Release 0.1.0 archive

Historical release snapshot. It does not describe the current 0.33.0 capability matrix; see backend-capabilities.md.

First public API and ABI release of the policy-agnostic execution layer shared by MCP Runtime and Maelys Orchestrator.

Included

• sealed and canonicalized sandbox plans with fail-closed capability matching;
• backend ABI 1 with explicit ownership and bounded lifecycle contracts;
• POSIX backend for trusted, explicitly unconfined processes;
• Bubblewrap backend for Linux filesystem, network and descendant confinement;
• captured stdio, duplex stdio and kernel-isolated protocol fd 3;
• process-group supervision that does not confuse leader exit with containment;
• backend seam exercised by a synthetic Seatbelt-shaped implementation.

Validation performed

• macOS arm64: Apple Clang, static analyzer, ASan+UBSan, UBSan, TSan and the deterministic fuzz smoke harness under ASan+UBSan;
• Ubuntu 24.04 arm64 in Docker: Clang, GCC, ASan+UBSan, TSan and libFuzzer with 10,000 runs;
• privileged nested Bubblewrap semantic test: read-only denial, read-write persistence, explicit-environment masking and network namespace isolation.

The privileged nested test validates plan compilation and behavior. It is not evidence that Docker's host boundary is strengthened by nesting Bubblewrap.

Deliberate limits

No policy engine, Seatbelt implementation, seccomp, cgroups, domain allowlist, OCI backend, remote executor or attestation is included. See docs/security-model.md before treating any backend as a security boundary.