SEMAPRAX v0.10.1 is beta software.

Install

SEMAPRAX v0.10.1 (beta).

Download the archive for your computer:

Or install with one command:

macOS and Linux:

curl -fsSL https://github.com/wavect/semaprax/releases/download/v0.10.1/install.sh | sh -s -- --version v0.10.1

Always the latest stable release:

curl -fsSL https://github.com/wavect/semaprax/releases/latest/download/install.sh | sh

Windows PowerShell:

powershell -ExecutionPolicy Bypass -c "& ([scriptblock]::Create((irm https://github.com/wavect/semaprax/releases/download/v0.10.1/install.ps1))) -Version v0.10.1"

Always the latest stable release:

powershell -ExecutionPolicy Bypass -c "irm https://github.com/wavect/semaprax/releases/latest/download/install.ps1 | iex"

Full instructions, the first-project walkthrough and uninstall steps: Install SEMAPRAX.

After installation, open a new terminal and run:

semaprax new first-semaprax
semaprax check first-semaprax/semaprax.toml
semaprax test first-semaprax/semaprax.toml
semaprax run first-semaprax/semaprax.toml

The last command prints 42. The same commands work in PowerShell.

Only the semaprax-<tag>-<target> archives are runnable programs. GitHub's "Source code" downloads are automatic repository snapshots, and SHA256SUMS, release-*.json, *.bundle and trusted_root.jsonl are verification metadata.

To verify a download, compare it with SHA256SUMS and check its attestation as described in the release process.

SEMAPRAX v0.9.0 is beta software.

Install

SEMAPRAX v0.9.0 (beta).

Download the archive for your computer:

Or install with one command:

macOS and Linux:

curl -fsSL https://github.com/wavect/semaprax/releases/download/v0.9.0/install.sh | sh -s -- --version v0.9.0

Always the latest stable release:

curl -fsSL https://github.com/wavect/semaprax/releases/latest/download/install.sh | sh

Windows PowerShell:

powershell -ExecutionPolicy Bypass -c "& ([scriptblock]::Create((irm https://github.com/wavect/semaprax/releases/download/v0.9.0/install.ps1))) -Version v0.9.0"

Always the latest stable release:

powershell -ExecutionPolicy Bypass -c "irm https://github.com/wavect/semaprax/releases/latest/download/install.ps1 | iex"

Full instructions, the first-project walkthrough and uninstall steps: Install SEMAPRAX.

After installation, open a new terminal and run:

semaprax new first-semaprax
semaprax check first-semaprax/semaprax.toml
semaprax test first-semaprax/semaprax.toml
semaprax run first-semaprax/semaprax.toml

The last command prints 42. The same commands work in PowerShell.

Only the semaprax-<tag>-<target> archives are runnable programs. GitHub's "Source code" downloads are automatic repository snapshots, and SHA256SUMS, release-*.json, *.bundle and trusted_root.jsonl are verification metadata.

To verify a download, compare it with SHA256SUMS and check its attestation as described in the release process.

SEMAPRAX v0.8.0 is beta software.

Changes

• Re-pin all three generated Rust ownership caller digests to the 0.8.0
  package identity after the physical moves, allocating, and nested-moves
  controls passed on the current source. Release manifests and GitHub
  publication now mark beta builds as regular releases.

• Re-pin the private Wasmtime Component runner's four independent known-answer
  sets to the 0.8.0 package identity. The owning contract test now reports
  all mismatches together; unchanged source descriptor digests stay pinned.

• LAW-16: retain pinned Bend U32 universal insertion-sort verdict/kernel
  evidence and pinned SEMAPRAX LAW15 Lean sortedness/permutation/multiplicity
  evidence over the U32 subset. A versioned guarded-i64 profile records their
  matched semantic laws, separate source identities and trust boundaries;
  bounded balance controls and source-Z3 obligations remain separate. Agent
  token events are authenticated across ten Boolean pairs, while monetary
  cost events and cache-isolated cold measurements remain unavailable. The
  original checked-u32 cells and LAW-16 closure remain open.

• RI-13: retain clean locked offline macOS arm64 and Linux x86_64 guest
  M1/M2/M3 application receipts. Each has 22 passed, 0 failed, 0 skipped
  stages/measurements and 44 verified raw streams. The linked consumer,
  copy/friction ledgers, and adverse-throughput investigations are published.
  Exact target checks refuse unsupported M1/M3 Wasm routes while the separate
  M2 scalar Project builds; generated Rust Serde/iterator adapters are not
  claimed on Wasm. Linux performance remains guest evidence.

• Repaired current-main CI regressions in command help, task-service semantic
  fixture setup, source-local manifest refusals, standalone generated-package
  lockfile classification, SMT proof guards, review digests, and Windows durable
  writer contention. The network handle-capacity test now splits its source
  across bounded helper calls while still exercising the ninth-handle refusal.

• Pinned native tool setup to the real Linux Clang image, scoped the checked-in
  macOS arm64 Regex/URL registry envelopes to their host, and checked both
  carrier-specific generated context names. Linux service packaging acceptance
  now builds and supplies a static service executable.

• Fixed the patch-receipt evidence pagination regression to exercise a
  renameable declaration in the app module; the fixture now preserves its
  cross-file identity check without attempting to rename main. Both renamed
  functions now carry contracts so the contract-delta page checks their IDs.

• Made the paired affine callback's flipped-source control change the paired
  return expression, so its physical consumer detects the substitution.

• Recorded the durable job writer's harness-aware child selector in the
  self-invocation inventory.

• Added the explicitly bounded SMT solver process module to the audited unsafe
  quarantine inventory, including its production and test-only Unix calls.

• RI-08: admit one synchronous parameter-rooted borrowed-text source capture.
  Source/HIR scope validation rejects aliases and escape; interpreter, native C
  and Core Wasm preserve the borrowed descriptor. The generated Rust scope
  executes the actual source closure under an RI-06 URL owner-view guard, with
  real iterator, pointer/copy controls, contract and lifetime regression gates.

• HR-07: complete the macOS arm64 cross-layer hot reload evidence at
  9a9db7a81. Twenty-two exact selectors and a real installed VS Code
  Extension Host gate pass; 11 raw samples distinguish save-to-ack, full
  restart, and authenticated warm restart. The observed interpreter reload is
  slower than full restart on this fixture. Other platforms, native/Wasm state
  swap, and production rollout remain unclaimed.

• RI-08: admit the narrow noncopyable FnMutI64(i64) -> i64 receiver with the
  specified direct transition literal. Source/HIR ownership and alias refusals,
  success-only state commit, interpreter/native/Core Wasm parity, generated Rust
  FnMut consumers and failure/drop controls cover the transactional profile.

• RI-08: stage the transactional scalar mutable carrier across HIR, interpreter,
  native C, Wasm and the generated Rust owner. State commits only on checked
  success; internal guard/copy tests and Rust borrow/thread-bound negatives
  cover the carrier seams. Source and retained-HIR admission stay closed.

