silicon-cli 1.0.20__tar.gz → 1.0.22__tar.gz

{silicon_cli-1.0.20 → silicon_cli-1.0.22}/.github/workflows/publish-runtime.yml

@@ -52,11 +52,6 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Require a packaged production release trust anchor
-        run: |
-          python -m pip install --disable-pip-version-check .
-          python -m silicon_cli.updater.signatures --check-packaged
-
       - name: Build and push runtime image
         id: build
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2

{silicon_cli-1.0.20 → silicon_cli-1.0.22}/MANIFEST.in

@@ -4,7 +4,7 @@ include pyproject.toml
 include uv.lock
 include .github/workflows/publish-runtime.yml
 recursive-include docker/runtime *
-recursive-include silicon_cli *.json *.py
+recursive-include silicon_cli *.py
 recursive-include tests *.py
 global-exclude *.py[cod]
 global-exclude __pycache__

{silicon_cli-1.0.20/silicon_cli.egg-info → silicon_cli-1.0.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: silicon-cli
-Version: 1.0.20
+Version: 1.0.22
 Summary: Silicon CLI — create, run, and manage your silicon instances.
 Author: Saket
 License-Expression: MIT
@@ -13,7 +13,6 @@ Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: certifi>=2024.2.2
-Requires-Dist: cryptography>=46.0
 Requires-Dist: silicon-extend==0.1.1
 Dynamic: license-file
 
@@ -85,7 +84,8 @@ silicon help                 Show help
 `silicon-browser`, `silicon-extend`, `silicon-interface`, `claude`, or
 `codex`. Shared pip/npm copies update once on the host. Local instance copies
 update only across a safe stop boundary, and Docker copies move through the
-signed runtime release instead of being modified inside a running container.
+published, digest-pinned runtime instead of being modified inside a running
+container.
 Glass uses the JSON form of these commands to provide team-scoped inventory
 and durable update jobs.
 
@@ -95,10 +95,7 @@ and durable update jobs.
 | --- | --- | --- |
 | `SILICON_HOME` | `~/.silicon` | registry + CLI state |
 | `GLASS_SERVER_URL` | `https://glass.teamofsilicons.com` | Glass sync server (pull/push) |
-| `SILICON_RELEASE_MANIFEST_URL` | `<GLASS_SERVER_URL>/api/v1/silicon-release/latest.json` | signed schema-1 release manifest |
-| `SILICON_RELEASE_TRUSTED_KEYS` | packaged production keys | JSON map of key id to base64 raw Ed25519 public key; additive for self-hosting/key rotation |
-| `SILICON_UPDATE_ALLOW_UNSIGNED_GIT` | *(empty)* | explicit compatibility opt-in; select exact-revision Git instead of the signed channel |
-| `SILICON_STEMCELL_REPO` | `teamofsilicons/silicon-stemcell` | base for `new` |
+| `SILICON_STEMCELL_REPO` | `teamofsilicons/silicon-stemcell` | GitHub repository used by `new`, `pull`, and `update` |
 | `SILICON_PYTHON` | `python3` | interpreter used to run a silicon's `main.py` |
 | `SILICON_INTERFACE_CLI_PACKAGE` | `@teamofsilicons/silicon-interface-cli` | npm package used to install the Silicon Interface CLI |
 | `SILICON_INTERFACE_CLI_TARBALL` | versioned npm tarball | fallback package URL if registry metadata is briefly unavailable |
@@ -106,7 +103,7 @@ and durable update jobs.
 | `SILICON_INTERFACE_CLI_SKIP` | *(empty)* | set to `1` to skip interface CLI setup |
 | `SILICON_INTERFACE_DAEMON_SKIP` | *(empty)* | set to `1` to install the CLI without starting its listener daemon |
 | `SILICON_RUNTIME` | *(empty)* | default pull uses Docker; set to `local` to opt out |
-| `SILICON_RUNTIME_IMAGE` | signed release manifest | bootstrap-only exact digest when no runtime digest is persisted; it cannot retarget an installed release |
+| `SILICON_RUNTIME_IMAGE` | published Stemcell tag metadata | bootstrap-only exact digest when no runtime digest is persisted; it cannot retarget an installed release |
 | `SILICON_DOCKER_ROOT` | `~/silicons` | Docker-backed instance root |
 | `SILICON_DOCKER_COMPOSE` | `<root>/compose.yml` | generated Compose file path |
 | `SILICON_DOCKER_SHARED_HOME` | `<root>/.shared-home` | VM-wide Claude/Codex auth home mounted into every container |
@@ -133,14 +130,15 @@ documented by Docker. The CLI never downloads or executes `get.docker.com` (or
 any other mutable installer) as root.
 
