0.2.0-alpha.1 publication evidence

Verified on 2026-09-26. This preview packages the SDK, shared provider/connection component and Linux desktop companion. Wire protocol remains 1.0. Package publication does not qualify every provider, account or discovered model.

Reviewed source and checks#

• Source: 19ed7d3a7a75601f708c061b66857913e976e6c4.
• SDK CI 36262465036: all nine jobs passed on prometheus-agenticdriver-01 (runner 21). This covers three Linux runtime combinations, installed language clients, verified TLS and containers, documentation, offline Codex and Claude contracts, the sandboxed packaged desktop and exact release-archive installation. No hosted compute.
• Local SDK checks passed 338 tests; desktop checks passed seven tests. The panel validation additionally records desktop and narrow-browser checks under strict style CSP, removal confirmation/cancellation, stale revisions and older/read-only host capability gates.
• Fresh installations passed the four language quickstarts over verified HTTPS. Go and Rust used their published registries; JavaScript used the reviewed npm archive pending npm sign-in, and Python used both the reviewed wheel and sdist. Installed JavaScript recipes for all three application types also passed.

Immutable release assets#

The public GitHub prerelease contains nine assets. Every uploaded asset's GitHub digest and size matched its local reviewed file before the draft was published. Both the release tag and the Go module tag point directly at the reviewed source; previous tags were not moved.

The manifest and candidate checksums preserve the CI bundle's eight package files. agenticdriver-0.2.0-alpha.1-candidate.zip preserves that full directory layout. The release's ASSET-SHA256SUMS covers flattened assets, including the desktop. Checksums are integrity records, not signatures.

The expected npm archive integrity is sha512-lkxbgsXHQ/xIL5jXrMBEBmrxKEojacxHsoHnhBuoLzXbdRZ3RlSvL77eh+sewfpGZwWzounKBMhmEBCImCgj/Q==.

Publication status#

Rust publication 36263769997 compared Cargo's repackaged contents with the reviewed crate before acquiring the short-lived crates.io identity, uploading and verifying the registry result. This is live evidence of the configured Rust trusted publisher on Prometheus.

Go publication 36263772376 created clients/go/v0.2.0-alpha.1 only after validating the exact successful CI candidate, then installed through the public module proxy and checksum database.

npm's existing member credential expired. Its upload was then held when LitAgent's application check found a TypeScript declaration mismatch: managedHost().management was incompatible with serve() under exactOptionalPropertyTypes. The runtime checks still pass. The follow-up alpha.2 fixes the SDK declaration and adds an installed-consumer regression check; alpha.1 archives/tags are unchanged. There is no replacement npm token on Prometheus and no hosted-runner fallback. PyPI remains under the selected organization; no personal publisher was used. The release page records subsequent channel status updates.

Desktop and application adoption#

The exact downloaded desktop archive passed the native smoke with renderer isolation, provider setup/removal and strict style CSP. Its bundled Node runtime is v24.21.0. The user-local installer retained previous runtimes and updated the managed application-menu launcher to 0.2.0-alpha.1-398245e30885. It did not restart the existing desktop or shared application/synthetic host services.

All three application owners received the public artifact, source, CI and integrity receipt. Brandstorm's integration checkout, LitAgent's existing stack and AI Workspace's application settings remain owned by their active threads. Their final npm dependency upgrades target the corrected alpha.2 and await its verified registry receipt; sending a handoff is not evidence of adoption. Brandstorm's isolated strict-CSP component and seven contract checks passed; LitAgent identified the strict declaration issue, and AI Workspace requested a public validated profile-metadata reader. Both SDK changes belong to alpha.2.

Applications retain their auth stack, private credential storage, saved model choices and current grants. The alpha client does not upgrade a running host. Old hosts remain usable for their advertised features; management/removal and provider sign-in controls must follow capability and permission checks. Existing LitAgent credentials are not silently expanded to grant management access.

No live model request was made for this publication. Usagestat remains the accounting dependency. Provider availability, execution permission, application enablement and live qualification remain separate. There is no account/model fallback or default inference/inactivity deadline.

AD-042 remains open for the outstanding registry and application gates. Windows, macOS, Linux ARM, public relay hosting, signed installers and automatic updates are not qualified by this release.