Version 0.1, October 2026. This page is the ledger. Nothing here is labelled production-ready: Arcotheon 0.1 is a working foundation, not a finished v1. "Verified" means automated tests or a recorded live check; interfaces and fakes are named as such.
See also the v1 release checklist for pass/fail evidence and the go/no-go recommendation.
Built and verified#
| Area | Evidence |
|---|---|
.adcap v1 spec and JSON Schema | spec/adcap-1.md, schema served at /arcotheon/schema/capability-1.json |
| Reproducible build; hash and signature verification; hostile-archive rejection | Tests: identical bytes across builds, tamper/add/remove/swap detection, traversal, symlinks, bombs |
| SDK and CLI lifecycle: init, validate, build, verify, inspect, publish, install, uninstall, update, rollback, pin, doctor, lock, cache, run, workflow, mcp | 160+ tests including a CLI end-to-end run as publisher then user (publish, update with a new permission, refusal without approval, approval, rollback, uninstall) |
| Resolver, compatibility, permission consent on install, update, dependency update and rollback | Tests |
Registry: signed catalogue, rollback protection, expiry, immutable entries, yank/revoke/deprecate, publisher key retire/revoke, publisher suspension, root key rotation and revocation, identity-gated trusted | Tests, including a full rotation and a forged-catalogue attempt |
| External signers (HSM/KMS style): signing without the process holding the key | Tests |
| Network allowlist enforced by a host-side filtering proxy; no direct network from the sandbox; private-address, IPv6 and DNS-rebinding protection | Tests: allowed port reachable, other port denied, direct IPv4/IPv6/private/metadata/DNS all fail even when the proxy variables are ignored |
| seccomp-BPF syscall filter (denylist by default; opt-in strict allowlist on x86_64; refuses unsupported architectures) | Tests: ptrace, unshare, mount, bpf, io_uring, perf, AF_PACKET/NETLINK, clone with CLONE_NEW* are denied; ordinary work passes. Run on x86_64 only; the aarch64 table is unrun |
| Memory, process, CPU, file-size, time limits (cgroup v2 scope when available, rlimit fallback) | Tests: allocation past the ceiling dies, a fork attempt stops at the ceiling, no stray processes or scratch directories after timeouts |
| No unrestricted fallback: tools refuse to run without an enforcing sandbox | Option removed from the SDK and CLI |
| Fuzz and property tests of archives, manifests, resolver and catalogues; crash recovery under SIGKILL | Tests (found and fixed: resolver self-dependency, catalogue parse errors, empty-lock hang) |
| Multipart, resumable uploads; end-to-end re-hash of stored objects | Tests against a local S3-compatible server: resume skips finished parts, changed files do not reuse parts |
| npm packaging of the SDK and CLI | scripts/pack-check.mjs packs both, installs the tarballs into an empty project, runs the CLI and imports the SDK (found and fixed a missing --version) |
| Automated review of registry changes and publisher registration with proof of key possession | Tests on real git repos, including a change that adds its own key and signs with it (judged against base keys) |
registry-review CI check; branch protection on main | Workflow run once successfully on a hosted runner; protection configured (admins can bypass) |
Exec isolation: only the interpreter and process:spawn-granted programs exist (Node, Python) | Tests |
| Secrets delivery, environment scrubbing, rlimits, per-run enforcement report | Tests |
| Cross-capability isolation (a tool cannot read other capabilities, the state file, or modify itself) | Tests |
| Resumable, verified, ranged resource downloads; mirror failover; cache verification | Tests, including resume after interruption and across processes, corruption, servers without Range |
| S3-compatible store (SigV4) and blob upload with verification | SigV4 matches AWS's published vector; tested against an independent local S3 server |
| Entitlement gateway reference: short-lived content-bound grants, revocation, ranged serving; client authoriser | Tests with in-memory fakes |
| Four example capabilities (six versions), GitHub releases for each | Installed and run from the live registry at agdc.dev through bubblewrap |
| Directory at agdc.dev/arcotheon | Deployed; see the deployment notes in the release report |
Partly verified#
- AgentDock Pro integration (draft PR #87, isolated branch): see that PR and
docs/arcotheon-integration.mdthere for what was run in Electron and what was not. Not merged. - macOS Seatbelt backend: profile generation is unit-tested as text only; it has never run on a Mac and is off by default.
- Windows: no native backend; WSL2 route documented.
- aarch64: seccomp table present, never executed.
- Hosted-runner behaviour of the sandbox tests: not run (CI runs only the registry review).
- Site: tested in headless Chrome (desktop, 390 px, reduced motion, no-JS, measured contrast) with software rendering; real-GPU performance and other browsers not measured.
- S3/R2 client: verified against a local S3-compatible server, not a real R2 bucket.
Not built, or blocked#
| Item | State |
|---|---|
| Cloudflare R2 | Blocked. The account answers "Please enable R2 through the Cloudflare Dashboard" (code 10042); enabling is an account/billing action. No bucket exists. Storage abstraction and S3/R2 client are ready. |
| Entitlement service | Not built and not deployed. Only the reference gateway and the client seam exist. The Worker adapter ships a deny-everyone provider. Sarja must supply the account-backed provider, R2, KV and the signing secret. |
| Production trust roots | Not created. Keys in use are development keys. The concrete ceremony, signer wrapper and rotation steps are in production signing; executing them is an owner action. |
| macOS / Windows native sandboxes | macOS: written, unvalidated, off by default. Windows: not built. Tools are refused on both; nothing runs unsandboxed. |
Reserved runtimes (wasm, mcp, http) | Refused with a clear error. |
| Real model-backed Visual Intelligence | Not done: no inference infrastructure is installed here (no ollama, ONNX or torch). The example stays labelled experimental with lexical hash vectors. |
| Publishing from a publisher's own CI with OIDC identities, static analysis of packages | Designed, not built. |
| npm publication of the SDK and CLI | Packaging verified; not published (needs an npm org and token; release.yml is ready and unrun). |
| Outside contributors opening publish PRs | Blocked while the repository is private. |
| Repository visibility | Private, as instructed. |
Operational notes#
- Release assets in the private repository are not publicly downloadable; installs use the agdc.dev mirror.
- The directory source lives in the agdc.dev website repository;
scripts/export-site.mjscopies the registry, datasets and these documents into it.