0.5.0 — A Standard You Can Run

2026-08-20 · additive · every 0.3.0–0.4.1 document stays valid

0.5.0 completes the vNext roadmap: all nine RFCs shipped. Through 0.4.1 FLUX was something you could check. It is now also something you can run and prove.

RFC-04 — Policy with teeth

agentPolicy was declared and lint-checked; nothing enforced it at call time. 0.5.0 publishes the enforcement decision contract — decide(policy, request) → decision — with a normative check order so two independent gates return the same verdict and the same reason. Policies fail closed. Skills narrow budgets, never widen them. Every decision carries a policyDigest, so an audit log proves which policy allowed a call.

Conformance isn't a claim: 34 published vectors (tests/enforcement-vectors.json) pin allow, reasonCode and policyDigest across allow paths, every deny code, budget boundaries, skill narrowing, off-spec policies, normalisation evasions and check-order tie-breaks. Digests are canonicalised per RFC 8785 (JCS), so gates in different languages agree byte-for-byte.

And the suite is itself tested: six deliberately-broken gates — fail-open purpose default, budget-widening skills, native-int budget handling, case-folded matching, lenient off-spec policies, fabricated digests — must all fail it. A conformance suite nothing can fail is decoration.

RFC-09 — Proof that travels

scripts/bundle.py pack|verify turns a validated bundle into a portable artifact: a deterministic archive (byte-identical across repacks), a manifest with per-file digests and a Merkle root, and an attestation of what the toolchain could actually prove — validator status, Playback scorecards, every seam crossing with its contract digest.

verify recomputes all of it from scratch, so a manifest cannot claim what the bundle doesn't contain, and tampering with any file fails. Signing is detached over the manifest bytes (ssh-keygen, cosign, openssl — your choice); because the manifest commits to the Merkle root, one signature covers everything. Packing refuses to run on a bundle that doesn't validate.

Honest limits

An offline bundler attests core or enterprise — never runtime. Level-3 Runtime certification requires a live engine feeding a calibration loop and emitting per-run provenance; 0.5.0 ships the contract and vectors that make such certification checkable, not a claim that a packer can self-certify.

Numbers

  • Regression suite: 132 checks (was 97) — enforcement conformance, the six broken-gate negative tests, canonicalisation, the pack/verify/ determinism/tamper round-trip, and nine hostile-archive fixtures.
  • Three published schemas: core, enforcement contract, bundle manifest — plus an in-toto Statement emitted per bundle for supply-chain tooling.

Standing on prior art

Rather than invent: the Merkle construction follows RFC 6962, canonical digests follow RFC 8785, archives follow the reproducible-builds.org recipe, attestations are in-toto Statements, and the authorization model is Cedar's (default deny, forbid overrides permit).

Full field-by-field diff: Changelog · Deep dive: Runtime & Evidence.