arcane-os 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.3.1
+
+- Restored ordinary warn-first Browser Speech operation with explicit
+  `secure:false` defaults, one concise load warning, and truthful
+  `unchecked`/`pending`/`verified`/`failed` integrity telemetry while keeping
+  strict authenticated-graph admission behind explicit `secure:true`.
+- Added atomic hydration for exact saved-but-unregistered STT/TTS selections
+  without a transient provider fallback, including independent mixed
+  browser/Cloud/Core role ownership and mismatch-safe rollback.
+- Continued to resolve speech runtimes, models, voices, and providers from
+  their upstream npm/fetch distribution paths; the SDK package redistributes
+  none of those third-party payloads or their legal corpora.
+
 ## 0.3.0
 
 - Added the branded, versioned, per-realm `globalThis.arcaneEvents` authority

package/README.md

@@ -19,7 +19,7 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.3.0` SDK contract. Applications pin one exact npm
+This checkout defines the `0.3.1` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into immutable
 application artifacts.
 
@@ -132,7 +132,7 @@ uses the same controller for automatic memory extraction.
 Create a new repository-shaped Arcane application with the exact stable SDK:
 
 ```bash
-npx arcane-os@0.3.0 new my-app --path ./my-app --target portable --git
+npx arcane-os@0.3.1 new my-app --path ./my-app --target portable --git
 cd my-app
 npm install
 npm run check
@@ -143,7 +143,7 @@ To enroll an existing repository, install the exact SDK and initialize only
 missing Arcane files:
 
 ```bash
-npm install --save-dev --save-exact arcane-os@0.3.0
+npm install --save-dev --save-exact arcane-os@0.3.1
 npm exec -- arcane init my-app --target portable
 ```
 
@@ -159,7 +159,7 @@ npm exec -- arcane-os targets
 No global SDK install or standalone Arcane CLI is required. The application
 repository's exact npm dependency and lockfile own the CLI and toolchain version.
 
-Use `npx arcane-os@0.3.0` for the initial bootstrap because it names this npm
+Use `npx arcane-os@0.3.1` for the initial bootstrap because it names this npm
 package explicitly; bare `npx arcane` outside an installed project could resolve
 a different package. Both installed commands invoke the same headless toolchain.
 Project-local npm scripts use the SDK pinned by that app's `package-lock.json`,
@@ -180,7 +180,7 @@ node ./bin/arcane.mjs new local-app --path ../local-app --target portable --git
 
 # From the generated app repository
 cd ../local-app
-npm install --save-dev --save-exact ../arcane-os-sdk/arcane-os-0.3.0.tgz
+npm install --save-dev --save-exact ../arcane-os-sdk/arcane-os-0.3.1.tgz
 npm run check
 npm ci
 ```
@@ -191,7 +191,7 @@ still verifies the installed package name and exact version, the locked runtime
 identity, and the runtime bytes. Local directory `file:` dependencies are not
 accepted because npm may install them as links; use a packed `.tgz`. A GitHub
 runner also needs that tarball at the locked path. After publication, replace
-the local declaration with the exact `arcane-os@0.3.0` registry package and
+the local declaration with the exact `arcane-os@0.3.1` registry package and
 commit the regenerated lock.
 
 Generated repositories use `npm ci --ignore-scripts` in CI. Run dependency
@@ -304,7 +304,7 @@ recorded length through a final identity check; an appended byte, concurrent
 growth, path replacement, or hard link fails closed. NFC paths use defined
 UTF-8 byte ordering, covered by one pinned golden bundle digest on every
 supported Node/runner combination. This SDK accepts only the explicitly listed
-`0.3.0` bundle generation; structural validity does not imply cross-SDK
+`0.3.1` bundle generation; structural validity does not imply cross-SDK
 compatibility, and a release with zero payload bytes cannot be created. Portable
 path validation rejects file/directory prefix conflicts, case-colliding prefix
 spellings, and Windows device aliases including superscript COM/LPT digits.
@@ -350,7 +350,7 @@ package installation, or assertions.
 
 ## Current target support
 
-Version `0.3.0` exposes one browser target and five explicitly paired
+Version `0.3.1` exposes one browser target and five explicitly paired
 native development targets: a verified non-runnable portable directory, a
 Windows x64 unsigned-local-test EXE bundle, Linux x64 and Linux ARM64
 unsigned-local-test DEBs, and an Android development-signed APK. The

package/browser-runtime/ARCANE_SDK_BROWSER_RELEASE.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "builder": "arcane-sdk-browser-runtime-v1",
-  "sdkVersion": "0.3.0",
+  "sdkVersion": "0.3.1",
   "source": {
     "authority": "arcane-os-sdk",
     "repository": "https://github.com/TheWizardNexus/arcane-os-sdk.git",
@@ -29,8 +29,8 @@
     ]
   },
   "fileCount": 26,
-  "totalBytes": 9551253,
-  "contentSha256": "164c30c71f4de1affaa335e0d435aa3cca31294f2c98be937b219e5e13e35959",
+  "totalBytes": 9554968,
+  "contentSha256": "1493497265c330507abed847e52e65dc2ce22c15efaf5646ed7ae544b107ad6f",
   "files": [
     {
       "path": "ai/ARCANE_AI_BROWSER_SPEECH_COMPONENTS.json",
@@ -57,15 +57,15 @@
       "path": "ai/browser-speech-artifacts.mjs",
       "sourcePath": "browser-runtime/ai/browser-speech-artifacts.mjs",
       "provenance": "sdk-source-identity",
-      "bytes": 135328,
-      "sha256": "d5eb7d74000f8d91f6e9d19a1f5bffc12feb292d004605b28fc35d368419427d"
+      "bytes": 135988,
+      "sha256": "2587922a708f014ae8b4e819a607b1a5b322fc4eb969e470cd6c068b33b3adcd"
     },
     {
       "path": "ai/browser-speech-providers.mjs",
       "sourcePath": "browser-runtime/ai/browser-speech-providers.mjs",
       "provenance": "sdk-source-identity",
-      "bytes": 56765,
-      "sha256": "abe453aad718f9abc1e1b0911ea45a8f07e77f916e48d87cd661397e06084195"
+      "bytes": 59278,
+      "sha256": "84802cba366c3a54013214240ebaf3ae2896322efc965aab4054a61ca9d06aab"
     },
     {
       "path": "ai/browser-speech.mjs",
@@ -120,15 +120,15 @@
       "path": "ai/speech-worker-client.mjs",
       "sourcePath": "browser-runtime/ai/speech-worker-client.mjs",
       "provenance": "sdk-source-identity",
-      "bytes": 14130,
-      "sha256": "833565bcad0cb6091bfccc4b5e42542362b149a9ffd6ecc0b1b0440ae70efb58"
+      "bytes": 14247,
+      "sha256": "2e5580a86d5adc4f44a0d680e1820437b8d22b5555bf73a36b361ee50d24b3f5"
     },
     {
       "path": "ai/speech-worker-runtime.mjs",
       "sourcePath": "browser-runtime/ai/speech-worker-runtime.mjs",
       "provenance": "sdk-source-identity",
-      "bytes": 90700,
-      "sha256": "4449fddbc1963f2c51f524b4a44993d88a28124482d96d183cd3e28f4ebdf1c8"
+      "bytes": 91125,
+      "sha256": "c865ad9a84df30ea1d14c81e7bb5c38666afdb65d5237472cdabfb11e7c66de4"
     },
     {
       "path": "ai/wllama/LICENCE",

package/browser-runtime/ai/browser-speech-artifacts.mjs

@@ -2863,13 +2863,6 @@ function assertArtifactGraphStaticImportClosure(metadata) {
 }
 
 async function inspectArtifactGraphRuntime(admitted, metadata, signal, security) {
-  if (security?.secure !== true) {
-    return Object.freeze({
-      plans: new Map(),
-      order: Object.freeze([]),
-      warnings: Object.freeze(["artifact-graph-runtime-unchecked"]),
-    });
-  }
   const admittedByPath = new Map(admitted.files.map((entry) => [entry.descriptor.path, entry]));
   const plans = new Map();
   for (const descriptor of metadata.runtimeFiles) {
@@ -2903,15 +2896,25 @@ async function inspectArtifactGraphRuntime(admitted, metadata, signal, security)
   const order = assertArtifactGraphStaticImportClosure(metadata);
   const warnings = [...new Set([...plans.values()].flatMap((plan) => plan.warnings))]
     .sort();
-  if (security?.secure !== true && warnings.length > 0) {
-    globalThis.console?.warn?.(
-      `Arcane browser speech warn-first mode allowed runtime capabilities: ${warnings.join(", ")}.`,
-    );
-  }
   throwIfAborted(signal);
   return Object.freeze({ plans, order, warnings: Object.freeze(warnings) });
 }
 
