Conformance checkpoint, 2026-09-26 (later): protected run 36213255383 on the
replacement candidate failed Windows at
phase1.stage.execution-root-cleanup.root-rename with every check passing. A
scratch probe showed a transient 0x80070005 that clears within 3 s;
Chat #389 retries it, and this
binding selects the Chat #390
repin producer 399e1f199417e74db6a1b9096500d0e953fdfa6b with harness authority
2f72ecedd225759a11889ec4b7dd112b71361d56. The candidate and consumer are
unchanged.
Earlier checkpoint, 2026-09-26: the #40 re-review blocked candidate
96804bc4. The replacement candidate cd10a3fa1d9900e0dbcb04bbb2477140854fba1d
(SDK #321) is adopted by Chat #383
and bound here to Chat #385
producer ce151728a309f8f5532d1426d7503c2c4efe38be, whose reviewed head has
harness authority 1c80212e3aca79c2800d703abaedc080b1cf9ef8 as its sole
parent. A fresh protected run and a new #40 disposition are required.
Previous checkpoint, 2026-09-25: that binding selected Chat #375 producer
b10910545b14133a619e56641e5692a4335c83c4, the merge that repins Chat's harness
authority to 6a95b93d3eeb73a01f4a1882ea94ae9aa466345f after
Chat #374. That change reports a
Google Fonts download failure in the frozen Cave build as compile.font-fetch
and retries the Cave build once on exactly that failure. The reviewed head has
the same complete tree and the harness authority as its sole parent. SDK
#316 delivered the preceding Chat
#371 binding, whose protected runs 36033589858 and 36038079308 were the first
complete authenticated aggregates.
The preceding SDK #302 merged at
1c10e63a9ff87934397e8defc2d0b98f3932abe2, binding Chat #328 producer
ac1c4f4ca658fbb03bd2541bf265a57666e80c7c, with both Chat validator scopes
rotated and read back at that revision.
Protected run 35566636457
is historical and failed. Linux and macOS records
independently passed exact identities, canonical schema, privacy and retained-evidence
scans, Cave timing, and all 197 ordered assertions each (110 Cave, 46 SDK, 41 Chat).
Windows failed at phase1.packaging.chat-native-build.build-script and produced
no platform record; artifact validation, attestation, and aggregation were skipped.
That stage is the aws-lc-sys build script, whose deepest relative include
overflowed MAX_PATH beneath the previous isolated bootstrap root. Chat #348
shortens that root and was verified on a scratch copy of the Windows lane
(deepest include 250 characters, cargo build exit 0). The current protected run
reached evidence assembly but did not establish a complete Windows
journey or an accepted aggregate, and the earlier checkout-quota monitor question
remains unanswered by those preceding failed runs, which never reached the monitor.
SDK #295 delivered descendant
provenance validation through both collectors at 888358012. The current
binding remains specific to the reviewed producer; subsequent Chat main
changes require their own provenance review. See the
binding and validation record.
The OpenCoven SDK is experimental and unpublished. The current objective is a secure read-only 0.0.1 release that proves discovery, consent, identity, credential custody, canonical reads, native trust, and packed-consumer behavior before adding mutation authority.
The 0.0.1 release decision replaces the original 0.1.0 version target, not its scope or acceptance gates. The dated 0.1 design and delivery program below retain their historical names.
For the complete design and execution graph, see:
Delivered foundations include:
- transport-neutral package boundaries;
- explicit caller-supplied transports;
- no import-time discovery or I/O;
- normalized errors, deadlines, cancellation, and observers;
- secure owner-local Coven discovery and health transport contracts;
- strict Cave Client v1 one-page canonical reads and bounded lazy iterators merged through SDK PR #55;
- contract fixture verification;
- property, stress, package, and packed-consumer tests;
- a locked two-key release system with checksummed artifacts and OIDC-oriented publishing.
All workspace packages remain private and public publishing remains
intentionally disabled. The 0.0.1 release inventory contains the four SDK
libraries; @opencoven/dev-cli remains a source-tested private workspace and
is excluded from release artifacts and the Changesets fixed group.
SDK #35 merged through PR #69 at
163961f4e59cfdef51d2271fa98e7c514977203f. It adds strict discovery v2 plus
hpke-bound-v1, and the upstream producer/runtime authority boundary landed in
OpenCoven/coven-cave#5044
and closed
OpenCoven/coven-cave#4996.
The original pairing milestone used Cave authority
6325fc4c1154c7d7398074a9760a2e2dc323b424; it is not the current release
authority. The current source and artifact identities are pinned in
conformance/client-v1-cross-repository-lock.json
and the release process.
