diff --git a/CHANGELOG.md b/CHANGELOG.md index 07839d5..d5eaeb1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,21 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The 0.20.0 beta line follows the frozen operator contract; earlier alpha releases remain historical snapshots. Beta does not mean error-free operation. +## [0.20.0-rc.1] — 2026-10-28 + +### Release qualification + +- First candidate for stable 0.20.0, retaining the Beta.9 runtime and frozen operator + contract. This is a prerelease; stable requires a separate operating observation + window and final-artifact qualification. +- Release gates now require an explicit, different upgrade predecessor, verify all + four dependency locks and test the qualification tooling on Linux and macOS. +- Documents exact-artifact installation, signed upgrade/rollback, package delivery + and seven consecutive calendar days of RC observation before stable promotion. +- Give the large-skill test fixture explicit owner-only permissions so installation + proofs also pass under a group-writable umask. The runtime still refuses insecure + skill files. + ## [0.20.0-beta.9] — 2026-10-28 ### Fixed diff --git a/README.md b/README.md index f3e1516..be026a0 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ Tools Default identities Python - Latest release, including beta + Latest release, including prereleases MIT

@@ -45,8 +45,8 @@ tools — but only after a deterministic permission kernel has ruled on the acti Choose **Allow once**, **Allow this task**, or an exact-action standing approval; you do not have to approve every step individually. Sandboxed shell execution and an append-only audit trail keep actions bounded and reviewable. Talos is MIT-licensed; -model-provider and hosting costs depend on your setup. It is now **beta**: the -[operator contract](docs/beta-contract.md) is frozen; beta is not a claim of error-free +model-provider and hosting costs depend on your setup. It is now a **release candidate**: the +[operator contract](docs/beta-contract.md) is frozen; RC is not a claim of error-free operation or a substitute for reviewing permissions and keeping backups. [Install Talos](#install) · [Run local models with Ollama](https://talos-agent.ch/docs/#model) · @@ -84,7 +84,7 @@ Beta.8 also pins pip 26.2.2 with hashes, including the temporary verifier, and i - **Inspect the evidence:** review tool outcomes and the audit trail; do not mistake a confident answer for a successful action. Start with the [model, cost and permission FAQ](https://talos-agent.ch/faq/). -Talos is not Talos Linux or Cisco Talos. It is a self-hosted AI agent, and it remains beta. +Talos is not Talos Linux or Cisco Talos. It is a self-hosted AI agent, and it remains a prerelease. If this approach is useful, **star the repository to bookmark it**, try a small task and [report a reproducible result](https://github.com/talos-kernel/Talos/issues). Want to improve it? [Fork Talos](https://github.com/talos-kernel/Talos/fork) and read @@ -381,7 +381,7 @@ come from `stdin` instead of `getUpdates`. ``` $ talos chat - ◉ Talos / 0.20.0-beta.9 + ◉ Talos / 0.20.0-rc.1 Your terminal. Your rules. ────────────────────────────────────────────────────────────────────────── model claude-cli/claude-opus-4-1 @@ -937,8 +937,7 @@ artifact checks and the seven-day operating observation. The frozen [beta contract](docs/beta-contract.md), [recovery runbook](docs/recovery.md) and local `python scripts/beta-gate.py --previous ` make these checks repeatable. The [RC and stable qualification plan](docs/stable-readiness.md) tracks the next -transition from beta through `0.20.0-rc.1` to `0.20.0`; these versions are not yet -published. The path to 1.0 +transition from beta through `0.20.0-rc.1` to `0.20.0`; stable remains subject to the RC observation and final-artifact gates. The path to 1.0 requires evidence from the beta line and a verified upgrade from a previous beta; it is not a calendar promise. diff --git a/docs/stable-readiness.md b/docs/stable-readiness.md index e4c494b..7222ac1 100644 --- a/docs/stable-readiness.md +++ b/docs/stable-readiness.md @@ -1,8 +1,8 @@ # From beta to a stable 0.20.0 -The next proposed release is `0.20.0-rc.1`, followed by `0.20.0` only after the -evidence below passes. This is a qualification plan, not an announcement that -either version has shipped. The published baseline is `0.20.0-beta.9`. +This tree identifies `0.20.0-rc.1`, followed by `0.20.0` only after the evidence +below passes. Publication is established by the signed release assets, not this +source label. The upgrade baseline is `0.20.0-beta.9`. The historical `0.20.0-alpha.rc.*` artifacts qualified the earlier transition **into beta**. They are not candidates for this transition out of beta. `1.0.0` @@ -47,7 +47,7 @@ Start with the current published baseline in a prepared, hash-locked development environment: ```sh -python scripts/beta-gate.py --previous 0.20.0-beta.8 --current 0.20.0-beta.9 +python scripts/beta-gate.py --previous 0.20.0-beta.9 --current 0.20.0-rc.1 python -m pytest macos/Tests -q python e2e.py ``` @@ -90,5 +90,5 @@ installation or restart its service. | Artifact | State | Evidence boundary | |---|---|---| | `0.20.0-beta.9` | Published baseline | [Core main CI](https://github.com/talos-kernel/Talos/actions/runs/40661310306), [Homebrew](https://github.com/talos-kernel/homebrew-tap/actions/runs/40661911664), [Pinokio](https://github.com/talos-kernel/talos-pinokio/actions/runs/40663657826). These qualify beta.9 only. | -| `0.20.0-rc.1` | Preparation started; not published | Needs its own commit, signed artifact, complete platform/install/recovery evidence and operator rollout. | +| `0.20.0-rc.1` | Candidate source | Requires matching signed assets and platform/install/recovery evidence; deployed RC observations start only after rollout. | | `0.20.0` | Not qualified | Needs the RC observation window and final-artifact gates above. | diff --git a/site/console.html b/site/console.html index 9f24234..a3906c2 100644 --- a/site/console.html +++ b/site/console.html @@ -284,7 +284,7 @@ .lg .k.c-deny{color:var(--deny)} .lg .k.c-allow{color:var(--allow)} -/* ── this beta release, measured ── */ +/* ── this release candidate, measured ── */ .stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:1px;background:var(--line);border:1px solid var(--line);margin-top:44px} .stat{background:var(--bg);padding:28px 26px} .stat .n{font-family:var(--crt);font-size:clamp(30px,3.4vw,44px);color:var(--hot);line-height:1.05; @@ -365,7 +365,7 @@
-

