Prepare Runner v0.24.0 release documentation

README.md

@@ -106,9 +106,14 @@ existing independent lease before opening state or starting workers and inherits
 it into every Runtime invocation. A Runtime that survives its Runner keeps the
 lease until exit, including for a release preview or saved check. Configured state
 must already exist; missing/corrupt enrollment refuses with no creation or reset.
-Unconfigured boots retain existing Jobs behavior. The closed capability response
-is version 2 and reports `governanceAdmission: false`: ownership grants no policy
-permission and does not make jobs governed.
+Unconfigured boots retain existing Jobs behavior. Ownership grants no policy
+permission. Supported admission hosts report closed capability version 3 with
+`governanceAdmission: true` scoped solely to `local-admin-manual-pack/1`; hosts
+without admission support retain ownership-only version 2 with
+`governanceAdmission: false`. The separate experimental
+[manual gate](docs/design/manual-admission-gate.md) requires retained enrollment,
+matching boot and execution demands, and fresh anchored authority admission.
+A probe response alone grants no permission.
 
 ## Upgrading a job
 

docs/design/executor-ownership.md

@@ -8,8 +8,11 @@ or an inheriting Runtime remains alive. Unconfigured workspaces retain existing
 portable-store locking and recovery behavior.
 
 Ownership is cooperative process exclusion. It is not execution permission, a
-policy decision, governance admission or authorization of a particular job. Runner
-continues to report `governanceAdmission: false`; all jobs remain ungoverned.
+policy decision, governance admission or authorization of a particular job.
+Ownership alone leaves jobs ungoverned. The separate experimental
+[manual gate](manual-admission-gate.md) requires retained enrollment, matching
+boot and execution demands, and fresh anchored authority admission for the sole
+profile `local-admin-manual-pack/1`. A capability response grants no permission.
 
 ## Authority and provisioning
 
@@ -42,8 +45,11 @@ external enrollment as part of portable Runner state.
 
 ## Trusted boot and Service integration
 
-The private [capability response](runner-capabilities.md) is closed version 2 and
-adds `executor-ownership/1`. The trusted host probes an immutable executable
+The private [capability response](runner-capabilities.md) includes
+`executor-ownership/1`: supported admission hosts report closed version 3 with
+`governanceAdmission: true` scoped solely to `local-admin-manual-pack/1`; hosts
+without admission support retain ownership-only closed version 2 with
+`governanceAdmission: false`. The trusted host probes an immutable executable
 snapshot before sending any boot authority, then repeats the requirement in boot.
 The [shared boot fixture](executor-ownership-boot.json) defines the additional
 members, alongside the established boot configuration:

docs/governance-payload.md

@@ -2,9 +2,10 @@
 
 `judgment-pack-runner/execution-payload/1` is an experimental, private Runner
 payload descriptor for the single-Pack run admission work in Runner #147. The
-codec has no execution callers, HTTP routes, boot configuration, store schema or
-permission effect. It neither interprets a Policy nor establishes approval,
-dependency eligibility, authority freshness or an execution grant. It does not
+private `local-admin-manual-pack/1` gate now uses it at actual operational
+admission and launch. The codec itself adds no HTTP routes, boot configuration,
+store schema or permission effect. It neither interprets a Policy nor establishes
+approval, dependency eligibility, authority freshness or an execution grant. It does not
 change legacy releases, `releaseDigest`, preparation bindings or verification
 exports. This profile is not an adopted portable Spec contract or a conformance
 claim. It does not add public graph jobs.

docs/releases/v0.24.0.md

@@ -0,0 +1,134 @@
+Runner v0.24.0 adds startup capability negotiation, external executor ownership,
+exact operational payload commitments and an explicitly enrolled experimental
+manual Pack admission profile. Runner remains a single-owner local Jobs research
+preview. These changes cover all four source commits since published `v0.23.0`
+(#158–#161); they do not adopt a portable Policy standard.
+
+## What an operator must do
+
+- Installing this version alone does not enroll a workspace. Published Desk still
+  pins Runner `v0.23.0` and Runtime `v0.34.0`; coordinated companion adoption and
+  installed activation remain pending. A successful capability probe grants no
+  permission. A supporting trusted host must explicitly enroll the entire
+  workspace in `local-admin-manual-pack/1`, retain its independent ownership and
+  Policy authority, and require matching capabilities in the actual boot.
+- **Before enrollment, stop Desk and Runner and back up the entire Jobs workspace**,
+  including SQLite/WAL, runtimes, releases and attempts, as
+  [State and backups](../../README.md#state-and-backups) describes. Desk chat
+  backups do not include Jobs. Keep the external trusted enrollment and authority
+  separate from portable Jobs copies; a copied store or backup is not authority.
+- Enrollment requires explicit offline `prepare-manual-store` under the host's
+  continuously held external exclusive lease. It accepts only an untouched
+  schema-3 store with no triggers (even paused), queued/running work or pending
+  acquisition/occurrences, then durably publishes its marker and schema 4.
+  Ordinary enabled `Open` refuses older/restored schemas; it does not migrate
+  them. The earlier ownership-era Runner was tested to refuse schema 4. There is
+  no supported in-place downgrade or automatic undo of enrollment: a pre-enrollment
+  backup alone does not clear the independently retained execution demand.
+- A refusal, partial preparation or lost reply can follow durable changes. Only
+  the original fresh committed preparation response can advance activation;
+  a recovered observation cannot. Hold the workspace for explicit reviewed
+  reconciliation rather than retrying automatically or stripping markers/demands.
+- The enrolled workspace permits only immutable, registered, manual single-Pack
+  jobs. Triggers, acquisition/provider operations, workflows, prepared or mapped
+  inputs, input-profile installation and job upgrades are held across the entire
+  workspace, including legacy resources. Choose a workspace compatible with this
+  scope before enrolling it.
+
+## Exact operational payloads (#158)
+
+The private `judgment-pack-runner/execution-payload/1` descriptor commits the
+existing frozen Release identity, exact Pack/configuration/lock and facts bytes,
+evidence presence and bytes, typed preparation/SourceInput commitments and actual
+operational signing mode/public key. It does not change legacy release digests or
+invent a portable Policy canonical encoding. Raw facts and evidence retain number
+spelling and whitespace. The codec alone interprets no Policy and grants no
+execution permission; the manual gate uses its commitment at the actual starter.
+See [the payload contract](../governance-payload.md).
+
+## Probe and ownership before startup (#159–#160)
+
+The trusted host probes the exact executable using
+`jpack-runner capabilities --format json` before sending boot authority, pins
+that executable through launch, and repeats its requirements in the boot object.
+Closed version 3 on supported admission hosts lists only the manual profile
+alongside `jobs/1`, required boot capabilities and `executor-ownership/1`.
+Unsupported hosts retain the closed ownership-only version-2 response; unknown
+shapes or missing requirements must hold startup.
+
+With explicit ownership configured, Runner acquires the existing independently
+pinned external exclusive lease before portable state, recovery, providers or
+workers. Every Service Runtime invocation, including utility checks, inherits
+that ownership through the actual child lifetime. Closing or killing the parent
+does not release it while an inheriting Runtime remains alive. A failed or stopped
+configured service cannot fall back to unowned execution. The supported boundary
+is cooperative exclusion on suitable local filesystems, described in
