Repository navigation
feat(sdk): integrate Pierre stack and Inspect for 0.7.1 - #362
Draft
ebursztein wants to merge 71 commits into
Draft
ebursztein wants to merge 71 commits into
ebursztein wants to merge 71 commits into
Conversation
Add `AppError::new(status, error)` and mechanically rewrite tuple-struct
call sites across `crates/capsem-service/src` so subsequent structured
error fields and helper constructors do not mix with mechanical renames.
Generated with:
python3 -c 'import pathlib, re; [p.write_text(re.sub(r"\bAppError\((?!pub\b|status\b)", "AppError::new(", p.read_text())) for p in pathlib.Path("crates/capsem-service/src").rglob("*.rs")]' && cargo fmt -p capsem-service
…ck OCI registry Add evaluator-granted host-side Dockerfile and Compose `build:` image building and a read-only loopback HTTPS OCI v2 registry to `inspect-capsem-sandbox`: - Add `HostBuildGrant` (`containers/build_grant.py`) enforcing evaluator environment authority (`CAPSEM_INSPECT_HOST_BUILD=1`, `CAPSEM_INSPECT_ALLOWED_HOST_PATHS`, `CAPSEM_INSPECT_BUILD_NETWORK`, `CAPSEM_INSPECT_BUILD_DOCKER_CONFIG`) with task-level narrowing and strict refusal of `--network host`. - Add `containers/build_context.py` for canonical path containment, symlink escape rejection, `.dockerignore` context tree walking, deterministic cache key hashing, and unified Compose `build:` / `dockerfile:` normalization. - Add `containers/image_build.py`, `containers/oci_ingest.py`, and `containers/oci_registry.py` to build OCI archives via `docker build` / `buildx`, ingest OCI-layout and legacy `docker-save` tars into a content- addressed blob store (skipping BuildKit attestation manifests), and serve verified digests over a loopback TLS 1.2+ `/v2/` registry with 0.7 `[images]` `sources`, `ca_pem`, and `admit` profile wiring.
Add structured `ErrorResponse` fields (`code: ErrorCode`, `vm_id`, `timeout_secs`) on the HTTP wire contract, return HTTP 504 (`GATEWAY_TIMEOUT`) on service-side exec and container create timeouts, and expose structured Python SDK exceptions (`CapsemError`, `CapsemTimeoutError`, `CreateTimeoutError`, `ExecTimeoutError`, `VmNotFoundError`) plus `MAX_REQUEST_BODY_BYTES` and `CREATE_READY_SECS` in the Python and TypeScript SDKs.
Stage .capsem-ca.crt and .capsem-ca-bundle.crt into a temporary build context when CAPSEM_INSPECT_BUILD_CA_PEM_FILE (and optional CAPSEM_INSPECT_BUILD_CA_BUNDLE_FILE) is set, seed NSS sql:$HOME/.pki/nssdb via certutil during builds and container startup, require BuildKit on the host (removing the legacy 0.6 classic-builder heredoc lowering module), and include the CA fingerprint in build cache keys.
…list
Allow callers to attach optional key/value string labels to VMs at
creation time, inherit or override them on fork, and return them on
every SandboxInfo entry in /vms/list and /vms/{id}/info so external
orchestrators and garbage collectors can identify their own VMs.
- capsem-api / capsem-service / OpenAPI: add optional labels
(Option<HashMap<String, String>>) to ProvisionRequest, ForkRequest,
SandboxInfo, VmInstance, SessionCreationParams, and PersistentVmEntry,
validated server-side via naming::validate_vm_labels (<= 64 entries,
keys reuse validate_vm_name: 1..=64 ASCII chars starting with
[A-Za-z0-9] and containing only [A-Za-z0-9_-]; values <= 255 UTF-8
bytes with no control chars) and normalized via
naming::non_empty_labels so {} is treated identically to None.
- Fork inheritance: /vms/{id}/fork inherits the source VM's labels when
ForkRequest.labels is omitted/null, replaces them when a non-empty map
is provided, and clears them when {} is provided.
- List cache fingerprint: include running and inactive VM labels in
list_response_fingerprint via append_labels_fingerprint so label
differences invalidate cached /vms/list responses.
- SDKs (Python, Rust, TypeScript): thread optional labels through
Hypervisor.create / CreateOptions and VM.fork / ForkOptions and
regenerate OpenAPI models across all three SDKs.
