Repository navigation
docs(release): v0.6.0-rc Research Day cut — date-driven re-scope, freeze 2026-08-03 - #231
Merged
Merged
Conversation
…eze 2026-08-03 A talk proposal went to Wasm Research Day (2026-08-06), and the Component Model update to the CG on 08-04/05 will link this project in its implementation-status section. That makes the real freeze the 3rd, not the 6th: the slide is written before our talk. The submitted abstract deliberately claims only what was already true — components that speak the OS seam, and the lowered path on silicon. Everything scoped MUST here is over-delivery against a promise we can already keep; that asymmetry is the point. MUST is gale#224 (the fused OS as one component exporting gust:os, residual exactly gust:hal), its CI gate, and the DD-OS-DELIVERY-001 V-link. Measured today: four of five providers componentize cleanly; exec-provider is the single blocker, and it is a seam defect not a design one — one raw env.poll_task import and no WIT world, while the taskdisp interface it needs already exists and nothing exports it. WON'T is stated rather than attempted: cross-arch drivers (synth#871, upstream), on-device tenant hosting, scry loop-bound inference. Those go on the honesty slide. Includes the ledger mapping each claim that may reach a slide to a repo path, so nothing on screen can outrun the evidence between now and the 6th. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Two updates, both cases where reality beat the plan. The WON'T list's headline item is gone. "Drivers across architectures" was filed as synth#871 the morning this doc was written and fixed the same afternoon in synth 0.52.0; six of eight thin drivers now lower completely to RV32 with the seam intact. The residual gap is narrower, not absent: compiled on both, executed on one. M1 landed its artifact and, in doing so, invalidated its own acceptance criterion. "Exports gust:os, residual exactly gust:hal" is true of the composite while exec, spawn and timer each embedded their own copy of the executor — three schedulers behind one facade, breaking a promise gust-os.wit already makes in timer.sleep's doc comment. The same embed-instead-of-import shape appeared again in the clock. wac plug also turned out to be structurally inapplicable; the providers were a flat antichain with no edges to connect. Recorded rather than quietly corrected, because the failure of the criterion is the useful part: none of this was visible while everything linked into one native image. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo
…freeze 2026-08-03 The two existing v0.6.0 documents are scope; this is the release. It records what ships, which gates must be green to tag, what ships with its gap stated, and the publish sequence. Why a release rather than a branch: the CG implementation-status slide on 08-04/05 will link this project, and a branch is not an implementation status. DD-OS-DELIVERY-001 already defines gale's consumable cut as a cosign-signed OCI component exporting gust:os, so tagging is not packaging around the work — it is the deliverable that decision describes, and it is what lets a third party verify the claim without asking us. Two things remain to close it: wire the fused component into gustos-publish.yml (which today ships only the provider components, as its own header notes), and promote DD-OS-DELIVERY-001 with its verifies link — which our own V-closure gate will otherwise fail the release on. Those are gale#224's two open acceptance boxes. The largest gap is stated plainly rather than buried: the composite has never been executed. One scheduler and one clock are verified structurally, by import routing and source ownership. Nobody has called spawn.start() and watched the handle work in timer.sleep(). That is v0.7.0's first job. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo
… wins The user-facing notes for the tag. Leads with what the release actually is (the OS ships as one signed component exporting the whole gust:os world), then the two architecture findings, then a "does NOT claim" section that is deliberately as prominent as the wins. The largest gap is stated first among them: the composite has never been executed. One scheduler and one clock are structural properties, verified by import routing and source ownership, and nobody has called spawn.start() and watched the handle work in timer.sleep(). Ends with the commands a third party runs to check the claim themselves — pull, cosign verify, and read the world back — including what a violated delivery invariant would look like and an invitation to report it. A signature nobody outside has verified is not evidence. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo
…k loop v0.6.0 ships an OS that composes into one signed component and has never been run as one. Every claim in it is structural. v0.7.0's whole thesis is turning those into observed claims, or finding out they were wrong. The thesis is written as a falsification target rather than a demo: a handle from spawn.start() must be valid in timer.sleep() and exec.state(), and one clock must sit behind time.now() and the timer's deadlines. We asserted that from import routing. If running it refutes the claim, that is the most valuable result the release can produce and it ships as the headline — exactly as the triplication finding did. Four rungs, strictly increasing evidence: host engine, dissolve, qemu/Renode, silicon. E1 is first on purpose. It is cheap and it is the rung that can refute the thesis, so it must not slip behind the more impressive-sounding ones. Each rung must also leave a gate behind, because a rung that ran once is not a property. The loop is the part that makes this a cycle rather than a list: run, update the "does NOT claim" ledger (a rung that succeeds removes a line, one that fails rewrites one — never edited to look better), route friction upstream the same day, and re-derive claims against the live artifact rather than inheriting them. v0.6.0 proved all three: a RISC-V blocker filed and fixed within a day moved an item off the WON'T list before the release shipped, and two stale claims were caught by re-derivation. Research Day feedback is named as an input, not applause — the room contains the people best placed to attack this, and their questions get triaged into this plan the same week. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo
…hcr, it is not a copy The notes said the component is published "to ghcr and wasm.directory", which reads as two publications. wasm.directory is a meta-registry: registry/pulseengine.toml holds a TOML pointer at ghcr.io/pulseengine. There is one artifact and one signature; the directory makes it discoverable. Same confusion produced a real bug in the publish job, fixed separately: a `wkg publish --registry wasm.directory` that could only fail into a warning while the job stayed green. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo
The release notes tell third parties to pull the component, check its signature and read its world back. That check should be something we run too, not only something we ask for — so it is a script, and it uses nothing from the working tree. It re-checks the delivery invariant against the PUBLISHED bytes rather than a local build: residual imports exactly gust:hal/mmio + gust:os/taskdisp, five gust:os exports, and gust:sched absent. That last one is the point of putting the scheduler seam in its own package — if it is reachable from the published world, a tenant importing gust:os could mutate scheduling state, and this fails. This is the step that moves DD-OS-DELIVERY-001 from implemented to evidenced. A signature nobody outside has verified is not evidence, and an invariant that only holds in our own build directory has not been delivered. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-scopes v0.6.0 around a hard external date.
Why: a talk proposal went to Wasm Research Day (2026-08-06), and the Component Model update to the CG on 08-04/05 will mention and link this project in its implementation-status section. The real freeze is therefore 2026-08-03 — that slide is written before our talk.
The asymmetry is deliberate. The submitted abstract claims only two concrete things, both already true when it went in: components that speak the OS seam, and the same set lowered ahead of time to one native object on real silicon. Everything scoped MUST is over-delivery against a promise we can already keep.
MUST
gust:os, residual exactlygust:halDD-OS-DELIVERY-001gets itsverifieslinkM1 is assembly, not invention. Measured today:
log/spawn/time/timerproviders all componentize cleanly;exec-provideralone failswasm-tools component newwith module requires an import interface namedenv— one rawenv.poll_taskimport and no WIT world, whileinterface taskdispalready exists and nothing exports it. That hole sits at the centre of the composition graph.WON'T — stated as gaps, not attempted: cross-arch drivers (synth#871, upstream), on-device tenant hosting, scry loop-bound inference.
Includes an honesty ledger mapping every claim that may reach a slide to a path in this repo.
🤖 Generated with Claude Code
https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo