Release 2.0.1

Start with the current qualification order and the linked packaged trial report, then review the remaining release gates under “Done means” and the acceptance record. The exact rc.1 trial result and Anders’s release decision are still pending, with installed journeys, signing, publication, and human acceptance also open. This is a coordinated release effort spanning candidate checks, supported-host validation, and release authorization.

2.0.1

Target: 2.0.1-rc.1 on test versions on Fri 6 Nov, then 2.0.1 stable from the same build at the weekend (Anders, 5 Nov). A failed check moves the date.

Current qualification order

On 7 November, Grook relayed Anders's request to try 2.0.1-rc.1 on a real machine before another signing request. Candidate 30b166b05e1e4e29e97597aad25a688a19380ad1, tree b9734f180608f64e8be04d7920d8c224df40ae5f, has completed CI and package qualification. The pre-sign archive equality and disk reserve checks passed. This trial order supersedes the earlier signing handoff and target dates below.

Main reports that the exact unsigned Linux ARM64 package from run 42337367672 is running in an isolated Jetson trial Home for Anders. Main matched 81 package hashes to the signing input and verified 2,394 installed payload files. The installed Runtime identifies as 2.0.1-rc.1 and has SHA-256 d293755bab4cc8aafdaf0b89dde9fcee6bed9d51d8f9c71fbf6afbcd7133b2e9. Main reports Home HTTP 200, Browser ready, and Browser Open/Close HTTP 202/200 in a separate harness Home with the same payloads. Main restarted the trial Home in Community mode for Chat. Anders's trial result is pending. The public installer and launcher, update from 2.0.0, Undo, and one-time administrator Browser setup remain open. Main's packaged trial report

The trial surfaced the operator drive adapter Init failure (#558) and Browser's use of the host internet connection without a separate owner grant (#559). Main reports both were present in 2.0.0. Root checked the #558 wire mismatch in both source revisions and corrected its source references. Anders owns the #559 release decision. Main will record the trial result and that decision here before another signing request.

The public installer verifies the publisher signatures on the channel head and release manifest. An unsigned preparation cannot be installed through that route. Signing would supply the signed test candidate for Main to verify and publish on Test versions under its own authorization. Stable release still requires the installed journeys and human acceptance. The public installer reads the seed's single published head, so fresh installs from that origin would receive rc.1 during the Test versions window. The Runtime update check filters offers by subscription channel. Main's publication and staging update

The release tester reported GO for Linux x86_64 source Home QA on 30b166b05. The local build identified as elastos 2.0.1-dev. The tester reported matching built and installed SHA-256 81405586cabf6566280ebca596d9c84756f06c75c0aad187a70bc594e634cb31. First-run admin passkey and Home sign-in, unlock after Runtime restart, Library document save and exact text recovery after restart, and People, Marketplace and Chat UI smoke checks passed. The tester noted a lock-screen tile initial that differed from the profile name. Unlock still worked.

Browser setup exited 1 on x86_64. Root checked that the frozen source requires Linux ARM64 and KVM for this setup path. Native Browser and package validation were outside the tester's completed checks. Public channel install, update from 2.0.0 and official Undo were skipped pending the signed candidate. Main owns the remaining supported-host Browser checks. Linux Browser host check

The required #536 security review passed on the merged source at 344284ebb. Root checked that all seven files in the reviewed change have identical Git blobs and modes in 30b166b05. The #536 security review requirement is met for this candidate. Installed sign-out and reconnect remain part of qualification.

Scope

• On develop: Chat and open apps stay connected and reconnect by themselves (#532); Browser Close no longer fails on a busy port (#526); Assistant keeps a finished reply in view (#533); release scripts keep the GitHub token off the command line (#529); CI reliability (#530, #533).
• Browser on the Jetson and other Linux ARM64 hosts with KVM (#90, #531). Anders's decision, 5 Nov: in 2.0.1, although docs/VERSIONING.md counts a new platform artifact as a minor change.
• Browser on Linux is opt-in for 2.0.1: install.sh no longer runs the Browser administrator setup or the 900 MB download; one command turns it on, and opening Browser shows that command (Anders, 5 Nov: Browser from Marketplace, not install.sh; the Marketplace Get is #333 in 2.1.0).
• Merged to develop: Community room sessions end with the person's session (#536); installer fixes #516/#517 (#542); update retries only an unreachable source (#544); System, About offers the Inbox-approved Stable / Test versions choice (#546). GitHub merge records prove integration; the remaining release checks below retain their own proof.
• Merged: Linux Browser opt-in and the privileged helper / Open repair fixes (#551), at c38f8709a5bc6513e8bba7dc3be7895d5c3adcd5.
• Merged: actionable Browser launch refusals and private diagnostic handling (#556), at c6adf600676efb43cab33d36b3660593d30d428a. Main is naming rc.1 from this integrated source before the full check, CI, packaging and qualification.

