feat(sdk): integrate Pierre stack and Inspect for 0.7.1

.github/workflows/ci.yaml

@@ -326,6 +326,15 @@ jobs:
           COVERAGE_FILE: ${{ github.workspace }}/cache/target/coverage/python-sdk/.coverage
         run: uv run --frozen pytest --junitxml=../../cache/target/coverage/junit/python-sdk.xml
 
+      - name: Install Linux guest tools for host-backed Inspect fixtures
+        run: brew install coreutils
+
+      - name: Inspect AI extension tests with coverage
+        working-directory: integrations/inspect-ai
+        env:
+          COVERAGE_FILE: ${{ github.workspace }}/cache/target/coverage/inspect-ai/.coverage
+        run: uv run --frozen pytest --junitxml=../../cache/target/coverage/junit/inspect-ai.xml
+
       - name: Python lint and type check
         run: |
           uv run --project build_system --frozen capsem-gate lint
@@ -439,6 +448,15 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false
 
+      - name: Upload Inspect AI extension coverage
+        if: ${{ !cancelled() }}
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac
+        with:
+          files: cache/target/coverage/inspect-ai/coverage.xml
+          flags: inspect-ai
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
+
       - name: Upload Rust unit test coverage
         if: ${{ !cancelled() }}
         uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac
@@ -480,7 +498,7 @@ jobs:
         if: ${{ !cancelled() }}
         uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3
         with:
-          files: cache/target/coverage/nextest/ci-unit/junit.xml,cache/target/coverage/nextest/ci-integration/junit.xml,cache/target/coverage/junit/frontend.xml,cache/target/coverage/junit/python-cross-system.xml,cache/target/coverage/junit/python-build-system.xml,cache/target/coverage/junit/python-sdk.xml,cache/target/coverage/junit/typescript-sdk.xml,cache/target/coverage/junit/mcp-typescript.xml
+          files: cache/target/coverage/nextest/ci-unit/junit.xml,cache/target/coverage/nextest/ci-integration/junit.xml,cache/target/coverage/junit/frontend.xml,cache/target/coverage/junit/python-cross-system.xml,cache/target/coverage/junit/python-build-system.xml,cache/target/coverage/junit/python-sdk.xml,cache/target/coverage/junit/inspect-ai.xml,cache/target/coverage/junit/typescript-sdk.xml,cache/target/coverage/junit/mcp-typescript.xml
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false
 
@@ -543,6 +561,16 @@ jobs:
         with:
           node-version: 24
 
+      - name: Select the declared tool set
+        id: gate_tools
+        run: |
+          list=$(python3 build_system/scripts/ci/gate-tool-list.py --sets complete)
+          echo "list=$list" >> "$GITHUB_OUTPUT"
+      - name: Install prebuilt Rust gate tools
+        uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b
+        with:
+          tool: ${{ steps.gate_tools.outputs.list }}
+
       - name: Bootstrap complete install qualification host
         env:
           CAPSEM_SKIP_ASSET_CHECK: "1"
@@ -557,16 +585,6 @@ jobs:
           test -c /dev/kvm
           test -c /dev/vhost-vsock
 
-      - name: Select the declared tool set
-        id: gate_tools
-        run: |
-          list=$(python3 build_system/scripts/ci/gate-tool-list.py --sets complete)
-          echo "list=$list" >> "$GITHUB_OUTPUT"
-      - name: Install prebuilt Rust gate tools
-        uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b
-        with:
-          tool: ${{ steps.gate_tools.outputs.list }}
-
       - name: Materialize locked qualification dependencies
         run: |
           uv sync --project build_system --frozen

.github/workflows/fast-gate.yaml

@@ -73,6 +73,7 @@ jobs:
         run: |
           uv sync --project build_system --frozen
           python3 build_system/scripts/ci/run-bounded-command.py --timeout-seconds 300 -- uv sync --project sdk/python --frozen --no-install-project
+          python3 build_system/scripts/ci/run-bounded-command.py --timeout-seconds 300 -- uv sync --project integrations/inspect-ai --frozen --no-install-project
           cargo fetch --locked
           for workspace in web/app web/docs web/marketing build_system/release_site sdk/typescript mcp/typescript; do
             pnpm --dir "$workspace" install --frozen-lockfile
@@ -86,3 +87,18 @@ jobs:
 
       - name: Run release source contracts
         run: uv run --project build_system --frozen capsem-gate test-release-contracts
+
+      - name: Retain verified registry package archives
+        if: ${{ inputs.source_commit != '' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: client-packages
+          if-no-files-found: error
+          path: |
+            cache/target/sdk/python/*.whl
+            cache/target/sdk/python/*.tar.gz
+            cache/target/sdk/rust/*.crate
+            cache/target/sdk/typescript/*.tgz
+            cache/target/integrations/inspect-ai/*.whl
+            cache/target/integrations/inspect-ai/*.tar.gz
+            cache/target/mcp/typescript/*.tgz

