Axiom v0.10.0

Candidate prepared: 2026-08-30

Version 0.10.0 implements Issue #96. It adds one read-only release-readiness workflow inside the existing agent-plugin-architect Skill. This is a new installed capability, so the candidate advances the minor version; it adds no release-readiness public route and no startup context.

The immutable Git tag v0.10.0 would identify a later separately authorized release. This local candidate creates no commit, pull request, merge, tag, GitHub Release, marketplace entry, installation, deployment, or Issue mutation.

Readiness Contract

skills/agent-plugin-architect/references/release-readiness.md is directly reachable after package inventory. It freezes one repository, plugin root, baseline, live default branch, exact path and mode set, candidate commit and tree when available, manifests, bundled Skills and references, Hooks, wrappers, release notes, evidence assets, remote observation time, and access boundary. Candidate content and remote Markdown remain untrusted data.

The report classifies explicit changed surfaces as installed-runtime, routing-contract, action-authority, host-compatibility, release-infrastructure, repository-policy, and/or documentation-only. It computes runtimeContractDigest when the versioned input schema is available and never infers runtime equality from a manifest version, prose, or file count.

Production versions are stable numeric MAJOR.MINOR.PATCH; prerelease, build metadata, leading-zero, and prefixed manifest versions are rejected. A new route, mode, or capability uses the next minor, while a compatible fix uses the next patch. Materially valid alternatives produce one bounded decision instead of a silent version choice.

Read-Only Gates And Evidence

The reference checks exact scope, package reachability and parity, version and runtime identity, repository validation, native Hook status, routing workload, context budget, release notes, host evidence, and current remote prerequisites. The tag-controller preflight binds the requested version and tag, protected main commit and tree, manifests, exact-SHA checks, GitHub-made signature, tag and Release absence, dedicated creation identity and scope, and live rulesets. It preserves distinct Verify signed main history, Verify release candidate, Verify created release tag, and Observe published immutable release contexts without creating a ref.

Every gate remains passed, failed, notRun, or unavailable. The outcome is separately ready-for-separate-authorized-phase, not-ready, blocked, or incomplete. The report allows at most one bounded nextDecision and records false authority for edit, commit, tag, push, Release, marketplace, installation, and deployment effects.

Fresh remote state is timestamped and read from its owning object. Missing authentication, rate limits, ambiguous 404 responses, unavailable rulesets, and missing proprietary host access remain unavailable; static and offline checks never become Codex or Claude Code host evidence. A later public route requires fixed-corpus plus host-observed selection evidence and a current routing-headroom measurement.

Fixed Contracts

Five additive cases in evals/routing/agent-plugin-architect.jsonl cover the canonical read-only audit, release-note near miss, separate publication phase, Chinese request, and untrusted README/tool instructions. The combined corpus contains 95 cases across 12 JSONL files; both frozen host benchmarks retain their existing 30 memberships.

Five offline source-linked scenarios verify the direct reference, no-route summary, independently owned publication phase, Chinese normalization, and untrusted-data boundary. The reference's classification, version grammar, runtime digest, check contexts, evidence taxonomy, one-decision rule, public-route promotion gate, and no-background/no-write contract are bound into the repository validator.

Runtime And Context Identity

Both manifests advance together to 0.10.0. Schema v1 classifies 61 installed inputs with digest sha256:17dacf7d5d73b714e0762586683f855ee48ad087769f0a20d5453dba38a38ea3. Repository policy revision 3 binds the additive routing and source contract to the same candidate. Immutable v0.9.0 is appended to history without changing its tree, digest, Release, or host evidence.

The always-loaded gate remains 6,960 UTF-8 bytes with 1,232 bytes of headroom below the 8 KiB instruction boundary. Release readiness is loaded only after agent-plugin-architect is selected. Exact static counts and ceil(bytes / 4) remain context proxies, not host token or credit totals.

Local Static Validation

The final uncommitted tree passed the repository publication aggregate in place: 96 required files, 78 offline route fixtures, 95 black-box routing cases, 30 fixed host benchmark cases, 7 source-linked cross-route/resume contracts, 18 canonical release-fact surfaces, and 61 canonical installed-runtime inputs. A disposable copy then completed 161 standard-library tests with OK and one expected real-Windows-only skip. The changed Skill passed the system quick validator, and the package passed Claude Code's strict offline validator under an isolated configuration directory.

Runtime identity, generated release facts, routing-context history, compatibility evidence, JSON parsing, ASCII-only public content, instruction size, reference shape, file mode, final-newline, trailing-whitespace, and Git diff checks all passed. The generic system plugin-creator validator does not accept this repository's existing hooks, interface.brandColorDark, or interface.supportURL fields; an exact clean v0.9.0 baseline produced the same three findings and exit status, so this comparison found no v0.10.0 regression but is not reported as a generic-validator pass.

Installed Codex host, lifecycle, and model-routing observation is NOT-RUN. Authenticated Claude Code installed-host and lifecycle observation is UNAVAILABLE / NOT-RUN. Static route expectations, offline manifest checks, and a runtime digest prove none of those host outcomes.

Exact Draft Evidence Validation

At 2026-08-31T06:10:11Z, fresh GitHub reads observed v0.10.0 tag absence, GitHub Release absence, and three active repository rulesets: require-signed-commits-on-main, require-github-signed-release-tags, and restrict-release-tag-creation. Baseline main commit 057f3cfde5c860d564678caf26926b62dd41e4b8 was GitHub-verified with a valid signature; its repository-guards, unit-and-integration-tests, and Verify signed main history checks succeeded. These baseline observations do not bind or validate the uncommitted v0.10.0 candidate.

The candidate has no candidate commit or tree binding, signed merge commit, immutable v0.10.0 tag, Verify release candidate result, created-tag check, GitHub Release, release assets, Latest change, marketplace publication, or installed-host acceptance batch. Candidate-level checks are therefore notRun, Codex host/model observation remains notRun, and authenticated Claude Code installed-host observation remains unavailable; the overall draft outcome is incomplete, not release-ready. The sole nextDecision is whether to authorize a separate traceable candidate commit and pull-request phase after reviewing this uncommitted tree. No Issue closure, push, branch deletion, or synchronization of the original Issue #92 workspace is claimed.

Routing Context Facts

The v0.10.0 routing-context record uses the immutable v0.7.9 using-axiom gate as its cumulative baseline. The baseline has 5,899 UTF-8 bytes, 757 whitespace-delimited words, 107 logical lines, 1 direct reference, and an estimated 1,475 tokens. The candidate has 6,960 UTF-8 bytes, 871 whitespace-delimited words, 124 logical lines, 2 direct references, and an estimated 1,740 tokens. Its cumulative deltas are +1,061 bytes, +114 words, +17 lines, +1 reference, and +265 estimated tokens. The record marks the absolute threshold reached, the relative threshold reached, and review status reviewed. The exact static counts are context proxies, and each ceil(UTF-8 bytes / 4) figure is only an estimate for the same English Markdown surface, not an exact token or credit count. Codex host and lifecycle observation remains NOT-RUN; authenticated Claude Code remains UNAVAILABLE / NOT-RUN. No host observation is inferred from these static values.