Added

• Added an opt-in, bearer-authenticated loopback MCP Streamable HTTP endpoint using RMCP 3.2.0. It shares the stdio broker's principal, tool invocation, and consent handling, supports MCP 2026 stateless requests and tool-change subscriptions, and retains older-client session compatibility. Listener and token settings honor the selected workspace layout, including branded layouts.

Install

From source (requires Rust 1.95+):

cargo install astrid

Linux pre-built archive:

tar xzf astrid-*-$(uname -m)-unknown-linux-*.tar.gz
sudo install -m 0755 astrid-*/astrid astrid-*/astrid-daemon \
  astrid-*/astrid-build astrid-*/astrid-emit \
  astrid-*/astrid-storage-provider-fuse /usr/local/bin/

macOS pre-built archive and signed AstridFS app:

ARCH=$(uname -m); [[ "$ARCH" == arm64 ]] && ARCH=aarch64
tar xzf astrid-*-${ARCH}-apple-darwin.tar.gz
sudo install -m 0755 astrid-*/astrid astrid-*/astrid-daemon \
  astrid-*/astrid-build astrid-*/astrid-emit /usr/local/bin/
astrid-*/macos/manage-macos-fskit.sh install
astrid-*/macos/manage-macos-fskit.sh enable

Astrid Runtime does not bundle a product distro. To compose it with a
distro you trust, run:

astrid init --distro <name, @org/repo, path, or .shuttle>

With many thanks from the following Astrinauts 🚀

• Joshua J. Bouw

Fixed

• Preserve installed capsule content across idle shutdown, explicit stop, and
  restart. All graceful shutdown paths finalize the same durable projection;
  capsule files held only in the volume are no longer mistaken for deletions.

• Keep initialization connected through installation batches and final grants,
  preventing idle retirement from interrupting first boot. Provisioning traffic
  no longer fills the connection's unread broadcast queue.

• Honor explicit init --grant-capsules for the complete verified distro after
  a resumed install, including earlier batches. Plain resume does not grant
  access implicitly.

• Leave unset optional distro credentials absent during initialization instead of
  attempting to store invalid empty secrets. Reinitialization preserves existing
  credentials; nonempty secrets still use the daemon's typed secret API.

• Allow a daemon that retired its generation markers during clean shutdown to
  finish exiting before reporting an identity error. Process identity and
  singleton-lock checks remain enforced.

• Deliver capsule-supplied stdin to synchronous native subprocesses, close the
  pipe after delivery, and drain output concurrently. Native request/response
  adapters now receive their requests without full-pipe deadlocks.

• Correct filesystem identification in the macOS legacy-upgrade mount test.

Install

From source (requires Rust 1.95+):

cargo install astrid

Linux pre-built archive:

tar xzf astrid-*-$(uname -m)-unknown-linux-*.tar.gz
sudo install -m 0755 astrid-*/astrid astrid-*/astrid-daemon \
  astrid-*/astrid-build astrid-*/astrid-emit \
  astrid-*/astrid-storage-provider-fuse /usr/local/bin/

macOS pre-built archive and signed AstridFS app:

ARCH=$(uname -m); [[ "$ARCH" == arm64 ]] && ARCH=aarch64
tar xzf astrid-*-${ARCH}-apple-darwin.tar.gz
sudo install -m 0755 astrid-*/astrid astrid-*/astrid-daemon \
  astrid-*/astrid-build astrid-*/astrid-emit /usr/local/bin/
astrid-*/macos/manage-macos-fskit.sh install
astrid-*/macos/manage-macos-fskit.sh enable

Astrid Runtime does not bundle a product distro. To compose it with a
distro you trust, run:

astrid init --distro <name, @org/repo, path, or .shuttle>

With many thanks from the following Astrinauts 🚀

• Joshua J. Bouw

Added

• Content-addressed durable storage with principal-owned KV and file trees,
  content-defined chunking, deduplication, atomic root publication, and journal
  recovery. Bounded range writes avoid whole-file buffers.
• Governed FSKit mounts on macOS and FUSE mounts on Linux, with principal views
  and a writable administrative runtime view. Volume branding is configurable;
  usage describes the hosted volume rather than the backing disk's other data.
• Native Linux musl archive targets for x86_64 and ARM64 alongside GNU Linux
  and macOS. GNU compatibility builds support glibc 2.34 enterprise hosts.
• Signed Distro manifests with relative capsule archives, selected inventory
  verification, and caller-scoped resumable installation and grants.
• Restricted throwaway agent sessions, stable principal identities, and full
  principal-state reclamation on deletion.
• Capability-controlled loopback TCP listeners and concurrent capsule workers.
• Pre-mount client configuration for run and administrative timeouts.
  ASTRID_ADMIN_TIMEOUT_SECS supplies the administrative fallback; explicit
  client configuration takes precedence.
• Bounded conditional KV batches published through one durable root transition,
  with journal recovery and opt-in governed read caching.
• Durable human and fleet ownership identities, independent of principal names.
• Foreground daemon logging to stderr through ASTRID_DAEMON_LOG_TARGET=stderr.

Changed

• Stopped runtime state is consolidated into astrid.volume. Startup restores
  its working projection and clean shutdown retires it. Migration preserves
  existing durable state and supports subsequent restarts.
• Capsule activation uses verified durable package identities; matching
  completed installations resume without repeating daemon install requests.
• Principal runtimes isolate guest memory, run tasks, subscriptions, processes,
  and lifecycle generations while sharing compiled code where appropriate.
• MCP supports protocol 2026-07-28 and shared, session-scoped gateway
  attachments. Quiet connected sessions remain attached; automatic gateway
  and daemon lifetime follows their connections. Run-loop capsule tools
  participate in discovery. RMCP is updated from 2.2.0 to 3.1.4.
• Capsule archives are reproducible for identical inputs; capsule builds honor
  Cargo's resolved target configuration.
• Durable writes and journal recovery reuse verified immutable map subtrees
  without weakening missing-descendant detection or crash recovery.
• Mounted appends reuse verified prefix chunks, extent mutations scan only
  affected ranges, and unchanged volumes avoid redundant device flushes.
  Canonical content identity, quota checks, atomic publication, and failed-flush
  retries are preserved; the volume format is unchanged.
• The Astrid workspace and versioned runtime crates advance from 0.10.4 to
  2026.9.0 using the documented calendar version convention.
• Wasmtime advances from 46.0.1 to 48.0.1; older compiled caches are rebuilt.
  Direct WASM tooling advances from the 0.253 family to 0.257.1, Syn from 2 to
  3, TOML from 0.9 to 1.1, and Base64 from 0.22 to 0.23.
• Tokio advances from 1.52.3 to 1.53.1, UUID from 1.23.4 to 1.25.0, and
  SurrealKV from 0.21.2 to 0.21.3. The complete dependency inventory
  itemizes all lockfile version changes, additions, and removals since 0.10.4.
• See the upgrade notes and limitations
  before migrating from 0.10.4.

Removed

• The unused SurrealDB wrapper. Provider execution belongs to capsules,
  not host-level LLM configuration.

Fixed

• Release publication supports supervised, exact-archive macOS certification
  through protected operator approval when a dedicated FSKit runner is absent.
• Authoritative stop waits for the daemon and MCP gateway to exit and clears
  coordination state. Failed MCP launches clean up children; ephemeral daemons
  shut down after their final client disconnects. Cancelling the host that
  started a shared gateway no longer disconnects its other attached hosts.
  Explicit astrid start remains persistent; automatic host startup uses
  connection-owned lifetime and retires the stopped projection.
• Principal-specific discovery, configuration, secrets, and lifecycle hooks no
  longer fall back to another principal's state.
• Restart budgets survive runtime replacement, lazy WASM pools handle epoch
  changes, and retirement waits for outstanding work.
• macOS discovery, sandbox callback transport, Finder directory handling,
  volume metadata, and administrative configuration write-through.
• Linux FUSE reports the configured volume name, backing-volume capacity,
  and root timestamps instead of placeholder filesystem statistics.
• Mounted files can exceed the 4 MiB callback payload limit without buffering
  the complete file.
• Component-level capsule capabilities are merged completely during discovery,
  rather than silently dropping network, identity, or persistence declarations.

Security

• Host-process injection limits, approved-executable identity, shared
  environment authorization, uplink key-method enforcement, WASM resource
  limits, and durable device revocation.
• Capsule provenance and Distro checks preserve signed identities; generic
  first-use trust remains distinct from product-pinned trust.

