From f55e977a4d9cac3a7e0775663cbc40f341c836dd Mon Sep 17 00:00:00 2001 From: ymote <151983+ymote@users.noreply.github.com> Date: Sun, 11 Oct 2026 05:05:55 -0700 Subject: [PATCH] docs: document published RC6 sockets and updater --- AGENTS.md | 4 +- README.md | 84 +++++++++++++++++++++++----------------- README.zh-CN.md | 24 +++++++----- docs/PUBLISHING.md | 6 ++- docs/PUBLISHING.zh-CN.md | 4 +- docs/RUST.md | 16 ++++---- docs/RUST.zh-CN.md | 11 +++--- sdk/rust/README.md | 5 ++- sdk/rust/README.zh-CN.md | 4 +- 9 files changed, 91 insertions(+), 67 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 1c601487..bdcf453a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -139,8 +139,8 @@ says who runs each one and when. which also adds the required `wasm-components-v1` ABI and usage disclosures (`storage` for files, `net` for HTTP or sockets). Socket imports additionally require `host-api-v1` and - `host_api.required: {"wasm.sockets": 1}`. This needs a forthcoming host; - released RC5 does not provide sockets. Missing disclosures + `host_api.required: {"wasm.sockets": 1}`. [Published desktop RC6](README.md#compatible-shell-download) + provides this API; RC5 does not provide sockets. Missing disclosures must not become execution gates. OctoSense #453 merged component, HTTP and host-service integration; App Hub #186/#188 are also merged. Compatible release and actual app acceptance remain separate. diff --git a/README.md b/README.md index f604e7dd..3643ff11 100644 --- a/README.md +++ b/README.md @@ -94,41 +94,53 @@ architecture; published repositories above own the current release bytes. ### Compatible shell download -[**Desktop 0.1.0-rc.4 is available**](https://github.com/OctoSense-org/OctoSense/releases/tag/desktop-v0.1.0-rc.4), published 2026-10-10 from -source [`9266b008`](https://github.com/OctoSense-org/OctoSense/commit/9266b0083544d86bd7636543b5ff60c61b26460f). -It includes GitHub-attested apps, the public v2 catalog, Host API v1, -shared Wasm components and the corrected declaration-only API policy. -Capability names and `network.hosts` describe expected use; omitted declarations -do not deny public APIs. App identity, private storage, resource limits, -account/device consent and reviewed tool access remain enforced -([policy](docs/CAPABILITIES.md#current-source-policy-and-release-boundary)). -The OS APIs introduced in RC2 remain subject to their platform limits -([Host API families](docs/HOST-API-FAMILIES.md)). - -| Platform | Download | +**[Desktop 0.1.0-rc.6 is published](https://github.com/OctoSense-org/OctoSense/releases/tag/desktop-v0.1.0-rc.6)** +(2026-10-11), from source [`f9f6fea9`](https://github.com/OctoSense-org/OctoSense/commit/f9f6fea90b52182790cb2641fd0145c425af4d84) +and the [official release build](https://github.com/OctoSense-org/OctoSense/actions/runs/38125407028). + +RC6 adds ordinary TCP streams/listeners, UDP datagrams and DNS for Rust/WASI +components through `wasm.sockets@1` ([Rust sockets](docs/RUST.md#tcp-udp-and-dns)). +It also adds the native OctoSense Updates app with Stable, Release candidate +and Preview channels, verified downloads and an explicit installer handoff. +RC5 has no updater: install RC6 manually once before using it for later updates. +The updater verifies GitHub's attestation on each desktop checksum manifest; +this does not provide a macOS Developer ID signature or Windows Authenticode. + +| Platform | RC6 downloads | | --- | --- | -| macOS Apple silicon | [DMG](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/OctoSense_0.1.0-rc.4_aarch64.dmg) or [app ZIP](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/OctoSense_0.1.0-rc.4_macos_aarch64.app.zip) | -| Windows x64 | [Installer](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/octosense_0.1.0-rc.4_x64-setup.exe) | -| Linux