v0.7.0

Breaking

• Per-domain WIT host ABI. The single astrid:capsule@0.1.0 world has been split into per-domain frozen packages at @1.0.0 (astrid:fs, astrid:ipc, astrid:kv, astrid:net, astrid:http, astrid:sys, astrid:process, astrid:uplink, astrid:elicit, astrid:approval, astrid:identity) plus Astrid-owned foundation I/O (astrid:io/{error, poll, streams}). Capsule authors must recompile against this SDK; the contract surface is wire-level incompatible with pre-0.7 capsules. Guest exports moved to per-export worlds in astrid:guest@1.0.0 (interceptor, background, installable, upgradable).
• Resource-backed handles. ipc::Subscription, fs::File, process::Process, net::TcpStream, net::TcpListener, net::UnixListener, net::UdpSocket, and http::HttpStream are now component-model resources with RAII Drop that release the underlying kernel handle. Pre-migration code that carried opaque u64 handles (SubscriptionHandle, StreamHandle, ListenerHandle, BackgroundProcessHandle, HttpStreamHandle) and called free fns like ipc::unsubscribe, net::close, http::stream_close, process::kill(id) is gone. The new pattern: hold the typed handle in scope, call methods on it, let scope-end clean up. Explicit close methods remain where the spec defines them (e.g. HttpStream::close).
• Typed ErrorCode enums per domain. Every host fn previously returning Result<T, String> now returns a domain-specific typed ErrorCode (astrid:fs/host.error-code, astrid:net/host.error-code, …). The SDK preserves SysError::HostError(String) as the unified public error type — typed kernel errors are converted via Debug formatting at the boundary (see the new host_err helper) so capsule code that branches on SysError::HostError(msg).contains("Timeout") continues to work without change. Pattern-matching on a typed variant requires calling the host fn directly through astrid_sys::astrid::<domain>::host::*.
• identity::resolve returns Ok(None) for unlinked. The new contract surfaces "no link" as a typed ErrorCode::LinkNotFound rather than the pre-migration found: bool flag. The SDK wrapper translates this to Ok(None) so callers use idiomatic Option semantics. identity::unlink similarly returns Ok(false) when no link existed.
• fs::Metadata reshaped. Metadata.mtime (raw u64 seconds) is replaced by typed modified() -> Result<SystemTime> / created() / accessed() reading optional Datetime records. is_dir is replaced by a FileType enum with Regular, Directory, Symlink, Other variants. New: symlink_metadata, Metadata::mode.
• fs::FileHandle (now fs::File). Returned by fs::File::open / fs::File::create / fs::File::open_mode. Wraps the resource; provides read_at / write_at / sync_data / sync_all / set_len / metadata methods. Replaces ad-hoc u64 file handles.
• process::ProcessResult renamed to process::Output; process::ExitInfo added. The new contract carries structured (exit_code, signal) so capsules can distinguish SIGTERM-shutdown from SIGKILL-oom from normal-exit. Output::exit_code() -> i32 is kept as a backward-compat accessor (returns -1 for signal-killed). BackgroundProcessHandle is replaced by Process (Drop-reaped) with methods read_logs, write_stdin, close_stdin, signal, kill, wait, wait_with_output, os_pid. New process::Command builder surfaces the cwd, env, and stdin fields the new ABI adds.
• approval::request_decision returns typed Decision. approval::request still returns bool (any approval variant = true). The new request_decision exposes the full Denied / Approved / ApprovedSession / ApprovedAlways / Allowance ladder.
• uplink::register takes a string profile or uplink::Profile. New Profile enum mirrors the WIT enum; register validates the string against canonical names (chat / interactive / notify / bridge) and register_profile takes the typed enum directly.
• net::TcpStream::connect accepts both Unix-domain accepted streams and outbound TCP. The pre-migration distinction between StreamHandle (accepted) and TcpStream (outbound) collapses — the new contract uses a single astrid:net.tcp-stream resource for both, and TCP-only options return a NotTcp host error when called on a Unix-domain stream. net::recv / net::send / net::try_recv / net::accept / net::close / net::bind_unix (free fns) are now methods on TcpStream / UnixListener. New net::bind_tcp exposes inbound-TCP listeners; new net::udp_bind exposes UdpSocket.
• http::HttpStream reshaped. stream_start returns a single HttpStream (resource-backed) carrying status, headers, and read_chunk / close methods. The pre-migration (handle, status, headers) triple is gone. HttpStream::read_chunk() returns Ok(None) at EOF.
• ipc::Message carries typed PrincipalAttribution. Subscribers see the principal as Verified(...), Claimed(...), or System so cross-uplink trust decisions branch on the variant rather than parsing a string. Subscription::poll / Subscription::recv are methods; the free-fn ipc::poll / ipc::recv are gone.
• hooks::trigger removed. The pre-migration wit_sys::trigger_hook host fn is no longer part of the host ABI surface. User-middleware triggering is now an internal capsule-to-capsule concern.
• interceptors::poll removed. Interceptor events are delivered through astrid-hook-trigger (the existing guest export), not run-loop subscriptions. interceptors::bindings() remains for enumeration / debugging.
• env::var returns Ok("") for missing keys; env::var_opt is the new disambiguator. The host fn now returns Result<Option<String>>; the SDK keeps var returning String for source compatibility (empty for missing) and adds var_opt for the option semantics.

Added

• host_err helper. Single point of conversion from any per-domain ErrorCode (or other Debug host failure) into SysError::HostError(String).
• kv::list_keys_page + kv::cas. Wrappers for the new paginated key listing and atomic compare-and-swap host fns.
• kv::get_bytes_opt / kv::get_json_opt. Disambiguate "missing key" from "empty value"; the existing get_bytes / get_json continue to collapse both into empty.
• time::sleep / time::monotonic / runtime::random_bytes. Wrap the new astrid:sys primitives (sleep-ns, clock-monotonic-ns, random-bytes).
• process::Command builder. Mirrors std::process::Command for the new env / cwd / stdin fields on spawn-request.
• net::lookup_host. Wraps the new DNS-with-airlock host fn.
• net::TcpListener + net::bind_tcp. Inbound TCP server posture for self-hosted webhook receivers, gRPC endpoints, etc.
• net::UdpSocket + net::udp_bind. Unconnected and connected-mode UDP.
• net::TcpStream::peek / set_keepalive / set_linger / set_reuseaddr / set_hop_limit. Full surface of the new tcp-stream resource.
• net::TcpStream::shutdown(Shutdown::Read | Write | Both). Mirrors std::net::Shutdown.
• fs::append / fs::create_dir_all / fs::copy / fs::rename / fs::canonicalize / fs::read_link / fs::hard_link / fs::symlink_metadata / fs::remove_dir_all. Bring the SDK to feature parity with std::fs for the operations the new VFS surfaces.

Notes

• The request_response helper is unchanged in semantics; the parallel TS SDK is migrating to match.

---

With many thanks from the following Astrinauts 🚀

• Joshua J. Bouw