talos 0.20.0-beta.9 · operator console · MIT

+

talos 0.20.0-rc.1 · operator console · MIT

recorded · unfurled · no live wire

Witness one deed from door to ledger.

This hall unfurls one true session, recorded on the working machine @@ -553,12 +553,12 @@

Numbers this candidate must ship.

embedded below. Either way the digits come from a count, not from memory.

-
0.20.0-beta.9
beta release
public installer v0.20.0-beta.9
+
0.20.0-rc.1
release candidate
public installer v0.20.0-rc.1
3456
automated tests, collected by pytest
277
adversarial cases, all behaving
996
lines in policy.py, readable in one sitting
37
tools, every one through the gate
-
v0.20.0-beta.9
release tag
+
v0.20.0-rc.1
release tag
@@ -724,7 +724,7 @@

Numbers this candidate must ship.

replayBtn.addEventListener('click', play); })(); -/* ─── this beta release, measured: ./status.json with an embedded fallback ─── */ +/* ─── this release candidate, measured: ./status.json with an embedded fallback ─── */ (() => { const src = document.getElementById('statusSrc'); const FIELDS = ['version', 'installer_version', 'tests', 'redteam_faelle', 'kernel_zeilen', 'werkzeuge', 'release_ref']; diff --git a/site/docs/index.html b/site/docs/index.html index 0f75a04..02aef49 100644 --- a/site/docs/index.html +++ b/site/docs/index.html @@ -407,7 +407,7 @@

Section 04Run it

Section 05The terminal session

$ talos chat
-Talos 0.20.0-beta.9  ·  anthropic-api/claude-opus-4-8  ·  autonomy 3
+Talos 0.20.0-rc.1  ·  anthropic-api/claude-opus-4-8  ·  autonomy 3
 speaking as cli:1000  ·  approvals possible  ·  you are at a terminal
 /help for commands, `exit` to leave
 
diff --git a/site/index.html b/site/index.html
index 73235ae..cad9d55 100644
--- a/site/index.html
+++ b/site/index.html
@@ -638,7 +638,7 @@ 

The bounds are named.