Not in 2.0.1

• #515 (Mac local AI update with a changed engine archive). Guard: 2.0.1 ships the same local AI engine archives as 2.0.0, checked before signing.
• #534: Root gave a scoped no-hold decision for 2.0.1 under the prior host-account-write precondition. Signed per-file digest binding and both-host replacement regressions remain open. Reassess if a confined app, remote input, another account or a privileged operation reaches this path without that precondition. #406 remains a separate privilege gate.

Done means

• All scope PRs merged to develop with CI green and their reviews recorded.
• Release prechecks cover the linux-arm64 Browser image (ops: alpha-lib.sh musl_check, musl-precheck.sh); local AI engine archives equal 2.0.0's.
• 2.0.1-rc.1 named, package run and qualification pass. Main supplies the exact packaged build for a real-machine trial before another signing request. After Anders signs, Main verifies the signed candidate and publishes it on Test versions.
• Installed checks on rc.1: fresh install and update from 2.0.0 on Mac and Linux x86/ARM; Mac with local AI updates; Jetson: one-time Browser setup, update from 2.0.0, Browser opens, profile kept through the update, Undo.
• 2.0.1 stable from the same build, signed, published; GitHub release page.

Acceptance record — 6 November 2026 source and entropy audit

1. Candidate. Root audited develop f50e448b3e98c813106f0b17b2bf5d7fee8f5f18, tree 8fa9e56488d5a9b7c9968689b2b7a3da790ce9ed. All 1,972 exported source files match their Git blob identities and executable modes. The local fetched develop ref was 324bc2bc2; Root used the pinned GitHub source export and changed no source ref.
2. Checks. Product data passed (42 capsules, 2 profiles, 28 method contracts). Node tests: 105 product-data + 6 clipboard + 374 Browser/lifecycle/phone/journey tests = 485 PASS, 0 skipped. All 14 additional UI/source commands passed, including committed Chat parity, Home shell/bridge/recovery, Assistant, People, Clipboard, public copy, Library, system map, Bus WIT, templates and shared UI tokens. Both required Rust format checks passed. Whitespace checks found no errors in the pending PR integration delta or the two files changed by #549. Two off-gate checks failed and one stale documentation reference remains, recorded in #527. The CI release-policy attempt stopped at import before any tests because the plain export has no Git index. The initial archive extraction used an unsupported local Python option; corrected extraction completed before the audit. Heavy builds, Rust tests, full pre-push, real Browser engine/target tests and installed journeys were outside this source audit.
3. Review and completed receipt. #551 head acd2baeb3cc1ff878d693b01109f03eb1284950b, tree 4fe47bb72e1633e874c0dde3a7b921c7a7ee6e0e, has a completed full Linux PASS receipt against base 324bc2bc2dc3543c680d4be5469567956e1c9c94 (finished 6 Nov 11:44 UTC; receipt SHA-256 f457b64e52a68860051d0bc485da3850158374c1912b3af2e5a46846cabe33ba). Root read the receipt and bounded completed log tail; execution is owner evidence. All 21 files in the earlier reviewed task delta are byte-identical between bc39a939a and this head, so the bounded task source verdict retains that scope. The six integration files and compatibility with the newer develop base retain Main's current review/check gates. GitHub had zero submitted reviews and zero reviewer requests. Root requested irzhywau, the required human reviewer for this Anders-authored privileged-helper change, and verified that the request is present. Human approval remains open.
4. Installed proof. This audit ran source and fixture checks. Signed setup/removal, Open/Close, profiles, update/Undo, accepted product media/manual checks and human acceptance retain their existing owning records and remaining gates.
5. Remaining gates. Merge the accepted Browser candidate with its current required reviews/checks; repair the off-gate test drift in #527; retain ARM image prechecks, unchanged local-AI engine archive proof, engine-present Mac update, ten-minute Mac Browser/input/Close/reopen, release qualification and the exact installed journeys above. #534's scoped disposition grants no signing or release authority.
6. Next owner. Main owns candidate integration and the #527 test repairs in the accepted lane order. Anders owns production signing after the release gates pass. Original #93 duties, remaining #368 scope and recorded deferrals carry forward.