Issue #35 is closed after
OpenCoven/chat#30 and
Actions run 33250233035
completed the packaged darwin-arm64 pairing/custody matrix, including
secure-store failure/retry, restart reuse, revocation, ambiguity handling, and
retained evidence secret scanning.
SDK #36 merged through PR #55 at
d7f9e69378d6136c2771f60b4c57d7beeaa74f6a. It exposes five one-page reads
(listFamiliars, listProjects, listConversations, getConversation, and
listConversationMessages) plus four bounded list iterators; it has no detail
iterator. Limits default to 50, reject unsafe or out-of-range values above
the maximum 100, and use opaque strict canonical base64url cursors bounded to
512 characters. Iterators require positive maxPages or a caller-owned signal
and never prefetch, retry, or implicitly walk the whole corpus.
SDK #37 records that the private
CLI is deferred from the first release and that Chat's Tauri layer owns the
Phase 1 native trust adapters. The native Chat/real-authority conformance matrix is
frozen to darwin-arm64, linux-x64, and win32-x64. Chat
#27 is closed after the native
integration landed. OpenCoven/chat#30 and Actions run 33250233035 provide
the first named packed real-authority record for darwin-arm64. That historical
record does not qualify the new 0.0.1 candidate.
The private 0.0.1 candidate is frozen at
cd10a3fa1d9900e0dbcb04bbb2477140854fba1d, replacing 96804bc4, which #40
blocked. The source lock above is authoritative
for the current producer and counterpart identities. On 2026-09-15, SDK #276
landed as 6b4e0d04e168c7ccd99df492a0494e223150e2ab with the verified
Chat #293 binding. Both validator scopes were rotated and read back at that
actual merge. Protected run 34951851914,
attempt 1, was dispatched with Chat 6fa5dab5 and SDK #276. Its frozen workflow
and supervisor artifact passed independent authentication before environment
approval. Linux and macOS passed independent record identity, Cave timing,
scan, and all 197 ordered assertion checks each. Windows failed at
phase1.native-scenarios.native-preflight-installation-rpc, during
app_installation_id and before the installation-ID assertion. It published
no record; validation, attestation, and aggregation were skipped. This is
terminal partial evidence, not aggregate acceptance or publication approval.
The RPC's underlying failure remains unclassified; the stage does not prove
a recurrence of the earlier quota-monitor cause.
The prior SDK #275 run 34945048615 is terminal failure: Linux and macOS
records passed independent inspection, while Windows published no record and
failed its bounded checkout directory quota monitor. Downstream attestation
and aggregation were skipped. The #38 checkpoint
tracks subsequent platform records and exact aggregate acceptance.
SDK #277 separately delivered
per-client discovery v2 retention, concurrent current-credential preservation,
and snapshots used to pin pairing authority. That development-source change is
not included in frozen candidate 96804bc4 or validated by the SDK #276 run.
SDK #299, merged at b80fc6d76,
adds real-HPKE regressions for forged stale guidance while preserving single-use
pairing's no-retry behavior. #301,
merged at 09c537753, adds managed authenticated reads with authority pinned
separately for each iterator. PR-head and merged-main checks passed for both;
#296 is closed after both blockers
were delivered. Native adapter adoption remains separate. Candidate and
counterpart authorities stay frozen; a later candidate needs its own review
and evidence.
Historical candidate77 protected
run 34796638173, attempt 1
produced authenticated partial Unix records,
but Windows failed and downstream validation, attestation, and aggregation
were skipped. A closed issue or successful ordinary CI does not satisfy this
gate. See the dated release checkpoint
for the remaining evidence and authorization requirements.
Use the GitHub issue graph for active delivery. The historical Beads ledger is not a current issue-status mirror; see the plan index.
