morningstarnasser · Oct 28, 2026 · Oct 28, 2026 · Oct 28, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,21 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 The 0.20.0 beta line follows the frozen operator contract; earlier alpha releases
 remain historical snapshots. Beta does not mean error-free operation.
 
+## [0.20.0-rc.1] — 2026-10-28
+
+### Release qualification
+
+- First candidate for stable 0.20.0, retaining the Beta.9 runtime and frozen operator
+  contract. This is a prerelease; stable requires a separate operating observation
+  window and final-artifact qualification.
+- Release gates now require an explicit, different upgrade predecessor, verify all
+  four dependency locks and test the qualification tooling on Linux and macOS.
+- Documents exact-artifact installation, signed upgrade/rollback, package delivery
+  and seven consecutive calendar days of RC observation before stable promotion.
+- Give the large-skill test fixture explicit owner-only permissions so installation
+  proofs also pass under a group-writable umask. The runtime still refuses insecure
+  skill files.
+
 ## [0.20.0-beta.9] — 2026-10-28
 
 ### Fixed

diff --git a/README.md b/README.md
@@ -30,7 +30,7 @@
   <img src="https://img.shields.io/badge/tools-37%20gated-8a4318.svg" alt="Tools">
   <img src="https://img.shields.io/badge/default%20identities-0-c62828.svg" alt="Default identities">
   <img src="https://img.shields.io/badge/python-3.11%2B-1565c0.svg" alt="Python">
-  <a href="https://github.com/talos-kernel/talos/releases"><img src="https://img.shields.io/github/v/release/talos-kernel/talos?include_prereleases&amp;color=1565c0" alt="Latest release, including beta"></a>
+  <a href="https://github.com/talos-kernel/talos/releases"><img src="https://img.shields.io/github/v/release/talos-kernel/talos?include_prereleases&amp;color=1565c0" alt="Latest release, including prereleases"></a>
   <img src="https://img.shields.io/badge/licence-MIT-616161.svg" alt="MIT">
 </p>
 
@@ -45,8 +45,8 @@ tools — but only after a deterministic permission kernel has ruled on the acti
 Choose **Allow once**, **Allow this task**, or an exact-action standing approval;
 you do not have to approve every step individually. Sandboxed shell execution and an
 append-only audit trail keep actions bounded and reviewable. Talos is MIT-licensed;
-model-provider and hosting costs depend on your setup. It is now **beta**: the
-[operator contract](docs/beta-contract.md) is frozen; beta is not a claim of error-free
+model-provider and hosting costs depend on your setup. It is now a **release candidate**: the
+[operator contract](docs/beta-contract.md) is frozen; RC is not a claim of error-free
 operation or a substitute for reviewing permissions and keeping backups.
 
 [Install Talos](#install) · [Run local models with Ollama](https://talos-agent.ch/docs/#model) ·
@@ -84,7 +84,7 @@ Beta.8 also pins pip 26.2.2 with hashes, including the temporary verifier, and i
 - **Inspect the evidence:** review tool outcomes and the audit trail; do not mistake a confident answer for a successful action.
 
 Start with the [model, cost and permission FAQ](https://talos-agent.ch/faq/).
-Talos is not Talos Linux or Cisco Talos. It is a self-hosted AI agent, and it remains beta.
+Talos is not Talos Linux or Cisco Talos. It is a self-hosted AI agent, and it remains a prerelease.
 If this approach is useful, **star the repository to bookmark it**, try a small task and
 [report a reproducible result](https://github.com/talos-kernel/Talos/issues).
 Want to improve it? [Fork Talos](https://github.com/talos-kernel/Talos/fork) and read
@@ -381,7 +381,7 @@ come from `stdin` instead of `getUpdates`.
 ```
 $ talos chat
 
-  ◉  Talos / 0.20.0-beta.9
+  ◉  Talos / 0.20.0-rc.1
      Your terminal. Your rules.
   ──────────────────────────────────────────────────────────────────────────
   model      claude-cli/claude-opus-4-1
@@ -937,8 +937,7 @@ artifact checks and the seven-day operating observation. The frozen
 [beta contract](docs/beta-contract.md), [recovery runbook](docs/recovery.md) and
 local `python scripts/beta-gate.py --previous <published-version>` make these checks repeatable.
 The [RC and stable qualification plan](docs/stable-readiness.md) tracks the next
-transition from beta through `0.20.0-rc.1` to `0.20.0`; these versions are not yet
-published. The path to 1.0
+transition from beta through `0.20.0-rc.1` to `0.20.0`; stable remains subject to the RC observation and final-artifact gates. The path to 1.0
 requires evidence from the beta line and a verified upgrade from a previous beta;
 it is not a calendar promise.
 

diff --git a/docs/stable-readiness.md b/docs/stable-readiness.md
@@ -1,8 +1,8 @@
 # From beta to a stable 0.20.0
 
-The next proposed release is `0.20.0-rc.1`, followed by `0.20.0` only after the
-evidence below passes. This is a qualification plan, not an announcement that
-either version has shipped. The published baseline is `0.20.0-beta.9`.
+This tree identifies `0.20.0-rc.1`, followed by `0.20.0` only after the evidence
+below passes. Publication is established by the signed release assets, not this
+source label. The upgrade baseline is `0.20.0-beta.9`.
 
 The historical `0.20.0-alpha.rc.*` artifacts qualified the earlier transition
 **into beta**. They are not candidates for this transition out of beta. `1.0.0`
@@ -47,7 +47,7 @@ Start with the current published baseline in a prepared, hash-locked development
 environment:
 