+function assertArtifactGraphRuntimeInspection(inspection) {
+  if (
+    !inspection
+    || !(inspection.plans instanceof Map)
+    || !Array.isArray(inspection.order)
+    || !Array.isArray(inspection.warnings)
+  ) {
+    throw artifactGraphError(
+      "artifact-graph-runtime-inspection-missing",
+      "Artifact graph runtime inspection is required before executable materialization.",
+    );
+  }
+  return inspection;
+}
+
 function applyArtifactGraphModuleTransforms(plan, materializedByPath, guardCapability) {
   const replacements = [];
   for (let index = 0; index < plan.staticImports.length; index += 1) {
@@ -3033,6 +3036,7 @@ async function createArtifactGraphObjectUrls(admitted, metadata, inspection, sec
   const created = [];
   const createdIdentities = new Set();
   const guardCapability = artifactGraphGuardCapability();
+  const runtimeInspection = assertArtifactGraphRuntimeInspection(inspection);
   async function materialize(descriptor, body) {
     const blob = body instanceof Blob && body.type === descriptor.mediaType
       ? body
@@ -3131,20 +3135,42 @@ async function createArtifactGraphObjectUrls(admitted, metadata, inspection, sec
   try {
     for (const descriptor of metadata.files) {
       if (ARTIFACT_GRAPH_JAVASCRIPT_KINDS.has(descriptor.kind)) continue;
-      await materialize(descriptor, admittedByPath.get(descriptor.path).file);
+      const admittedFile = admittedByPath.get(descriptor.path)?.file;
+      if (!admittedFile) {
+        throw artifactGraphError(
+          "artifact-graph-materialized-source-file-missing",
+          `Artifact graph file ${descriptor.path} is unavailable for materialization.`,
+        );
+      }
+      await materialize(descriptor, admittedFile);
     }
-    for (const path of inspection.order) {
+    for (const path of runtimeInspection.order) {
       const descriptor = metadata.filesByPath.get(path);
-      const plan = inspection.plans.get(path);
+      const plan = runtimeInspection.plans.get(path);
+      if (!descriptor || !plan) {
+        throw artifactGraphError(
+          "artifact-graph-runtime-inspection-incomplete",
+          `Artifact graph runtime inspection is incomplete for ${path}.`,
+        );
+      }
       await materialize(
         descriptor,
         applyArtifactGraphModuleTransforms(plan, materializedByPath, guardCapability),
       );
     }
+    const files = metadata.files.map((descriptor) => {
+      const materialized = materializedByPath.get(descriptor.path);
+      if (!materialized) {
+        throw artifactGraphError(
+          "artifact-graph-materialization-incomplete",
+          `Artifact graph file ${descriptor.path} was not materialized.`,
+        );
+      }
+      return materialized;
+    });
     return Object.freeze({
       guardCapability,
-      files: Object.freeze(metadata.files.map((descriptor) =>
-        materializedByPath.get(descriptor.path))),
+      files: Object.freeze(files),
       release() {
         for (const url of created.splice(0).reverse()) {
           try {
@@ -3436,11 +3462,9 @@ export function createDbopfsSpeechArtifactStore({
       files.push({ descriptor, file });
     }
     try {
-      const inspection = graph && security.secure
+      const inspection = graph
         ? await inspectArtifactGraphRuntime({ files }, metadata, signal, security)
-        : graph
-          ? null
-          : (await assertSelfContainedRuntime({ files }, metadata, security), null);
+        : (await assertSelfContainedRuntime({ files }, metadata, security), null);
       throwIfAborted(signal);
       return Object.freeze({
         files: Object.freeze(files),
@@ -3734,11 +3758,9 @@ export function createDbopfsSpeechArtifactStore({
         }
         installed.push({ descriptor, file });
       }
-      const inspection = graph && security.secure
+      const inspection = graph
         ? await inspectArtifactGraphRuntime({ files: installed }, metadata, signal, security)
-        : graph
-          ? null
-          : (await assertSelfContainedRuntime({ files: installed }, metadata, security), null);
+        : (await assertSelfContainedRuntime({ files: installed }, metadata, security), null);
       throwIfAborted(signal);
       const manifest = Object.freeze({
         schema: graph ? ARTIFACT_GRAPH_MANIFEST_SCHEMA : MANIFEST_SCHEMA,
@@ -3789,12 +3811,6 @@ export function createDbopfsSpeechArtifactStore({
       throw error;
     }
     const metadata = artifactMetadata(authority);
-    if (graph && effectiveSecurity.secure !== true) {
-      throw artifactGraphError(
-        "artifact-graph-secure-mode-required",
-        "Browser speech artifact graphs require explicit secure:true.",
-      );
-    }
     assertSecurityDescriptors(metadata.files, effectiveSecurity);
     const cached = await openCached(authority, {
       signal,
@@ -3812,7 +3828,7 @@ export function createDbopfsSpeechArtifactStore({
       if (graph) {
         throw artifactGraphError(
           "artifact-graph-offline-cache-miss",
-          "No complete verified offline artifact graph cache is available.",
+          "No complete admitted offline artifact graph cache is available.",
         );
       }
       throw speechError("ARCANE_AI_ARTIFACT_OFFLINE_MISS", "No admitted offline speech cache is available.");
@@ -3837,12 +3853,14 @@ export function createDbopfsSpeechArtifactStore({
         cache: artifactGraphAdmission,
         artifactGraphId: authority.identitySha256,
         artifactGraphAdmission,
+        warnings: admitted.inspection.warnings,
         security: effectiveSecurity,
         runtime: Object.freeze({
           ...metadata.runtime,
           files: runtimeFiles,
           edges: metadata.edges,
           transforms: metadata.transforms,
+          warnings: admitted.inspection.warnings,
           guardCapability: materialized.guardCapability,
           artifactGraphId: authority.identitySha256,
           artifactGraphAdmission,

