@astrale-os/kernel-protocol 0.5.0-beta.31 → 0.5.0-beta.32

package/CHANGELOG.md

@@ -24,6 +24,14 @@
 * the first supported V2 release is a coordinated `1.0.0`, not a compatible continuation of the
   current `0.x` line; package and wire versions remain independent as specified in
   [the protocol architecture](./.spec/architecture.md)
+## [0.5.0-beta.32](https://github.com/astrale-os/kernel/compare/kernel-protocol-v0.5.0-beta.31...kernel-protocol-v0.5.0-beta.32) (2026-08-31)
+
+
+### Bug Fixes
+
+* **api:** keep profile validation runtime-safe ([#589](https://github.com/astrale-os/kernel/issues/589)) ([fd5c5f6](https://github.com/astrale-os/kernel/commit/fd5c5f6e7e6b2a4b617ccffe9efa605c05ea0c52))
+* **protocol:** keep profile identity reference portable ([#592](https://github.com/astrale-os/kernel/issues/592)) ([c942216](https://github.com/astrale-os/kernel/commit/c942216fa52c0344ef74cf1dea49229e7981d9bf))
+
 ## [0.5.0-beta.31](https://github.com/astrale-os/kernel/compare/kernel-protocol-v0.5.0-beta.30...kernel-protocol-v0.5.0-beta.31) (2026-08-31)
 
 

package/dist/publication/index.d.ts

@@ -1,4 +1,4 @@
-export { MEDIA_TYPE, PATH, url, seal, accept, acceptStored, encode, type Publication, type StoredPublication, } from './publication.js';
+export { MEDIA_TYPE, PATH, url, seal, accept, encode, type Publication } from './publication.js';
 export { acceptBundle, decodeBundle } from './bundle-admission.js';
 export { BUNDLE_MEDIA_TYPE, describeBundle, type BundleDescriptor } from './bundle.js';
 export { verifyBundleBytes } from './bundle-evidence.js';

package/dist/publication/index.js

@@ -1,4 +1,4 @@
-export { MEDIA_TYPE, PATH, url, seal, accept, acceptStored, encode, } from './publication.js';
+export { MEDIA_TYPE, PATH, url, seal, accept, encode } from './publication.js';
 export { acceptBundle, decodeBundle } from './bundle-admission.js';
 export { BUNDLE_MEDIA_TYPE, describeBundle } from './bundle.js';
 export { verifyBundleBytes } from './bundle-evidence.js';

package/dist/publication/publication.d.ts

@@ -31,16 +31,6 @@ export interface Publication {
     readonly routes: readonly HttpRoute[];
     readonly delivery?: DeliveryEndpoint;
 }
-/** Canonical semantic Publication plus its exact coordinate in durable storage. */
-export interface StoredPublication {
-    readonly publication: Publication;
-    readonly deployedEtag: Etag;
-}
 export declare function seal(input: Content): Publication;
 export declare function accept(input: unknown): Publication;
-/**
- * Admit a canonical Publication retained before the admin-to-authority vocabulary cutover.
- * Network admission remains strict; this one-way reader exists only for already-trusted storage.
- */
-export declare function acceptStored(input: unknown): StoredPublication;
 export declare function encode(input: Publication): Uint8Array;