 ```sh
-python scripts/beta-gate.py --previous 0.20.0-beta.8 --current 0.20.0-beta.9
+python scripts/beta-gate.py --previous 0.20.0-beta.9 --current 0.20.0-rc.1
 python -m pytest macos/Tests -q
 python e2e.py
 ```
@@ -90,5 +90,5 @@ installation or restart its service.
 | Artifact | State | Evidence boundary |
 |---|---|---|
 | `0.20.0-beta.9` | Published baseline | [Core main CI](https://github.com/talos-kernel/Talos/actions/runs/40661310306), [Homebrew](https://github.com/talos-kernel/homebrew-tap/actions/runs/40661911664), [Pinokio](https://github.com/talos-kernel/talos-pinokio/actions/runs/40663657826). These qualify beta.9 only. |
-| `0.20.0-rc.1` | Preparation started; not published | Needs its own commit, signed artifact, complete platform/install/recovery evidence and operator rollout. |
+| `0.20.0-rc.1` | Candidate source | Requires matching signed assets and platform/install/recovery evidence; deployed RC observations start only after rollout. |
 | `0.20.0` | Not qualified | Needs the RC observation window and final-artifact gates above. |
diff --git a/site/console.html b/site/console.html
@@ -284,7 +284,7 @@
 .lg .k.c-deny{color:var(--deny)}
 .lg .k.c-allow{color:var(--allow)}
 
-/* ── this beta release, measured ── */
+/* ── this release candidate, measured ── */
 .stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:1px;background:var(--line);border:1px solid var(--line);margin-top:44px}
 .stat{background:var(--bg);padding:28px 26px}
 .stat .n{font-family:var(--crt);font-size:clamp(30px,3.4vw,44px);color:var(--hot);line-height:1.05;
@@ -365,7 +365,7 @@
 
 <header class="hero" id="top">
   <div class="wrap">
-    <p class="sys">talos 0.20.0-beta.9 · operator console · MIT</p>
+    <p class="sys">talos 0.20.0-rc.1 · operator console · MIT</p>
     <span class="rec-chip">recorded · unfurled · no live wire</span>
     <h1 id="main-content" tabindex="-1">Witness one deed from door to ledger.</h1>
     <p class="lede">This hall unfurls one true session, recorded on the working machine
@@ -553,12 +553,12 @@ <h2 class="rv">Numbers this candidate must ship.</h2>
     embedded below. Either way the digits come from a count, not from memory.</p>
 
     <div class="stats" id="releaseStats">
-      <div class="stat rv"><div class="n" data-f="version">0.20.0-beta.9</div><div class="l">beta release</div><div class="sub-l" data-f="installer_version">public installer v0.20.0-beta.9</div></div>
+      <div class="stat rv"><div class="n" data-f="version">0.20.0-rc.1</div><div class="l">release candidate</div><div class="sub-l" data-f="installer_version">public installer v0.20.0-rc.1</div></div>
       <div class="stat rv"><div class="n" data-f="tests">3456</div><div class="l">automated tests, collected by pytest</div></div>
       <div class="stat rv"><div class="n" data-f="redteam_faelle">277</div><div class="l">adversarial cases, all behaving</div></div>
       <div class="stat rv"><div class="n" data-f="kernel_zeilen">996</div><div class="l">lines in policy.py, readable in one sitting</div></div>
       <div class="stat rv"><div class="n" data-f="werkzeuge">37</div><div class="l">tools, every one through the gate</div></div>
-      <div class="stat rv"><div class="n" data-f="release_ref">v0.20.0-beta.9</div><div class="l">release tag</div></div>
+      <div class="stat rv"><div class="n" data-f="release_ref">v0.20.0-rc.1</div><div class="l">release tag</div></div>
     </div>
 
     <div class="measure-note rv">
@@ -724,7 +724,7 @@ <h2 class="rv">Numbers this candidate must ship.</h2>
   replayBtn.addEventListener('click', play);
 })();
 
-/* ─── this beta release, measured: ./status.json with an embedded fallback ─── */
+/* ─── this release candidate, measured: ./status.json with an embedded fallback ─── */
 (() => {
   const src = document.getElementById('statusSrc');
   const FIELDS = ['version', 'installer_version', 'tests', 'redteam_faelle', 'kernel_zeilen', 'werkzeuge', 'release_ref'];

diff --git a/site/docs/index.html b/site/docs/index.html
@@ -407,7 +407,7 @@ <h2><span class="n">Section 04</span>Run it</h2>
   <section id="session" class="rv">
     <h2><span class="n">Section 05</span>The terminal session</h2>
 <pre>$ talos chat