package/browser-runtime/ai/browser-speech-providers.mjs

@@ -27,6 +27,9 @@ const ROLE_REQUEST_REASON = Object.freeze({
   tts: "tts-synthesis-cancelled",
 });
 const UNMAPPED_PROVIDER_REASON = "browser-speech-provider-error-reason-unmapped";
+const WARN_FIRST_WARNING = "browser-speech-warn-first-secure-mode-disabled";
+const NO_PROVIDER_WARNINGS = Object.freeze([]);
+const WARN_FIRST_PROVIDER_WARNINGS = Object.freeze([WARN_FIRST_WARNING]);
 const WORKER_FAILURE_CODES = new Set([
   "ARCANE_AI_WORKER_CRASHED",
   "ARCANE_AI_WORKER_MESSAGE_ERROR",
@@ -298,6 +301,34 @@ function graphSecurity(scope, label) {
   return normalizeModelSecurity(scope, label);
 }
 
+function providerIntegrity(security, outcome = "pending") {
+  const enabledCount = Number(security.checks.byteLength)
+    + Number(security.checks.sha256);
+  const state = enabledCount === 0 ? "unchecked" : outcome;
+  if (!["unchecked", "pending", "verified", "failed"].includes(state)) {
+    throw new TypeError("Browser speech integrity outcome is invalid.");
+  }
+  return Object.freeze({
+    state,
+    byteLength: Object.freeze({
+      enabled: security.checks.byteLength,
+      state: security.checks.byteLength ? state : "unchecked",
+    }),
+    sha256: Object.freeze({
+      enabled: security.checks.sha256,
+      state: security.checks.sha256 ? state : "unchecked",
+    }),
+  });
+}
+
+function providerWarnings(security, runtimeWarnings = NO_PROVIDER_WARNINGS) {
+  const warnings = security.secure === true
+    ? runtimeWarnings
+    : [...WARN_FIRST_PROVIDER_WARNINGS, ...runtimeWarnings];
+  if (warnings.length === 0) return NO_PROVIDER_WARNINGS;
+  return Object.freeze([...new Set(warnings)]);
+}
+
 function publicStatus({
   role,
   id,
@@ -311,6 +342,8 @@ function publicStatus({
   activeOperation,
   artifactGraphAdmission,
   security,
+  integrity,
+  warnings,
 }) {
   return Object.freeze({
     role,
@@ -326,6 +359,8 @@ function publicStatus({
     errorCode,
     cache,
     security,
+    integrity,
+    warnings,
     artifactGraphId: authority.artifactGraphId ?? null,
     artifactGraphAdmission,
   });
@@ -1101,8 +1136,22 @@ function createBrowserSpeechProvider({
   let unloadOperation = null;
   let disposeOperation = null;
   let requestOperation = null;
+  let lastWarnings = NO_PROVIDER_WARNINGS;
+  let lastIntegrity = Object.freeze({
+    security: defaultSecurity,
+    integrity: providerIntegrity(defaultSecurity),
+  });
 
   function status() {
+    const effectiveSecurity = active?.security
+      ?? loadOperation?.security
+      ?? lastIntegrity.security;
+    const integrity = active?.integrity
+      ?? loadOperation?.integrity
+      ?? lastIntegrity.integrity;
+    const runtimeWarnings = active?.warnings
+      ?? loadOperation?.warnings
+      ?? lastWarnings;
     return publicStatus({
       role,
       id: providerId,
@@ -1115,7 +1164,9 @@ function createBrowserSpeechProvider({
       lifecycleReason,
       activeOperation,
       artifactGraphAdmission,
-      security: active?.security ?? loadOperation?.security ?? defaultSecurity,
+      security: effectiveSecurity,
+      integrity,