- CLI & TUI: add repeatable -l / --label KEY=VALUE to capsem create and
capsem fork, and display labels in the TUI session detail pane.
- Service test helpers & Citadel ratchets: consolidate ProvisionOptions
and PersistentVmEntry test constructors via test_provision_options and
test_persistent_entry in crates/capsem-service/src/tests.rs (reducing
tests/lifecycle.rs and tests/assets_registry.rs by ~100 lines) and
update the four corresponding oversized-Rust-file line ratchets in
config/gate.toml.
Add `discover_gateway`, `capsem_run_dir`, `GatewayEndpoint`,
`Hypervisor.connect`, and optional `url`/`token`/`run_dir` parameters on
`Hypervisor` and `VM` resolving `CAPSEM_GATEWAY_URL`,
`CAPSEM_GATEWAY_TOKEN`, and `<run_dir>/gateway.{port,token}`.
…ration Port the inspect-capsem Inspect AI SandboxEnvironment integration onto the 0.7 Python SDK surface in VM-only mode (container/image execution deferred to the follow-up container commit): - Split the implementation across focused modules under integrations/inspect-ai/inspect_capsem/ (config.py, _cleanup.py, _controller.py, _exec.py, _files.py, _lifecycle.py, _registry.py, _tools.py, _transfer.py, sandbox.py) with every module under 300 lines at 100 columns. - Encapsulate private CapsemSandboxEnvironment state inside sandbox.py, return SandboxConnection(type="capsem", command="capsem shell <id>"), and bound process-owned VM teardown at interpreter exit. - Derive staged file transfer part sizes from MAX_REQUEST_BODY_BYTES, scope VM cleanup to exact managed-by + prefix labels, and clean up unnamed VMs on 504 CreateTimeoutError via CreateTimeoutError.vm_id. - Harden non-root user environment reset when id -un prints numeric UID to stdout and exits 1 or pwd.getpwuid raises KeyError in minimal containers. - Wire integrations/inspect-ai into capsem-gate, CI scope routing, installed wheel/sdist entry-point proof (image_package_acceptance.py), and live VM ironbank acceptance (live_acceptance.py + test_sdk_live.py). Proves #310 / #342 acceptance criteria: - [x] `inspect_capsem` registers cleanly as an `inspect_ai` `SandboxEnvironment` entry point (`@sandboxenv(name="capsem")`) from an installed `inspect-capsem-sandbox` wheel and sdist in an isolated prefix (`integrations/inspect-ai/tests/image_package_acceptance.py`). - [x] `sample_init`, `exec` (`ExecTarget.VM` with non-zero exit, signal, and timeout), `read_file`/`write_file` (text, binary, non-workspace), Inspect's `self_check` suite, `eval_async` with `SandboxEnvironmentSpec("capsem", ...)`, `sample_cleanup`, `task_cleanup`, and prefix-scoped `cli_cleanup` run against the live service with session ledger (`history(layer=EXEC)` + `session.db` `exec_events`) and zero leaked VMs.