Install

From source (requires Rust 1.95+):

cargo install astrid

Linux pre-built archive:

tar xzf astrid-*-$(uname -m)-unknown-linux-*.tar.gz
sudo install -m 0755 astrid-*/astrid astrid-*/astrid-daemon \
  astrid-*/astrid-build astrid-*/astrid-emit \
  astrid-*/astrid-storage-provider-fuse /usr/local/bin/

macOS pre-built archive and signed AstridFS app:

ARCH=$(uname -m); [[ "$ARCH" == arm64 ]] && ARCH=aarch64
tar xzf astrid-*-${ARCH}-apple-darwin.tar.gz
sudo install -m 0755 astrid-*/astrid astrid-*/astrid-daemon \
  astrid-*/astrid-build astrid-*/astrid-emit /usr/local/bin/
astrid-*/macos/manage-macos-fskit.sh install
astrid-*/macos/manage-macos-fskit.sh enable

Astrid Runtime does not bundle a product distro. To compose it with a
distro you trust, run:

astrid init --distro <name, @org/repo, path, or .shuttle>

With many thanks from the following Astrinauts 🚀

• Copilot
• Jamie Steiner
• Joshua J. Bouw
• cursor[bot]
• dependabot[bot]

Removed

• Capsule manifests no longer embed the agent-specific [[skill]]
  protocol. Skills remain a user-space concern that agent runtimes can
  discover over IPC or advertise through product registries without teaching
  the Astrid kernel or generic capsule archive about an AI workflow format.
  Builders still preserve files under assets/ and legacy skills/ as opaque,
  symlink-free capsule data without generating manifest metadata.

Fixed

• astrid capsule check no longer treats embedded Rust examples as live
  tools. The scanner now parses Rust attributes instead of matching source
  text, so scaffold templates and documentation strings cannot create phantom
  unrouted-tool failures.
• Interrupted immutable-release drafts recover without replacing uploaded
  assets. Release uploads are sequential, and reruns authenticate every
  existing payload and signature before adding only the missing files. Closes
  #1285.

Install

From source (requires Rust 1.95+):

cargo install astrid

Pre-built binaries:
Download the archive for your platform, extract, and add to PATH:

tar xzf astrid-*-$(uname -m)-*.tar.gz
sudo mv astrid-*/astrid astrid-*/astrid-daemon astrid-*/astrid-build astrid-*/astrid-emit /usr/local/bin/

Astrid Runtime does not bundle a product distro. To compose it with a
distro you trust, run:

astrid init --distro <name, @org/repo, path, or .shuttle>

With many thanks from the following Astrinauts 🚀

• Joshua J. Bouw

Fixed

• astrid mcp serve now waits for the authenticated principal's broker to
  answer before exposing MCP stdio. Non-default capsule views intentionally
  warm after global daemon readiness; an immediate client tools/list could
  previously publish before the broker subscribed, lose the non-durable bus
  request, and hang for the full 55-second reply deadline. Startup now proves
  the generic broker path with an idempotent tools/list probe and reissues it
  when the principal's capsules_loaded signal arrives, without hardcoding a
  product capsule name.

Install

From source (requires Rust 1.95+):

cargo install astrid

Pre-built binaries:
Download the archive for your platform, extract, and add to PATH:

tar xzf astrid-*-$(uname -m)-*.tar.gz
sudo mv astrid-*/astrid astrid-*/astrid-daemon astrid-*/astrid-build astrid-*/astrid-emit /usr/local/bin/

Astrid Runtime does not bundle a product distro. To compose it with a
distro you trust, run:

astrid init --distro <name, @org/repo, path, or .shuttle>

With many thanks from the following Astrinauts 🚀

• Joshua J. Bouw

Fixed

• Runtime service discovery is product-neutral. CLI and unique compatible
  model/session interfaces authenticate live source IDs. Closes #1267.

Install

From source (requires Rust 1.95+):

cargo install astrid

Pre-built binaries:
Download the archive for your platform, extract, and add to PATH:

tar xzf astrid-*-$(uname -m)-*.tar.gz
sudo mv astrid-*/astrid astrid-*/astrid-daemon astrid-*/astrid-build astrid-*/astrid-emit /usr/local/bin/

Astrid Runtime does not bundle a product distro. To compose it with a
distro you trust, run:

astrid init --distro <name, @org/repo, path, or .shuttle>

With many thanks from the following Astrinauts 🚀

• Joshua J. Bouw

Added

• Native process requests now honor their declared environment and working
  directory. Every spawn tier starts from a small host environment allowlist,
  applies validated guest variables, rejects session-token injection, confines
  relative working directories to the capsule workspace, and can resolve
  HOME=home://... or a home://... working directory after host-side policy
  checks. The native child receives the resolved path, but the process host API
  does not return it directly. Principal-home reads require an
  explicit read capability; the OS sandbox makes writable only the capsule's
  declared home:// write roots for that principal. Recv-driven capsules now install the same
  per-principal home/tmp overlays as interceptor invocations.