+      warnings: providerWarnings(effectiveSecurity, runtimeWarnings),
     });
   }
 
@@ -1270,14 +1321,6 @@ function createBrowserSpeechProvider({
               "Browser speech graph load security",
             ),
           });
-          if (effectiveSecurity.secure !== true) {
-            throw providerError(
-              "ARCANE_AI_SECURE_MODE_REQUIRED",
-              "Authenticated browser speech artifact graphs require explicit secure:true.",
-              undefined,
-              `${role}-artifact-graph-secure-mode-required`,
-            );
-          }
         } else {
           effectiveSecurity = resolveModelSecurity({
             app: configuredAppSecurity,
@@ -1320,6 +1363,8 @@ function createBrowserSpeechProvider({
       const record = {
         promise: null,
         security: effectiveSecurity,
+        integrity: providerIntegrity(effectiveSecurity),
+        warnings: NO_PROVIDER_WARNINGS,
         observers: new Set(),
         settled: false,
         hasProgress: false,
@@ -1334,6 +1379,11 @@ function createBrowserSpeechProvider({
           for (const observer of [...record.observers]) observer.progress(progress);
         },
       };
+      lastIntegrity = Object.freeze({
+        security: effectiveSecurity,
+        integrity: record.integrity,
+      });
+      lastWarnings = NO_PROVIDER_WARNINGS;
       const promise = Promise.resolve().then(async () => {
         let prepared = null;
         let slot = null;
@@ -1344,6 +1394,15 @@ function createBrowserSpeechProvider({
             offline,
             security: effectiveSecurity,
           });
+          record.integrity = providerIntegrity(effectiveSecurity, "verified");
+          record.warnings = Array.isArray(prepared.warnings)
+            ? Object.freeze([...prepared.warnings])
+            : NO_PROVIDER_WARNINGS;
+          lastIntegrity = Object.freeze({
+            security: effectiveSecurity,
+            integrity: record.integrity,
+          });
+          lastWarnings = record.warnings;
           throwIfAborted(
             linked.controller.signal,
             () => linked.reason(`${role}-load-cancelled`),
@@ -1363,6 +1422,8 @@ function createBrowserSpeechProvider({
             released: false,
             client: null,
             security: effectiveSecurity,
+            integrity: record.integrity,
+            warnings: record.warnings,
           };
           slot.client = createSpeechWorkerClient({
             role,
@@ -1447,6 +1508,13 @@ function createBrowserSpeechProvider({
           let failure = linked.controller.signal.aborted
             ? linkedAbortFailure(linked, `${role}-load-cancelled`)
             : trustedLoadFailure(error, role);
+          if (!linked.controller.signal.aborted && prepared === null) {
+            record.integrity = providerIntegrity(effectiveSecurity, "failed");
+            lastIntegrity = Object.freeze({
+              security: effectiveSecurity,
+              integrity: record.integrity,
+            });
+          }
           try {
             if (slot) await terminateSlot(slot, failure);
             else prepared?.release();