-Talos 0.20.0-beta.9  ·  anthropic-api/claude-opus-4-8  ·  autonomy 3
+Talos 0.20.0-rc.1  ·  anthropic-api/claude-opus-4-8  ·  autonomy 3
 speaking as cli:1000  ·  approvals possible  ·  you are at a terminal
 /help for commands, `exit` to leave
 

diff --git a/site/index.html b/site/index.html
@@ -638,7 +638,7 @@ <h2 class="rv">The bounds are named.</h2>
     <h2 class="rv">Measured, with the path stated</h2>
     <p class="sub rv">None of this asks for belief. The installer runs the unit and
     adversarial suites in front of you; the real-model cases are a separate opt-in E2E run.</p>
-    <p class="source-caption">Beta.6 source and signed release. Counts describe the source test suite, not speed or real-world success rates; signed release contents follow their tag.</p><div class="stats">
+    <p class="source-caption">Release-candidate source and signed release. Counts describe the source test suite, not speed or real-world success rates; signed release contents follow their tag.</p><div class="stats">
       <div class="stat rv"><div class="n cnt" data-n="3456">0</div><div class="l">automated tests collected from the source tree</div></div>
       <div class="stat rv"><div class="n cnt" data-n="277">0</div><div class="l">adversarial cases trying to pass the kernel</div></div>
       <div class="stat rv"><div class="n cnt" data-n="44">0</div><div class="l">opt-in end-to-end cases against a real model</div></div>
@@ -764,7 +764,7 @@ <h2 class="rv">Talos AI agent: your questions</h2>
   <div class="wrap">
     <p class="sec-tag rv">raise the keep</p>
     <h2 class="rv">The command remains yours</h2>
-    <p class="sub rv">Beta release 0.20.0-beta.9. Tested on Python 3.11 · 3.13, Linux and macOS, including Raspberry Pi.
+    <p class="sub rv">Release candidate 0.20.0-rc.1. Tested on Python 3.11 · 3.13, Linux and macOS, including Raspberry Pi.
     Bring your own model: a supported CLI, configured API provider or local Ollama.
     The installer runs the unit and adversarial suites in front of you, then <strong>starts nothing.</strong></p>
     <div class="term rv">
@@ -788,7 +788,7 @@ <h2 class="rv">The command remains yours</h2>
       <a class="btn ghost" href="https://github.com/talos-kernel/talos-pinokio#start">Read the launcher guide</a>
     </div>
     <p class="install-note rv" id="pinokio-note">Another path to your keep, on macOS or Linux.
-    The separate launcher installs the signed Beta release it currently pins; its release cadence is independent
+    The separate launcher installs the signed release it currently pins; its release cadence is independent
     from this website's default download. Bring your own model access; existing Talos installations
     remain untouched. For API keys, follow the guide's system-terminal setup, outside Pinokio.</p>
   </div>

diff --git a/site/install.sh b/site/install.sh
@@ -15,7 +15,7 @@
 
 set -euo pipefail
 
-VERSION="0.20.0-beta.9"
+VERSION="0.20.0-rc.1"
 BASE="${TALOS_BASE:-https://talos-agent.ch}"
 TARBALL="${BASE}/dist/talos-${VERSION}.tar.gz"
 PREFIX="${TALOS_PREFIX:-$HOME/talos}"

diff --git a/site/status.json b/site/status.json
@@ -1,11 +1,11 @@
 {
-  "version": "0.20.0-beta.9",
+  "version": "0.20.0-rc.1",
   "release_state": "released",
   "source_state": "release",
-  "installer_version": "0.20.0-beta.9",
+  "installer_version": "0.20.0-rc.1",
   "tests": 3456,
   "redteam_faelle": 277,
   "kernel_zeilen": 996,
   "werkzeuge": 37,
-  "release_ref": "v0.20.0-beta.9"
+  "release_ref": "v0.20.0-rc.1"
 }
diff --git a/talos/__init__.py b/talos/__init__.py
@@ -8,4 +8,4 @@
 advertised and a released package is never left behind.
 """
 
-__version__ = "0.20.0-beta.9"
+__version__ = "0.20.0-rc.1"
diff --git a/tests/test_skillmanage.py b/tests/test_skillmanage.py
@@ -180,6 +180,7 @@ def test_view_lists_bounded_entries_and_truncates_large_content(root: Path, view
     big = "---\nname: big\ndescription: Big.\n---\n\n" + "x" * 30_000 + "\n"
     (root / "big").mkdir(mode=0o700)
     (root / "big" / "SKILL.md").write_text(big)
+    (root / "big" / "SKILL.md").chmod(0o600)
     shown = view(name="big")
     assert shown["truncated"] is True and len(shown["content"]) == sm.MAX_VIEW_CHARS
     assert shown["expected_sha256"] == _sha(big)