sept-agent 0.1.1 → 0.1.2

package/README.md

@@ -6,7 +6,9 @@ SEPT is a durable, single-slot task worker for Node.js, built on the native Pi D
 
 Requires Node.js **22.19.0 or newer**, ESM, Pi credentials or a suitable configured model, persistent local state, and an operator-supplied Docker Linux hands namespace. Valid hands are required even for text-only tasks. The package does not install Docker, serve models or provision hands.
 
-After npm publication, add SEPT to your application with `npm install --save-exact sept-agent`. The command is `sept` and the import name is `sept-agent`.
+The npm worker runs natively on Linux and macOS; task effects use Linux Docker containers. Apple Silicon uses the ARM64 image through Docker Desktop. Published image tags select AMD64 or ARM64 automatically. Native Windows and Intel Mac task execution remain unqualified. See [release verification](https://github.com/DB-Conneely/sept/blob/main/docs/releasing.md) for exact proof boundaries.
+
+Add SEPT to your application with `npm install --save-exact sept-agent`. The command is `sept` and the import name is `sept-agent`.
 
 To install a retained exact package artifact for a qualified source revision:
 

package/docs/index.md

@@ -6,7 +6,7 @@ This is the canonical Markdown corpus for people and AI assistants. Read these s
 
 This corpus describes `sept-agent@0.1.0`, ESM on Node.js >=22.19.0, with installed Pi 1.1.0. Only `sept-agent`, `sept-agent/client` and `sept-agent/hands` are npm APIs; internal source/mechanism barrels are not public entries. CommonJS, browser use and native Windows worker operation are unsupported.
 
-Execution uses an explicitly supplied local Docker Linux Engine (API 1.44–1.52, cgroup v2) and the matching SEPT image. Installing npm does not compile the C helpers or apply the image-only overlay. Build from a pinned full source checkout; the tarball intentionally excludes the build/test context.
+Execution uses an explicitly supplied local Docker Linux Engine (API 1.44–1.52, cgroup v2) and the matching SEPT image. Installing npm does not compile the C helpers or apply the image-only overlay. Published versioned image tags select Linux AMD64 or ARM64 automatically. On macOS the Node worker runs on the host and Docker Desktop supplies Linux containers. Native Apple Silicon task execution is qualified separately; Intel Mac package install/worker lifecycle checks do not establish task/effect support. Building locally requires a pinned full source checkout; the tarball intentionally excludes the build/test context.
 
 The prior portability qualification is historical: executable source `3bf4f560e4989005469431c16a67fd911398fa01`, confirmed at docs-only commit `d361123d7c242db5af3ae2d1cb4daea4a2acdeff`. Its [repository-only as-built record](https://github.com/DB-Conneely/sept/blob/d361123d7c242db5af3ae2d1cb4daea4a2acdeff/docs/as-built/capability-confinement.md) records native abyss Ubuntu26.04.1/x86_64, kernel7.0.0-38, Docker29.1.3/cgroup v2 and Node 22.22.1; native Mac ARM qualifies only its scoped Docker Linux path. This does not certify a later package/image. Full Darwin, Intel Mac, Windows/WSL and arbitrary combinations remain unqualified. The [Pi contract qualifications](pi-contract.md#portability-qualification) retain the exact network/provider/security/evidence limits.
 

package/docs/pi-contract.md

@@ -100,17 +100,20 @@ These commands are operator-owned setup for one **local** Docker Linux Engine, n
 