x86_64 | [Debian package](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/octosense_0.1.0-rc.4_amd64.deb) or [AppImage](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/octosense_0.1.0-rc.4_x86_64.AppImage) | - -Check downloads against [SHA256SUMS](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/SHA256SUMS) and read the release's -platform instructions. The macOS packages have only a linker ad-hoc signature, -**no Developer ID signature or notarization**; Windows has **no publisher -signature**. The [release workflow](https://github.com/OctoSense-org/OctoSense/actions/runs/38065627444) -built the packages; its [macOS](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/OctoSense_0.1.0-rc.4_macos-arm64.receipt.json), -[Windows](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/OctoSense_0.1.0-rc.4_windows-x64.receipt.json) and -[Linux](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/OctoSense_0.1.0-rc.4_linux-x64.receipt.json) receipts record source -and package identities. All nine published assets passed checksum verification. - -The final Mac ZIP bytes match the candidate that passed **11/11** App Hub/component -checks: installation, cold restart, component calls and separate app state/files -([archive acceptance and limits](https://github.com/OctoSense-org/OctoSense/releases/tag/desktop-v0.1.0-rc.4)). This used real GitHub publisher proofs -and a private administrator-attested dry-run catalog; it did not publish or -install those components through the official public catalog. Installed -Windows/Linux GUI acceptance and live-provider effects remain **unverified**. -Android Home is a separate release; Home beta.2 is unchanged by this desktop -release. To build RC4 yourself, follow the -[pinned setup guide](https://github.com/OctoSense-org/OctoSense/blob/9266b0083544d86bd7636543b5ff60c61b26460f/README.md#set-up). +| macOS Apple silicon | [DMG](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/OctoSense_0.1.0-rc.6_aarch64.dmg) or [app ZIP](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/OctoSense_0.1.0-rc.6_macos_aarch64.app.zip) | +| Windows x64 | [Installer](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/octosense_0.1.0-rc.6_x64-setup.exe) | +| Linux x86_64 | [Debian package](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/octosense_0.1.0-rc.6_amd64.deb) or [AppImage](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/octosense_0.1.0-rc.6_x86_64.AppImage) | + +The release includes [SHA256SUMS](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/SHA256SUMS), its +[GitHub attestation](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/SHA256SUMS.sigstore.json) and +[macOS](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/OctoSense_0.1.0-rc.6_macos-arm64.receipt.json), +[Windows](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/OctoSense_0.1.0-rc.6_windows-x64.receipt.json) and +[Linux](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/OctoSense_0.1.0-rc.6_linux-x64.receipt.json) package receipts. +All eight package/receipt files passed checksum verification. The exact RC6 +updater verifier accepted the [GitHub signature](https://github.com/OctoSense-org/OctoSense/actions/runs/38137543497) +and rejected altered checksums and a wrong release tag. The public Mac download +passed updater checks (RC/Preview: up to date; Stable: no release yet), plus +public App Hub installation, opening and restart persistence for Repo Radar. +Linux passed six isolated startup checks; Windows passed static package checks. +Windows GUI execution, native installer handoff/replacement and full app +functionality were not tested. App Hub's Install action remains below its +permission review. The Mac package is not Developer ID signed or