Add OCI container execution mode (`execution_mode="container"`, `image=...`, and `compose.yaml` / `docker-compose.yml` config parsing) on top of Capsem VM sandboxes: - `inspect_capsem/containers/compose.py` + `compose_fields.py` + `compose_inputs.py` + `compose_interpolation.py` + `compose_service.py` + `compose_values.py`: single bounded Compose parser built on `ComposeInputs`, `ComposeLimits` / `_BoundedSafeLoader`, and `InterpolationBudget` with redacted diagnostics, default-deny host environment interpolation (`SAMPLE_METADATA_*` allowlist with `.env` spoofing rejection), support for `image`, `command`/`entrypoint`, `environment`, `working_dir`, `user`, `volumes` (read-write and `:ro` bind mounts with symlink and project-root containment), `healthcheck`, `cpus`/`mem_limit`, and fail-closed validation on unsupported service keys, network isolation overrides, and multi-service topologies. - `inspect_capsem/containers/runtime.py` + `controller.py`: OCI container staging (`prepare_oci_workload_container`, `_stage_oci_bind_volumes`) and `ContainerController` protocol. - `inspect_capsem/_compose.py`, `_controller.py`, `_exec.py`, `_files.py`, `_lifecycle.py`, `config.py`, `sandbox.py`: thread container execution mode, non-root `user` execution (`su -m` / `setpriv`, skipping privilege switching when already running at target UID/GID inside non-root workloads and raising `PermissionError` when requesting a root or different user switch inside a `no-new-privileges` non-root workload), `/workspace` staging, and `SdkCapsemController` `registry_ca_pem` / `Registry(ca_pem=...)` plumbing (moved from PR #340 into PR #339 so #339's hermetic loopback TLS OCI workload fixture authenticates without #340 while `CapsemSandboxConfig` continues to reject `registry_ca_pem` in untrusted task configs). - Unit tests (`tests/containers/*`, `tests/test_config.py`, `tests/test_sandbox*.py`) and hermetic loopback TLS OCI workload acceptance (`tests/oci_workload_fixture.py`, `tests/live_acceptance.py`). Proves #310 / #311 / #342 acceptance criteria: - [x] Compose config coercion (`compose.yaml` / `docker-compose.yml`) and `CapsemSandboxConfig(image=...)` select `execution_mode="container"` and route `exec` to `ExecTarget.WORKLOAD`. - [x] Hermetic OCI workload acceptance (`tests/oci_workload_fixture.py` + `tests/live_acceptance.py`) builds a digest-pinned OCI image from the guest initrd busybox, serves it over loopback TLS with a per-run CA passed via `SdkCapsemController(registry_ca_pem=...)`, admits its digest in `settings.toml`, runs `sample_init`, `exec` (`ExecTarget.WORKLOAD`), `write_file`/`read_file` (text and binary), and `eval_async` with `SandboxEnvironmentSpec("capsem", ...)` without pulling from Docker Hub, and verifies `history(layer=EXEC)` + `session.db` `exec_events` (`target="workload"`) and zero leaked VMs after `sample_cleanup`.
Extend `run_live_vm_sandbox_acceptance` (invoked by the live VM gate `test_inspect_ai_live_vm_sandbox_acceptance`) with `verify_host_build_workload_mode` (`#342` bullets 2, 5, and 6): - Require the `docker` CLI and daemon on `PATH` and fail loudly if absent (no silent skip; `#342` bullet 5). - Load a hermetic busybox base image from the guest initrd into local Docker and build a multi-stage `Dockerfile` + `compose.yaml` (`build:` with `context`, `dockerfile`, `target`, and `args`) completely offline (`CAPSEM_INSPECT_BUILD_NETWORK=none`). - Verify fail-closed refusals when `CAPSEM_INSPECT_HOST_BUILD` is unset, when a symlink escapes the build context, and when `HostBuildGrant` attempts to widen `allowed_contexts` or `network` beyond the operator environment ceiling. - Verify multi-stage `FROM ... AS ...`, `FROM scratch`, `ARG`/`ENV`, `WORKDIR`, `USER 1000:1000`, `ENTRYPOINT`/`CMD`, `COPY --from` with `--chown`/`--chmod`, heredoc `RUN`/`COPY`, `ADD` local tar extraction, `.dockerignore` exclusion, real `inspect-sandbox-tools` host binary upload (`700:1000:1000`) and onedir archive extraction as UID `1000:1000` (`RUN rm -rf /var/tmp/sandbox-services` before `USER 1000:1000`), and `CAPSEM_INSPECT_BUILD_CA_PEM_FILE` CA injection (including byte-for-byte PEM equality inside the live guest container) on a real VM workload container (`#342` bullets 2 and 6). - Verify non-root `USER 1000:1000` container file round-trip (`write_file`, in-container append, `read_file`), `PermissionError` on `user="root"` privilege escalation under `no-new-privileges`, and `inspect_ai`'s portable `self_check` suite against the `USER 1000:1000` container. - Pin a stable loopback OCI registry port (preferring default `5055` via `CAPSEM_INSPECT_BUILD_REGISTRY_PORT` and falling back to an available loopback port if `5055` is busy) across `settings.toml` `[images]` source admission and verify second-sample digest cache reuse without a second `docker build` even after tightening `settings.toml` to digest-only admission. - Load sibling test modules in standalone `python -I` gateway consumer runs via `importlib.util.spec_from_file_location` without mutating `sys.modules["tests"]`, and use `unittest.mock.patch.object` for test seam overrides.