• Capsule installation has an explicit non-interactive configuration path.
  astrid capsule install --yes resolves lifecycle fields from repeatable
  --var KEY=VALUE inputs, ASTRID_VAR_<KEY> environment variables, or
  manifest defaults, and fails instead of silently choosing an enum value or
  empty secret when a required value is absent. Secret automation can use the
  environment form so credentials do not appear in process arguments.

• Signed runtime release channels and immutable manifests. Every release records the exact
  runtime and WIT source commits, release-workflow identity, and all four platform archives with
  their sizes, BLAKE3 digests, SHA-256 compatibility digests, and Sigstore bundle
  names. Protected manual promotion advances signed, expiring stable, dev,
  or nightly pointers only to those immutable releases. astrid update
  authenticates the pointer, manifest, and archive; rejects generation rollback,
  same-generation equivocation, expiry, digest drift, and workflow-identity
  drift; and follows deliberate higher-generation rollbacks for self-managed
  installations. An opt-in daily nightly train reuses the same tag-bound signer,
  remains disabled by default, and still requires protected release and channel
  approvals. A merge to main never publishes a release or moves a pointer.

• Operators can enforce a distro for astrid init.
  ASTRID_ENFORCED_DISTRO supplies the distro source and rejects CLI attempts
  to override it. Standalone astrid init requires an explicit --distro;
  Astrid Runtime never chooses a product distro. Closes #1253.

• Passive content-addressed capability-registry primitives. Astrid now has
  exact capability IDs, typed content-bound references, immutable registered
  definitions, deterministic BLAKE3 semantic digests and canonical registry
  manifests. Existing profile persistence, wildcard evaluation, bootstrap,
  socket and wire behavior remain unchanged. Closes #1233. Refs #1228.

• Distro init can grant exactly installed capsules to an explicit target.
  astrid --principal <operator> init --target-principal <target> --grant-capsules ensures the runtime daemon, verifies the operator has
  agent:modify authority over an existing target before provisioning, and
  applies the installed set through the shared admin.agent.modify path.
  Distro capsules require a concrete released version or tag; identity and
  declared version are checked before install mutation, and locks record the
  version and WASM hash that actually landed. Fresh-lock reuse rehashes the
  installed content blob before names become grants. Concurrent provisioning
  of one target is rejected, and recovery commands preserve the operator
  identity. The target defaults to the process principal when omitted; no
  principal name receives special treatment.
  Signed .shuttle grant composition remains deferred and fails explicitly.
  Closes #1195.

• Capability-registry revision 1 now has fixed semantics and BLAKE3 digest
  vectors. All 51 kernel entries bind scope, target kinds, delegability,
  privileged status and provenance. Kernel/admin request mappings and the
  current capsule-side secondary enforcement constants resolve through the
  registry in tests, while the complete role partition is frozen independently.
  Authorization and persisted state remain unchanged. Closes #1235. Refs #1228
  and #1233.

Changed

• Device key IDs now use BLAKE3. The short per-device handle is derived from
  the first eight bytes of BLAKE3(pubkey_hex_bytes). Profile loading already
  treats the stored key_id as informational and re-derives it from the public
  key, so existing local profiles self-heal; device-scoped bearer sessions must
  authenticate again after upgrading.

• Self-managed updates now authenticate the release publisher before any
  archive is extracted or installed. The updater requires a Sigstore bundle
  for the exact archive bytes, verifies it with fresh public-good trust
  material, and pins the certificate to Astrid's release workflow, repository,
  tag, and GitHub Actions issuer. Only an authenticated archive can enter the
  independent BLAKE3 integrity stage; missing, duplicated, malformed, or
  mismatched evidence fails closed with a distinct publisher-authentication or
  integrity error. Homebrew and Cargo installs remain delegated to their
  package managers, and the signed SHA-256 compatibility manifest remains
  available to downstream tooling. Before publishing, release automation now
  requires both Cosign and the updater's native production verifier to accept
  every generated archive and bundle pair. Existing v0.9.x self-updaters cannot
  enforce the new publisher policy retroactively; it applies from the first
  release containing this updater onward. Closes #1250.