Source review checkpoint — 6 November 2026 (#556)

• Candidate and source review: #556 head 801cd984dc473df4608049605efecb6d10d339d1, tree 2593b27df0be60de5741f249c9a15dca962c5969, base c668f3ca8f76484bcc4901f5640fef05af446bce. Root gives a bounded SOURCE PASS for the 17-file delta. The review covered the closed refusal code and safe byte counts across the native supervisor, control service, adapter, Runtime and Browser; static/typed public error projections and the consuming diagnostic boundary; profile-transfer, Exit host, expired-sign-in and in-flight-open consumer behaviour; exact cleanup ownership and explicit Close job retirement. Relevant Rust regressions were inspected.
• Independent checks: 26 focused Node tests PASS, 0 skipped (browser-status.test.mjs and browser-launch-refusal.test.mjs); candidate-attribute whitespace check PASS. The frozen worktree stayed clean and unchanged; its fetched tracking-ref comparison was 20 ahead / 0 behind, without a fetch or a claim about a newer remote tree. Root ran no Rust build/tests, Runtime, privileged command or target journey. The 11.5 MB export was removed after 571 exported blob/mode checks and an empty exact-directory open-file check.
• Completed owner proof: full Linux receipt PASS binds this exact head/tree/base, finished 6 Nov 15:51 UTC; receipt 385 bytes, SHA-256 74bbd8423f0a6a928a8dd827c679a3ac55dd903c769d89703d1585ad94ad4ccf. Root read the receipt and completed log tail (SHA-256 fa73666a82e32046b9288bdcfa5636d1954972a5cd58ffc39954fe2a21d6d171); execution and totals are owner evidence. The five earlier Claude rounds and failures remain in the PR history; the present receipt and review are separate results.
• #551 review update: GitHub confirms merge of reviewed head acd2baeb3 at c38f8709a. Irzhywau supplied a bounded adversarial security PASS on that exact head, superseding the earlier waiting state for that task security comment. Its follow-ups remain follow-ups; signed installed setup/removal and human product acceptance retain their existing #406/#90 gates.
• Scope and ownership: Main's supplied plan is to freeze rc.1 after #556. Main is preserving the separately owned Cursor work (#552, #554, #555 and launcher #61) outside this release candidate; Root starts no overlapping writer or merge. The #541 long-running-Home investigation remains Main's read-only device lane until the reported CPU use is explained. These are owner handoffs, separate from new human release acceptance.
• Next owner and remaining gates: Main records the rc.1 version/release-notes candidate and proceeds through the full check, CI, packaging and qualification in the accepted order. Retain #527's test repairs and ten-minute Mac Browser/input/Close/reopen; unchanged local-AI engine archives plus the engine-present update; ARM prechecks; signed fresh-install/update/profile/Undo and accepted media/manual/human journeys. Anders owns production signing. Original #93 duties, remaining #368 scope, #534's scoped disposition and recorded deferrals carry forward.

Latest owner checkpoint: Main's 18:23 UTC update says the planned scope is integrated and rc.1 version/release-note preparation is active. GitHub confirms #556 merged at c6adf600676efb43cab33d36b3660593d30d428a; Root independently checked its tree 2593b27df0be60de5741f249c9a15dca962c5969 equals the reviewed 801cd984d tree. The bounded source verdict applies to the same tree. The completed receipt still names 801cd984d and base c668f3ca8; Main applies the accepted gate rules for exact-tree reuse. Root ran no repeat tests or CI query. The new version/notes candidate will have its own identity and applicable checks before packaging. Main retains preparation and qualification ownership. Irzhy's #536 review, unchanged-engine/engine-present update, installed and human gates remain in their accepted records; Anders owns signing.

