From 634d6052eaed37c846e49c549ad90247cb48b4ee Mon Sep 17 00:00:00 2001 From: kikashy Date: Mon, 19 Oct 2026 11:41:41 -0400 Subject: [PATCH] Prepare Runner v0.24.0 release documentation Co-authored-by: Codex (gpt-6.1-sol) Signed-off-by: kikashy --- README.md | 11 ++- docs/design/executor-ownership.md | 14 +++- docs/governance-payload.md | 7 +- docs/releases/v0.24.0.md | 134 ++++++++++++++++++++++++++++++ 4 files changed, 156 insertions(+), 10 deletions(-) create mode 100644 docs/releases/v0.24.0.md diff --git a/README.md b/README.md index 1415b1c..5ca9af4 100644 --- a/README.md +++ b/README.md @@ -106,9 +106,14 @@ existing independent lease before opening state or starting workers and inherits it into every Runtime invocation. A Runtime that survives its Runner keeps the lease until exit, including for a release preview or saved check. Configured state must already exist; missing/corrupt enrollment refuses with no creation or reset. -Unconfigured boots retain existing Jobs behavior. The closed capability response -is version 2 and reports `governanceAdmission: false`: ownership grants no policy -permission and does not make jobs governed. +Unconfigured boots retain existing Jobs behavior. Ownership grants no policy +permission. Supported admission hosts report closed capability version 3 with +`governanceAdmission: true` scoped solely to `local-admin-manual-pack/1`; hosts +without admission support retain ownership-only version 2 with +`governanceAdmission: false`. The separate experimental +[manual gate](docs/design/manual-admission-gate.md) requires retained enrollment, +matching boot and execution demands, and fresh anchored authority admission. +A probe response alone grants no permission. ## Upgrading a job diff --git a/docs/design/executor-ownership.md b/docs/design/executor-ownership.md index df5417a..f4cbe40 100644 --- a/docs/design/executor-ownership.md +++ b/docs/design/executor-ownership.md @@ -8,8 +8,11 @@ or an inheriting Runtime remains alive. Unconfigured workspaces retain existing portable-store locking and recovery behavior. Ownership is cooperative process exclusion. It is not execution permission, a -policy decision, governance admission or authorization of a particular job. Runner -continues to report `governanceAdmission: false`; all jobs remain ungoverned. +policy decision, governance admission or authorization of a particular job. +Ownership alone leaves jobs ungoverned. The separate experimental +[manual gate](manual-admission-gate.md) requires retained enrollment, matching +boot and execution demands, and fresh anchored authority admission for the sole +profile `local-admin-manual-pack/1`. A capability response grants no permission. ## Authority and provisioning @@ -42,8 +45,11 @@ external enrollment as part of portable Runner state. ## Trusted boot and Service integration -The private [capability response](runner-capabilities.md) is closed version 2 and -adds `executor-ownership/1`. The trusted host probes an immutable executable +The private [capability response](runner-capabilities.md) includes +`executor-ownership/1`: supported admission hosts report closed version 3 with +`governanceAdmission: true` scoped solely to `local-admin-manual-pack/1`; hosts +without admission support retain ownership-only closed version 2 with +`governanceAdmission: false`. The trusted host probes an immutable executable snapshot before sending any boot authority, then repeats the requirement in boot. The [shared boot fixture](executor-ownership-boot.json) defines the additional members, alongside the established boot configuration: diff --git a/docs/governance-payload.md b/docs/governance-payload.md index 8cd4c2a..dd46d5e 100644 --- a/docs/governance-payload.md +++ b/docs/governance-payload.md @@ -2,9 +2,10 @@ `judgment-pack-runner/execution-payload/1` is an experimental, private Runner payload descriptor for the single-Pack run admission work in Runner #147. The -codec has no execution callers, HTTP routes, boot configuration, store schema or -permission effect. It neither interprets a Policy nor establishes approval, -dependency eligibility, authority freshness or an execution grant. It does not +private `local-admin-manual-pack/1` gate now uses it at actual operational +admission and launch. The codec itself adds no HTTP routes, boot configuration, +store schema or permission effect. It neither interprets a Policy nor establishes +approval, dependency eligibility, authority freshness or an execution grant. It does not change legacy releases, `releaseDigest`, preparation