package/browser-runtime/ai/speech-worker-client.mjs

@@ -176,7 +176,7 @@ class SpeechWorkerClient {
     if (typeof MessageChannelConstructor !== "function") {
       throw clientError(
         "ARCANE_AI_WORKER_MESSAGE_ERROR",
-        "Authenticated artifact graph loading requires MessageChannel.",
+        "Strict artifact graph loading requires MessageChannel.",
         undefined,
         "artifact-graph-private-message-channel-unavailable",
       );
@@ -294,18 +294,20 @@ class SpeechWorkerClient {
       worker = this.#start();
       const graphLoad = op === "load"
         && payload?.configuration?.runtime?.moduleGraph === ARTIFACT_GRAPH_MODULE_GRAPH;
-      if (graphLoad) {
+      const strictGraphLoad = graphLoad
+        && payload?.configuration?.security?.secure === true;
+      if (strictGraphLoad) {
         initialPrivatePort = this.#establishPrivateTransport();
       } else if (this.#transportMode === null) {
         this.#transportMode = "worker-global-message";
         this.#transport = worker;
       }
       if (op === "load"
-        && !graphLoad
+        && !strictGraphLoad
         && this.#transportMode === "private-message-port") {
         throw clientError(
           "ARCANE_AI_ADAPTER_PROTOCOL_MISMATCH",
-          "A private artifact graph Worker cannot load a legacy runtime descriptor.",
+          "A private strict artifact graph Worker cannot load an ordinary runtime descriptor.",
           undefined,
           `${this.#role}-worker-runtime-transport-mode-mismatch`,
         );