 ### Pin source, image and Engine authority
 
-Build images from a **complete pinned source checkout**, using an operator-selected commit. The npm artifact is intentionally not a Docker build context: it does not ship the test/compiler/helper-build context. A separate checkout at the required revision avoids modifying another working tree.
+Prefer the matching published image: install `sept-agent@0.1.2` and use `ghcr.io/db-conneely/sept:0.1.2`; Docker selects Linux AMD64 or ARM64 for the Engine. The host Node worker can run on macOS, with Docker Desktop supplying Linux hands. Choose its socket explicitly, usually `$HOME/.docker/run/docker.sock`, even if the default Docker context points to another server. Intel Mac task/effect execution remains unqualified; hosted Intel checks establish package/worker lifecycle only.
+
+For a custom build, use a **complete pinned source checkout**, using an operator-selected commit. The npm artifact is intentionally not a Docker build context: it does not ship the test/compiler/helper-build context. A separate checkout at the required revision avoids modifying another working tree.
 
 ```sh
 export SEPT_SOURCE=/absolute/path/to/pinned/full/sept-checkout
 export SEPT_SOURCE_REVISION=the-full-commit-you-selected
-export SEPT_ENGINE_SOCKET=/run/docker.sock  # explicitly choose your trusted local socket
+export SEPT_ENGINE_SOCKET=/run/docker.sock  # Linux; on macOS choose "$HOME/.docker/run/docker.sock"
 export SEPT_ENGINE_SOCKET="$(node -e 'console.log(require("node:fs").realpathSync(process.env.SEPT_ENGINE_SOCKET))')"
 export SEPT_ENGINE_HOST="unix://$SEPT_ENGINE_SOCKET"
 sept_docker() {
   env -u DOCKER_HOST -u DOCKER_CONTEXT docker --host "$SEPT_ENGINE_HOST" "$@"
 }
+# These source checks apply when building locally rather than pulling a published image.
 test "$(git -C "$SEPT_SOURCE" rev-parse HEAD)" = "$SEPT_SOURCE_REVISION"
 git -C "$SEPT_SOURCE" diff --exit-code -- Dockerfile package.json package-lock.json src image
 ```
@@ -171,13 +174,13 @@ JS
 Inspect these receipts: the daemon ID, Linux OS, supported API 1.44–1.52 and cgroup v2 must match the intended local authority. Verify the socket is OS-protected against untrusted replacement. Recheck it and the daemon before later setup/finalization. Configure Pi credentials/models privately as described in [models](models.md); never print their values into receipts.
 
 ```sh
-sept_docker build --no-cache --iidfile "$SEPT_EVIDENCE/image.iid" "$SEPT_SOURCE" \
-  > "$SEPT_EVIDENCE/build.log" 2>&1
-export SEPT_IMAGE="$(cat "$SEPT_EVIDENCE/image.iid")"
+export SEPT_IMAGE_REFERENCE=ghcr.io/db-conneely/sept:0.1.2
+sept_docker pull "$SEPT_IMAGE_REFERENCE" > "$SEPT_EVIDENCE/pull.log" 2>&1
+export SEPT_IMAGE="$(sept_docker image inspect --format '{{.Id}}' "$SEPT_IMAGE_REFERENCE")"
 sept_docker image inspect "$SEPT_IMAGE" > "$SEPT_EVIDENCE/image.json"
 ```
 
-Retain the exact image ID, Linux platform, source revision, helper/dependency/provenance identity and build result. The supplied image owns `/app`, UID10001 brain, UID10002 resident, UID10003:GID10002 commands, C guards and native-search overlay. Installing the host npm package does not produce that image.
+For a custom build, replace the pull with `sept_docker build --no-cache --iidfile "$SEPT_EVIDENCE/image.iid" "$SEPT_SOURCE"` and read `SEPT_IMAGE` from that file. Retain the exact image ID, Linux platform, source revision, helper/dependency/provenance identity and pull/build result. For published images, obtain the source and architecture-specific identities from the matching GitHub release’s `release.json`. The supplied image owns `/app`, UID10001 brain, UID10002 resident, UID10003:GID10002 commands, C guards and native-search overlay. Installing the host npm package does not produce that image.
 
 ### Create and seed one minimal generation
 

package/examples/incident-investigator/package.json

@@ -10,6 +10,6 @@
     "report": "node investigate.mjs report"
   },
   "dependencies": {
-    "sept-agent": "0.1.1"
+    "sept-agent": "0.1.2"
   }
 }

package/examples/node-app/package.json

@@ -12,7 +12,7 @@
     "client": "node dist/client.js"
   },
   "dependencies": {
-    "sept-agent": "0.1.1",
+    "sept-agent": "0.1.2",
     "@earendil-works/pi-durable": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0"
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sept-agent",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Durable Pi-native single-slot task worker",
   "type": "module",
   "engines": {