| Issue | Remaining work and dependency |
|---|---|
| #31 | Keep the release program open through #38, #40, and #41, including registry verification. |
| #38 | The Windows identity failure is traced to Coven's TerminateProcess(handle, 1) stop and the runner image rollout is profiled per image; runs 36033589858 and 36038079308 completed full aggregates, and this binding selects the Chat #375 producer, which also names and retries the Cave build's Google Fonts failures. Rotate both validator scopes, obtain a fresh protected run, and reach a complete authenticated aggregate. |
| #40 | The security review records BLOCK. Re-review the exact publication candidate after #38 passes. |
| #41 | Execute publication only after #40 recommends ship and the maintainer explicitly authorizes each release mutation. |
| #42 | Conversational control depends on #41, canonical Cave mutation authority, and real-authority mutation evidence. |
| #43 | Rich content and privileged actions depend on #42 and their separately reviewed authority contracts. |
| #44 | Offline reads and tooling depend on #41 and approved native cache semantics. |
| #80 | Domain event pages and subscriptions shipped in #300. Local receipt integrity and caller-binding verification shipped in #304. Bounded reducer, event-integrity and definition-digest helpers shipped in #305; full guarded transitions remain unreconciled. Missing producer queries and authority-bearing commands have separate upstream gates. |
| #199 | Preserve the delivered refusal-only consumer until Coven publishes a reviewed, explicitly negotiated positive admission contract. |
- #32 — reconcile release scope and current plans
- Cave #4869 — make capabilities operationally truthful
- #33 — source-lock the Cave contract and correct health compatibility
- #34 — secure Cave discovery
- #35 — pairing and credential
custody; closed after strict discovery v2 +
hpke-bound-v1merged through PR #69 and the packageddarwin-arm64pairing/custody evidence passed - #36 — canonical reads merged through PR #55
- #37: defer the private CLI from the first release; assign Phase 1 native trust adapters to Chat
- Chat #27 — packed SDK/native integration complete
- #38: cross-repository real-authority conformance; the 0.0.1 candidate has partial Unix evidence, but Windows and the complete authenticated aggregate remain required
- #39 — profiles, diagnostics, and public API governance
- #40 — security review and ship/block disposition; remains BLOCK until the exact final candidate is re-reviewed
- #41 — release execution and registry/provenance validation; locked, packages private, publishing disabled
#42 adds the first bounded mutation tier. Its implementation-ready design is complete; implementation remains blocked by #41 and the unbuilt Cave Client v1 mutation authority.
- canonical conversation creation;
- persistent idempotency;
- send;
- resumable typed streaming;
- stop and retry;
- canonical reconciliation after replay gaps.
Ambiguous mutations are never automatically replayed.
#43 covers:
- bounded attachments;
- passive rich-content semantics;
- attention responses;
- task handoffs;
- explicitly confirmed, scope-checked GitHub mutations.
Every privileged action remains constrained, idempotent, auditable, and revalidated by Cave.
#44 covers:
- encrypted replaceable offline read cache;
- completions;
- fixed safe scaffolds;
- expanded redacted diagnostics;
- packed examples and native-boundary guidance.
Offline mode remains read-only and never becomes a second canonical database. The implementation design requires real producer revisions and keeps the CLI private unless a separate distribution gate is approved.
#80 adds a constrained Automations
SDK consuming canonical coven.automations.v1 artifacts.
OpenCoven/coven#855 is closed:
the immutable base-artifact canary landed in SDK #106. The canary now also
independently recomputes golden definition/receipt integrity and checks the
receipt's definition binding before exercising replay vectors. This is
constrained contract conformance, not a public receipt-authentication API.
The Automations client on SDK main discovers capabilities and exposes
list(), get(), health(), runs(), occurrences(), getOccurrence(),
getReceipt(), and bounded events() reads. Authenticated Unix socket and
Windows named-pipe transports use the source-pinned POST /api/v1/actions surface.
Reads require their exact advertised action; receipt retrieval does not
independently authenticate receipt identity, authority, or outcome claims.
The package contract describes the
read projections and native-adapter requirements.
SDK #300, merged at dd07e1d45,
delivered events() and demand-driven subscribe() pages for automation,
occurrence, and run streams. PR-head and merged-main checks passed. The API
supports explicit checkpoints, duplicate handling, ordering, cancellation,
and bounded pages without polling, prefetch, retry, or implicit cursor reset.
These APIs do not recapture the frozen 96804bc release candidate.
SDK #304, merged at 0cd6e510b,
delivered local verifyReceipt() integrity checks and seven explicit
caller-supplied identity bindings. The reviewed and delivered trees match;
all final PR checks passed, including 2,912 tests in both normal and coverage
runs. Authentication and runtime authority remain explicitly unverified.
SDK #305, merged at 49b7ab5e3,
delivered reduceAutomationEvents(), verifyEventIntegrity(), and
computeDefinitionDigest(). The delivered tree matches the reviewed tree;
all final PR checks passed, including 2,978 tests in both normal and coverage
runs. Occurrence continuity is checked only when prior occurrence state is
available in the current projection. These helpers cannot authenticate a producer or runtime,
and a complete normative definition cannot be reconstructed from get()'s
legacy projection. Full guarded transition validation across every stream
remains unreconciled.
An optional global-feed API remains deferred. The producer supports feed/all
with a separate page cursor; domain event sequences do not establish feed-wide
ordering. This is separate SDK API design, not a missing producer route.