package/browser-runtime/ai/speech-worker-runtime.mjs

@@ -7,7 +7,7 @@ const ARTIFACT_GRAPH_MODULE_GRAPH =
 const GRAPH_GUARD_NAME = "__arcaneBrowserSpeechArtifactGraphGuardsV1";
 const NESTED_WORKER_PROTOCOL =
   "arcane-ai-browser-speech-artifact-module-worker/1";
-const STRICT_GRAPH_ADMISSIONS = new Set([
+const GRAPH_ADMISSIONS = new Set([
   "artifact-graph-network-dbopfs-verified",
   "artifact-graph-dbopfs-cache-verified",
   "artifact-graph-offline-dbopfs-cache-verified",
@@ -695,14 +695,24 @@ function validateConfiguration(configuration, role) {
       paths.add(file.path);
     }
     const runtimePaths = new Set(configuration.runtime.files.map((file) => file.path));
+    const security = configuration.security;
+    const securityChecks = security?.checks;
     if (
-      configuration.security?.secure !== true
+      !security
+      || typeof security !== "object"
+      || Array.isArray(security)
+      || typeof security.secure !== "boolean"
+      || !securityChecks
+      || typeof securityChecks !== "object"
+      || Array.isArray(securityChecks)
+      || typeof securityChecks.byteLength !== "boolean"
+      || typeof securityChecks.sha256 !== "boolean"
       || typeof configuration.runtime.artifactGraphId !== "string"
       || !/^[a-f0-9]{64}$/u.test(configuration.runtime.artifactGraphId)
       || (
         typeof configuration.runtime.guardCapability !== "string"
         || !/^[a-f0-9]{64}$/u.test(configuration.runtime.guardCapability)
-        || !STRICT_GRAPH_ADMISSIONS.has(configuration.runtime.artifactGraphAdmission)
+        || !GRAPH_ADMISSIONS.has(configuration.runtime.artifactGraphAdmission)
         || !configuration.runtime.edges
         || typeof configuration.runtime.edges !== "object"
         || !Array.isArray(configuration.runtime.transforms)
@@ -710,7 +720,7 @@ function validateConfiguration(configuration, role) {
     ) {
       throw workerError(
         "ARCANE_AI_ARTIFACT_GRAPH_CONFIGURATION_INVALID",
-        "Explicit secure:true plus authenticated artifact graph identity, admission, edges, and transforms are required.",
+        "Artifact graph security, identity, admission, edges, and transforms are required.",
         undefined,
         "artifact-graph-worker-configuration-incomplete",
       );
@@ -2293,7 +2303,7 @@ export function createSpeechWorkerRuntime({ role, scope = globalThis, send } = {
       configuration = validateConfiguration(request.payload?.configuration, role);
       const entry = configuration.runtime.files.find((file) =>
         file.path === configuration.runtime.entry);
-      if (graphConfiguration(configuration) && configuration.security?.secure === true) {
+      if (graphConfiguration(configuration)) {
         environment = installArtifactGraphEnvironment(scope, configuration, role);
       } else if (configuration.security?.secure === true) {
         const legacyFetch = installLegacyAuthorizedFetch(scope, configuration);
@@ -2561,8 +2571,10 @@ export function installBrowserSpeechWorker(role, scope = globalThis) {
     const requestedPort = privatePort(event.data?.privatePort);
     const isGraphLoad = event.data?.op === "load"
       && graphConfiguration(event.data?.payload?.configuration);
+    const isStrictGraphLoad = isGraphLoad
+      && event.data?.payload?.configuration?.security?.secure === true;
     if (requestedPort) {
-      if (!isGraphLoad || transportMode !== null) return;
+      if (!isStrictGraphLoad || transportMode !== null) return;
       transportMode = "private-message-port";
       transport = requestedPort;
       requestedPort.addEventListener("message", (portEvent) => receive(portEvent.data));
@@ -2572,14 +2584,14 @@ export function installBrowserSpeechWorker(role, scope = globalThis) {
       receive(request);
       return;
     }
-    if (isGraphLoad) {
+    if (isStrictGraphLoad) {
       scope.postMessage({
         protocol: SPEECH_WORKER_PROTOCOL,
         id: event.data.id,
         ok: false,
         error: serializedError(workerError(
           "ARCANE_AI_ARTIFACT_GRAPH_ISOLATION_UNAVAILABLE",
-          "Authenticated artifact graph loading requires a private MessagePort.",
+          "Strict artifact graph loading requires a private MessagePort.",
           undefined,
           "artifact-graph-private-message-port-missing",
         ), role, "load"),

package/docs/architecture.md

@@ -200,7 +200,7 @@ length with an EOF growth probe, and rechecked by handle and pathname identity.
 Every cumulative path prefix has one case-folded spelling and one file/directory
 kind; prefix topology conflicts and the complete portable Windows device-name
 set fail before creation or admission.
-The current SDK admits only the explicitly compatible `0.3.0` bundle
+The current SDK admits only the explicitly compatible `0.3.1` bundle
 generation and rejects zero-byte payload releases.
 
 Promotion retains any prior output as an identity-bound backup until the new
@@ -320,7 +320,7 @@ through SDK-bound verified readers rather than accepting a mutable source path
 as authority. Build completion requires provider verification, and later
 verify/run calls receive the exact artifact receipt.
 
-The SDK `0.3.0` runtime requires Arcane `0.8.12` or newer. Compatibility
+The SDK `0.3.1` runtime requires Arcane `0.8.12` or newer. Compatibility
 is contractual rather than exact-version pinning: the prepared Core must meet
 the highest minimum declared by the runtime, selected app, and bundled app
 dependencies; keep each app's Arcane protocol generation; and provide every

package/docs/reference/README.md

@@ -58,25 +58,23 @@ See [Core reference provenance](core/README.md) for the imported inventory and
 the exact distinction between a documentation snapshot and shipped runtime
 bytes.
 
