Evidence is from automated tests (npm test: 208 tests, also green on a hosted GitHub runner), recorded live checks, or named scripts. FAIL and BLOCKED are not hidden.
Recommendation: NO-GO for a public "v1", GO for a Linux-first controlled beta once three owner actions are done#
Arcotheon's core is sound and verified: packaging, signing, resolution, installation, rollback, sandboxed execution on Linux, the registry, the directory, and a working AgentDock integration. What blocks a v1 label is not code:
- No production trust root exists. The registry still trusts a development key held on one machine.
- Tools cannot run on Windows or macOS (no validated native sandbox), so a v1 for those users means "install and verify only".
- Entitled and Pro-only distribution has no server, and R2 is not enabled.
Everything else below passes or is a documented limitation.
Checklist#
| # | Criterion | Result | Evidence |
|---|---|---|---|
| 1 | .adcap format specified, schema published, existing packages still install | PASS | spec/adcap-1.md; a store written by the first deployed SDK (113a98f) installs from today's live registry and is then listed, doctored, updated, rolled back, run and uninstalled by the current SDK |
| 2 | Reproducible builds | PASS | identical archive bytes across builds (tests); two clean builds of the npm tarballs hash identically (scripts/pack-check.mjs) |
| 3 | Integrity and signature verification, hostile archives | PASS | tamper/add/remove/swap tests; fuzzing of the tar/gzip readers, signed-package mutation, manifest validator and catalogue parser (found and fixed a resolver self-dependency bug and non-deliberate errors on malformed catalogues) |
| 4 | Dependency resolution correct | PASS | property test: any returned solution satisfies every constraint, and "no solution" is returned only when brute force finds none |
| 5 | Install atomicity and crash recovery | PASS | 11 SIGKILLs at different points during real installs: the store stays consistent and a retry succeeds; leftovers, orphans, damaged state and stale/empty locks are repaired (found and fixed an empty-lock hang) |
| 6 | Permission consent on install, update, dependency update, rollback | PASS | tests; AgentDock approval dialogs exercised in Electron |
| 7 | Sandbox: filesystem, process, network, syscalls, limits (Linux) | PASS, with limits | 40+ adversarial tests: direct IPv4/IPv6/private/metadata/DNS blocked, rebinding refused, exec isolation, seccomp denylist, optional strict allowlist, cgroup and rlimit limits tested separately, cleanup after timeouts |
| 8 | Sandbox on Windows / macOS | FAIL (by design: refuses) | no Windows backend; macOS Seatbelt written but never run on a Mac, off by default. Nothing runs unsandboxed |
| 9 | Registry: signed catalogue, rollback and freeze protection, revocation, suspension | PASS | tests incl. forged and rolled-back catalogues |
| 10 | Root key rotation and recovery procedure | PASS (rehearsed), NOT EXECUTED | tests/rotation-rehearsal.test.ts runs the whole procedure with throwaway keys and an external signer on a copy of the real registry; no production key was created |
| 11 | Public access needs no GitHub credentials | PASS | install from a clean environment contacted only agdc.dev; the private GitHub release returns 404 anonymously |
| 12 | Release assets and hashes | PASS | scripts/verify-releases.mjs: all 6 versions: GitHub release asset, Git mirror and public mirror hash to the registry entry |
| 13 | npm packages publishable | PASS (not published) | tarballs contain only dist, schemas, readme, licence; no sources, maps or key material; installed into an empty project the CLI and SDK work |
| 14 | Publishing workflow and automated review | PASS | registry check-changes tests on real git repos (a change cannot vouch for its own key); registry-review workflow ran green on a hosted runner |
| 15 | Branch protection | PASS (admin bypass on) | PR + 1 review + registry-review check, no force-push or deletion; enforce_admins is off because there is one maintainer |
| 16 | CI on a hosted runner | PASS | 208/208 at the time of the run, including the bubblewrap/seccomp tests (2 runs, a few cents) |
| 17 | AgentDock integration | PASS, unmerged | PR #87 (draft): packaged Linux build with the bundled, checksum-verified Node; 30 packaged e2e checks and a hostile-capability probe; Pro gating tested through the registered IPC handlers (found and fixed a rollback-onto-Pro bypass) |
| 18 | AgentDock full suite | PASS | integration branch 0 failures in 300 files. The 34 failures seen earlier were an environment problem (vitest 5 / vite 7 / Electron 44 installed instead of the lockfile's 2.1.9 / 5.4.21 / 33.4.11), plus one stale fixture fixed on fix/test-baseline-failures. None came from Arcotheon |
| 19 | Packaging overhead | PASS | +120.7 MiB unpacked (120 MiB is the Node binary; the SDK is 516 KiB); startup difference about 50 ms, within noise; idle CPU about 1%; the host process is not running until Capabilities opens |
| 20 | Native Windows/macOS AgentDock builds | NOT VERIFIED | pinned Node checksums for all six platform builds match nodejs.org's SHASUMS256.txt; nothing was built or run there |
| 21 | Website: GPU, Chrome, Firefox, WebKit, fallbacks, accessibility | PASS, with limits | real RTX 3060 at 60 fps; Firefox 158, Playwright WebKit (not Safari); WebGL-off fallback, reduced motion, no-JS, measured contrast; 3 defects found and fixed |
| 22 | Real Safari / iOS, other GPUs | NOT VERIFIED | not available here |
| 23 | Storage ready for R2 | BLOCKED (account) | S3/R2 client with SigV4 (matches AWS vector), resumable multipart uploads tested against a local S3 server; R2 returns error 10042 |
| 24 | Entitlement service | BLOCKED (does not exist) | reference gateway and client seam only; deny-everyone adapter |
| 25 | Production signing keys | BLOCKED (owner) | procedure in production signing |
Owner-only actions, in order#
- Decide key custody and run the root ceremony (production signing): create the production root and a recovery root (hardware token or KMS), add them to
registry/root-keys.json, rotate, and release an SDK pinning them. Then re-vendor that SDK into AgentDock. Until then the registry's trust anchor is a development key. - Enable R2 (Cloudflare dashboard, needs billing information). Then create a bucket, a scoped API token, and
arcotheon storage pushthe first dataset. Nothing else in Arcotheon changes. - Build the entitlement provider against Sarja accounts, then deploy
services/entitlement-gatewaywith R2, a KV namespace and the grant signing key as a secret. - Publish to npm: create the
@arcotheonorganisation and a granular token as theNPM_TOKENsecret, then dispatchrelease.yml(it runs the tests andpack-checkfirst and publishes with provenance). - Merge decisions: website PR #9 (supersedes #7 and #8), AgentDock PR #87 and
fix/test-baseline-failures. None were merged. Make the repository public when you want outside publishers. - Windows/macOS: either accept "install and verify only" for v1, or fund a native Windows helper and validate the Seatbelt backend on a real Mac.
Known security limitations (unchanged by this sprint)#
Denylist seccomp by default (the strict allowlist is opt-in, x86_64, and may break unusual tools); a kernel or bubblewrap vulnerability could still allow escape; net:connect filters by host and port, not content; no GPU for tools; memory limits fall back to a 1 GiB RLIMIT_DATA floor where cgroup v2 delegation is unavailable.