package/dist/publication/publication.js

@@ -44,40 +44,6 @@ export function accept(input) {
     }
     return publication;
 }
-/**
- * Admit a canonical Publication retained before the admin-to-authority vocabulary cutover.
- * Network admission remains strict; this one-way reader exists only for already-trusted storage.
- */
-export function acceptStored(input) {
-    try {
-        const publication = accept(input);
-        return deepFreeze({ publication, deployedEtag: publication.etag });
-    }
-    catch (currentFailure) {
-        const value = record(input, 'PUBLICATION_INVALID', 'Expected a Publication object.');
-        const requirements = record(value.requirements, 'PUBLICATION_INVALID', 'Publication requirements are invalid.');
-        const capabilities = record(requirements.capabilities, 'PUBLICATION_INVALID', 'Publication capability requirements are invalid.');
-        if (capabilities.admin === undefined)
-            throw currentFailure;
-        if (capabilities.authority !== undefined) {
-            fail('PUBLICATION_INVALID', 'Publication cannot mix admin and authority requirements.');
-        }
-        const { etag, ...content } = value;
-        const admittedEtag = admitDigest(etag);
-        if (admittedEtag !== computeEtag(content)) {
-            fail('PUBLICATION_ETAG_MISMATCH', 'Publication ETag does not match its canonical content.');
-        }
-        const { admin, ...currentCapabilities } = capabilities;
-        const admitted = acceptPublication({
-            ...value,
-            requirements: {
-                ...requirements,
-                capabilities: { ...currentCapabilities, authority: admin },
-            },
-        }, true);
-        return deepFreeze({ publication: seal(withoutEtag(admitted)), deployedEtag: admittedEtag });
-    }
-}
 export function encode(input) {
     return portable.json.encode(input);
 }

package/dist/publication/requirements.js

@@ -1,10 +1,13 @@
-import { K } from '@astrale-os/kernel-core/schema';
 import { AuthorityOperationOrder } from '@astrale-os/kernel-core/schema/authority/operation';
-import { schema as schemaApi } from '@astrale-os/kernel-dsl/v1';
 import { acceptDefinitionRef, callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import { revision } from '@astrale-os/kernel-dsl/v1/schema/revision';
 import { array, deepFreeze, exact, record, unique } from './content.js';
 import { fail } from './error.js';
+const KernelIdentityClass = Object.freeze({
+    origin: 'kernel.astrale.ai',
+    kind: 'class',
+    name: 'Identity',
+});
 export const ClassOperationOrder = Object.freeze([
     'create',
     'read',
@@ -106,18 +109,11 @@ export function validateRequirements(root, closure, requirements) {
             fail('PUBLICATION_INVALID', 'Class capability requirement names an unknown dependency Class.');
         }
     }
-    const resolvedRoot = requirements.capabilities.profiles === undefined
-        ? undefined
-        : schemaApi.resolve(schemaApi.accept(root, {
-            get(origin, expectedRevision) {
-                return closure.find((dependency) => dependency.origin === origin && revision(dependency) === expectedRevision);
-            },
-        }));
     for (const profile of requirements.capabilities.profiles ?? []) {
-        const subject = resolvedRoot.core.nodes[profile.subject.name];
+        const subject = root.core.nodes[profile.subject.name];
         if (profile.subject.origin !== root.origin ||
             subject === undefined ||
-            !subject.class.satisfies(K.classes.Identity)) {
+            !classSatisfies(root, dependencies, subject.class, KernelIdentityClass)) {
             fail('PUBLICATION_INVALID', 'Capability profile subject must name one local Core Identity.');
         }
         for (const callable of profile.functions ?? []) {
@@ -137,6 +133,22 @@ export function validateRequirements(root, closure, requirements) {
         }
     }
 }
+function classSatisfies(root, dependencies, candidate, expected) {
+    const expectedKey = Key.of(expected);
+    const visited = new Set();
+    const visit = (reference) => {
+        const key = Key.of(reference);
+        if (key === expectedKey)
+            return true;
+        if (visited.has(key))
+            return false;
+        visited.add(key);
+        const owner = reference.origin === root.origin ? root : dependencies.get(reference.origin);
+        const definition = owner?.classes[reference.name];
+        return definition?.kind === 'node' && definition.extends.some(visit);
+    };
+    return visit(candidate);
+}
 function exactDependencyClosure(root, closure) {
     const supplied = new Map(closure.map((dependency) => [dependency.origin, dependency]));
     const reachable = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-protocol",
-  "version": "0.5.0-beta.31",
+  "version": "0.5.0-beta.32",
   "description": "Portable Astrale invocation, publication, installation, routing, and issuer protocols",
   "license": "Apache-2.0",
   "repository": {