Current rc.1 candidate — 6 November 2026

1. Identity and review: release/2.0.1-rc.1 at d88efd1f211f51917987c591b5dca7f5d058aa64, tree 79fef2e77e00a7f18489fadfe1477277b6e7cb81, based on integrated source c6adf600676efb43cab33d36b3660593d30d428a; #557 merged at this exact commit on 6 Nov 20:22 UTC. Root gives a bounded SOURCE PASS for the 23-file version/naming delta: workspace version 2.0.1, rc.1 notes, corresponding Carrier check pin, and two additional version-order test pairs. The earlier Browser source reviews retain their applicable scope.
2. Independent checks: all 67 changed lockfile package versions belong to the 16 workspace packages; each package block changes only 2.0.0 to 2.0.1, with zero dependency changes. Four focused release-note rule/bounds tests PASS, 0 skipped. The actual candidate note parser and signed-release bounds accept 12 bullets / 1,256 UTF-8 bytes. Candidate-attribute whitespace check PASS. The frozen worktree was clean and unchanged, 2 ahead / 0 behind its fetched develop tracking ref; Root performed no fetch or current-remote equivalence claim. The 11.2 MB export was removed after 539 blob/mode checks and an empty exact-directory open-file check.
3. Completed owner receipt: full Linux PASS binds this exact commit/tree/base, finished 6 Nov 19:48 UTC; receipt 376 bytes / SHA-256 2cad59a3ce32bed2df786c7b9f137490d64317fd99def3c3a4923ed51744d961. Root read the receipt and bounded completed log tail (SHA-256 78bd224e0701307959417598574a11e73fada223c8672ee190c35e599a1fcaaa); execution and full-suite totals remain owner evidence. Root inspected the new Rust test pairs and ran no Rust build/tests, Runtime, target or privileged operation.
4. Qualification result: Package run 42287807786, attempt 1 on exact d88efd1f211f51917987c591b5dca7f5d058aa64, completed with failure. Root independently read the completed job records and bounded logs: both Linux musl builds fail with E0425 at elastos/crates/elastos-common/src/owned_removal.rs:161, where libc::getentropy is unavailable. The downstream platform-receipt attestation was skipped. The Apple silicon and other successful jobs retain only their individual scope. Main reports develop CI green and is writing portable random-byte acquisition plus a musl compile check before repeating packaging; that owner report is separate from the failed package result. Main reports extended prechecks cover the Linux ARM64 image and pin the three local-AI engine archive inputs to 2.0.0; assembled archive equality and the engine-present installed update retain their own proof.
5. Remaining acceptance: Main owns completed CI/package/preparation receipts and exact built/installed artifact identities, then the accepted fresh-install/update, Browser setup/Open/Close/profile/Undo, long-session, media/manual and human journeys. Retain #527's remaining checks, the #536 human-review gate and all recorded release conditions. A source pass or a package result does not complete those journeys.
6. Next owner: Main continues the existing qualification run and supplies completed results or a frozen repair candidate. Anders owns signing the exact accepted bytes. Root adds no build, device owner, signing action or overlapping writer; original #93 duties, remaining #368 scope and recorded deferrals carry forward.

Completed package failure review — 6 November 22:07 UTC

Root confirmed the failed x86_64 and aarch64 jobs each exit 101 during the N/N+1 build step. Completed logs read: x86_64 200,995 bytes / SHA-256 5f6a663ee90ea7344940d5952d809ce491b1e634455df918fa79f4e3b6fecb74; aarch64 196,371 bytes / SHA-256 dc121a28a5568805e68bc6ce0452d476c12f0f3d653cbc981c5605a1e5f7ca24. The first log-read attempt was refused by gh's terminal-escape filter; an explicit read with escape handling succeeded, and displayed excerpts were stripped of terminal controls. This read failure ran zero product tests.

Main owns the active repair and pre-release musl check. Supply the frozen repair identity and completed applicable checks for source review, then repeat the package qualification for that candidate. Keep this failed attempt and the skipped attestation visible. The existing source verdict on d88's metadata delta stands within its scope; package success and installed acceptance remain pending. Main reports that nothing was published and the rc.1 name remains. Root ran source/receipt review only, with no build, CI rerun or target operation.

Queue admission handoff — 7 November 00:07 UTC

The supplied queue handoff at 6 November 23:43 UTC reports three untriaged late failures blocking Main's push queue. This is an operational admission blocker; the handoff supplies neither the failure causes nor a frozen repair candidate. Main owns the next action: inspect elastos-lesson untriaged, review each actual failed attempt and its cause, then triage each ID with the result and required repair. Keep failed attempts visible and resume the existing musl repair/check queue through its normal admission path. Root performs source review when Main supplies the frozen candidate and completed evidence. The known package failure above remains separate from these uninspected queue entries.

Owner queue recovery update — 7 November 03:37 UTC

Main reports that all three late-failure entries from the 23:43 UTC queue block are now triaged: two duplicate the known musl cause; the third concerns an Assistant “Jump to latest” flash and is being investigated on its own branch. This supersedes the waiting state in the queue handoff above as owner evidence. Main also reports that its inbox watcher was restored and the musl repair is in the existing push queue, with qualification to repeat after the push. Root read the bounded owner handoff; Root performed neither lesson/watcher operations nor an independent check of those operational claims.

