v0.18.0

Added

• trust.VerifierWorkerBudgets fixes the verifier worker lane's time and byte
  bounds as daemonkit-owned constants, so the verifier lane no longer inherits
  the product pool's budgets and a product configuration can never truncate a
  verifier verdict. Caller deadlines beyond the lane's time budget clamp to it.
• trust.ProcessVerifier.Probe runs one complete verifier child exchange and
  reports transport health only; any well-formed verdict passes.

Changed

• Breaking: worker.Pool.ClaimRuntime now takes worker.VerifierBudgets
  (pass trust.VerifierWorkerBudgets()); direct callers must update. Products
  that only construct pools are unaffected.
• daemon.Runtime.Begin self-probes the trust verifier after worker activation
  and before serving. A daemon whose executable does not dispatch
  trust.RunVerifierChild, or whose verifier lane cannot complete an exchange,
  now refuses to start with daemon.ErrTrustVerifierProbe instead of silently
  rejecting every peer as untrusted.
• The wire server logs peer-verification infrastructure failures — worker
  kills, decode failures, child exec errors, and fail-closed verifier absence
  (trust.ErrNoVerifier) — at Error level; policy denial verdicts keep their
  Debug logging. The peer-facing response stays PeerUntrusted in both cases.

v0.17.4

Fixed

• Keep accepted wire sessions alive after runtime intake closes, then settle
  every written terminal response through its session-bound acknowledgement
  before canceling transport during shutdown.

v0.17.2

Added

• daemon.PublicationSlot.Value resolves the exact resource graph carried by
  an already-admitted request while its admission lease remains live, without
  opening a nested admission or consulting the runtime's current publication.

Fixed

• Re-prove exact dedicated-session absence when Darwin reports EPERM for a
  signal raced by natural process-group exit, while retaining ownership if any
  member remains.
• Make the Swift broker-handoff deadline test prove delivery to a still-blocked
  peer without assuming a wall-clock scheduler-latency bound.

v0.17.1

Fixed

• Correct the release comparison metadata required by the source-release
  contract. The v0.17.0 tag contains the complete deployment and publication
  hard cut, but its automated GitHub release stopped before publication.

v0.16.0

Fixed

• proc.ClaimSpawnedSessionIdentity now duplicates the inherited session
  descriptor before inspection and leaves the original descriptor and flags
  untouched unless the exact ownership proof succeeds.
• Spawned-session ownership is bound to the direct manager parent through
  kernel AF_UNIX peer credentials, independently captured process identity,
  and the exact v1 bootstrap, receipt, acknowledgement, and nonce exchange.
  Reparented sessions, foreign peers, malformed acknowledgements, and partial
  proofs fail without transferring or damaging descriptor ownership.

v0.15.0

Added

• deployment.ActivateInstalled activates only a caller-packaged app at one
  canonical full path. Its schema-v1 receipt seals daemonkit's fresh 64-hex
  operation ID, exact build and policy, bundle and entitlement digests, Team
  ID, signing identifier, designated requirement, CDHash, inode, service plan,
  and operation-bound readiness proof before reporting active.
• StatusInstalled distinguishes an exactly verified but unactivated app from
  prepared and active receipts. AttestInstalled returns the read-only signed
  bundle, entitlement, tree, and file-identity facts consumed by activation.
  DeactivateInstalled requires exact receipt
  ownership, quiesces through a request-scoped runtime stopper, removes only
  receipt and service state, and leaves the packaged app untouched.
• Swift StaticSessionServiceRuntime<Request, Response> owns one typed,
  same-EUID service generation from listener acquisition through Ready,
  draining, request settlement, unlink, and retained terminal result.
• SessionServiceHandler, SessionServiceCodec, and
  SessionServiceConfiguration make the product route and every transport
  bound explicit while keeping raw socket requests and responses internal.
• The Swift service runtime owns receipt and readiness control operations;
  ServiceSocketClient follows an authenticated successor without product
  code implementing lifecycle framing or retry policy.

Changed

• Protected runtime controls are exact unary calls with an empty tenant and
  are rejected before product dispatch when their framing is incomplete.
• A session owns at most one readiness subscription. Duplicate registration is
  rejected with SocketResponseCode.readinessSubscriptionExists; the service
  client retires that session and reconnects instead of replacing an active or
  terminal-settlement owner.
• Trust is evaluated against the peer's effective UID before a session can
  reserve capacity or send application bytes.
• Shutdown has one deadline-independent settlement task. A caller deadline can
  expire, but a later shutdown joins the same drain and reaping work.

Removed

• Deploy, Recover, staged replacement, artifact-driven signed-app
  publication, and WithSignedAppDeploy are removed. Packaging owns app bytes;
  daemonkit owns activation only, with no compatibility or adoption path.
• Swift consumers no longer construct public raw SocketServer,
  SocketRequest, or SocketResponse service loops. There is no compatibility
  wrapper for the deleted public server surface.

v0.14.0

Changed

• Swift BrokerSocketBridge now requires a lifecycle
  RuntimeClientConfiguration and a distinct, nonempty handoffRole. The
  lifecycle session performs only receipt and readiness preflight; a separate
  persistent handoff session sends only daemon.broker-handoff.v1, pinned to
  the exact ready-runtime receipt.
• deployment.RuntimeStopControlStore returns the exact *proc.FileStore
  consumed by holders, without an interface assertion.
• Trust policies allow any exact, disjoint lifecycle role topology that fits
  the server's configured session capacity; the lifecycle-specific two-role
  ceiling is removed.

Removed

• The single-role BrokerSocketBridge initializer and lifecycle-session
  handoff path are removed. There is no compatibility API.

v0.13.0

Fixed

• Swift service-client readiness fixtures use a private test operation instead
  of impersonating protected daemon.* authority. Production Swift servers
  continue to reject every daemon.* operation.
• Schema-archive tests use the typed RecoveryTaskID introduced by the runtime
  recovery hard cut, restoring the Go vet and lint gates.

v0.12.0

Adds the artifact version-exact descriptor resolution library (content-addressed cache, python-tool and signed-app backends, path containment + archive-bound hardening), ghrelease.Latest, version.Equal, proc.FileStamp, the FileStore/Controller UnsupportedSchema archive policy, cache GC, and the cask-template husk self-heal fix. Also carries the wire broker handoff, runtime recovery, and lifecycle/workers/trust hard-cut landed since the 0.11.0 preparation. See CHANGELOG.md.

v0.10.0

Added

• deployment.Controller is the sole public signed-application publication
  workflow. Deploy, Deactivate, Recover, and Status operate on exact
  Config inputs, generation proofs, immutable service plans, and durable v1
  receipts and transactions under .daemonkit-deployment.

Changed

• Service replacement is fenced by an exact operation, consumer-policy
  binding, and canonical plan. Completion and deployment acknowledgement are
  persisted independently, ordinary convergence is rejected while a fence is
  active, executable paths must be exact, and prior plan history survives when
  its executable is no longer resident.
• The application release template consumes an artifact-only reusable
  workflow, stages and publishes one caller-owned draft by exact release ID,
  and publishes a stable cask only after local and public-asset verification.

Removed

• The public fetch package and its one-step installation API. This is a hard
  cut with no compatibility aliases, legacy readers, or fallback state paths.