notarized; +the Windows installer is not Authenticode signed. + +Android Home is a separate release; this desktop release does not upgrade it. +To inspect or build RC6, use its [pinned setup guide](https://github.com/OctoSense-org/OctoSense/blob/f9f6fea90b52182790cb2641fd0145c425af4d84/README.md#set-up). + +GitHub-attested apps, the public v2 catalog, Host API v1 and shared Wasm components +remain part of the host. Capability names and `network.hosts` describe expected +use; omitted declarations do not deny public APIs. Required ABI/API versions, +app identity, private storage, resource limits, account/device consent and +reviewed tool access still apply ([policy](docs/CAPABILITIES.md#current-source-policy-and-release-boundary)). +The OS APIs introduced in RC2 retain their [platform limits](docs/HOST-API-FAMILIES.md). + +**Historical evidence.** [RC4's release notes](https://github.com/OctoSense-org/OctoSense/releases/tag/desktop-v0.1.0-rc.4) +record its nine checked assets and 11/11 Mac component checks against a private +administrator-attested rehearsal catalog. Those results apply to RC4; the RC6 checks above are separate. For these samples, use a Mac: **App Hub → Search → exact app ID → Get → Install → Open**. Review the permissions before Install; **Library** offers @@ -213,9 +225,9 @@ Use `main` of each repository. | Piece | State | | --- | --- | -| The gate (`hub`) | App Hub `main`, app contract 1.11.0 (also pinned by RC4), which validates usage declarations for the connected-account capabilities `auth`, `github`, `gmail` and `gcalendar`, the [Host API v1](docs/HOST-API-V1.md) declarations, the `wasm` capability and RC2's `files`, `audio` and `device_calendar`. | +| The gate (`hub`) | [Pinned App Hub `38635915`](https://github.com/OctoSense-org/OctoSense-App-Hub/tree/386359153ed6377b5f047bd9ed2767a6a2ac2bc7), app contract **1.12.0**, which validates usage declarations for the connected-account capabilities `auth`, `github`, `gmail` and `gcalendar`, the [Host API v1](docs/HOST-API-V1.md) declarations, the `wasm` capability and RC2's `files`, `audio` and `device_calendar`. | | `card-host` | App Hub `main`. It runs one bundle and serves no host services except `runtime` discovery. Build it as the [Quick path](#quick-path) shows. | -| The shells | [Desktop RC4 release, source `9266b008`](#compatible-shell-download); see platform downloads there. The desktop shell and the phone's Home run system and store apps; the desktop also serves connected accounts and app agents' host-service tools. | +| The shells | [Published desktop RC6](#compatible-shell-download); see platform downloads and acceptance there. The desktop shell and the phone's Home run system and store apps; the desktop also serves connected accounts and app agents' host-service tools. | | GitHub publishing | Contract 1.8.0 / `publisher-github-v1`, no developer key. Real releases and public-catalog macOS install/update checks passed; [RC download status](#compatible-shell-download). Isolated phone fixture checks do not establish support for macOS-only sample apps. | | Submission | An issue on OctoSense-App-Hub, as App Hub's [SUBMITTING.md](https://github.com/OctoSense-org/OctoSense-App-Hub/blob/main/docs/SUBMITTING.md) describes. | | Installing your own bundle on a phone | Not supported. See [Running an app](#running-an-app). | diff --git a/README.zh-CN.md b/README.zh-CN.md index 3fce95a8..79f4219f 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -68,17 +68,23 @@ App Flow 带着你（或编码 Agent）从一个想法（一段文字需求、 ### 下载兼容 Shell -[**桌面版 0.1.0-rc.4 已发行**](https://github.com/OctoSense-org/OctoSense/releases/tag/desktop-v0.1.0-rc.4)，于 2026-10-10 发布，源码为 [`9266b008`](https://github.com/OctoSense-org/OctoSense/commit/9266b0083544d86bd7636543b5ff60c61b26460f)。