.github/workflows/release-client-packages.yaml

@@ -0,0 +1,89 @@
+name: Publish verified client packages
+
+on:
+  workflow_call:
+    inputs:
+      source_commit:
+        required: true
+        type: string
+      release_tag:
+        required: true
+        type: string
+    secrets:
+      PYPI_TOKEN:
+        required: true
+      NPM_TOKEN:
+        required: true
+      CARGO_REGISTRY_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+  actions: read
+  id-token: write
+  attestations: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        with:
+          ref: ${{ inputs.source_commit }}
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86
+      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
+        with:
+          toolchain: 1.97.1
+      - uses: ./.github/actions/rust-cache
+        with:
+          key: client-publication
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: client-packages
+          path: cache/target
+      - name: Materialize locked publication dependencies
+        run: |
+          uv sync --project build_system --frozen
+          cargo fetch --locked
+      - name: Attest the tested registry archives
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373
+        with:
+          subject-path: |
+            cache/target/sdk/python/*.whl
+            cache/target/sdk/python/*.tar.gz
+            cache/target/sdk/rust/*.crate
+            cache/target/sdk/typescript/*.tgz
+            cache/target/integrations/inspect-ai/*.whl
+            cache/target/integrations/inspect-ai/*.tar.gz
+            cache/target/mcp/typescript/capsem-mcp-*.tgz
+      - name: Publish and verify the exact client cohort
+        env:
+          SOURCE_COMMIT: ${{ inputs.source_commit }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+          PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: >
+          uv run --project build_system --frozen python -m capsem_builder.release.tools.client_publishers publish
+          --source-commit "$SOURCE_COMMIT" --release-tag "$RELEASE_TAG"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: release-linux-x86_64
+          path: cache/target/release/staging/client-native/
+      - name: Extract the qualified native service for public SDK consumers
+        shell: bash
+        run: |
+          set -euo pipefail
+          packages=(cache/target/release/staging/client-native/*.deb)
+          test "${#packages[@]}" -eq 1
+          dpkg-deb -x "${packages[0]}" cache/target/release/staging/client-native/extracted
+      - name: Install public registry clients and prove real service access
+        run: >
+          uv run --project build_system --frozen python tests/client_registry_acceptance.py
+          --binary-dir cache/target/release/staging/client-native/extracted/usr/bin

.github/workflows/release.yaml

@@ -59,16 +59,32 @@ jobs:
           test "$GITHUB_REF" = "refs/tags/capsem-source-$SOURCE_COMMIT"
           test "$(git rev-parse HEAD)" = "$SOURCE_COMMIT"
 
-  runtime-preflight:
+  client-publication-prerequisites:
     needs: source-identity
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        with:
+          ref: ${{ inputs.source_commit }}
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86
+      - name: Require stable registry publisher configuration
+        if: ${{ inputs.channel == 'stable' && inputs.publish == true }}
+        env:
+          PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: uv run --project build_system --frozen python -m capsem_builder.release.tools.client_publishers check-credentials
+
+  runtime-preflight:
+    needs: [source-identity, client-publication-prerequisites]
     uses: ./.github/workflows/release-runtime-preflight.yaml
     with:
       channel: ${{ inputs.channel }}
       bootstrap_missing_first_party: true
       source_commit: ${{ inputs.source_commit }}
 
   fast-gate:
-    needs: source-identity
+    needs: [source-identity, client-publication-prerequisites]
     uses: ./.github/workflows/fast-gate.yaml
     with:
       source_commit: ${{ inputs.source_commit }}
@@ -1274,6 +1290,23 @@ jobs:
           build_system/scripts/build/prove-live-public-install.sh
           "$ASSET_MANIFEST_URL" "$RELEASE_CHANNEL"
 
+  publish-client-packages:
+    needs: [verify-release-downloads]
+    if: ${{ inputs.channel == 'stable' && inputs.publish == true }}
+    uses: ./.github/workflows/release-client-packages.yaml
+    permissions:
+      contents: read
+      actions: read
+      id-token: write
+      attestations: write
+    with:
+      source_commit: ${{ inputs.source_commit }}
+      release_tag: ${{ inputs.tag }}
+    secrets:
+      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
   cleanup-unpublished-version-claim:
     needs: [verify-release-downloads]
     if: ${{ always() && inputs.publish == true && (failure() || cancelled()) }}

CHANGELOG.md

@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+- Upgrade aiohttp to 3.14.5 across shipped Python locks and the debug image,
+  fixing request-header timeout and connection resource-exhaustion advisories.
+
+- Python gateway discovery requires complete URL/token pairs, keeps remote
+  connections from borrowing local credentials, redacts tokens from endpoint
+  representations, and refuses unsafe or incomplete local metadata.
+
 - Time-box the new zbus 5 maintenance advisories through 2026-11-18 while
   stable Tauri's Linux opener and single-instance plugins still require the
   split crates; the exceptions expire automatically and report no known exploit.
@@ -18,6 +25,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- OCI workspaces retain the workload's full UID/GID range while mapping stable
+  VirtioFS metadata to the image user, so `chown` and archive extraction work.
+
+- Proxy workers consume their final shutdown acknowledgement before reaping the
+  process, avoiding intermittent clean-shutdown failures on slower hosts.
+
+- Host-ledger diagnostics report malformed binary fields as corruption without
+  aborting verification or changing the ledger hash format.
+
 - Keep Linux VirtioFS workspace ownership stable across VM and OCI workload
   metadata reads, including after resuming or cloning an existing image session.
 