Codecov Report❌ Patch coverage is ❌ Your patch status has failed because the patch coverage (0.0%) is below the target coverage (90.0%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## 0.7 #362 +/- ##
==========================================
+ Coverage 68.4% 76.2% +7.7%
==========================================
Files 1830 1423 -407
Lines 150520 117941 -32579
Branches 113562 110210 -3352
==========================================
- Hits 103066 89913 -13153
+ Misses 40783 21427 -19356
+ Partials 6671 6601 -70
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Hosted Linux x86 coverage in CI38935897735 failed the existing already-exited-shell test at633ms against its500ms wall-clock assertion. A100ms setup sleep did not prove the child exited; shared-host scheduling is outside the shutdown contract. Observe the real unreaped exit with the existing foundation primitive, prove success with zero grace and positive reaping, and synchronize ignored-HUP readiness over stdout. Production shutdown behavior is unchanged. Focused nine shutdown tests, formatting and changed-owner Clippy pass.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces support for advisory metadata labels on sandboxes across the service, API, and all SDKs (Python, TypeScript, and Rust), enabling better tracking and categorization of VMs. It also refactors error handling by introducing a structured ErrorCode enum and adding metadata fields (vm_id, timeout_secs) to ErrorResponse and AppError to provide more diagnostic context on failures. Additionally, it fully implements the standalone inspect-capsem-sandbox (inspect_capsem) integration for Inspect AI, supporting both VM and container/Compose execution modes, host-side OCI image builds with CA patching, and local registry hosting. The build system and gate have been updated to run standalone lint, type, test, and build checks for this new integration. I have no feedback to provide as there are no review comments.
…/0.7.1-pierre-sdk-20261016
Stamp the user-selected0.7.1 version across native, Rust library publication constraints, Python, Node, MCP and builder metadata; require capsem>=0.7.1 for Inspect labels and typed-error APIs. Refresh Cargo/uv/pnpm locks with their owners. Review confirms32first-party Cargo version changes and no upstream Cargo/Python dependency version drift. Correct the stale Inspect editable SDK lock0.6.3 and add a source guard with four adversarial cases; genuineRED before refresh,48focused version/contracts,4lock/type checks and47shape/web guards pass. Document the matching service prerequisite and complete-pair credential discovery, replacing retired parser-only/legacy-heredoc notes.
Install job117096865747 source-built the pinned Cargo tools from17:12 through17:30, then downloaded those same versions as prebuilts in six seconds. Move the existing declared-tool selection and pinned install action before the complete bootstrap so its exact-version probes can reuse them. Keep full QEMU/binfmt/device provisioning and asset ownership. Genuine ordering guard RED before reorder; fifteen prerequisite and adversarial tests, Ruff and canonical source syntax pass. Hosted after-times remain unmeasured; primary0.7 candidate stays frozen.
CI38960767456 fast.citadel caught the new cohort guard reading bare project manifest and lock names. Use the declared Inspect manifest and audit lock inventory instead of adding obsolete-path debt. Existing guard reproduced RED;36 focused SDK/path checks and configured Ruff pass.
CI38960767456 packed-package workflow and the focused local tarball test exposed the literal0.7.0 after the0.7.1 version update. Read the installed package manifest once with a module-relative createRequire. Production build and actual isolated authenticated tarball workflow pass; no test expectation or protocol name changes.
Hosted macOS run38975304803 failed three permission self-checks because the Linux guest commands encountered BSD stat, then fell back to mode644. Provision coreutils in that job and put its actual gstat under the fixture-owned stat name. Keep all permission self-checks, and assert real mode/size output. Focused transfer checks5 passed, workflow contracts67 passed, Ruff and the package-owned strict Ty command passed.
The canonical release contracts exposed the old installed-only upload assertion after356ca8051 expanded CI evidence retention. Assert the configured complete test-artifact root, which includes installed proof and managed-restart logs. Preserve failure condition, pinned upload action, journal selection and missing-file enforcement. Regression3 passed with Ruff clean.
The actual binary publisher rejected0.7.0 because config release.line remained0.6 even after full qualification. New fast Citadel tests call its real cohort validator against checkout metadata and prove a different configured line is still rejected. Set the explicit line to0.7 and align existing pre-release labels; no version stamping or publication bypass. Native actual-cohort/docs12 tests, source shape24, Ruff and owner Ty pass.