它包含带 GitHub 证明的应用、公开 v2 签名目录、Host API v1、共享 Wasm 组件，以及能力声明仅用于披露用途的新策略。能力名称与 `network.hosts` 描述预计用途；遗漏声明不会拒绝公开 API。应用身份、私有存储、资源上限、账户和设备同意，以及经审核的工具访问仍受检查（[策略](docs/CAPABILITIES.zh-CN.md#当前源码策略与发布边界)）。RC2 引入的 OS API 仍按各自的平台限制提供（[宿主 API 能力族](docs/HOST-API-FAMILIES.zh-CN.md)）。 +**[桌面版 0.1.0-rc.6 已发布](https://github.com/OctoSense-org/OctoSense/releases/tag/desktop-v0.1.0-rc.6)**（2026-10-11），来自源码 [`f9f6fea9`](https://github.com/OctoSense-org/OctoSense/commit/f9f6fea90b52182790cb2641fd0145c425af4d84)和[正式发布构建](https://github.com/OctoSense-org/OctoSense/actions/runs/38125407028)。 -| 平台 | 下载 | +RC6 为 Rust/WASI 组件增加普通 TCP 流与监听器、UDP 数据报和 DNS，通过 `wasm.sockets@1` 提供（[Rust 套接字](docs/RUST.zh-CN.md#tcpudp-和-dns)）。它还增加原生 OctoSense Updates 应用，支持 Stable、Release candidate 和 Preview 通道、验证下载及明确的安装程序交接。RC5 没有更新器：须先手动安装一次 RC6，之后才能用它更新后续版本。更新器验证每份桌面校验和清单上的 GitHub 证明；这不等于 macOS Developer ID 签名或 Windows Authenticode 签名。 + +| 平台 | RC6 下载 | | --- | --- | -| macOS Apple 芯片 | [DMG](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/OctoSense_0.1.0-rc.4_aarch64.dmg) 或 [应用 ZIP](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/OctoSense_0.1.0-rc.4_macos_aarch64.app.zip) | -| Windows x64 | [安装程序](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/octosense_0.1.0-rc.4_x64-setup.exe) | -| Linux x86_64 | [Debian 包](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/octosense_0.1.0-rc.4_amd64.deb) 或 [AppImage](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/octosense_0.1.0-rc.4_x86_64.AppImage) | +| macOS Apple 芯片 | [DMG](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/OctoSense_0.1.0-rc.6_aarch64.dmg) 或 [应用 ZIP](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/OctoSense_0.1.0-rc.6_macos_aarch64.app.zip) | +| Windows x64 | [安装程序](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/octosense_0.1.0-rc.6_x64-setup.exe) | +| Linux x86_64 | [Debian 包](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/octosense_0.1.0-rc.6_amd64.deb) 或 [AppImage](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/octosense_0.1.0-rc.6_x86_64.AppImage) | + +发行版附带 [SHA256SUMS](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/SHA256SUMS)、它的 [GitHub 证明](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/SHA256SUMS.sigstore.json)，以及 [macOS](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/OctoSense_0.1.0-rc.6_macos-arm64.receipt.json)、[Windows](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/OctoSense_0.1.0-rc.6_windows-x64.receipt.json) 和 [Linux](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.6/OctoSense_0.1.0-rc.6_linux-x64.receipt.json) 安装包收据。8 个安装包及收据文件均通过校验和验证。RC6 原版更新器验证代码接受 [GitHub 签名](https://github.com/OctoSense-org/OctoSense/actions/runs/38137543497)，并拒绝篡改的校验和与错误发布标签。公开 Mac 下载通过更新器检查（RC/Preview：已是最新；Stable：尚无发行版），以及公开 App Hub 的 Repo Radar 安装、打开与重启保留状态检查。Linux 通过 6 项隔离启动检查；Windows 通过静态安装包检查。未测试 Windows 图形界面、原生安装程序交接或替换，以及完整应用功能。App Hub 的 Install 按钮仍位于权限审核内容下方。Mac 包没有 Developer ID 签名或公证；Windows 安装程序没有 Authenticode 签名。 + +Android Home 单独发行，此桌面发行版不会升级它。查看或自行构建 RC6 请按[固定源码的环境准备指南](https://github.com/OctoSense-org/OctoSense/blob/f9f6fea90b52182790cb2641fd0145c425af4d84/README.zh-CN.md#环境准备)操作。 -请用 [SHA256SUMS](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/SHA256SUMS) 核对下载，并阅读发行说明中的平台要求。macOS 包只有链接器生成的临时签名，**没有 Developer ID 签名或公证**；Windows **没有发布者签名**。[发布工作流](https://github.com/OctoSense-org/OctoSense/actions/runs/38065627444)构建了这些安装包；[macOS](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/OctoSense_0.1.0-rc.4_macos-arm64.receipt.json)、[Windows](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/OctoSense_0.1.0-rc.4_windows-x64.receipt.json) 和 [Linux](https://github.com/OctoSense-org/OctoSense/releases/download/desktop-v0.1.0-rc.4/OctoSense_0.1.0-rc.4_linux-x64.receipt.json) 收据记载源码及安装包身份。公开发布的九个附件均通过校验和验证。 +宿主继续包含带 GitHub 证明的应用、公开 v2 签名目录、Host API v1 和共享 Wasm 组件。能力名称与 `network.hosts` 描述预计用途；遗漏声明不会拒绝公开 API。所需 ABI/API 版本、应用身份、私有存储、资源上限、账户和设备同意及经审核的工具访问仍受检查（[策略](docs/CAPABILITIES.zh-CN.md#当前源码策略与发布边界)）。RC2 引入的 OS API 保留原有[平台限制](docs/HOST-API-FAMILIES.zh-CN.md)。 -最终 Mac ZIP 与通过 **11/11** 项 App Hub/组件检查的候选包字节完全一致，覆盖安装、冷启动、组件调用及各应用独立状态/文件（[归档包验收与限制](https://github.com/OctoSense-org/OctoSense/releases/tag/desktop-v0.1.0-rc.4)）。该演练使用真实 GitHub 发布者证明和经管理员证明的私有演练签名目录；没有通过官方公开目录发布或安装这些组件。Windows/Linux 安装后的界面验收及真实提供商效果仍为**未验证**。Android Home 单独发行；此次桌面发布不更新 Home beta.2。自行构建 RC4 请按[固定源码的环境准备指南](https://github.com/OctoSense-org/OctoSense/blob/9266b0083544d86bd7636543b5ff60c61b26460f/README.zh-CN.md#环境准备)操作。 +**历史证据。** [RC4 发布说明](https://github.com/OctoSense-org/OctoSense/releases/tag/desktop-v0.1.0-rc.4) 记录了九个校验通过的附件，以及在经管理员证明的私有演练目录上通过的 11/11 项 Mac 组件检查。这些结果仅适用于 RC4；上文 RC6 检查另行执行。 这些示例使用 Mac：**App Hub → Search → 确切应用 ID → Get → Install → Open**。Install 前审阅权限；**Library** 提供重新打开和兼容更新。保留签名目录、来源及信任锚的默认设置，不需要开发者密钥或 OctoSense 云端账户。Beta.2 无法使用这些发布者证明或公开 v2 签名目录。 @@ -113,9 +119,9 @@ macOS 上的原生公开签名目录安装及 0.2.0 → 0.2.1 更新保留了本 | 部分 | 状态 | | --- | --- | -| 准入检查（`hub`） | App Hub `main`，应用契约 1.11.0（RC4 也固定使用此版本），校验以下用途声明：连接账户的 `auth`、`github`、`gmail` 和 `gcalendar` 能力、[Host API v1](docs/HOST-API-V1.zh-CN.md) 的各项声明、`wasm` 能力，以及 RC2 的 `files`、`audio` 和 `device_calendar`。 | +| 准入检查（`hub`） | [固定的 App Hub `38635915`](https://github.com/OctoSense-org/OctoSense-App-Hub/tree/386359153ed6377b5f047bd9ed2767a6a2ac2bc7)，应用契约 **1.12.0**，校验以下用途声明：连接账户的 `auth`、`github`、`gmail` 和 `gcalendar` 能力、[Host API v1](docs/HOST-API-V1.zh-CN.md) 的各项声明、`wasm` 能力，以及 RC2 的 `files`、`audio` 和 `device_calendar`。 | | `card-host` | App Hub `main`。它运行单个应用包，除了用于发现宿主 API 的 `runtime`，不提供任何宿主服务。构建方法见[快速上手](#快速上手)。 | -| Shell | [桌面 RC4 发行版，源码 `9266b008`](#下载兼容-shell)；各平台下载见该节。桌面端 Shell 和手机 Home 运行系统应用与商店应用；桌面端还支持已连接账户，并为应用 Agent 提供宿主服务工具。 | +| Shell | [已发布的桌面 RC6](#下载兼容-shell)；各平台下载与验收见该节。桌面端 Shell 和手机 Home 运行系统应用与商店应用；桌面端还支持已连接账户，并为应用 Agent 提供宿主服务工具。 | | GitHub 发布 | 应用契约 1.8.0 / `publisher-github-v1`，无需开发者密钥。真实发布及公开目录 macOS 安装/更新检查已通过；见 [RC 下载状态](#下载兼容-shell)。隔离手机测试示例不代表仅声明 macOS 的应用可在手机运行。 | | 提交途径 | 在 OctoSense-App-Hub 开 issue，见 App Hub 的 [SUBMITTING.zh-CN.md](https://github.com/OctoSense-org/OctoSense-App-Hub/blob/main/docs/SUBMITTING.zh-CN.md)。 | | 在手机上安装自己的应用包 | 不支持。见[运行应用](#运行应用)。 | diff --git a/docs/PUBLISHING.md b/docs/PUBLISHING.md index e6963e71..ae7fd72b 100644 --- a/docs/PUBLISHING.md +++ b/docs/PUBLISHING.md @@ -256,8 +256,10 @@ bundle integrity and GitHub publisher-proof checks still apply. This pin also includes [App Hub #209](https://github.com/OctoSense-org/OctoSense-App-Hub/pull/209): ordinary WASI TCP/UDP/DNS imports require `host-api-v1` and `host_api.required: {"wasm.sockets": 1}`, which `tools/octo wasm build` adds. -RC5 can read the catalog but cannot install or run these socket apps; a -host implementing that API is still required ([Rust sockets](RUST.md#tcp-udp-and-dns)). +RC5 can read the catalog but cannot install or run these socket apps. +[Published desktop RC6](../README.md#compatible-shell-download) provides that API. +A publisher check does not establish that the chosen host supports the app +([Rust sockets](RUST.md#tcp-udp-and-dns)). CI builds the exact [publisher pin](../tools/publisher-toolchain.json) and runs [the native CLI regression](../tools/check-publisher-toolchain.py) against real diff --git a/docs/PUBLISHING.zh-CN.md b/docs/PUBLISHING.zh-CN.md index b60c808a..c8d44cb7 100644 --- a/docs/PUBLISHING.zh-CN.md +++ b/docs/PUBLISHING.zh-CN.md @@ -169,8 +169,8 @@ tools/octo publish-github "$APP" 这个固定版本还包含 [App Hub #209](https://github.com/OctoSense-org/OctoSense-App-Hub/pull/209)： 普通 WASI TCP/UDP/DNS 导入要求 `host-api-v1` 和 `host_api.required: {"wasm.sockets": 1}`，`tools/octo wasm build` 会自动加入。 -RC5 能读取目录，但不能安装或运行这些套接字应用；仍需要实现该 API 的宿主 -（见 [Rust 套接字](RUST.zh-CN.md#tcpudp-和-dns)）。 +RC5 能读取目录，但不能安装或运行这些套接字应用。[已发布的桌面 RC6](../README.zh-CN.md#下载兼容-shell) 提供该 API。发布工具检查通过， +并不能证明所选宿主支持该应用（见 [Rust 套接字](RUST.zh-CN.md#tcpudp-和-dns)）。 CI 会构建[固定版本的发布工具](../tools/publisher-toolchain.json)，用真实 SDK 组件运行[原生 CLI 回归检查](../tools/check-publisher-toolchain.py)，验证结构准入和发布准备，以及缺失 ABI、组件格式错误和缺失发布证明时的拒绝。这个检查不会生成证明、发布应用或执行组件，也不代表 shell 或设备功能验收。 diff --git a/docs/RUST.md b/docs/RUST.md index bc6c6763..d0eda9dd 100644 --- a/docs/RUST.md +++ b/docs/RUST.md @@ -19,12 +19,13 @@ in a sandbox, and the app's script calls it by name. There are two kinds: nothing but their input. [Core modules](#core-modules-adr-0011) at the end of this page covers them. -**Socket support is newer than RC5.** The tooling below accepts ordinary -TCP, UDP and DNS imports. Those apps require a forthcoming host advertising -`wasm.sockets@1`; RC5 does not provide it. See [TCP, UDP and DNS](#tcp-udp-and-dns). +**Socket support is available in [desktop RC6](../README.md#compatible-shell-download).** +It provides ordinary TCP, UDP and DNS for apps requiring `wasm.sockets@1`; +RC5 does not provide it. Test each app on its claimed platforms. +See [TCP, UDP and DNS](#tcp-udp-and-dns). No native library or privileged raw-IP socket access is added. -**Recorded release baseline.** [Desktop RC4](../README.md#compatible-shell-download) +**Historical RC4 baseline, unchanged.** [Desktop RC4](https://github.com/OctoSense-org/OctoSense/releases/tag/desktop-v0.1.0-rc.4) is published at source `9266b008`, with component loading, HTTP, public host-service imports and shared catalog components. Its App Hub contract 1.11 uses `capabilities` and `network.hosts` as disclosures, not execution gates. @@ -41,7 +42,7 @@ retain their original scope. | | Core module (ADR 0011) | Component (ADR 0014) | | --- | --- | --- | | Write and build it | Copy OctoSense's guest crate; `cargo build --target wasm32-unknown-unknown` | `tools/octo wasm new`, then `tools/octo wasm build` (this page) | -| What it reaches | Its input only | The clock, random numbers, bounded private storage, HTTP and public host services under actual authorization. | +| What it reaches | Its input only | The clock, random numbers, bounded private storage, HTTP and public host services under actual authorization; RC6 adds TCP/UDP/DNS. | | Between calls | Starts fresh every call | Keeps its state | | The manifest | Disclose `wasm` | Require `wasm-components-v1`; socket imports also require `host-api-v1` and `host_api.required: {"wasm.sockets": 1}`. Disclose `wasm`, `storage` for files and `net` for HTTP/sockets | | App Hub's gate (`hub check`) | Admits it from contract 1.7 | Current source admits supported components with `wasm-components-v1`; the 1.11 policy treats family declarations as disclosures. | @@ -531,8 +532,9 @@ bundle/manifest.json: ### TCP, UDP and DNS -**Release boundary:** ordinary `std::net` sockets require a forthcoming -OctoSense build advertising the `wasm.sockets@1` host API. Released desktop +**Release boundary:** ordinary `std::net` sockets require the `wasm.sockets@1` +host API, available in [published desktop RC6](../README.md#compatible-shell-download) +(source [`f9f6fea9`](https://github.com/OctoSense-org/OctoSense/commit/f9f6fea90b52182790cb2641fd0145c425af4d84)). RC5 does not provide it. This adds TCP streams/listeners, UDP datagrams and DNS through WASI, not privileged raw-IP sockets or native libraries. diff --git a/docs/RUST.zh-CN.md b/docs/RUST.zh-CN.md index fc578380..8c5f132d 100644 --- a/docs/RUST.zh-CN.md +++ b/docs/RUST.zh-CN.md @@ -9,14 +9,14 @@ - **组件**（[ADR 0014](https://github.com/OctoSense-org/OctoSense/blob/9266b0083544d86bd7636543b5ff60c61b26460f/docs/adr/0014-app-components-in-webassembly.zh-CN.md)，已接受）：用本仓库的 SDK 编写普通的 Rust，`tools/octo wasm build` 把它变成 `fns/.wasm`。