• RI-08: reserve distinct FnMutI64(i64) -> i64 and mut fn syntax with
  canonical source preservation, private AST/HIR codec tags, exhaustive leaf
  classifications and independent source/HIR refusal. The mutable runtime
  remains unadmitted; this foundation does not claim stateful execution.

• RI-08: permit a direct mutable i64 binding as the scalar half of the
  private retained FnOnceI64() -> i64 profile. Construction copies the value
  into the existing environment, so later source mutation cannot alias the
  callback; interpreter, C, Core Wasm and generated Rust regressions cover the
  snapshot boundary.

• Add an RI-13 combined application measurement gate. It runs the existing
  locked M1 Regex/Url, M2 Serde record/iterator callback, and M3 local HTTP
  generated consumers in one ordered receipt; it separately records each
  Cargo build-and-run stage, M3 route timing and M3 allocator requests. The
  receipt explicitly preserves the separate source-profile boundary and does
  not claim copied bytes, a nontrivial batch result, Linux evidence, or one
  linked M1/M2/M3 Project.

• Add the LAW-16 Bend 2 benchmark harness. It pins Bend's reviewed revision,
  keeps ordinary and --verdict execution separate, requires separately
  declared SEMAPRAX SMT/Lean/runtime paths, and retains raw cold/warm timing
  and seeded law-gaming controls under exact local source/environment inputs.
  No Bend fixture or result is claimed: missing, drifted, timed-out, or
  semantically mismatched cells remain unavailable or failed.

• Bind six checked-u32 semantic fixture corpora into LAW-16 benchmark
  results, including distinct acceptance and law-gaming inputs. SEMAPRAX's
  admitted scalar profile lacks u32, so an i32 substitute is explicitly
  unavailable rather than represented as an equal implementation.

• RI-08: add a distinct private FnOnceI64() -> i64 source profile for retained
  owned Bytes plus immutable i64 captures, with graph v63, versioned cleanup
  identities, and aligned interpreter, C, Core Wasm and generated Rust carriers.

• Add a bounded RI-08 same-thread foreign-registration lease to the generated
  affine FnOnce() -> i64 Rust projection. A physical Rust consumer retains
  the source-created environment inside a stateful safe registry, dispatches it
  once, and proves unregister drops an uncalled owner before later dispatch
  reaches callback state. The generated lease remains !Send and reports a
  closed registration rather than entering C after teardown. Mutable, borrowed
  and mixed source capture modes remain open.

• Save an RI-13 M1 mixed Regex/Url application. One held, canonical Project
  source authenticates four selected imports and two exports, then generates
  separate source-bound SDK carriers with distinct C owner symbols. Exact
  admission and stale-lock/source controls pass 1/1; locked offline prepare
  and a single-process Rust/C consumer pass locally on macOS arm64. The
  general Project SDK CLI, fresh-checkout/Linux run, and wider RI-13 acceptance
  remain open.

• Repair main CI's current constructor and discovery contracts, frozen help
  snapshot, source-locked coverage, standalone lockfile checks, and selected
  project fixtures. Keep native Rust interop replay on its wire ABI, scope
  real registry evidence to its recorded target, and make the local benchmark
  daemon's integrity fault deterministic. Format the new Rust and collection
  sources, export the project hot-reload lifecycle, and preserve fail-closed
  repair receipt recovery after malformed candidate observations. Restore the
  Windows checkpoint API, documentation catalog and editor activation snapshot,
  and split over-budget source modules while retaining source-locked coverage.
  Cover the checkpoint-waiting branch in the source-agent handoff test fixture.
  Keep the native Regex/Url lint allowance valid under non-Clippy builds with
  warnings denied. Canonicalize Rust formatting after the merged v0.8.0 work.
  Repair the durable-job recovery fixture's byte request and the list-proof
  fixture's borrowed evidence slices. Keep the source-local Future Project
  fixtures free of Clippy warnings without changing their runtime checks.
  Scope physical Url test helpers to their supported target and document the
  independent fixture inputs used by the guarded foreign-law repair test.
  Align verifier-hint and CLI help fixtures with admitted lists and the public
  dev command. Mark the list sort proof's type spelling as code so rustdoc
  accepts the module documentation with warnings denied. Catalog the RI-13
  indexed Rust Future profile and state its intended audience.

• Repair the current main CI fixtures for owned-byte Wasm imports, constructor
  schema counts, the pinned iOS action, and authenticated Everyday Agent
  examples. Regenerate the Agent skill bundle, refresh exact workspace
  artifact digests, and keep Rust modules within their size budgets. Correct
  owned-wait test fixtures and platform-specific host/compiler assertions.

• Keep explorer response branch schemas under the root document identity so
  generated clients can normalize them, and trim generated Rust source
  indentation to keep the selected client within its byte limit. Complete
  documentation metadata and catalog navigation, align VS Code syntax and
  activation checks with the manifest, fix a Unix-only proof import on
  Windows, quote container types in native interop Rustdoc, and supply the
  owned-byte interval imports in the iterato...

SEMAPRAX v0.7.0 is alpha research software.

Changes

This alpha candidate gathers development work since v0.5.0: checked session
endpoints, private owned-Agent continuation and cleanup, local package and
resolver work, and host/tooling repairs. The completion matrix remains the
authority for executable support; local or private evidence does not become
public support through a release tag.

• Preserve the selected host failure and physical authority-loss retirement
  when cancellation and lease corruption coincide during continued
  owned-effect dispatch. Keep the
  refused authorization proposal fixture in canonical wire order, and check
  failed cleanup against its own reserved capacity edge.

• Repair main CI regressions in the example index, Rust formatting and module
  budget, Unix-only owned-wait test selection on Windows, the desktop linker
  pin, generated-package Cargo coverage, generic Wasm entry-wrapper count,
  and sanitizer omission-control cleanup. Keep the browser fixture's exact
  revision mismatch visible for the next hosted run. Follow up on hosted Clippy
  diagnostics for owned-wait context matching and private phase visibility.
  Restore the owned-wait outcome visibility required by parent modules and
  accept the three exact linker builds observed on hosted Windows runners.
  Keep platform-independent owned-wait tests active on Windows while limiting
  tests that require the Unix physical lease fixture to Unix; resolve the
  hosted Clippy diagnostics in workspace and catalog acceptance tests.
  Retain cross-platform settlement test helpers, refresh the browser
  baseline's exact graph digest, and admit the shared workspace fixture in
  the offline package test harness.
  Resolve native-host rustdoc links on Windows and remove redundant explicit
  targets from the reference-service documentation.
  Keep the generated TypeScript fixture aligned with its ABI-version field,
  and send large native parity inputs through bounded stdin framing so the
  full 64 KiB cases run without exceeding process argument limits.
  Select the native ASan/UBSan hostile corpus only on its documented local
  macOS arm64 target; the hosted sanitizer lanes keep their separate gates.
  Refresh the browser rename fixture's exact graph digest after hosted
  generation exposed its current known answer.
  Index the Kernel-0 accepted-revision validation document and highlight the
  session-protocol endpoint keyword in the VS Code grammar.
  Give the Source Agent owned-wait contract a separate audience field and
  catalog entry so the documentation gate covers it.
  Use a checked length conversion for the native parity probe's bounded
  stdin frame on 64-bit hosts.