-## Published 0.2.3
+## Published 0.3.0
 
-The most recently verified published package before this 0.3.0 source candidate
-is exactly `arcane-os@0.2.3` from source commit
-`d717f21d45664d20e4ed6377596db87c47492e11`. The npm `latest` dist-tag resolves
-to `0.2.3`; the separate `dev` dist-tag remains `0.1.0-dev.5`.
+The verified published package is exactly `arcane-os@0.3.0` from source commit
+`72239d0221279b461f1be08b02a70105f4cf7364`. The npm `latest` dist-tag resolves
+to `0.3.0`; the separate `dev` dist-tag remains `0.1.0-dev.5`.
 
-The singleton-event, Mail, warn-first Browser Speech, and mixed-route contracts
-documented below are newer canonical source. They are not package authority in
-`0.2.3`; consumers require the numeric 0.3.0 publication before relying on them.
+The singleton-event, Mail, warn-first Browser Speech, and independent mixed-route
+contracts documented below are included in this exact package authority.
 
 | Evidence | Exact value |
 | --- | --- |
-| npm integrity | `sha512-TZewkGM7dh9PdVnOtnkBO7QalJ6qyWWdKruCmsTxoHyeoG5XpqVbkNgiJhtBLhrIzgUV3vydYplxZQkIbIWoHg==` |
-| npm shasum | `8e978a23289a41db130253e6475a0c8bb0c0d73f` |
-| Immutable release tarball | `arcane-os-0.2.3.tgz`; 6,999,078 bytes; SHA-256 `857f179c2f9d4549e7691b4e6cebc49e5ab5e18600816443b26319c61fc1f85d` |
-| GitHub release | [`0.2.3`](https://github.com/TheWizardNexus/arcane-os-sdk/releases/tag/0.2.3) (tag and title are both exactly `0.2.3`) |
-| Hosted source/artifact gate | [Check run 33052271534](https://github.com/TheWizardNexus/arcane-os-sdk/actions/runs/33052271534) |
-| Trusted publication | [Run 33052383457](https://github.com/TheWizardNexus/arcane-os-sdk/actions/runs/33052383457) |
+| npm integrity | `sha512-dh7QfM1ur48hOyMez1XWjym/LJcOAYy+Xl3KcvVQ6ewwX5N7ER82PQx6LE+zSb5sHVtz4TOU2AuARsrFNSwuVw==` |
+| npm shasum | `94075dad9c3974b0e069ecfe09f8d612d8a30ea7` |
+| Immutable release tarball | `arcane-os-0.3.0.tgz`; 7,230,292 bytes; SHA-256 `4afdb8113d8408b03917b73ce45e25bf4d302577fc6f199165d4931dda8ca081` |
+| GitHub release | [`0.3.0`](https://github.com/TheWizardNexus/arcane-os-sdk/releases/tag/0.3.0) (tag and title are both exactly `0.3.0`) |
+| Hosted source/artifact gate | [Check run 33130699235](https://github.com/TheWizardNexus/arcane-os-sdk/actions/runs/33130699235) |
+| Trusted publication | [Run 33131083176](https://github.com/TheWizardNexus/arcane-os-sdk/actions/runs/33131083176) |
 
 The npm SLSA provenance binds the published package to that exact source commit
 and `.github/workflows/publish-dev.yml`. Hashes prove byte identity or

package/docs/reference/ai/browser-speech-package-authority.json

@@ -822,7 +822,7 @@
       "closureStatus": "browser-speech-runtime-resolved-from-upstream-packages-and-provider-downloads",
       "publicationStatus": "browser-speech-public-runtime-ready-warn-first-secure-opt-in"
     },
-    "deferredReleaseBoundary": "The combined numeric 0.3.0 package, runtime/browser receipts, npm integrity/provenance, tag, and GitHub release remain assigned to the shared release owner after Browser Speech, singleton events, and Mail source increments are reconciled."
+    "deferredReleaseBoundary": "The additive numeric 0.3.1 package, runtime/browser receipts, npm integrity/provenance, tag, and GitHub release remain assigned to the shared release owner after the warn-first and exact selected-route corrections are reconciled."
   },
   "omittedUntilVerified": [
     "Final composite SPDX license expressions for the bundled JavaScript entrypoints.",