bindings or verification exports. This profile is not an adopted portable Spec contract or a conformance claim. It does not add public graph jobs. diff --git a/docs/releases/v0.24.0.md b/docs/releases/v0.24.0.md new file mode 100644 index 0000000..0d2bb61 --- /dev/null +++ b/docs/releases/v0.24.0.md @@ -0,0 +1,134 @@ +Runner v0.24.0 adds startup capability negotiation, external executor ownership, +exact operational payload commitments and an explicitly enrolled experimental +manual Pack admission profile. Runner remains a single-owner local Jobs research +preview. These changes cover all four source commits since published `v0.23.0` +(#158–#161); they do not adopt a portable Policy standard. + +## What an operator must do + +- Installing this version alone does not enroll a workspace. Published Desk still + pins Runner `v0.23.0` and Runtime `v0.34.0`; coordinated companion adoption and + installed activation remain pending. A successful capability probe grants no + permission. A supporting trusted host must explicitly enroll the entire + workspace in `local-admin-manual-pack/1`, retain its independent ownership and + Policy authority, and require matching capabilities in the actual boot. +- **Before enrollment, stop Desk and Runner and back up the entire Jobs workspace**, + including SQLite/WAL, runtimes, releases and attempts, as + [State and backups](../../README.md#state-and-backups) describes. Desk chat + backups do not include Jobs. Keep the external trusted enrollment and authority + separate from portable Jobs copies; a copied store or backup is not authority. +- Enrollment requires explicit offline `prepare-manual-store` under the host's + continuously held external exclusive lease. It accepts only an untouched + schema-3 store with no triggers (even paused), queued/running work or pending + acquisition/occurrences, then durably publishes its marker and schema 4. + Ordinary enabled `Open` refuses older/restored schemas; it does not migrate + them. The earlier ownership-era Runner was tested to refuse schema 4. There is + no supported in-place downgrade or automatic undo of enrollment: a pre-enrollment + backup alone does not clear the independently retained execution demand. +- A refusal, partial preparation or lost reply can follow durable changes. Only + the original fresh committed preparation response can advance activation; + a recovered observation cannot. Hold the workspace for explicit reviewed + reconciliation rather than retrying automatically or stripping markers/demands. +- The enrolled workspace permits only immutable, registered, manual single-Pack + jobs. Triggers, acquisition/provider operations, workflows, prepared or mapped + inputs, input-profile installation and job upgrades are held across the entire + workspace, including legacy resources. Choose a workspace compatible with this + scope before enrolling it. + +## Exact operational payloads (#158) + +The private `judgment-pack-runner/execution-payload/1` descriptor commits the +existing frozen Release identity, exact Pack/configuration/lock and facts bytes, +evidence presence and bytes, typed preparation/SourceInput commitments and actual +operational signing mode/public key. It does not change legacy release digests or +invent a portable Policy canonical encoding. Raw facts and evidence retain number +spelling and whitespace. The codec alone interprets no Policy and grants no +execution permission; the manual gate uses its commitment at the actual starter. +See [the payload contract](../governance-payload.md). + +## Probe and ownership before startup (#159–#160) + +The trusted host probes the exact executable using +`jpack-runner capabilities --format json` before sending boot authority, pins +that executable through launch, and repeats its requirements in the boot object. +Closed version 3 on supported admission hosts lists only the manual profile +alongside `jobs/1`, required boot capabilities and `executor-ownership/1`. +Unsupported hosts retain the closed ownership-only version-2 response; unknown +shapes or missing requirements must hold startup. + +With explicit ownership configured, Runner acquires the existing independently +pinned external exclusive lease before portable state, recovery, providers or +workers. Every Service Runtime invocation, including utility checks, inherits +that ownership through the actual child lifetime. Closing or killing the parent +does not release it while an inheriting Runtime remains alive. A failed or stopped +configured service