• Refresh workspace artifact known answers for the current deterministic
  projections. Correct the bounded complete Semantic Impact JSON so embedded
  workspace review evidence matches the direct single-file report exactly.

• Repair Windows unit CI fixtures: gate native stage parity tests on the
  supported process hosts, use the current snapshot and JSON-event host
  adapters, retain the source entry in the checked-cache reuse test, and
  refresh the pinned agent skill bundle for the current diagnostic catalog.
  Resolve the compact CLI's plain-project test fixture from either package
  manifest so the root and full-toolchain binaries test the same project.

• Add a closed acceptance-record format for #328's Kernel-0 rung-2 decision.
  It requires every local receipt to bind to one selected revision or an exact
  unchanged subject, keeps all rows pending, and separates an eventual reviewer
  decision from historical local counts and hosted evidence. No gate was run,
  and rung 1 remains the only accepted rung.

• Connect actual continued owned-Agent Decision cleanup to the existing v8
  fixed append and physical release path (#330). Preserve the same State,
  reservation hold and accounting across Started/Settled, cancellation and
  observed release failure. Continued Outcome/Reduce, public execution and
  restart recovery remain unfinished. Compilation passed; bounded test runs
  were interrupted without completed results, so this increment is unverified.

• Add partial signed-image checks to the standalone Windows doctor spawn using
  held NTFS file/path guards and a retained advisory read oplock (#333).
  Preserve the ten historical native cases and add six substitution/settlement
  cases. Writable-section mutation can still race; exact binding acceptance,
  native Windows execution and request/bundle transport remain open. No
  production or release-trust support is promoted.

• Retain catalog-normalizer's 100,000,000-step maximal-response requirement
  (#324) in the complete application selector. Its one-call scalar phase
  encoder omits redundant per-byte token-length arguments and selects the
  plain or enriched terminal phases without a second per-byte function call.
  Record the 160,000,000-step library ceiling only as the current execution
  capacity and retain the separate 2,000,000-step source-suite bound. The
  frozen oracle, corpus, response capacity, mutation controls and backend
  lanes are unchanged.

• Add the explicit endpoint Bytes session profile, connecting checked protocol
  order to a unique source carrier through local moves and terminal consumption.
  Refuse stale aliases, use after close, replacement carriers and escapes before
  backend emission; preserve the existing declaration-only profile.

• Pass all eight source/HIR/graph/cache and interpreter/native O0/O2/generated
  Wasm endpoint success and terminal-failure settlement tests locally at
  c714e7c6c on 2026-09-30. Endpoint/compiler/backend paths remain unchanged
  through e9019e9e1; that later comparison is source equivalence, not a new
  execution receipt. Session Protocol Types v1
  records the command, scope, and separately pending legacy preservation and
  broader integration evidence.

• Add an opt-in local Ollama specialization runner for #326 around the frozen
  control schedule and scorer, with public-only prompt projection, exact model
  pins, explicit independent-review gates and immutable outcome receipts.
  Keep the unresolved discount cells unavailable; synthetic tests and offline
  receipt checks are not actual model execution or experiment acceptance.

• Add #326 read-only specialization cell accounting using the existing v1
  protocol. Retain the original 81-cell inputs byte-for-byte from ebe4235e,
  distinguish today's nine added cells and oracle drift, and report every
  missing authority, unexecuted outcome and unrecorded independent review.
  No provider or training work is dispatched; the experiment remains blocked.

• Resolve comparison-adapter scope #322 through explicit exclusions: retain
  only the already-admitted official TypeScript v3 lane, without promoting
  local fixtures. Add a read-only, source/correction-bound support inventory
  and offline regression gate preserving all 182 task/adapter rows. Correct
  stale status prose while retaining the original 54/54 execution subject.
  No executor, scorer, frozen source, wire profile or resource bound changes.

• Reconcile generated-package support decision #325 with ADR 0003: retain
  ordinary owned-data Rust-only maintenance, the fixed unpublished preview
  identity and five-target boundary, and real SemVer before any future publish.
  Distinguish genuine Rust/npm consumer and exact local MSRV evidence from npm
  maintenance, public promotion, publisher identity and release provenance.
  npm remains deferred to its own ADR; no publication or machinery change.

• Add private continued Transfer and Authorize transport into actual Granted or
  Refused Staged outcomes, retaining the same token, ledger and measured source
  consumption. Owning runtime gates and full public execution remain pending.

• Add private continued model SDK settlement and Resume transport through actual
  durable ACKs, retaining authenticated accounting and the same spent token.
  Owning runtime gates, next authorization and full public execution remain pending.

• Add private fresh-cell acquisition certificates and native host custody,
  rollback and retirement on the existing owner registry. Owning runtime gates
  are pending; source endpoints and interpreter/Wasm admission remain unfinished.

• Add private continued Start and Prepared ACK transport around the actual
  retained owner and existing evaluator, preserving its ledger and hold.
  Owning runtime verification and the next real SDK exchange remain pending.

• Add private actual failed-Observe State cleanup ownership, per-action release
  capture and fixed durable ACK transport. Owning runtime verification and
  public lifecycle acceptance remain pending.

• Add private actual Decision-observer State cleanup through a monotonic seal
  and fixed ACKs, plus retained continuation preparation foundations.
  Integrated runtime verification and public lifecycle acceptance are pending.

• Add private initial and continued Observe settlement producers with actual
  State provenance, evaluator consumption and fixed durable ACKs. Owning
  integration verification and cumulative lifecycle execution remain pending.

• Add private actual Continue State/Observe ACK carry and irreversible observer
  cleanup-seal foundations; retain static Reduce capacity templates per exact
  Context. Cumulative physical execution and integration gates remain pending.

• Retain immutable checked Reduce proof per invocation and add private actual
  failed-target State disposal through fixed durable ACKs with unchanged
  accounting. Focused integration verification remains required.

• Add private owned-wait v8 authenticated effect history, retained-container
  append checks and physical effect/reducer ownership foundations. Fresh
  initialization uses exact typed Task and acknowledged stage reservations;
  historical data ...

SEMAPRAX v0.6.0 is alpha research software.

Changes

• Keep the frozen private Component v7 WIT identity at 0.5.0 while the crate
  advances to 0.6.0, and repin the version-bound public-generic Component
  known answers against independently emitted success and contract-failure
  fixtures. The four exact Component CI contract tests pass locally; hosted
  release evidence remains pending.

