0.2.0-alpha.2 publication evidence

Release verified on 2026-09-26; npm registry publication verified on 2026-09-27. This application preview contains the SDK, shared provider/connection component and Linux desktop companion. Wire protocol remains 1.0. Alpha.1's published archives and tags remain unchanged.

Changes qualified by this release#

Application acceptance found a declaration mismatch between managedHost().management and serve() under TypeScript exactOptionalPropertyTypes. Alpha.2 fixes that composition, preserves synchronous management snapshots, and makes the installed-consumer check enforce strict optional-property declarations without skipping dependency checks.

readConnectionProfile is now a public backend export. It validates private profile metadata without loading a bearer credential or contacting the host. Expired metadata remains displayable; the execution client still rejects an expired connection. This removes the need for application-owned profile parsers.

The shared panel distinguishes an empty host with management access from a connection with no provider grants. Removing the final provider returns to first-provider onboarding, including from the Models tab and after reload. Read-only connections show access guidance without management actions.

Reviewed source and checks#

• Source: 02d2e3a6d7a9a9a4a893debc8e8a6d971d1dcaf5.
• SDK CI 36265757403: all nine jobs passed on prometheus-agenticdriver-01, runner 21. Checks cover three Linux runtime combinations, installed language clients, verified TLS, containers, documentation, offline native Codex/Claude contracts, the sandboxed packaged desktop and exact candidate installation. No hosted compute.
• Local SDK checks passed 339 tests; desktop checks passed seven. The exact downloaded desktop also passed the Fedora native smoke with renderer isolation, provider setup/removal and strict style CSP.
• A fresh npm installation from the public GitHub archive passed without npm authentication. Its installed identity, lockfile URL/integrity and public management/profile-reader exports matched the reviewed candidate.
• Fresh quickstarts passed for all four languages over verified HTTPS. Go and Rust used their published registries; JavaScript used the reviewed archive, and Python used both the reviewed wheel and source distribution.

Immutable release assets#

The public GitHub prerelease contains nine assets. Every uploaded asset's digest and size matched its local reviewed file before publication. The release tag and Go module tag point directly at the reviewed source. Anonymous release access and the npm archive download were verified independently.

The manifest and candidate checksums preserve the CI bundle's eight package files. The candidate zip preserves their directory layout, including the Go module files. ASSET-SHA256SUMS on the release covers flattened downloads and the desktop. Checksums are integrity records, not signatures.

The npm lockfile integrity is sha512-JSeVyraqRvcHbBVDfQzx9QnNuZ7xqi7dGSPuzBvbKvzsO4EUSOyF2rX5GhvsIRs5YpEAC0KNjBwgeUwUHxVa2Q==.

Publication status#

Rust publication 36266990626 compared repackaged contents with the reviewed crate before acquiring the short-lived crates.io identity, uploading and verifying the registry result. Go publication 36266992513 validated the exact successful CI candidate before creating its immutable module tag and installing through the public proxy and checksum database. Both used Prometheus. No personal PyPI publisher or hosted-runner fallback was introduced.

The npm publication receipt records the public registry URL, exact archive digest/integrity and distribution tags. The renewed member sign-in and npm publishing verification completed on 2026-09-27. The upload used the original reviewed CI archive, without rebuilding; its registry download is byte-identical to the GitHub archive. A fresh registry installation passed the JavaScript quickstart over verified HTTPS. Existing app pins to the public GitHub archive remain valid; switching to the exact registry version does not change SDK code or require a host restart.

Desktop and application adoption#

The installed desktop runtime is 0.2.0-alpha.2-e6ea0c26dc00, bundling Node v24.21.0. The user-local installer retained previous runtimes and updated the managed application-menu launcher. Existing desktop sessions, private state, shared application hosts and synthetic-validation services were not restarted.

LitAgent independently checked the final CI archive in a disposable copy of its actual app: typecheck/build passed, 276 tests passed with two optional skips, and native T3 browser checks verified both empty-host permission states and reload. This prepublication acceptance is separate from final app dependency adoption.

All three application owners received the verified public archive, exact source, CI and integrity receipt for final manifest/lockfile updates and their own Prometheus checks. Their branch commits and application acceptance are tracked separately; sending a handoff does not prove adoption.

Applications retain their auth stack, private credential storage, saved model choices and current grants. A new client does not upgrade a running host or expand a token's scope. Provider catalog availability, host permissions, app enablement and live qualification remain separate. No real model request was made for this publication. Usagestat remains the accounting dependency; there is no model, account or billing fallback and no default inference or inactivity deadline.

AD-042 remains open for the outstanding registry and application gates. Windows, macOS, Linux ARM, public relay hosting, signed installers and automatic updates are not qualified by this release.