• Astrid-owned identifiers now use domain-separated BLAKE3. Invite and
  pair-device token stores carry an explicit schema and invalidate
  legacy SHA-256 records that cannot be rehashed without their raw secrets;
  newly issued bearer tokens use type-specific astrid_inv_ and
  astrid_pair_ prefixes, while fingerprints use an explicit blake3: label.
  CLI key metadata self-heals from the retained public key. Public-key
  fingerprints share a typed derivation primitive, MCP binary pins now carry
  an honest blake3: label, and gateway env-write logs no longer expose
  dictionary-testable fingerprints of low-entropy values. External SHA-based
  protocols such as SRI, Git, and registry checksums remain unchanged. Closes
  #1247.

• Astrid release archives now use BLAKE3 as their primary integrity
  manifest. Release automation publishes, signs, and attests
  BLAKE3SUMS.txt, while retaining a signed SHA256SUMS.txt compatibility
  manifest for Homebrew and existing downstream tooling. Self-managed updates
  require a strict lowercase BLAKE3 entry and reject absent, malformed,
  duplicate, or SHA-only manifests. Existing v0.9.x installations can still
  cross the boundary through the compatibility manifest. External protocol
  requirements remain unchanged. Closes #1249.

• Project runtime state now uses one validated workspace layout. The CLI
  and daemon default to .astrid, while distributions can select another safe
  relative directory name through --workspace-state-dir or
  ASTRID_WORKSPACE_STATE_DIR. Config, capsule installation and discovery,
  kernel boot, gateway source checks, hooks, and WIT garbage collection share
  the selected layout and reject persistent symlink/reparse redirection anywhere
  in workspace capsule and hook trees before reading them. They never scan both
  project roots. CLI uplinks, including long-lived MCP reconnects, and
  project-sensitive management reads reject a
  daemon booted for a different project or layout; daemon stop remains
  available as a recovery operation.

• Runtime E2E now stages the pinned Unicity AOS monorepo. The workflow
  preserves the AOS Cargo workspace outside the core checkout and supplies
  compatibility directory aliases for the existing runtime harness, replacing
  seven historical per-capsule repository checkouts. Closes #1220.

• Astrid Runtime no longer silently selects a product distro. Standalone
  astrid init and astrid distro apply now require an explicit distro, first-run
  bootstrap only creates runtime state, self-update refreshes only an already locked
  distro, and agent creation no longer carries a product-distro default. Closes #1214.

• Removed residual product distro policy from Astrid Runtime. Standalone
  distro installation now requires an explicit @owner/repo, URL, local
  manifest, or signed .shuttle input; it no longer manufactures a source URL
  from a bare distro name. Background update does not reconstruct a source from
  a lockfile identifier, and runtime guidance, examples, and mutable repository
  links use neutral/current values while published WIT and package identities
  remain unchanged. Closes #1216.

• Daemon status and shutdown now use one typed runtime-control path.
  astrid status propagates daemon connection and response failures instead of
  reporting success, and astrid stop sends its shutdown request through the
  authenticated, correlated uplink client. Closes #1210.

• CLI runtime-control requests now use the shared typed uplink client.
  astrid status, ps, who, and doctor no longer rebuild socket frames or
  parse response envelopes themselves; they use astrid-uplink for the same
  authenticated, principal-bound astrid.v1 control contract that external
  uplinks will consume. Closes #1208.

• Removed the product-branded README image. Astrid's repository front door
  now presents the runtime without Unicity artwork. Closes #1204.

• Astrid's mutable repository identity now points to astrid-runtime. Current
  documentation links, release automation, the WIT submodule origin, and the
  self-update default use the Astrid Runtime organization, while published crate,
  WIT, tag, artifact, and binary identifiers remain compatible. Closes #1202.

• Astrid's MCP bridge now uses RMCP 2.2. The client and ser...

Signed mutable channel pointer; immutable generations are retained as assets.

Signed mutable channel pointer; immutable generations are retained as assets.

Signed mutable channel pointer; immutable generations are retained as assets.