• Pin the Wavect GmbH release verifier to GitHub's immutable owner/repository
  OIDC subject and require matching subject and ID extensions in the verified
  Fulcio certificate. This is local offline verification, not hosted signature
  evidence until the authorized v0.6.0 tag gate publishes immutable assets.

• Observe Core Wasm record-Bytes copy-out only after the generated Node
  facade returns owned bytes from its settled JS arena, with strict transport
  refusal controls. Physical Wasm free, instruction-fuel parity and hosted
  target acceptance remain open.

• Project a frozen malformed-result carrier recipe through generated TypeScript
  against the compiler-produced checked Wasm provider, alongside exact
  descriptor/binding and once-only result-release controls. This is local
  compiled-provider evidence, not the full hostile or hosted R06 matrix.

• Bridge explicit held signed root/leaf generations into the existing resolver
  subject cache after fresh lock-bound artifact reads. CLI lock-bound fetch and
  the bridge share the extracted held cache writer; copied subjects carry no
  persistent signature/freshness authority and failures retain uncertain prefixes.

• Add explicit offline artifact reads from a held signed Registry-v3 generation,
  bound to exact Lock-v3 and independently admitted manifests. Reads replay
  trusted-time freshness and recheck ACTIVE before returning immutable bytes;
  no reusable bearer token, ambient path read or execution authority is added.

• Add an explicit local Registry-v3 generation store coordinating signed trust,
  full root/leaf Lock-v3 selection and exact core artifacts, with one-way v1
  migration and exact interrupted-commit recovery. Receipts remain evidence;
  no fetch/read/execution capability or hosted registry support is added.

• Add pure offline signed metadata-v2 verification for producer-backed
  Registry-v3 linked roots and leaves, exact lock/artifact checks, and a one-way
  Checkpoint-v2 protocol floor preserving prior version/digest high-water marks.
  Candidates remain non-authoritative; managed-host/fetch integration is separate.

• Add independently verified dependency-free Build-v1 leaf manifests and an
  additive producer-backed Registry-v3. A real linked root/leaf catalog now
  reproduces Lock-v3 bytes and checks exact source/report/dependency closure;
  focused tamper, yank, missing-leaf and API-claim controls pass locally.
  Existing profiles remain unchanged; trusted v3 distribution is separate.

• Add a separate private authenticated-native-allocating.v1 handoff for a
  closed checked Bytes body/callee subset. An explicit-context reservation,
  canonical lease settlement and all-leaf result preflight preserve sticky
  failure through generated C11/C++17 callers. Focused controls cover real
  allocating callees, reservation/body/postcondition refusals, oversized
  results and missing-drop/dispatch controls; the actual legacy runtime
  emitter retains its frozen bytes. General-body, cross-backend, hosted and
  public acceptance remain open.

• Add a separate private authenticated-native-moves.v1 handoff that executes
  checked flat-Bytes record movement bodies through generated C11/C++17
  callers. Focused physical controls cover both branches, malformed/legacy
  refusals, identity-body omission, and postcondition-failure settlement;
  allocating/status-producing bodies and public acceptance remain open.

• Add an explicit local registry trust host with held owner-private storage,
  independently pinned bootstrap, immutable signed-evidence/checkpoint and
  selected-artifact generations, one durable ACTIVE pivot, and exact
  fail-stop recovery. Focused local crash-point and hostile-state tests pass;
  this adds no fetch/network authority or physical power-loss claim.

• Correct catalog-normalizer JSON control escapes at \\u0010–\\u001f
  and exercise ten oracle-frozen controls across interpreter, native C and
  Core Wasm. The maximal 65,536-byte response still exhausts the unchanged
  100M-step fuel bound, so the catalog acceptance milestone remains open.

• Add a TUF-style local registry verifier with independently installed roots,
  namespace-delegated Ed25519 thresholds, dual-threshold root rotation, exact
  registry/manifest bindings, freshness, rollback and yank checks. Results are
  non-authoritative checkpoint candidates; the managed durable host above is
  separate, and trusted distribution remains open.

• Compact catalog-normalizer scalar projection helpers and avoid a repeated
  label walk when summing accepted record quantities. The 18-case focused
  interpreter/native C O0/O2/Core Wasm oracle selector passes, but the exact
  65,536-byte/256-record plain response still exhausts 100M fuel; enriched
  maximal output and the full owning gate remain unverified (#286 open).

• Add a dispatch-only Windows confinement runtime gate that requires nonzero
  execution of restricted-token child launch, job limit/membership, scratch
  DACL, descendant refusal and test-owned descendant timeout, normal/nonzero
  settlement, timeout cancellation, and filesystem-stage refusal with
  handle-count cleanup. The gate uses
  test-key-signed capsule fixture bytes (not a release trust anchor), requires
  successful taskkill /T and direct Cargo PID absence on
  timeout, and checks exact marker/scratch cleanup. Descendant quiescence is
  not independently enumerated. The original two-test slice passed on exact
  checkout c6bf9902; the historical five-test selector passed in hosted
  Windows run 35988348061 at 3d4220b6. Current source uses the shared
  signed-capsule verifier and capsule-v1 architecture codes 3/4 for Windows,
  with a historical nine-test selector (six runtime cases plus three admission refusals).
  That selector passed on exact checkout c608b8d8 in hosted Windows Server
  2025 run 35992373373 (9 passed, 0 failed, 0 ignored). Artifact-byte binding and production
  support remain unverified. A tenth selected Windows case now exercises a
  real inheritable broad ACE on a private parent and requires the created
  scratch DACL to stay protected with only its intended explicit ACE; the
  expanded selector passed at f4d3291f in hosted Windows Server 2025 run
  35993882814 (10 passed, 0 failed, 0 ignored).

• Harden additive lock-bound offline fetch with held-directory authority,
  bounded retained inputs, private staging and no-replace cache publication.
  Failures retain stages or a published prefix for explicit reconciliation,
  without pathname rollback or a misleading success receipt; unsupported
  hosts refuse before cache effects.

• Re-pin exact Semantic Workspace Change and Operations artifact/evidence/receipt
  KATs to the expanded Project graph and serialized limits while retaining
  domain, reference, API/CLI parity, tamper, replay, budget, and stale/no-write
  assertions.

• Keep the standalone compiler archive independent of unpublished crates by
  moving the private OCI emitter and all hostile tests into one internal
  compiler module. Preserve the typed input boundary, exact artifact bytes,
  credential refusal, and unchanged no-signing/no-registry-publication scope.

• Keep the private public-generic Component runtime inside its ambient-authority
  source contract: acquire a checked-in canonical project explicitly, replay
  against pinned identities, and authenticate exact Component bytes before
  typed execution. This does not widen public Component support.

• Generate canonical descriptor-bound TypeScript/Wasm carrier frames and run
  the generated package against the compiler-owned provider lifecycle. Add the
  private semaprax.authenticated-native-identity.v1 C profile, which rejects
  malformed or drifted frame metadata before physical work and invokes one
  compiler-checked flat owned-Bytes identity endpoint across C, C++, and Rust.
  These are local, unpublished profiles; broader shapes, shared-corpus and
  hosted acceptance remain open.