 `silicon pull` first checks Docker and Compose without selecting an image. It
-then verifies the signed Silicon release manifest, reads the exact
-`registry/repository@sha256:<digest>` runtime identity covered by that signature,
-pulls it, and verifies Docker reports that same repository digest before any
-instance or credential is created. The digest is persisted on each instance and
-generation; updates switch it only at activation, and rollback restores the
-prior generation's digest. A cached image is reusable only when that exact
-digest verifies. Pull completes only after each active Docker Silicon exposes
-the pinned Silicon Extend package and its `silicon-extend` command.
+then resolves the highest published stable Stemcell Git tag, verifies that
+tag's exact object, commit, version, files, and tree, and reads its exact
+`registry/repository@sha256:<digest>` runtime identity. It pulls the image and
+verifies Docker reports that same repository digest before any instance or
+credential is created. The digest is persisted on each instance and generation;
+updates switch it only at activation, and rollback restores the prior
+generation's digest. A cached image is reusable only when that exact digest
+verifies. Pull completes only after each active Docker Silicon exposes the
+pinned Silicon Extend package and its `silicon-extend` command.
 
 ```bash
 pip install silicon-cli
@@ -179,7 +177,7 @@ silicon codex --version
 The runtime image contains the complete Silicon runtime contract: Silicon CLI,
 Silicon Browser, Silicon Extend, Silicon Interface CLI, Claude Code, Codex,
 Node 22+, Python tooling, and Git. `silicon pull` verifies every command,
-minimum supported version, and the Python dependency graph in the exact signed
+minimum supported version, and the Python dependency graph in the exact pinned
 image digest before it asks Glass to claim or register a Silicon. Immutable
 releases use the updater's pre-staged, hash-locked dependency environment. Only
 a legacy flat installation falls back to creating `/silicon/.venv` from its
@@ -217,8 +215,8 @@ silicon docker compose
 ```
 