Main retains the repair, push and qualification lane. Supply the frozen musl repair identity and applicable completed checks for Root source review; preserve the original failed package attempt and its skipped attestation. The handoff supplies no completed repair check, package result or installed journey. The separate Assistant investigation keeps its own owner and acceptance record; this report adds no release scope.

rc.1 musl repair and qualification — 7 November 05:37 UTC

Candidate: 30b166b05e1e4e29e97597aad25a688a19380ad1, tree b9734f180608f64e8be04d7920d8c224df40ae5f, adds 43cf06dcea6c1d2dc034198c30ac262c509089f6 and 30b166b05 on d88efd1f2. GitHub develop points to this exact candidate.

Independent source review: PASS for the five-file repair delta. Linux reads the full 16 bytes from the OS random source before staging removal and returns an error on failure or a short read. The existing non-Linux path stays in place. The Browser supervisor uses the target libc field types and preserves the pipe and timeout checks on the supported 64-bit hosts. Both Linux source-home jobs select their musl target. The gate checks the locked Runtime, the support producers selected for that platform, and the separate native Browser supervisor. Root reviewed the command-selection regression. Shell syntax and candidate-attribute whitespace checks passed. Rust execution is covered by the completed receipts and jobs below.

Completed evidence: Root read the full Linux PASS receipt for this commit/tree against d88efd1f211f51917987c591b5dca7f5d058aa64, finished 6 Nov 23:43 UTC. Receipt SHA-256 8ec60df63bb24ff5869353ce7f6d4e6d5f3b60fe8de29a2e010c2b270a3b4a9c. GitHub records CI success with 14 successful jobs and two skipped jobs (cancel-on-failure and upstream release assets). Both musl steps passed. Package qualification passed all 11 jobs, including both Linux N/N+1 builds, ARM64 Jetson compatibility and all platform attestations. The pinned engine rebuild steps and inapplicable cross-platform steps were skipped. The earlier d88 failure and its skipped attestation remain recorded above.

Owner handoff: Main reports the universal receipt check covered six inputs and 296 entries with zero conflicts, then started seed and release preparation. Completion of those operations and the exact artifact identities remain with Main. Archive equality to 2.0.0, the engine-present update, signed installed journeys, media, manual and human acceptance retain their existing gates. Anders owns production signing. The #527, #536, #90, #406, #93 and #368 duties and recorded deferrals carry forward.

rc.1 prepared input and disk reserve — 7 November 06:37 UTC

Main reports seed upgrade and unsigned preparation complete for 30b166b05 and package run 42337367672. Root checked the clean release worktree, the prepared manifest digest c79cb0fd586e755665ada39c3ab97e0898fe560834a96be3f7d5284c45c84ed6, its exact source commit and tree, and the staged Mac Runtime digest bfbc2ab1d09158b488e7b3f9f5c45c56c757215ea7fcee0b90e1acc22364f030. Seed restart and current stable release head are owner reports. Main's preparation update

Pre-sign engine archive guard passed for this prepared input. Root hashed the three staged archives and their retained signed 2.0.0 counterparts. Each pair matches in size and SHA-256, and both preparation manifests list the same hashes.

• Darwin arm64, 21,205,416 bytes, a3ba8ae214c761a6f96b34e2c3ee6a87fde4716063a130df07bb906ba05c2876.
• Linux amd64, 16,547,701 bytes, c8243b7ec654e1a0e9fa4588dbbe0631d44bdb3bddabd8fd482ef715e4790e2d.
• Linux arm64, 15,892,843 bytes, cea0e983ea8e5f0e685623a784a14843234967560ec9074ef720dceaa644343c.

Disk reserve. Root checked the shared debug compiler cache against the lifecycle inventory, tracked paths and open files. Root releases its retention protection for that debug subtree only. Main owns the fresh identity, shared lease and process checks, then removal and inventory update. Main keeps the release cache and prepared signing input and reports measured free space against the 10% floor and release working-space requirement before signing.

Anders owns production signing after the pre-sign gates. Main owns the subsequent verification, test-channel publication and installed journeys. The engine-present Mac update, fresh installs, profile/Undo, media, manual and human acceptance remain open. Main's update keeps #536 human review as a gate before stable.

Disk reserve confirmed — 7 November 07:07 UTC. Main reports completing the scoped debug cache removal after fresh identity, queue, compiler and open-file checks. Root confirmed the debug subtree is absent, the release cache is present, and the lifecycle inventory records the removal. Root measured 68,064,028 KiB available, about 18.9 GiB above the 10% floor of 48,274,645 KiB and above the release working-space requirement. The retained signing manifest still hashes to c79cb0fd586e755665ada39c3ab97e0898fe560834a96be3f7d5284c45c84ed6. Main reports handing signing to Anders. Signed verification, test-channel publication and installed acceptance remain separate steps.