• Settle borrowed arguments and returned Bytes at the native Agent stage
  boundary, retaining sticky failure and strict post-drop receipts. Local
  controls cover success, contract failure, cancellation, omitted drops,
  malformed receipts, and duplicate calls; native instruction fuel, complete
  finalizer accounting, compound cleanup failures, and Wasm parity remain open.

• Emit the internal public-generic-wasm-provider.v1 endpoint as a
  deterministic zero-import Core Wasm module with exact descriptor/binding
  replay, normalized artifact binding, canonical carrier SHA-256 validation,
  module-owned scratch and opaque lifecycle handles, checked HIR invocation,
  two-pass result export, and explicit release/close operations. The generated
  TypeScript runtime now delegates provider lifecycle to those exports. The
  subsequent canonical carrier migration makes that package interoperable;
  #229 and the broader #162 matrix remain open for their larger acceptance
  scope.

• Add the internal public-generic-wasm-provider.v1 Project profile as the
  first compiler-owned target foundation for #229. Package Manifest v1 now
  selects exactly one concrete checked generic owned-record endpoint, derives
  its Public Generic Descriptor v1, independently replays it against the exact
  linked program and project revision, and binds the verified digest into
  Project Lock v1. Web, npm, native, and Agent Transport artifact routes remain
  fail-closed until the Core Wasm provider emitter exists. The #162 native
  generated-caller settlement gate now shares this compiler-d...

SEMAPRAX v0.5.0 is pre-alpha research software.

Changes

• Bind effect-free retained source job handlers to persisted deployment
  descriptors before claim, using the existing durable job runtime and
  checked interpreter; refuse stale roots and handler substitutions (#192).

• Complete the ten-row feature-composition inventory, exact ownership-profile
  refusal regression, and provisioned strict differential campaign route
  with explicit CI selections and nonzero-case enforcement (#103).

• Add exact SDK-envelope byte reservations to durable retries with frozen V2
  journal preservation, canonical V3 recovery, and post-poll cancellation
  checks (#179). Tighten provider conformance around request admission,
  completion, final bytes, and usage regressions with corpus V2 (#181).

• Add a checked two-call offline repair loop and private CLI demo with
  bounded candidate edits, diagnostic feedback, read-only review evidence,
  and terminal journal replay (#116). Extend imported owned cursor failure
  composition with exact Wasm cleanup-order and sticky-status controls (#103).

• Account compact workspace validation clones before allocation and schedule
  the final uncached graph phase by temporary HIR overhead without raising
  its cap (#124). Add decoded ID bounds and allocation-free token equality
  to the catalog helper application with cross-backend oracle checks.

• Add generic durable retry/failover with acknowledged attempt journals,
  exact retained execution/schema/model bindings, non-widening source and
  deployment limits, request-seed checks, and conservative recovery (#179).
  This is local host composition; checkpoints do not prove provider identity
  or billing.

• Add V6 durable source-model quote accounting with nonrefundable observed and
  unknown usage, absolute deadlines, cumulative migration carry, and optional
  request/response byte ceilings (#113). Retain observed quote overages in
  ordinary source-model admission as well.

• Retain exact generic model request/response reservations in the additive
  priced I/O envelope, cross-bind successor carry, and reject noncanonical
  recovery requests (#113). Add store-backed typed source-model execution with
  acknowledged intents, exact raw settlements, and no uncertain redispatch
  (#177). Release full sequential workspace HIR after compact validation facts
  and selected output carriers are extracted (#124).

• Pair generic live work reservations with durable monetary accounting (#113),
  and enforce opt-in source-model ceilings before adapter construction (#177,
  #179). Add a final uncached graph retry that charges retained output vectors
  while preserving earlier successful budget receipts (#124).

• Bind typed live model operations to deployment selection and commit their
  redacted attempt evidence in an additive execution root (#177). Propagate
  remaining host deadlines and distinguish reserved, observed and unknown
  provider charges in a separate Runtime v1 receipt (#113).

• Add counterbalanced pilot scheduling, isolated MCP tools for both comparison
  lanes, retained candidate source bytes and exact transport archives (#105).
  Trial capture remains separate from eligible observations and review.

• Preserve pre-dispatch OpenCode cancellation as a zero-call cancellation
  failure (#113). A changed journal or claimed dispatch without a receipt
  remains a model failure; unresolved attempts cannot become clean refusals.

• Add direct owned String variant payloads (#216), with canonical String
  lifecycle replay, own/borrow matching and backend cleanup. Scalar-match guard
  and arm temporaries settle through exact cleanup regions. Generic String
  substitutions and nested owned-record variant payloads remain restricted.

• Add explicit Rust-host Argon2id password hashing, authenticated sessions and
  signup/login/logout composition (#191). Persist job cancellation and recurring
  schedule advancement with checked arithmetic and replay evidence (#192).

• Add checked-source HTTPS POST across explicit provider, native C11 and
  Core-Wasm/npm fixture paths (#193), with bounded body/response bytes, explicit
  destination authorization and no automatic retry or redirect for POST.

• Add an explicit native HTTPS transport for provider adapters (#181), with
  injected credentials, bounded buffered responses and conservative dispatch
  uncertainty. Extend compact task context with ordered seeds, revision binding
  and selectable token accounting (#197). Add a host-driven single-job
  checkpoint runtime and evidence-based recovery (#192).

• Drive bounded retries and ordered failover through injected provider adapters
  (#179), preserving charged attempts and stopping on uncertain outcomes.
  Add host-transport protocol adapters for Responses and Messages (#181).
  Recheck cancellation and deadlines when streaming settlement returns.
  Add an eighth cross-language task family exercising owned byte mapping and
  hidden-oracle rejection in Rust, TypeScript and SEMAPRAX (#106).

• Import bounded provider invoice evidence through explicit verifiers and retain
  reconciliation results (#180). Enforce source usage consistency and complete
  audit-view disclosure, payload association and truthful privacy claims; add
  canonical audit replay and direct receipt emission from live run evidence.

• Decode canonical model receipts with strict bounds and enrich actual generic
  and source attempt journals using retained root, request and host metadata (#180).
  Join explicit adapter observations and provider usage without inventing
  missing measurements; preserve failure and unresolved lifecycle evidence.

• Capture ordered provider adapter attempts and replay retained chunks against
  actual generic/source runtime schemas (#178/#180). Bind generic settlements
  to validated journal requests and responses; compare provider token and cost
  observations independently during invoice reconciliation.

• Validate streamed nested Proposal fields, variant cases, exact scalars and
  text/byte bounds from compiled type tables before final decode (#178).
  Expose read-only grammar states and bounded work counters; extend the
  generated TypeScript/Python/Rust client harness with adversarial chunking.

