OwnFramework Loop v0.9.1 — Host Capability Runtime

OwnFramework Loop v0.9.1 — Host Capability Runtime

Frozen release target: d23cadc

This is the canonical official publication of the v0.9.1 closed source/master
line. The release is immutable; release tags are historical truth and are
not rewritten.

10/10 hosted CI lanes are green at the frozen release target:

• security
• adapter-contract
• claude-adapter
• codex-adapter-static
• core Ubuntu Python 3.12
• core Ubuntu Python 3.13
• core macOS Python 3.12
• core macOS Python 3.13
• release-gate Python 3.12
• release-gate Python 3.13

The canonical 87/87 release gate is also green locally.

What 0.9.1 delivers

Portable host capability runtime

• Packets may declare portable semantic capabilities; the trusted runtime
  resolves exact host executables, versions, read/write paths, and derived
  network authority before the model starts.
• Every semantic attempt receives an immutable capability-resolution receipt
  referencing a run-level CAPABILITY_BINDING.json; stable capability,
  host-manifest, network, privileged-canary and runner-profile identity is
  exact-matched before every later model launch.
• ofloop capabilities probe|preflight|fingerprint|profile|commission
  exposes host inventory, named runner profiles, and trusted privileged-canary
  commissioning without a semantic model call.
• HOME remains broadly denied; tools discovered under HOME now require
  explicit operator commissioning instead of relying on contradictory PATH
  discovery.
• Per-pass scratch is separated from durable repository-scoped package and
  browser caches, preventing repeated downloads without introducing
  cross-client writable-cache poisoning.
• Privileged container.docker is broker-only: direct daemon sockets,
  inherited Docker/Kubernetes/agent IPC selectors, and unsandboxed Docker
  exceptions are never granted; conventional Docker/Podman/containerd daemon
  sockets are explicitly denied, and the Bash guard requires the resolved
  privileged capability marker before Docker invocation, including common
  shell-wrapper forms.
• local.http-service is explicit and unavailable until a safe local-binding
  provider is commissioned and proven for the exact host runtime.
• Privileged and local authority requires core-receipted trusted canary
  evidence bound to platform/architecture/Claude runtime, provider/broker
  identity, and executable digests; a copied runtime fingerprint alone is
  insufficient.
• Trusted named runner profiles can select only model and effort, are frozen
  into run identity, and cannot override sandbox/tool/MCP/session authority.
• Funded supervisor runs propagate their exact remaining durable cost
  ceiling to Claude's native print-mode per-pass budget while aggregate
  Loop accounting remains canonical; reviewer tool caches remain
  pass-ephemeral.
• Capability-resolution failures are terminalized as proven pre-provider
  semantic attempts instead of leaving a reserved attempt for stale recovery.

Terminal source hardening

• Semantic replay is authorized only after durable resource accounting and
  an explicit acceptance publication bound to the exact semantic artifact
  digest and role-specific candidate identity; drifted bytes or candidate
  identity fail closed without a second semantic charge.
• Preflight output carries the same proved effort-attestation identity used
  at launch and marks explicit manifest/profile overrides as diagnostic
  rather than launch-parity evidence.
• Redacted secret scanning refuses unreadable or oversized inputs instead
  of collapsing unknown scan state into a clean result.
• Browser runtime proof binds the top-level Playwright version to the
  verified installed distribution identity and rejects contradictory proof.
• Source authority, recovery, claim ownership, cost accounting, capability
  binding, browser identity, runner-profile truth, secret scanning,
  worktree ownership, and state/event integrity remain covered by the
  canonical multi-platform release gate.

Public contract and runner normalization

• Durable supervisor runner availability is now explicit and distinct from
  adapter installation; unsupported --runner values are refused before a
  job row can be created, while Codex remains an experimental foreground
  Agent-Skills adapter rather than an implied unattended runner.
• Commissioned Claude model selection is documented as packet/profile truth:
  restricted workers do not inherit interactive settings.json; named
  operator profiles bind explicit model/effort policy before provider launch.
• Claude and Codex coordinator skills are parity-gated on critical authority
  doctrine so duplicated host UX cannot silently drift.
• Packet examples are executable documentation validated by the current
  packet admission path, including a modern v3 PROGRAM example with
  checkpoint-scoped acceptance and runner/capability declarations.

Repository hygiene

• Operator-facing adapter and supervisor lifecycle commands live under
  bin/; platform-specific service implementations live under
  scripts/supervisor/; repository root retains only the deliberate core
  install, uninstall, validation, and release-gate entrypoints.
• Maintained docs, templates, scripts, and tests now have explicit indexes;
  one-off implementation reports and retired policy examples are absent
  from the active repository surface while provenance-bearing regression
  names are retained.

Material limitations preserved

• Claude Code is the first production-hardened unattended semantic runner;
  other adapters are not equivalent commissioned unattended runners.
• Codex remains experimental/static-distribution proven; it is not an
  equivalent commissioned unattended runner.
• Native Windows is not a commissioned-supervisor target.
• WSL user service does not itself keep the WSL VM alive.
• APPROVED does not authorize push, merge, deploy, publish, payment,
  messaging, or any unrelated external effect; promotion remains
  human-controlled.
• Deferred defense-in-depth observations (executable symlink rejection in
  the host-manifest executable field, a read_paths policy gate against
  sensitive directories, and platform-specific os.link(2) semantics
  for broken symlink targets) remain unreachable through the current
  production authority path because every authority artifact is owner-gated
  by manifest ownership, installation-time mode and ownership checks, and
  Python's portable atomic-write pattern; they are not patched here.