Talos 0.20.0-beta.1

Talos 0.20.0-beta.1

The first beta freezes Talos' operator-facing command, approval, configuration,
schedule and signed-update contract. The model proposes; the kernel still decides.

What changed since 0.19.23-alpha

• urllib3 2.8.0 security fixes, with hashed runtime and development locks.
• Unresolved channel failures remain visible as degraded health until that same
  channel successfully polls again. A generated answer is not recovery evidence.
• Bounded retry headroom for transient conversation-compression failures.
• A conversational yes/ja no longer becomes an expired-approval error when
  there is no pending approval. Explicit and queued approvals stay bound to the
  original principal and request; they cannot approve a later replacement action.
• SOUL and skill content reload after same-size, same-timestamp edits.
• Local dashboard Host/Origin restrictions and pinned installer-verifier dependencies.
• A frozen operator contract, explicit support matrix and tested recovery procedure.

Executed release evidence

• Public source: 747044d6e8a64c51a584b750ce44e77141839749.
• Archive SHA-256: 0ba59b5406131d9cf013bab4d2ca1efabb0c2b813f1aa6d361c11541e3482d6a.
• Python 3.11 CI on macOS and Ubuntu; 2,933 collected regression tests with
  explicit platform/repository skips, 263 adversarial cases and 50 desktop tests.
• Exact signed beta archive: Mac and ARM64 Linux clean install, upgrades from
  0.19.23-alpha and RC5, schedule/state migration, rollback and isolated native
  service start/restart; 44/44 real-model E2E cases.
• Signature verification and modified-payload rejection; no new secret findings;
  OSV: zero findings in the shipped Python/Swift dependency locks.
• Seven daily operating observations reviewed for September 25–October 1.

The observation was not uninterrupted or error-free. Transient channel errors,
a Medium prompt-memory continuity incident, and two explained maintenance restarts
are disclosed in the evidence.
Underlying delivered exchanges were retained; generated summary text was not
archived verbatim. These are alpha operating observations, not seven days of beta.

Install or update deliberately

Read the installer before running it. Existing
installations can use talos update --check, then talos update after reviewing
the recovery instructions.
Installation and update do not start or restart a service. Existing operator-owned
configuration, permissions and durable state remain operator-owned.

Linux and macOS, Python 3.11–3.13. Windows is not a tested host. Bring your own
configured model provider or supported signed-in CLI; no model access is bundled.
The optional macOS app remains a non-notarized preview (0.3.3 build 7 with this core),
not an automatic replacement of an installed app. The separate
Pinokio launcher is pinned to this
signed beta; fresh and repeat installs passed on macOS and Linux. Existing Pinokio
installations are not upgraded automatically.

Beta is a compatibility commitment, not a claim of infallibility or a 1.0 release.