+[executor ownership](../design/executor-ownership.md).
+
+## Anchored local manual admission (#161)
+
+`local-admin-manual-pack/1` is a private experimental host contract. Its capability
+response is support information, not authority or normative Policy conformance.
+RFC 0023 remains Review and unadopted; Runtime prototype `0.0.2` and its explicit
+proposed-draft candidate `1.0.0` remain distinct offline formats.
+
+The same independently anchored Desk Policy authority governs registration,
+current eligibility, intent, reservation and start commitment. Runner checks
+matching external, store and boot demands, holds actual ownership, fixes signing
+and activates a fresh authenticated session before recovery or workers. The
+owner-only execution-binding export grants no registration or launch authority.
+
+Manual admission preserves the **original Idempotency-Key and exact original
+request body**, facts and optional evidence. Reusing the key with even a changed
+outer whitespace body conflicts. The existing payload descriptor, exact resource
+and registration bind reserve and commitStart. Actual files, Runtime, signing,
+job/release tuple and custody are checked before commitment and again at the
+common operational starter. Only an original fresh successful start reply,
+durably journaled locally, can mint one in-memory launch consumed once through
+the ownership-aware starter. No private workflow or alternate evaluator path can
+substitute an ordinary utility call for that permit.
+
+Withdrawal committed first blocks the start. A start committed first is the
+irrevocable **logical start**: its physical process may spawn after a later
+withdrawal. There is no atomic ledger/OS transaction. Lost reserve/start replies,
+recovered receipts or history, uncertain outcomes and restart recovery never
+authorize a launch or automatic replay. This does not resist hostile code under
+the same OS user, an administrator, or rollback/replacement of the entire trusted
+plane. See [the manual gate](../design/manual-admission-gate.md) and
+[offline preparation contract](../design/manual-admission-store-prepare-shape.md).
+
+## Source evidence and pending release gates
+
+Existing reviewed source evidence is reused for this documentation-only release
+preparation:
+
+- Runner native Linux/macOS CI
+  [39270753757](https://github.com/Judgment-Pack/judgment-pack-runner/actions/runs/39270753757)
+  passed at `d903728fb38368a5f0574990e01bc27acb2a2803`. Its normal real-Runtime
+  suite pins Runtime `09206e743cdf410d7b5ee970f1c9d09ca7c015ca` (included in
+  published `v0.34.0`), plus earlier signing Runtime `v0.27.1` at
+  `7a2fcfe20cedba5f164246fc544c4920971d2c56`; Gateway is `v0.9.1` at
+  `5b49e1e094b55fdd1deb9f613815c2beebd411f1`. The old-Runner schema-refusal
+  fixture pins `1cc6b29885b344716a970cd21fefeaca0a4edaeb`.
+- Combined actual Desk/Runner/Runtime source acceptance passed all seven required
+  manual checks in Desk CI
+  [39275718610](https://github.com/Judgment-Pack/judgment-pack-desk/actions/runs/39275718610),
+  using reviewed Desk `2ff3773a55b61c84317474fd80753f933c04ec5d` (merged as
+  `c4e6ef5c6170e7d134c8c3960adc7a9c909bc2bb` with the same tree), Runner
+  `d903728fb38368a5f0574990e01bc27acb2a2803` and Runtime
+  `55a23b884f0ce67fe6a9141b04e081a518fd5d61`. They cover exact registered
+  input/withdrawal-first, commitment-first, lost-start and lost-reserve replies,
+  actual MCP refusal when Jobs is unavailable, and the actual old-Desk registry
+  rollback fence. These are source-fixture results, not installed archive tests.
+- The Runtime release source `0554c43d2bea08e06b9a1e7be39834494ee29d5e` has
+  the same tree as that tested Runtime and passed main CI
+  [39165392059](https://github.com/Judgment-Pack/judgment-pack-runtime/actions/runs/39165392059).
+  Runtime `v0.35.0` remains a held unpublished draft at
+  `515724946fe83e7db800b4281e74d5daf06524fa`; it is not the tested candidate.
+
+Tag-time CI, four packaged archives, checksums, attestations, native archive smoke
+and draft/publication verification for `v0.24.0` remain pending under
+[the release procedure](../releasing.md). No Windows archive is released; the
+`darwin/amd64` archive is read but not run by release checks, and no release check
+starts `jpack-google-relay`. Coordinated Desk pins and acceptance against exact
+attested companion archives are still required before installed enablement.