Individual-run lookup and per-automation occurrence and run history have since
landed (SDK #330, #331 and #333).
SDK #303 separately added exact
17-file and released 19-file Automations artifact inventories at d4cf105df.
The actual Coven v0.4.4 bundle passed its integrity checks; result-envelope
authentication remains explicitly unperformed.
SDK #337 rebinds the base-artifact
lock and the exact-runtime CI reproduction from the pre-release 8a796807
artifact to the producer of the released Coven v0.4.7 bundle: c93a8a93,
19 files, contract content ef266d16.
SDK #338 adds a daemon canary.
CI installs the published @opencoven/cli@0.4.7 at its locked integrity and
drives its daemon through the built client: draft, revise and lifecycle
commands, adoption replay and refusal, and checkpoint resume across a daemon
restart. It found that v0.4.7's lifecycle events, occurrences, runs and
receipts pin the digest of the legacy routine projection rather than the
definition document's integrity (reported on Coven #1054).
Coven v0.4.8 fixed that (coven#1200), and
SDK #339 re-pins the canary to
@opencoven/cli@0.4.8. The canary now requires every lifecycle event to carry
its revision's definition integrity.
Coven v0.4.9 implements the run-control commands occurrence.runNow.v1,
occurrence.cancel.v1, attempt.cancel.v1, attempt.retry.v1 and
occurrence.recover.v1 (coven#1218–#1221). SDK #343 re-pinned the canary to
@opencoven/cli@0.4.9 and required the daemon to advertise all five. The SDK
still does not send them: they are Phase 3, which waits for coven#857 and #858.
The base-artifact lock and daemon fixture now both target v0.4.10, producer
d6afbffde4f815a538f65185c80da2d0ee951d2d, contract content 528b900c.
The protocol bundle reproduces byte-for-byte from that source and matches the
release asset and successful CI artifact 11868030042. This pin reconciliation
does not add run-control behavioral coverage or satisfy the Phase 3 gates.
OpenCoven/coven#991 (d277ade3) and OpenCoven/coven#999 (735e2f05) publish packaged base capability
negotiation, durable CAPABILITY_UNSUPPORTED outcomes, and exact wire request
fingerprinting. Coven now persists rich AutomationDefinition bodies
(OpenCoven/coven#1185), which createDraft() and revise() send (SDK #336).
Coven #1054
tracks executable rich persistence, command-catalog parity, and production
lifecycle emission. Current packed cross-repository certification remains
separate from these SDK development increments.
Authority-bearing commands remain additionally blocked by
OpenCoven/coven#857 and
OpenCoven/coven#858.
Automations are not part of the 0.0.1 release bar. The SDK will consume pinned Coven-owned contracts and evidence rather than defining scheduling, authority, or run state independently.
#199 has delivered the strict
refusal-only v1 consumer. Its refreshed prerequisite checkpoint records that
Coven #1083 merged the macOS
Seatbelt backend at 2c173cf2. Coven's
canonical implementation at 14487ac7
still advertises enforcement: "unavailable" and supported_profiles: [];
the backend merge does not activate admission.
SDK acceptance and lifecycle support require a separately reviewed negotiated
revision with verified enforcement and the evidence tracked by
Wand #9 and
Wand #10. Metadata does not grant
authority, and this work does not block the read-only 0.0.1 release.
#45 and
#296 are closed. The two HPKE
integration blockers landed through #299 and #301; the original branch tip
remains preserved at archive/retired-branch/sdk-20260918/cave-hpke-bound-v1.
Those development merges do not change the frozen candidate or authorize
publication.
The first release does not ship until all of the following are true:
- the SDK fixture matches a named Cave producer commit;
- compatibility health and capability declarations are truthful;
- discovery, pairing, credential custody, and canonical reads work from packed artifacts;
- Coven IPC trust uses live connected-peer or pipe identity;
- Chat completes the journey through native custody and trust adapters;
- SDK and Chat are removed from conformance
notCovered; - the frozen native conformance matrix has one passing record each for
darwin-arm64,linux-x64, andwin32-x64, bound to the same accepted candidate and authenticated through the complete protected evidence chain; - the accepted aggregate and its reviewed index are committed and selected by
conformanceEvidence.aggregateRecordinrelease.config.json; - public API baselines and redacted diagnostics are complete;
- the security review authorizes the exact publication artifacts, annotated tag object, and protected environment policy, not merely the private conformance candidate;
- registry bytes and provenance match the reviewed release manifest;
- bootstrap credentials are revoked;
- ordinary future publishing uses protected OIDC with no token fallback.