Measured, with the path stated

None of this asks for belief. The installer runs the unit and adversarial suites in front of you; the real-model cases are a separate opt-in E2E run.

-

Beta.6 source and signed release. Counts describe the source test suite, not speed or real-world success rates; signed release contents follow their tag.

+

Release-candidate source and signed release. Counts describe the source test suite, not speed or real-world success rates; signed release contents follow their tag.

0
automated tests collected from the source tree
0
adversarial cases trying to pass the kernel
0
opt-in end-to-end cases against a real model
@@ -764,7 +764,7 @@

Talos AI agent: your questions

raise the keep

The command remains yours

-

Beta release 0.20.0-beta.9. Tested on Python 3.11 · 3.13, Linux and macOS, including Raspberry Pi. +

Release candidate 0.20.0-rc.1. Tested on Python 3.11 · 3.13, Linux and macOS, including Raspberry Pi. Bring your own model: a supported CLI, configured API provider or local Ollama. The installer runs the unit and adversarial suites in front of you, then starts nothing.

@@ -788,7 +788,7 @@

The command remains yours

Read the launcher guide

Another path to your keep, on macOS or Linux. - The separate launcher installs the signed Beta release it currently pins; its release cadence is independent + The separate launcher installs the signed release it currently pins; its release cadence is independent from this website's default download. Bring your own model access; existing Talos installations remain untouched. For API keys, follow the guide's system-terminal setup, outside Pinokio.

diff --git a/site/install.sh b/site/install.sh index 873eaaa..2f43eb9 100755 --- a/site/install.sh +++ b/site/install.sh @@ -15,7 +15,7 @@ set -euo pipefail -VERSION="0.20.0-beta.9" +VERSION="0.20.0-rc.1" BASE="${TALOS_BASE:-https://talos-agent.ch}" TARBALL="${BASE}/dist/talos-${VERSION}.tar.gz" PREFIX="${TALOS_PREFIX:-$HOME/talos}" diff --git a/site/status.json b/site/status.json index 0db251c..83985f8 100644 --- a/site/status.json +++ b/site/status.json @@ -1,11 +1,11 @@ { - "version": "0.20.0-beta.9", + "version": "0.20.0-rc.1", "release_state": "released", "source_state": "release", - "installer_version": "0.20.0-beta.9", + "installer_version": "0.20.0-rc.1", "tests": 3456, "redteam_faelle": 277, "kernel_zeilen": 996, "werkzeuge": 37, - "release_ref": "v0.20.0-beta.9" + "release_ref": "v0.20.0-rc.1" } diff --git a/talos/__init__.py b/talos/__init__.py index a37106a..58917ae 100644 --- a/talos/__init__.py +++ b/talos/__init__.py @@ -8,4 +8,4 @@ advertised and a released package is never left behind. """ -__version__ = "0.20.0-beta.9" +__version__ = "0.20.0-rc.1" diff --git a/tests/test_skillmanage.py b/tests/test_skillmanage.py index 4fe5f5e..18297a9 100644 --- a/tests/test_skillmanage.py +++ b/tests/test_skillmanage.py @@ -180,6 +180,7 @@ def test_view_lists_bounded_entries_and_truncates_large_content(root: Path, view big = "---\nname: big\ndescription: Big.\n---\n\n" + "x" * 30_000 + "\n" (root / "big").mkdir(mode=0o700) (root / "big" / "SKILL.md").write_text(big) + (root / "big" / "SKILL.md").chmod(0o600) shown = view(name="big") assert shown["truncated"] is True and len(shown["content"]) == sm.MAX_VIEW_CHARS assert shown["expected_sha256"] == _sha(big)