Release-line0.7 exposed false positives for Axum history, docstrings and a numeric latency sample. The scanner now parses each Python file once and examines behavioral string constants, preserving rejection of direct, equality and JSON version literals. No file exemptions or benchmark changes. Focused guard/cohort10 tests, source shape24, canonical Ruff and Ty pass.
The actual stable source still carries0.6.6 packages and profiles. Its existing0.7 runtime authorer rejected that source; the old retirement digest does not authorize resetting this valid package cohort. Normalize only first-party0.6 sources inside the existing Rust candidate merge, preserve every package field, refuse mixed/foreign/modern/empty inputs, and retain strict graph readers plus compatibility and predecessor proof. The native CLI successfully authored an unpublished copy of captured source617244734, retaining all3 package rows and reporting incompatible with the old binary. Root regression RED then119 admin tests GREEN, fmt/Clippy clean, source checks34pass. No live manifest, publication ref or channel changed.
Merge current0.7 release source daeea2c after carrying its tested guard and runtime-authoring fixes. Resolved tree is identical to the already checked3de7916ec patch tree; preserve all branch history and package versions.
Includes 1e46656: ARM64 batching proof now uses an explicit queued-write handshake; production timing is unchanged. Six focused remote writer tests plus crate fmt/clippy and source-shape checks pass. Static job 117279951478 in run 38993231576 separately timed out running /usr/bin/docker info after 10 seconds, before the real Inspect frontend build. Suspected infrastructure flake: the same unchanged Inspect test passed on preceding source 9184 run 38985379704, and this source changed only safe readiness diagnostics. This forward fix gets one fresh CI run for that diagnosis; a repeated Docker timeout requires root-cause repair, not another blind retry.
Mac CI38994545441 exposed proxy policy BrokenPipe. Systematic SCM_RIGHTS audit found seven early owner releases and missing gateway/aggregator-owner receipts. Bring the complete repair plus lifetime regressions and guards into the coordinated SDK/Inspect source. Native focused 100 runtime tests, guards and clippy pass; final native and patch source qualification remains pending.
Finish the systematic SCM_RIGHTS audit with the private cable path: a concurrent table replacement reproduced early release deterministically. Keep its original through an exact service receipt, validate frame identity and connected descriptor before acknowledgement, and release on failure or timeout. 37 focused runtime tests,58 boundary/shape checks and service/process all-target clippy pass. Native111 qualification was deliberately interrupted early before expensive VM work; no proof claimed for it. Qualify the completed release sources next. # Conflicts: # CHANGELOG.md
Bring the test-only adversarial matrix fix for nativeMac38997642671 and patch38997680425 failures. The actual extra-descriptor row now transmits two descriptors; current old source reproduces RED and final stable source passes focused GREEN, formatting and all-target service clippy. No production behavior changes. Preserve source inputs during focused commands; final native and patch complete qualification and required CI remain pending.
The Python test coordinator still interpreted Adopted receipts as new requests after the production Rust handoff repair. Bring the exact-receipt/retained-owner fix and fast AST regression guard into the SDK/Inspect branch. Existing real-gateway endpoint class RED; all95 gateway tests,40 focused lifetime/shape guards and Ruff GREEN. No production code changes. Remaining stages will run diagnostically before final whole-source proof.
Preserve Inspect PythonPackageConfig and add the specialized TypeScript SDK configuration. Focused merged-source schema/deadline/shape checks pass27 tests; strict type checking and lint pass. Native hosted failures117308250318 and117308264535 are diagnosed in the merged fix; no unchanged CI retry.
…ion/0.7.1-pierre-sdk-20261016
The optional public Docker verifier ran bash as PID1 in plain Ubuntu, then asserted that an installed systemd service and gateway were healthy. Keep the installer path, but boot its prepared systemd image and ordinary user before executing the public installer. Share the boot primitive with both existing sealed install owners. Keep their network=none contract and readiness budgets intact; only the public download proof explicitly uses bridge. Require a clean prepared image, reuse the configured package inventory, own a unique container, and remove it on failure or SIGTERM while restoring the previous handler. The boot regression failed on the original verifier. SIGTERM cleanup was also RED before the handler. Focused checks:53 public/container tests, 55 shared-owner tests,24 staged shape guards, Ruff, strict source Ty, targeted test Ty and the exact type-debt guard pass. A real pinned-helper probe confirmed systemd PID1, the ordinary user manager and an active user unit, then removed the container. Actual public installer execution remains a post-publication proof. Native0.7 source489c is untouched and continues its final qualification.