cannot fall back to unowned execution. The supported boundary +is cooperative exclusion on suitable local filesystems, described in +[executor ownership](../design/executor-ownership.md). + +## Anchored local manual admission (#161) + +`local-admin-manual-pack/1` is a private experimental host contract. Its capability +response is support information, not authority or normative Policy conformance. +RFC 0023 remains Review and unadopted; Runtime prototype `0.0.2` and its explicit +proposed-draft candidate `1.0.0` remain distinct offline formats. + +The same independently anchored Desk Policy authority governs registration, +current eligibility, intent, reservation and start commitment. Runner checks +matching external, store and boot demands, holds actual ownership, fixes signing +and activates a fresh authenticated session before recovery or workers. The +owner-only execution-binding export grants no registration or launch authority. + +Manual admission preserves the **original Idempotency-Key and exact original +request body**, facts and optional evidence. Reusing the key with even a changed +outer whitespace body conflicts. The existing payload descriptor, exact resource +and registration bind reserve and commitStart. Actual files, Runtime, signing, +job/release tuple and custody are checked before commitment and again at the +common operational starter. Only an original fresh successful start reply, +durably journaled locally, can mint one in-memory launch consumed once through +the ownership-aware starter. No private workflow or alternate evaluator path can +substitute an ordinary utility call for that permit. + +Withdrawal committed first blocks the start. A start committed first is the +irrevocable **logical start**: its physical process may spawn after a later +withdrawal. There is no atomic ledger/OS transaction. Lost reserve/start replies, +recovered receipts or history, uncertain outcomes and restart recovery never +authorize a launch or automatic replay. This does not resist hostile code under +the same OS user, an administrator, or rollback/replacement of the entire trusted +plane. See [the manual gate](../design/manual-admission-gate.md) and +[offline preparation contract](../design/manual-admission-store-prepare-shape.md). + +## Source evidence and pending release gates + +Existing reviewed source evidence is reused for this documentation-only release +preparation: + +- Runner native Linux/macOS CI + [39270753757](https://github.com/Judgment-Pack/judgment-pack-runner/actions/runs/39270753757) + passed at `d903728fb38368a5f0574990e01bc27acb2a2803`. Its normal real-Runtime + suite pins Runtime `09206e743cdf410d7b5ee970f1c9d09ca7c015ca` (included in + published `v0.34.0`), plus earlier signing Runtime `v0.27.1` at + `7a2fcfe20cedba5f164246fc544c4920971d2c56`; Gateway is `v0.9.1` at + `5b49e1e094b55fdd1deb9f613815c2beebd411f1`. The old-Runner schema-refusal + fixture pins `1cc6b29885b344716a970cd21fefeaca0a4edaeb`. +- Combined actual Desk/Runner/Runtime source acceptance passed all seven required + manual checks in Desk CI + [39275718610](https://github.com/Judgment-Pack/judgment-pack-desk/actions/runs/39275718610), + using reviewed Desk `2ff3773a55b61c84317474fd80753f933c04ec5d` (merged as + `c4e6ef5c6170e7d134c8c3960adc7a9c909bc2bb` with the same tree), Runner + `d903728fb38368a5f0574990e01bc27acb2a2803` and Runtime + `55a23b884f0ce67fe6a9141b04e081a518fd5d61`. They cover exact registered + input/withdrawal-first, commitment-first, lost-start and lost-reserve replies, + actual MCP refusal when Jobs is unavailable, and the actual old-Desk registry + rollback fence. These are source-fixture results, not installed archive tests. +- The Runtime release source `0554c43d2bea08e06b9a1e7be39834494ee29d5e` has + the same tree as that tested Runtime and passed main CI + [39165392059](https://github.com/Judgment-Pack/judgment-pack-runtime/actions/runs/39165392059). + Runtime `v0.35.0` remains a held unpublished draft at + `515724946fe83e7db800b4281e74d5daf06524fa`; it is not the tested candidate. + +Tag-time CI, four packaged archives, checksums, attestations, native archive smoke +and draft/publication verification for `v0.24.0` remain pending under +[the release procedure](../releasing.md). No Windows archive is released; the +`darwin/amd64` archive is read but not run by release checks, and no release check +starts `jpack-google-relay`. Coordinated Desk pins and acceptance against exact +attested companion archives are still required before installed enablement.