脚本以 `wasm.` 加 JSON 调用每个 `pub fn`，因此不需要编写 WIT，也不需要胶水代码。组件在调用之间保留状态，能用时钟和随机数；还能访问受配额限制的私有文件。ADR 0014 的第 3 阶段再加两项：经 HTTP 访问主机（见[网络](#网络)）；以及通过实际授权检查调用可用的公开宿主服务（见[宿主服务](#宿主服务)）。 - **核心模块**（[ADR 0011](https://github.com/OctoSense-org/OctoSense/blob/main/docs/adr/0011-apps-own-functions-in-webassembly.zh-CN.md)）：处理字节或 JSON 的函数，用复制来的客体 crate 编写，只能看到自己的输入。本页末尾的[核心模块](#核心模块adr-0011)介绍它们。 -**套接字支持晚于 RC5。** 下述工具接受普通 TCP、UDP 和 DNS 导入，但这些应用需要即将提供的、声明 `wasm.sockets@1` 的宿主；RC5 不提供该功能。见 [TCP、UDP 和 DNS](#tcpudp-和-dns)。此变更不增加原生库或特权原始 IP 套接字访问。 +**[桌面 RC6](../README.zh-CN.md#下载兼容-shell) 已提供套接字支持。** 要求 `wasm.sockets@1` 的应用可以使用普通 TCP、UDP 和 DNS；RC5 不提供该功能。每个应用仍须在其声明的平台上测试。见 [TCP、UDP 和 DNS](#tcpudp-和-dns)。此变更不增加原生库或特权原始 IP 套接字访问。 -**已记录的发布基线。** [桌面 RC4](../README.zh-CN.md#下载兼容-shell) 已发布，源码为 `9266b008`，包含组件加载、HTTP、公开宿主服务导入与签名目录中的共享组件。它使用 App Hub 契约 1.11，`capabilities` 与 `network.hosts` 披露用途，不作为执行开关。`requires`、受支持的导入、完整性、配额、应用与账户 scope、实际设备同意、原生写入审核及应用间共享检查继续生效。最终 Mac 归档包与通过 11/11 项 Store/组件检查的候选包字节一致；测试使用真实 GitHub 证明与经管理员证明的私有演练目录，不代表官方公开目录组件安装、真实模型或 Windows/Linux 界面验收。OnePlus 6 组件检查使用隔离的源码测试包，没有升级 Home。你的确切应用仍需单独验收。RC2 与 Home beta.2 只包含核心模块；下方历史观察记录保留原有范围。 +**RC4 历史基线，保持不变。** [桌面 RC4](https://github.com/OctoSense-org/OctoSense/releases/tag/desktop-v0.1.0-rc.4) 已发布，源码为 `9266b008`，包含组件加载、HTTP、公开宿主服务导入与签名目录中的共享组件。它使用 App Hub 契约 1.11，`capabilities` 与 `network.hosts` 披露用途，不作为执行开关。`requires`、受支持的导入、完整性、配额、应用与账户 scope、实际设备同意、原生写入审核及应用间共享检查继续生效。最终 Mac 归档包与通过 11/11 项 Store/组件检查的候选包字节一致；测试使用真实 GitHub 证明与经管理员证明的私有演练目录，不代表官方公开目录组件安装、真实模型或 Windows/Linux 界面验收。OnePlus 6 组件检查使用隔离的源码测试包，没有升级 Home。你的确切应用仍需单独验收。RC2 与 Home beta.2 只包含核心模块；下方历史观察记录保留原有范围。 | | 核心模块（ADR 0011） | 组件（ADR 0014） | | --- | --- | --- | | 编写和构建 | 复制 OctoSense 的客体 crate；`cargo build --target wasm32-unknown-unknown` | `tools/octo wasm new`，然后 `tools/octo wasm build`（本页） | -| 能访问什么 | 只有自己的输入 | 时钟、随机数、有配额的私有存储、HTTP，以及通过实际授权检查的公开宿主服务。 | +| 能访问什么 | 只有自己的输入 | 时钟、随机数、有配额的私有存储、HTTP，以及通过实际授权检查的公开宿主服务；RC6 另提供 TCP/UDP/DNS。 | | 两次调用之间 | 每次调用都从头开始 | 保留状态 | | 清单 | 披露 `wasm` | 要求 `wasm-components-v1`；套接字导入还要求 `host-api-v1` 和 `host_api.required: {"wasm.sockets": 1}`。披露 `wasm`、文件用途的 `storage` 和 HTTP/套接字用途的 `net` | | App Hub 的准入检查（`hub check`） | 从契约 1.7 起接受 | 当前源码接受带有 `wasm-components-v1` 的受支持组件；1.11 策略把能力族声明视为披露。 | @@ -357,8 +357,9 @@ bundle/manifest.json: ### TCP、UDP 和 DNS -**发布边界：** 普通 `std::net` 套接字需要即将提供的、声明 `wasm.sockets@1` -宿主 API 的 OctoSense 构建。已发布的桌面 RC5 不提供该功能。这通过 WASI 增加 +**发布边界：** 普通 `std::net` 套接字要求 `wasm.sockets@1` 宿主 API， +[已发布的桌面 RC6](../README.zh-CN.md#下载兼容-shell) 提供该 API +（源码 [`f9f6fea9`](https://github.com/OctoSense-org/OctoSense/commit/f9f6fea90b52182790cb2641fd0145c425af4d84)）。RC5 不提供该功能。这通过 WASI 增加 TCP 流与监听器、UDP 数据报和 DNS，不增加特权原始 IP 套接字或原生库。 Rust 的 `wasm32-wasip2` 标准库提供导入，不需要学习另一套 OctoSense 套接字封装： diff --git a/sdk/rust/README.md b/sdk/rust/README.md index acfa0bd7..88873621 100644 --- a/sdk/rust/README.md +++ b/sdk/rust/README.md @@ -26,7 +26,7 @@ pub mod functions { | [examples/type-tour/](examples/type-tour/src/lib.rs) | Every type mapping both ways, random numbers through `getrandom`, and state kept between calls. | | [examples/template/](examples/template/src/lib.rs) | [templates/rust-component/src/lib.rs](../../templates/rust-component/src/lib.rs), which `tools/octo wasm new` copies, built as a member here. | | [examples/http-client/](examples/http-client/src/lib.rs) | `GET` and `POST` with `octosense_component::http`, a header and a timeout through its request builder (ADR 0014 phase 3). | -| [examples/socket-client/](examples/socket-client/src/lib.rs) | Bounded TCP/UDP echo requests and DNS using `std::net`, without an SDK socket wrapper. Needs the forthcoming `wasm.sockets@1` host API; RC5 does not support it. | +| [examples/socket-client/](examples/socket-client/src/lib.rs) | Bounded TCP/UDP echo requests and DNS using `std::net`, without an SDK socket wrapper. Requires `wasm.sockets@1`, available in [published desktop RC6](../../README.md#compatible-shell-download). RC5 does not support it. | | [examples/host-services/](examples/host-services/src/lib.rs) | Calls to the app's host services with `octosense_component::host` (ADR 0014 phase 3). | | [e2e/](e2e/tests/components.rs) | Builds the examples with plain cargo for `wasm32-wasip2`, loads them in Wasmtime 49 with WASI 0.2 as ADR 0014's runtime does, and calls every function. It links `wasi:http` (`wasmtime-wasi-http` 49) and `octosense:host` as OctoSense's phase 3 runtime does, with copies of its hooks: requests reach any host (here a local HTTP/1.1 server) and end at the call's deadline, and host calls reach fake services. | @@ -51,7 +51,8 @@ The SDK is not on crates.io yet. ADR 0014 publishes it there with a maintainer's approval; until then, a crate depends on it by a git commit of this repository or by path, and `tools/octo wasm new` writes either. OctoSense #453 merged component, HTTP and host-service source integration; -actual app acceptance and a compatible downloadable host remain separate. +[published desktop RC6](../../README.md#compatible-shell-download) adds socket support. +Test each app separately on its claimed platforms. Capability names are usage disclosures; ABI/import checks, app/account scope, quotas, consent and native reviews still apply ([docs/RUST.md](../../docs/RUST.md)). diff --git a/sdk/rust/README.zh-CN.md b/sdk/rust/README.zh-CN.md index ce3cc39b..561af651 100644 --- a/sdk/rust/README.zh-CN.md +++ b/sdk/rust/README.zh-CN.md @@ -21,7 +21,7 @@ pub mod functions { | [examples/type-tour/](examples/type-tour/src/lib.rs) | 双向的每一种类型映射、经由 `getrandom` 获取的随机数，以及在调用之间保留的状态。 | | [examples/template/](examples/template/src/lib.rs) | `tools/octo wasm new` 复制的 [templates/rust-component/src/lib.rs](../../templates/rust-component/src/lib.rs)，在这里作为成员构建。 | | [examples/http-client/](examples/http-client/src/lib.rs) | 用 `octosense_component::http` 发送 `GET` 和 `POST`，并通过它的请求构建器设置请求头和超时（ADR 0014 第 3 阶段）。 | -| [examples/socket-client/](examples/socket-client/src/lib.rs) | 用 `std::net` 发送有界的 TCP/UDP 回显请求并解析 DNS，不增加 SDK 套接字封装。需要即将提供的 `wasm.sockets@1` 宿主 API；RC5 不支持。 | +| [examples/socket-client/](examples/socket-client/src/lib.rs) | 用 `std::net` 发送有界的 TCP/UDP 回显请求并解析 DNS，不增加 SDK 套接字封装。要求 `wasm.sockets@1`，[已发布的桌面 RC6](../../README.zh-CN.md#下载兼容-shell) 提供该 API。RC5 不支持。 | | [examples/host-services/](examples/host-services/src/lib.rs) | 用 `octosense_component::host` 调用应用的宿主服务（ADR 0014 第 3 阶段）。 | | [e2e/](e2e/tests/components.rs) | 用普通的 cargo 为 `wasm32-wasip2` 构建这些示例，像 ADR 0014 的运行时一样在 Wasmtime 49 中以 WASI 0.2 加载，并调用每个函数。它像 OctoSense 第 3 阶段的运行时一样链接 `wasi:http`（`wasmtime-wasi-http` 49）和 `octosense:host`，并照搬其钩子：请求可以访问任何主机（这里是本机的 HTTP/1.1 服务器），并随这次调用的截止时间结束；宿主调用由模拟的服务答复。 | @@ -39,4 +39,4 @@ CI 的 `rust-sdk` 作业在 Ubuntu 上运行它们，并运行 `cargo fmt --all `tools/octo wasm build` 除了加入 `wasm-components-v1`，还会加入 `host-api-v1` 和 `host_api.required: {"wasm.sockets": 1}`，并用 `net` 披露网络用途。 -SDK 尚未发布到 crates.io。ADR 0014 会在维护者批准后发布它；在此之前，crate 通过本仓库的 git 提交或路径依赖它，`tools/octo wasm new` 两种都能写。OctoSense #453 已合并组件、HTTP 和宿主服务的源码集成；真实应用验收和兼容的可下载宿主仍需分别完成。能力名称仅披露用途；ABI/导入检查、应用与账户作用域、配额、实际同意及原生审核仍生效（见 [docs/RUST.zh-CN.md](../../docs/RUST.zh-CN.md)）。 +SDK 尚未发布到 crates.io。ADR 0014 会在维护者批准后发布它；在此之前，crate 通过本仓库的 git 提交或路径依赖它，`tools/octo wasm new` 两种都能写。OctoSense #453 已合并组件、HTTP 和宿主服务的源码集成；[已发布的桌面 RC6](../../README.zh-CN.md#下载兼容-shell) 增加套接字支持；每个应用仍须在其声明的平台上单独测试。能力名称仅披露用途；ABI/导入检查、应用与账户作用域、配额、实际同意及原生审核仍生效（见 [docs/RUST.zh-CN.md](../../docs/RUST.zh-CN.md)）。