Keep mocked release contracts portable to hosts without Docker. The Dockerless reproduction fails twice before the fixture and passes both tests after it; Ruff and the unchanged Python type-debt guard pass.
The complete release contract run found one stale assertion after the public installation helper extraction. Inspect the actual routed smoke function source file, preserving the updater assertion. Focused public installer contracts: 21 passed; shape and unchanged type-debt guards: 28 passed; Ruff passed.
Register the extracted public installer helper as release support and classify its new unit tests explicitly. Preserve exact namespace and test-ownership enforcement. Both original guards reproduced RED; all 16 related ownership/tool/installer tests pass, along with 27 shape checks and Ruff.
Use component-aware containment when selecting external collection paths. Current configured roots already end in slashes; valid unslashed roots must also retain similarly named sibling paths. Regression: one failed/one passed before, all four focused collection checks pass after. Ruff, canonical strict Ty, and25 shape/type-debt guards pass. Native09c qualification remains on its frozen tree; final patch qualification is pending.
Recognize comments and attributes between the subcommand marker and its own field, including bracket/comma-containing attribute strings. Reject marked fields that cannot be parsed; never scan into another field or silently shrink the approved command inventory. Seven focused regressions failed before; all16 public-surface tests pass, including the actual unchanged allowlist. Ruff, canonical strict Ty and25 shape/type-debt guards pass. Final patch qualification remains required.
Reject text, null, integer and list values for detail and chain hashes with ValueError so the existing doctor error boundary records corruption. Preserve the Rust BLOB contract and exact hash format, including valid bytes, bytearray and memoryview. Fifteen regressions failed before; all20 ledger tests pass after, including real SQLite TEXT corruption through the actual doctor verifier and the Rust golden vector. Ruff, canonical strict Ty and25 shape/type-debt guards pass. Final patch qualification remains pending.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The SDKs now discover and authenticate to the running local gateway without URL, IP or key arguments (#344). Explicit remote connections require a complete credential pair; discovery metadata remains bounded, private and opened without following symlinks.
Includes Pierre's full #336–#340 stack: VM labels, typed errors, gateway discovery and the SDK-backed Inspect adapter for VM, OCI, Compose and authorized host builds. Preserves service-managed sessions, supervised worker identity, authenticated IPC and logger ownership.
Stable native publication hands qualified archives to the registry continuation. It validates source, versions and dependencies, publishes dependencies first, rejects immutable byte conflicts, verifies anonymous downloads and runs clean external consumers against the matching native service. Native and SDK/MCP versions are0.7.1; Inspect is0.1.0 and requires capsem>=0.7.1. Verification builds receive no publishing tokens.
The public installer verifier uses the qualified systemd helper, proves clean-image ownership, runs installation as the ordinary user and removes its unique container on exit or interruption. Source-contract collection preserves prefix siblings for unslashed roots. CLI approval retains annotated nested fields and rejects unparsed marked fields. The host-ledger doctor reports invalid binary fields as corruption while preserving the Rust hash format.
Current source:ccc8d7875785994d85b20593031988e84eccbe7b. Includes native09c0bdda1 and all five current Pierre heads. CI:https://github.com/google/capsem/actions/runs/39027430935. This draft remains based on0.7 while #359 ships. Final complete local patch qualification is pending; current native qualification is separate.
Focused review fixes passed4collection,16public-surface and20ledger tests, including real SQLite corruption through the actual doctor verifier, plus Ruff, canonical strict Ty and25shape/type-debt guards. Earlier component evidence includes PythonSDK528tests, TypeScriptSDK1125tests, Inspect107tests with real BuildKit/isolated packaging, packaged-client discovery against a native service and five Cargo archives. These component results do not replace final whole-source patch qualification.
Release holds: final local proof, required CI, npm/Cargo publisher authority, Inspect PyPI token scope and actual public installation. Team ownership of PyPI capsem is confirmed and PYPI_TOKEN is present. No0.7.1 tag or publication is claimed. Physical Mac/Tart/VZ is explicitly deferred; hosted signing, notarization and native installation remain required. Unsupported official native AGY sign-in remains an explicit limit in #359.