@@ -40,6 +56,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Correct the release preflight's version line so qualified 0.7 packages can
   be published, and align the pre-release documentation labels.
 
+- SDK release handoffs keep adversarial test files out of published archive
+  directories and apply bounded retention to client package outputs.
+
+- Stable native releases publish the qualified SDK, npm MCP and Inspect package
+  cohort in dependency order and verify clean public registry consumers.
+
+- Public SDK and MCP packages identify their canonical source and license;
+  Python SDK packages include their usage guide.
+
+- Rust SDK registry dependencies include their canonical runtime limits, so
+  building them does not require the Capsem source checkout.
+
+- The npm MCP server reports its installed package version in protocol handshakes.
+
+- Inspect requires the SDK version providing its labels and typed-error APIs,
+  and its frozen dependency lock matches the current SDK package.
+
+- Inspect task labels respect the service's UTF-8 byte limit for accented
+  and emoji task names.
+
 - Native MCP handoffs retain connected sockets until the receiving worker
   confirms adoption, preventing intermittent initialization failures on macOS.
 
@@ -1805,6 +1841,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- `ErrorResponse` adds an optional typed `code: ErrorCode` (`"create_timeout"`,
+  `"exec_timeout"`, `"vm_not_found"`), `vm_id`, and `timeout_secs` on the HTTP
+  error wire contract, with service-side exec timeouts returning HTTP 504
+  (`StatusCode::GATEWAY_TIMEOUT`). The Python SDK adds host gateway discovery
+  (`discover_gateway`, `capsem_run_dir`, `GatewayEndpoint`,
+  `Hypervisor.connect`, and optional `url`/`token`/`run_dir` on `Hypervisor`
+  and `VM` resolving `CAPSEM_GATEWAY_URL`, `CAPSEM_GATEWAY_TOKEN`, and
+  `<run_dir>/gateway.{port,token}`) and structured exceptions
+  (`CapsemError`, `CapsemTimeoutError`, `CreateTimeoutError`,
+  `ExecTimeoutError`, and `VmNotFoundError`) dispatched from
+  `HttpError.code` (`models.ErrorCode`). The Python and TypeScript SDKs also
+  export `MAX_REQUEST_BODY_BYTES` and `CREATE_READY_SECS` guarded by Citadel
+  against the service and API constants.
+- `POST /vms/create` (`ProvisionRequest`) and `POST /vms/{id}/fork` (`ForkRequest`)
+  accept optional advisory `labels` (`<= 64` entries, ASCII keys `1..=64`
+  matching the VM-name rule `[A-Za-z0-9][A-Za-z0-9_-]{0,63}`, values `<= 255`
+  UTF-8 bytes without control characters; `{}` is treated as no labels),
+  returned on `SandboxInfo.labels` across `/vms/list` and `/vms/{id}/info`.
+  Labels are set at creation, immutable afterward, preserved across `persist`
+  and `resume`, and inherited on `fork` unless overridden (with `{}` clearing).
+  `Hypervisor.create` and `VM.fork` across the Python, Rust, and TypeScript
+  SDKs (as well as `capsem create -l KEY=VALUE` and `capsem fork -l KEY=VALUE`)
+  attach or override `labels`.
 - Images can be named from the catalog. The service reads
   `ghcr.io/google/capsem/catalog:stable` (or the mirror `[images] catalog`
   names, trusting `[images] catalog_ca` for it; `catalog = false` turns it
@@ -1923,6 +1982,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   bodies previously only ever grew. Ephemeral sessions are deleted whole and
   are unaffected.
 
+- `integrations/inspect-ai` (`inspect-capsem-sandbox`) provides a standalone
+  [Inspect AI](https://inspect.aisi.org.uk/) `SandboxEnvironment` registered
+  under `capsem`, supporting direct VM execution (`execution_mode="vm"`) and
+  rootless OCI workload container execution (`execution_mode="container"`)
+  with single-service Docker Compose support, evaluator-granted `Dockerfile`
+  and Compose `build:` image builds served via a loopback HTTPS OCI v2
+  registry with `[images]` `ca_pem` and `admit`, `SAMPLE_METADATA_*`
+  interpolation, and operator-owned host environment and bind-mount
+  allowlists, backed by the Capsem Python gateway SDK (`capsem>=0.7.0`).
+
 - The profile catalog names its own defaults, one per runtime: the binary
   compiles them from `config/profile-catalog.toml` (a runtime's default
   counts only when that profile is installed), `GET /status`