• Add versioned selective-dictionary model-text projections to CLI, retained
  service and compatibility negotiation (#201). Connect streaming proposals to
  Direct Runtime v2 typed effects and reject mismatched compiled schema envelopes
  while streaming (#178); nested semantic admission remains in the full decoder.

• Expose compact projections through CLI replay and retained service/MCP routes,
  with explicit format/profile negotiation and offline model-token measurement
  tooling (#201). Introduce Rust embedding API v2 for mandatory analysis/execution input caps, add
  cooperative request cancellation, and verify opaque session release (#203).

• Add authoritative task-context, Project API, candidate-diff, and Agent graph
  compact profiles with regeneration-bound replay (#201). Extend Rust embedding
  negotiation, cancellation, and the external consumer (#203). Connect the
  source Proposal grammar to incremental decoding and an explicit per-attempt
  provider adapter factory with bounded iterative context (#178).

• Connect the streaming Proposal decoder to the provider adapter and generic
  live-kernel seams (#178), and compose token/cost/call policy with the live
  work-budget hook (#179). Extend the embedding facade with opaque in-memory
  Project sessions, atomic refresh, semantic query, and candidate replay (#203).

• Add journal-derived model-call receipts (#180) for generic live runs and
  authenticated source checkpoints, including exact replay and Audit Capsule
  object references. Unrecorded timing and billing stay unknown. Harden enriched
  receipt replay against contradictory response states and decode refusals.
  Extend the Rust source embedding facade (#203) with bounded context v1/v2
  queries and explicitly authorized, cancellable, fuel-bounded interpretation.

• Implement additive Project Assurance Manifest v1 (#214): a canonical,
  integrity-bound envelope bound to one retained Project, workspace
  revision, ProgramRoot, and complete ordered source inventory. The profile
  deduplicates shared entry/public/test HIR obligations, records explicit
  unselected coverage, and admits only held forbid_reaches architecture laws;
  the existing single-file Assurance Manifest v1 bytes remain unchanged.

• Add additive source-journal I/O v5 accounting and private CLI config/receipt
  v3 (#113). Authenticated attempt rows reserve exact prompt bytes and bounded
  response capacity cumulatively; recovery and compatible migration retain
  reservations without profile conversion. Legacy source journal and CLI
  profiles remain unchanged. Add #103's result-allocation rejection case with
  ordered input release in interpreter/Wasm and status/resource parity in
  native C11 O0/O2, including a wrong-order oracle control.

• Extend #113's priced adapter regressions with exact retained retry I/O,
  invalid quote preflight, and deadlines reached at journal acknowledgements.
  Add #103's imported std.bytes view-composition oracle across the Project
  interpreter, native C11 O0/O2, and Core Wasm, including temporary cleanup.

• Add an explicit priced source-journal v4 route and private CLI config/receipt
  v2 (#113). Integer currency-bound reservations remain separate from work
  quotas and provider observations; replay retains unknown exposure and refuses
  quote drift. Add the private CLI's one-hop priced-to-priced migration carry,
  preserving cumulative reservations, observations, overage, and global money
  ordinals under a non-widening compatible quote. Legacy source profiles remain
  unchanged; unsupported profile conversion is refused.

• Construct ordinary imported function stubs from signatures without cloning
  discarded bodies (#124). Preserve f...

SEMAPRAX v0.4.1 is pre-alpha research software.

Changes

• Fix a temporary-path collision between two copies of the same owned-data
  native test helper. owned_vec_bytes_runtime/native.rs is
  #[path]-included by two modules of one test binary, so it is compiled
  twice and each copy owns a separate case counter starting at zero - while
  both named their scratch files from the process id and that counter alone.
  Two tests in the same process therefore shared a .c path and a binary
  path, which is exactly what the hosted shard reported twice: one run could
  not execute a binary a concurrent clang still held open (ETXTBSY), the
  next could not read a .c file the other copy's cleanup had already
  removed. The name now includes the module path, so the two copies cannot
  collide. The generated public generic consumer gate, which also compiles
  and then executes, retries a launch refused with ETXTBSY rather than
  adding another way for a foreign fork to redden an unrelated shard.

• Make the generated C and C++ public generic consumers build on Windows.
  The hosted leg found two things a Unix-only run could not: the UCRT marks
  the standard fopen deprecated in favour of its own fopen_s, which a
  -Werror build turns into an error, and a compiled consumer needs the
  host's executable name because Windows resolves a bare consumer by
  looking for consumer.exe. The generated sources now opt out of that
  deprecation, and the gate names the executable per host.
  The C++ consumer also drops std::span, which it used only to carry a
  pointer and a length together: a pointer and a size are the same
  information, so the generated artifact no longer needs a C++20 library
  header and builds under C++17. The compile check now fails on a warning
  or an error in the toolchain's output rather than on any output at all,
  because "compiles warning-free" is the claim; a linker note about
  something else is not evidence about the generated code.

• Make generated public generic consumers independent of the checkout that
  produced them. The fixed part of each consumer is an included template,
  and a Windows checkout delivers .txt with CRLF, so every placeholder
  whose match included its newline silently stopped substituting: the
  generated files kept their literal placeholders and lost both their type
  declarations and their embedded metadata. Templates are now normalized at
  generation time, .gitattributes pins .txt to LF like every other
  embedded text asset, and the generator itself asserts that no generated
  file carries a carriage return or a surviving placeholder — so this class
  fails where it happens rather than as a downstream expectation on one
  platform. A generator that only worked because of a checkout setting was
  not the deterministic generator the milestone claims.

• Guard the Windows checkout of the public generic ownership milestone job.
  Its first hosted run failed on windows-latest before any gate executed:
  the checkout itself cannot write this repository's retained evidence paths
  without core.longpaths, which every other Windows job already sets. The
  cross-platform leg was therefore reporting a checkout limit, not a
  milestone result.

• Add Public Generic Candidate Delta v1, milestone gate PG-4: a
  candidate-bound delta that describes the selected exports of an immutable
  Project candidate's base and final revisions over the public generic
  grammar, classifies the pair with the PG-3 rules, and binds the candidate
  digest, both Project and workspace revisions, both graph digests and a
  domain-separated facts digest. Inclusion is grammar-strict, so an entry in
  the delta is exactly a candidate public generic signature: no admitted
  export has one today, which makes the generic fixture all-excluded with
  the closed reason borrowed_byte_view - and the gate asserts its rendered
  bytes carry no template identity, instance term, record identity, or even
  the grammar's instance sigil. The substantive evidence rides on a Project
  v9 record-returning export, where a real add_record_field change is
  breaking with the finding on the record that changed and ordered
  arguments, substituted fields and owned leaves retained across mutation,
  recovery-capsule restoration and byte-exact independent replay
  (SPX-PG301-SPX-PG303).
  The grammar now also exposes Rejection::ALL and Rejection::of, so a
  consumer recovers a typed reason from the owning artifact instead of
  re-spelling its message, and the compatibility report exposes its digest.

