
  process-tree cleanup, measured writable export, and restart-safe effect
  reconciliation.
• One native Codex CLI builder profile using CLI-managed, file-backed ChatGPT
  authentication. Sworn accepts no Platform API key or authentication fallback,
  and model-directed tools cannot read the mounted credential or use the
  outer process's network access.
• One bounded sworn run operation that advances an already planned and active
  work item through the builder, its exact ordered local checks, and atomic
  admission to reviewable.
• Stable command identities and bound external results, so restarting the same
  work converges on durable truth instead of starting a second workflow.

The target branch is never updated by this path. reviewable means that the
exact candidate and its required local evidence were admitted together; it is
not an independent verdict and it does not mean PASS.

Artifact and prerequisites

The release publishes one supported archive,
sworn-v0.2.0-linux-amd64.tar.gz, plus checksums.txt. Verify and inspect it
before installation:

sha256sum --check checksums.txt
tar -xzf sworn-v0.2.0-linux-amd64.tar.gz
./sworn-v0.2.0-linux-amd64/sworn version --json
mkdir -p "$HOME/.local/bin"
install -m 0755 sworn-v0.2.0-linux-amd64/sworn "$HOME/.local/bin/sworn"

The binary is built without CGO. The execution boundary still requires Linux
amd64, a suitable systemd user manager, cgroup v2 delegation, Bubblewrap,
unprivileged user namespaces, and finite resource backing.

The production adapter accepts only codex-cli 0.145.0-alpha.18, an exact
304,169,008-byte static binary with SHA-256
16db86b6bf81cc426032fd42216dd97e60f97b149272f1f9963845a0675dae94.
Sworn does not download that artifact. Operators must provision it and a
dedicated file-backed Codex CLI ChatGPT login as described in Running the
bounded vertical.

Release evidence

The real Codex boundary suite exercised the exact pinned static CLI against a
local scripted Responses endpoint while mounting synthetic file-backed ChatGPT
state. It proved workspace editing, credential blindness for a real nested
tool, and nested network denial. The separate real contained-executor
credential suite proved that in-place refresh writes persist on the original
inode and that cleanup and reuse remain truthful after success, failure,
timeout, cancellation, and output overflow. The scripted provider used a
separate test-only bearer, made no provider model call, and does not claim that
its request authenticated from the mounted ChatGPT state.

On 2026-07-21, a separate opt-in built-process smoke test used the built-in
OpenAI provider, the dedicated Codex CLI ChatGPT login, gpt-5.4, and the exact
pinned CLI. One live model turn created the exact candidate, the real local
check passed, and Sworn reached reviewable at revision 4 without changing the
target ref. A second built-process invocation emitted no commands or effects
and converged without another model turn.

Ordinary and tag CI gate the deterministic suite, race detector, vet, non-CGO
build, and Baton snapshot checks. Release qualification also includes the
separately invoked opt-in real Linux and Codex boundaries recorded above. The
live provider smoke remains explicit because it consumes the operator's Codex
usage.

Deliberate limits

v0.2.0 is a bounded production vertical, not yet a turnkey autonomous delivery
product. It does not provide:

• public initialization, plan activation, configuration generation, or
  repository discovery;
• independent verifier dispatch, verdict acceptance, or bounded repair epochs;
• a scheduler, multi-item polling loop, or external authorizer transport;
• manual latch release or compare-and-swap target integration;
• Codex installation or an authentication browser flow; or
• the 18 Baton real-boundary cases through the built Sworn binary.

Deployments must provision an existing Store and authority bundle, an exact
content-bound check runtime, a dedicated Codex home, and the pinned Codex
binary. The executor currently requires Linux, a suitable systemd user manager,
cgroup v2 delegation, Bubblewrap, unprivileged user namespaces, and finite
resource backing. See Running the bounded vertical for the exact
operational contract.

There is no v0 compatibility or migration reader. The protected v0 line remains
archaeology rather than a production-package source for this kernel.

Direction for v0.3.0

v0.3.0 should extend the same reducer and effect journal with a fresh,
independent native-CLI verifier. Verifier turns will be memoryless and bind
their identity, policy, dispatch, submission, candidate, and evidence into the
verdict. Current authority will then gate verdict acceptance, and bounded repair
epochs can be added without treating INCONCLUSIVE as implementation failure.

The public scheduler and integration edge remain later work unless those
verifier invariants are complete first. This keeps the next release focused on
closing the quality gate rather than widening orchestration.

See ADR 0001 for the kernel boundary,
ADR 0009 for the
credential boundary, and the walking-skeleton roadmap for the
remaining gates.