Traverse v0.10.2

Traverse v0.10.2

Released 2026-09-14.

Traverse v0.10.2 is a compatibility-preserving patch for the public runtime,
embedders, MCP hosts, and CLI. It ships the work that landed on main after
the v0.10.1 compatibility fixes: verified Registry application references,
Mode A/B MCP hosts, Component WIT host-capability activation, host connector
command dispatch, persisted capability hydration, and browser-local planning
and composed execution.

v0.10.1 was tagged from codex/release-v0.10.1 and never merged to main,
so this cut moves the workspace version from 0.10.0 to 0.10.2.

Highlights

Verified Registry application references

A host prepares an active, signed Registry release and commits its verified
contract and WASM bytes under immutable digest keys. app validate,
app register, and app activate consume prepared evidence only; they do
not fetch from the Registry, replace an exact version, or substitute a local
component path. Cache integrity failures are redacted. Operators receive
stable lifecycle outcomes rather than endpoints, credentials, headers, cache
paths, or raw artifact bytes.

v0.10.0 and v0.10.1 do not provide the complete
preparation-to-offline-activation path. The checked-in Callweave
inference.evidence-normalize@1.0.1 signed-release fixture proves
exact-version validation, registration, and local activation from prepared
cache bytes with no credential or private endpoint requirement.

Mode A and Mode B MCP hosts

• Mode A (spec 119): a verified-registry MCP host over host-owned,
  verified public metadata.
• Mode B: traverse-mcp prepare-cache prepares a host-owned verified
  registry cache from public registry_ref values. traverse-mcp stdio --cache <dir> then serves discover/validate/execute/report from that cache
  only, without an expedition checkout or App-References materialize rewrite.

Pin and verify the same versioned traverse-mcp binary for both modes.

Component Model WIT host-capability activation

component-wit-v1 validates exact traverse:platform WIT imports and
resolves them only through application-activated target-local bindings. Host
ABI v1 / core-wasm-v1 fixtures are unchanged. Callweave recording identity
is not an automatic alias. See
docs/component-wit-v1-migration.md.

Host connector command dispatch

dispatch_host_connector_command is the public app-runtime port for a
manifest-selected, explicitly activated host connector. The first operation
is audio.capture; local-model-runtime (model.execute) uses the same
envelopes. Browser and macOS share schema 1.0.0. Guest
connector_invoke and the Component WIT recording fake are not this port.
See docs/host-connector-command-dispatch.md.

Persisted capability metadata and serve availability

serve builds an immutable persisted capability metadata index at workspace
load without parsing every component contract. Command routing and reached
workflow steps hydrate digest-verified contracts on demand into a
host-configured process-local LRU with single-flight coalescing. Unreached
workflow branches stay unparsed. Hydration faults fail only the dependent
command or workflow with secret-free diagnostics.

GET /v1/workspaces/{workspace}/apps/status reports whether each registered
app is ready or failed after serve materializes persisted registration
state. Registered apps that cannot materialize remain visible as failed
and return 503 app_unavailable on command routes, with a stable
secret-free reason_code.

traverse-cli serve dispatches Registry-backed app commands from the
persisted state_machine in workspace registration state. It does not
reopen or re-resolve the source application manifest. Legacy registrations
without that declaration require an explicit app register refresh;
app_registration_requires_refresh and 503 app_unavailable replace silent
404 app_not_registered.

Browser-local planning, composed execution, and state

The Rust embedder and traverse-embedder-web can plan a deterministic
workflow locally and execute a reviewed composed workflow offline. Adaptive
composition is opt-in; plan-then-seal is the default authoring path
(Decision 80). Stateful browser placement uses IndexedDB attestation, and
the Host ABI exposes state_get / state_put / state_delete for Stateful
capabilities.

ArtifactRouter WASI diagnosis

ArtifactRouter forwards the concrete WasmExecutor failure text (trap,
guest exit, instantiation/missing-export, or resource-limit detail) instead
of collapsing every failure to registered artifact execution failed.
Default WASM linear-memory limits are raised to 32 MiB so released registry
wasi-command planners that reserve ~17 MiB initial memory (for example
core.create-audio-capture-request-plan@1.0.0) can instantiate on the
registered target: local path.

Other changes

• CLI: workflow plan and promote/finalize commands; capability authoring
  metadata recorded at package time.
• Web embedder: npm Trusted Publishing via web-v* tags; composed-workflow
  run() uses async WebAssembly.instantiate; browserLocalPlan forwarding
  chains match the Rust planner.
• Swift host: production wasmi bridge documented at wasmi 2.0.0; WasmKit
  references deprecated.
• traverse-registry pin advanced to =0.20.0 for manifest-scoped
  preparation.

Upgrade notes

The Rust crate APIs and traverse-cli binary name are unchanged for existing
local-execution callers.

• Registry-backed app validate / register / activate now require a
  prepared host-owned cache. Hosts that previously resolved registry_ref
  at those commands must prepare the cache first.
• Legacy serve registrations without a persisted state_machine need an
  explicit app register refresh; missing refresh is 503 app_unavailable / app_registration_requires_refresh, not a silent 404.
• Default WASM linear memory is 32 MiB. Hosts that override resource limits
  should re-check planner instantiation.
• Adaptive/runtime workflow composition is opt-in. Plan-then-seal remains
  the default authoring path.
• traverse-registry consumers should pin =0.20.0.
• Browser capabilities that declare approved connector imports still load
  without ambient connector authority; use the Spec 137 host-connector
  command port for audio.capture / model.execute.

Validation

Release preparation must pass these local gates before tagging:

cargo build --workspace
cargo test --workspace
bash scripts/ci/repository_checks.sh
bash scripts/ci/spec_alignment_check.sh
bash scripts/ci/coverage_gate.sh
TRAVERSE_PUBLISH_DRY_RUN=1 TRAVERSE_PUBLISH_NO_VERIFY=1 bash scripts/ci/publish_crates.sh

The tagged commit must pass the GitHub version-guard, repository-checks,
coverage-gate, and stress-test jobs before the tag-triggered crates.io
publish job can run.

Release steps

Per the release process, from a clean main
checkout after CI is green:

bash scripts/ci/bump_version.sh 0.10.2
git push origin main
git push origin v0.10.2

The tag push triggers the guarded crates.io publication workflow. The
publication requires explicit manual approval under the Traverse constitution.

Further reading

• Changelog
• Release process
• Host connector command dispatch
• Component WIT v1 migration
• CLI reference

Traceability

• Governing spec: 048-semver-publishing-pipeline
• Themes: 119 (Mode A MCP), 120 (host-owned artifact preparation),
  132 (stateful browser placement), 135 (component-wit-v1),
  137 (host connector command dispatch), 113 (browser-local planning)
• Range: published v0.10.1 through this v0.10.2 (main since v0.10.0,
  excluding the three v0.10.1 compatibility fixes)