• Add Public Generic Settlement Obligations v1: for one owned admitted
  instance parameter, which owned leaves a boundary is accountable for, in
  which order, how each is discharged, and what is released when a transfer
  fails part way - each fact bound to the compiler's own cleanup facts
  rather than derived beside them. The grammar's owned-leaf paths must equal
  the inventory's structural leaf order; each obligation is paired with its
  liveness flag in flag order and carries that flag's checked drop
  lifecycle, because an obligation whose flag does not match it has no
  stated way to be discharged; and the transfer unit is the cleanup plan's
  single whole live owned place, since reading leaves out of the plan would
  invent a per-leaf transfer the compiler never performs. Release order is
  the exact reverse of the canonical order, and every disagreement is a
  refusal (SPX-PG501, SPX-PG502) rather than a sort or a repair.
  This is the specification half of milestone gate PG-7, which stays open:
  nothing here allocates, transfers, releases or observes a runtime, and
  there is no public generic boundary to exercise on any engine.

• Wire the public generic ownership milestone corpus into CI as the
  public-generic-ownership-milestone job on ubuntu-latest,
  macos-latest and windows-latest, and declare it a release blocker so
  it cannot be satisfied vacuously. It runs the grammar, template-identity,
  compatibility and metadata-consumer projections, the separation gate, the
  frozen Project v9/v11 descriptor refusals of a selected generic result,
  and the four-language consumer gate, and it resolves and prints the
  consumer toolchains each host actually has - a language whose toolchain is
  absent is skipped, which is a narrower run rather than a pass.
  Milestone gate PG-8 stays open: the harness exists, the hosted evidence
  does not, and the gate moves only when the owning document records a run
  and job for an exact implementation commit.

• Add Public Generic Metadata Consumers v1: a Rust, TypeScript/Wasm, C11
  and C++ consumer generated from a candidate public generic surface, plus
  the length-framed canonical metadata format they read. Before a foreign
  toolchain can call a public generic export, several of them have to agree
  on what its types are and refuse everything else - and that is
  falsifiable without a calling convention. All four consumers are compiled
  warning-free and run for real against nine hostile documents, and each
  must report the same closed refusal (malformed, term, mismatch) as
  the others and as the Rust reference reader; the gate fails when no
  toolchain was available rather than passing silently. Identifiers come
  from term bytes rather than display names, nested instances are declared
  before their holders so C and C++ never see an incomplete type, and
  regeneration is byte-identical.
  This closes the grammar half of milestone gates PG-5 and PG-6; both stay
  open for their descriptor half, because no public generic descriptor,
  carrier or calling convention exists. No generated consumer receives a
  SEMAPRAX value, allocates one, frees one, or links against anything, and
  every generated file says so in its own banner.

• Add Public Generic Compatibility v1, gate PG-3 of the public generic
  ownership milestone: candidate surfaces over the type grammar, and a
  closed thirteen-reason classification of one ordered pair of them. The
  rules are deliberately stricter than source compatibility, because a
  foreign consumer reads the whole substituted field tree and owned-leaf
  shape of what it receives: adding a Copy field to a nested reachable
  record is breaking even though no canonical term, parameter position or
  owned-leaf path moves, and it is reported once on the record that changed
  rather than on every position mentioning it. Presentation is never
  compatibility - renaming records, type parameters, fields, exports and
  parameters yields unchanged with an identical surface digest - and a
  parameter's value identity is excluded for the same reason the repository
  excludes it elsewhere: a revision-scoped fact must not move a verdict.
  A signature position that is not a data type gets its own closed
  view: vocabulary instead of widening the grammar. Both artifacts are
  canonical JSON with directional byte-exact replay
  (SPX-PG201-SPX-PG204), and both record that no semantic-version,
  support, publication or runtime conclusion follows from a verdict.
  A candidate surface is a description, not an admission: no public generic
  signature is admitted, and local evidence is the only evidence.

• Add Public Generic Type Grammar v1, gates PG-1 and PG-2 of the public
  generic ownership milestone: a versioned, target-neutral term for the
  types a public generic surface could name, plus the explicit template and
  ordered argument identities derived from it. Identities are
  length-prefixed in bytes, so an identity holding the grammar's own
  punctuation still round trips and two distinct types can never render
  alike; digests are computed over persistent identities, declared arity and
  ordered parameter positions, so a record, parameter or field display
  rename changes nothing while argument permutation, duplication or
  substitution changes the instance identity and omission is an
  ...

SEMAPRAX v0.4.0 is pre-alpha research software.

Changes

• Added Universal Semantic Transaction v2 for one exact, authority-free
  ReplaceExpression over an authenticated revision-scoped body-expression
  identity, including explicit monomorphic main. Validation rebuilds the
  complete Project Candidate, preserves exact source bytes outside the selected
  span, and emits deterministic separately versioned result/evidence. The
  persistent service adds ordinary and ProgramRoot-v2/v3 validation/replay,
  with exact selection before parsing/history and no replay history append;
  change preview ... replace-expression returns exact core output or the
  Candidate structural diff without writes. V1 transaction and CLI bytes are
  unchanged; contract/implicit/generic/synthetic/imported editing, composition,
  commit, publication, and authority remain unavailable.

• Added the product/package contract for Owned Bounded Box v1 and the
  alloc-tier std.mem package. Compiler-owned Box<T> is limited to the eight
  explicit Copy scalars with new, synchronous get, consuming into_inner,
  one unique non-Copy owner, a 4,096-live-allocation bound, and sticky
  allocation refusal. Additive prelude v4 is Box-selected while v1-v3 and
  authored inline record Box<T> programs remain frozen. std.mem contains
  exactly three authenticated aliases, explicit 3-by-8 conformance,
  scalar-only example/test results, and no public exports. Focused local
  package, catalog, interpreter, native C11, Core-Wasm, cleanup-replay, and
  hostile-carrier evidence passes; contract-failure cleanup, owned payloads,
  allocator interfaces, public generic ABI, regions, arenas, ARC/shared ownership,
  Iterator integration, hosted evidence, and production support remain open.

• Specified Owned Bounded Vec For Traversal v1: the source form
  for item in values { body } accepts one simple immutable Vec<T> binding
  over the existing eight Copy scalars, snapshots its length once, visits
  indices in ascending order, freezes the source, and discards each body
  result. Resolver lowering reuses the existing len/get/while HIR, so this adds
  no stable identity, schema, prelude or backend operation, standard-library
  declaration, or public ABI. Focused local language and all-engine runtime
  selectors pass; hosted evidence remains required before promotion. The
  lowering has no origin marker, so ordinary HIR-node validation applies
  instead of a traversal-specific canonical-shape rule. This is not Iterator
  support: objects, next,
  adapters, closures, associated types, lifetime inference, consuming
  traversal, owned elements, and std.iter remain open.

