Release 0.7.0 archive

Historical release snapshot. Deferred items below may have shipped since 0.7.0; see backend-capabilities.md for 0.33.0.

0.7.0 is the first release that treats both backend guarantees and evidence as public contracts. It deliberately ships a narrower capability matrix than the available OS primitives.

Compatibility

• public library ABI: 3;
• sandbox plan encoding: internal canonical v2 digest;
• mcp-runtime adapter: frozen launcher ABI 5 at adapter/MCP_RUNTIME_PIN;
• macOS: native Apple Silicon, macOS 15 or newer; no Intel/universal artifact;
• Linux: Bubblewrap tested on Ubuntu 24.04, amd64 and arm64 CI runners.

Bubblewrap provides NETWORK_IP_NONE, not strong NETWORK_NONE; Seatbelt provides the strong mode. Explicit DENY is part of the plan vocabulary but is fail-closed on all bundled 0.7 backends pending rename-safe enforcement.

Required release gates

• Clang and GCC make check;
• macOS 15 and 26 arm64 Seatbelt behavior;
• Ubuntu 24.04 amd64 and arm64 native Bubblewrap behavior;
• ASan+UBSan, TSan, static analyzer and fuzz smoke;
• privileged Docker Bubblewrap semantic coverage (not host-boundary evidence);
• mcp-runtime ABI 5 adapter test against the pinned commit;
• archive checksum and clean-tree tag.

Deferred intentionally

• external authenticated network channel;
• network proxy/TLS/credential policy;
• seccomp helper and syscall capability;
• complete descendant-tree lifecycle;
• OCI, Apple Container and Firecracker backends;
• signed or remote attestation receipts.