• Added bounded acyclic generic-to-generic forwarding between already-admitted
  templates. A direct call must pass the callee exactly the caller-owned type-
  parameter vector in declaration order; each concrete caller instance derives
  the deterministic transitive callee-instance closure, bounded at 256 entries. The existing
  direct-scalar and one-owner-identical-result relay profiles, Graph v14, and
  CleanupPlan v2/v5/v7 remain the limits. Focused evidence covers
  chained source/HIR identities in authored FIFO order,
  interpreter/native C11 -O0/-O2/Core-Wasm settlement, concrete
  non-identity/permutation/cycle rejection, and missing/reordered/forged HIR
  instance rejection.
  This adds no inference, constraints, construction, projection, variants,
  resources, effects, package signature, or public generic ABI.

• Added the exact flat generic owned-record expression-composition tranche.
  One owning parameter returns the identical record while all eight explicit
  Copy substitutions exercise Copy-field projection, top-level immutable
  update, match borrow returning a bound Copy field, and match own
  reconstructing the same owner. Focused local evidence covers update and
  reconstruction failure settlement, hostile HIR/backend mutation replay,
  repeated interpreter, native C11 -O0/-O2, and Core-Wasm execution, and
  no added aggregate memory.copy against the direct-relay baseline. Generic
  variants, nested expression-result composition, standalone constructors,
  consuming projections, public generic ABI, and Graph/schema widening remain
  closed or unclaimed.

• Added a dedicated Linux CI step for the additive nested generic-owned relay
  and identity-forwarding tranche. It names the exact source/HIR boundary,
  transitive-instance hostility, all-engine settlement, and scalar-only Project
  dependency selectors, and removes their duplicate invocations from the
  adjacent generic-owned step. New locally passing hostility regressions cover
  all eight Copy scalars through a three-template nested relay, forged HIR
  carrier and cleanup vectors, source vector changes and cycles, and the exact
  256/+1 instance-closure bound. The named step is hosted green in CI run
  34048713967, Ubuntu job 101528399406; the older run 34031917437 remains the
  evidence for the pre-nested-relay corpus.

• Re-derived the offline doctor carrier ceiling from measured distributions.
  DOCTOR_OFFLINE_INPUT_MAX_BYTES was 536,870,912 bytes, and on a hosted
  ubuntu-24.04 runner the loader closures of Node v22.23.2 and Rust 1.88.0
  alone encode to 462,424,370 of them, 86% of the ceiling, leaving 74,446,542
  bytes for a whole Clang role. No official LLVM release that runs on 24.04 is
  that small: clang 9.0.1 reaches a 568,339,434-byte carrier, 14.0.0 reaches
  618,411,514 and 17.0.6 reaches 652,142,493, and Ubuntu's own clang-18 closure
  is about 713,000,000. Since render_rows admits only Node 22 or newer and
  Rust 1.88 or newer, the two non-Clang roles cannot shrink, so the two
  real-distribution lifecycle fixtures could not be satisfied by any current
  real distribution set. The ceiling is now 1,073,741,824 bytes: 1.65 times the
  measured clang-17 three-role carrier, 1.51 times Ubuntu's clang-18 closure,
  and still 6.25% of a hosted runner's 16 GB. It stays a hard bound and remains
  a resource bound rather than an authority boundary, since seals, digests, the
  release signature, the ELF contract and the closed inventory decide admission
  and none of them depend on size. The delegated cgroup-v2 scope's memory.max
  moves with it, from 2 GiB to 4 GiB, and is now derived rather than
  coincidental: an admitted carrier of N bytes costs 2N of unswappable
  residency inside that scope -- the worker's whole-carrier snapshot, which the
  root plan borrows and so cannot release before the tool children run, plus
  the page-rounded tmpfs root written out of it -- while memory.swap.max is 0
  and memory.oom.group is 1, so an overshoot kills the whole scope instead of
  refusing cleanly. The signed capsule's MAX_ARTIFACT_BYTES, the release
  directory's MAX_ARTIFACT_BYTES and the signed store's MAX_FILE_BYTES are
  held equal to the new ceiling because they bound the same bundle and request
  bytes and the smallest of them is always the effective limit. The derivation
  is recorded beside the constant and in Doctor Sealed Input v1.

• Fixed the offline doctor collector retaining its whole-carrier snapshot
  across the blocking collect. Every fact the collector keeps is already an
  owned copy by that point, and the launcher and provisioner both release
  theirs before creating a child, so the omission left three whole carriers
  resident in the confined scope at once instead of two.

• Fixed the provisioned Linux doctor gate failing before any lifecycle fixture
  ran, with input permissions or link count are unsafe. Cargo uplifts each
  binary out of deps/ as a hard link, so the artifact in the target root has
  link count 2, and semaprax-doctor-release refuses an input a second name
  can still reach. The workflow now copies the four images to private
  single-link files and asserts the link count; the packager's check is
  unchanged. The gate also carries all three real roles again, which the
  re-derived ceiling admits.

• Added std.data.json.dec, the seventh JSON sibling package, which expands
  JSON string escapes. All eight simple escapes, \uXXXX, and surrogate pairs
  decode to their exact UTF-8 bytes; a lone or unpaired surrogate, an unknown
  escape letter, a raw control byte, and an unterminated string are rejected at
  the offset of the backslash or byte that opened them, in the family's
  usize result encoding. decoded_len/decoded_size size the output,
  token_end/emit_len/emit_at stream the decoded bytes with no allocation,
  and decoded_eq fills one owned bounded byte buffer of a fixed 256-byte
  capacity through the loop-carried same-owner replacement and compares it to a
  caller-supplied view. The conformance module runs on the interpreter, clang
  C11 -O0/-O2, and Core Wasm, where the standard-library closure now
  supplies the env.spx_bytes_zeroed/env.spx_bytes_set host-arena imports and
  asserts that the package's module reaches them, that the arena holds at most
  one live entry, and that it is empty after each of four re-entries. Three
  admission facts were measured rather than assumed and are recorded in the
  specifications: owned-data-api.v1 is the only project profile that admits
  both a borrowed byte view and the buffer, the buffer must stay out of the
  entry program because a public web build containing it is SPX-W115, and a
  Bytes value does not cross a module boundary (SPX-G172), so a
  caller-provided output buffer is not expressible. The package is committed at
  17,620 B against a measured 18,480 B admitted / 18,653 B first SPX-G171;
  decoded_at and decoded_same were written, measured over that bound, and
  cut.

• Added the bounded ScalarV1 internal flat generic-owned body path. Admission is
  based on the exact reachable ResolvedProgram rather than source or dependency
  provenance; callable and selected-public signatures remain value-scalar. One
  exact project-local Su...

SEMAPRAX v0.2 is pre-alpha research software.

These unsigned archives are not notarized and make no cross-host reproducible-build claim.
SHA-256 checksums are integrity facts, not signatures.

SEMAPRAX v0.2 is pre-alpha research software.

These unsigned archives are not notarized and make no cross-host reproducible-build claim.
SHA-256 checksums are integrity facts, not signatures.