 Build and publish the runtime image from this repo, then record the registry's
-immutable digest in Glass as `SILICON_RELEASE_RUNTIME_IMAGE` before publishing
-the matching Stemcell release:
+immutable digest as `runtime_image` in the Stemcell's `silicon.info` before
+creating and pushing the matching stable Git tag:
 
 ```bash
 docker build -f docker/runtime/Dockerfile -t ghcr.io/teamofsilicons/silicon-runtime:<version> .
@@ -345,7 +343,7 @@ Before stopping anything, the updater verifies a canonical recovery snapshot.
 It records the exact services that were running, atomically switches the active
 generation, restores that service state, and requires stable health checks
 before committing. A failure after the stop boundary automatically reactivates
-an authenticated reconstruction of the prior generation rather than trusting a
+a verified reconstruction of the prior generation rather than trusting a
 writable dormant directory. The mutable data root, memory, credentials,
 conversations, and local customization overlay are kept outside immutable
 release generations.
@@ -367,46 +365,28 @@ Cancellation is accepted only before the service-stop boundary. `resume`
 finishes or safely recovers an interrupted update according to its fsynced
 journal; it never guesses from a partially copied directory. Retention keeps
 the active, prior-known-good, and every nonterminal transaction generation even
-when old unreferenced generations are pruned. A durable highest-accepted signed
-release sequence remains in force even after an explicit runtime rollback.
-
-The default release channel accepts only an expiry-checked HTTPS manifest with
-at least one valid Ed25519 signature from a pinned public key. The manifest pins
-the exact content-addressed artifact and every extracted file; candidate code is
-never executed to perform or validate the update. Key rotation is additive:
-ship a new `key_id` and raw 32-byte public key in the CLI keyring before Glass
-begins signing with it, retain the old public key through the supported-client
-window, then remove it in a later CLI release. A self-hosted public-only keyring
-uses this operator-ready format:
-
-```bash
-export SILICON_RELEASE_TRUSTED_KEYS='{"release-2026-01":"<base64 of the raw 32-byte Ed25519 public key>"}'
-```
-
-The matching private key belongs only in Glass's secret store as
-`SILICON_RELEASE_SIGNING_PRIVATE_KEY`; it must never be placed in this CLI,
-an instance directory, or the JSON above. Until the production key is securely
-provisioned and its public half is packaged, signed updates fail closed.
-
-Production release-key handoff is deliberately explicit:
-
-1. Generate the Ed25519 keypair offline or in an HSM.
-2. Put only the standard-base64 raw 32-byte public key, under a stable key ID,
-   in `silicon_cli/release_trust_anchors.json`.
-3. Run
-   `python -m silicon_cli.updater.signatures --check-packaged`; a clean source
-   tree intentionally fails this gate until a real production anchor exists.
-4. Build and publish the wheel, then configure Glass's release signer with the
-   matching private key from its secret store/HSM.
-5. For rotation, ship and deploy the new public anchor before Glass uses it,
-   and retain the previous anchor until every supported CLI has crossed the
-   overlap window.
-
-For a deliberate compatibility operation,
-`--allow-unsigned-git` (or `SILICON_UPDATE_ALLOW_UNSIGNED_GIT=1`) selects the
-exact-revision Git source. It is never an automatic downgrade. That mode pins a
-single commit and verifies the downloaded tree and archive by SHA-256, but it
-cannot authenticate the publisher and always emits a warning.
+when old unreferenced generations are pruned. A durable highest-accepted
+published-version floor remains in force even after an explicit runtime
+rollback.
+
+Git is the sole source of truth for normal Stemcell releases. The updater lists
+the canonical repository's tags, considers only exact stable
+`vMAJOR.MINOR.PATCH` tags, and numerically selects the highest version. It never
+uses `main`, timestamps, prereleases, GitHub's separate “latest release” object,
+or an older fallback tag.
+
+The selected tag is pinned to both its advertised tag object and peeled commit.
+The updater fetches that exact ref, detects a tag that moves during the fetch,
+requires `silicon.info.version` to match the tag, requires an immutable runtime
+digest, and seals the downloaded tree into a deterministic SHA-256-verified
+artifact. Candidate Stemcell code is never executed by the updater. A durable
+SemVer floor rejects downgrades and detects a rewritten tag that reuses an
+accepted version with different content.
+
+Published stable tags are immutable release records: protect the `v*` tag
+namespace in GitHub and never force-push, move, or reuse one. Build the final
+runtime first, commit its digest and matching version in `silicon.info`, and
+only then create and push the tag.
 
 ## Implementation notes
 

{silicon_cli-1.0.20 → silicon_cli-1.0.22}/README.md

@@ -66,7 +66,8 @@ silicon help                 Show help
 `silicon-browser`, `silicon-extend`, `silicon-interface`, `claude`, or
 `codex`. Shared pip/npm copies update once on the host. Local instance copies
 update only across a safe stop boundary, and Docker copies move through the
-signed runtime release instead of being modified inside a running container.
+published, digest-pinned runtime instead of being modified inside a running
+container.
 Glass uses the JSON form of these commands to provide team-scoped inventory
 and durable update jobs.
 
@@ -76,10 +77,7 @@ and durable update jobs.
 | --- | --- | --- |
 | `SILICON_HOME` | `~/.silicon` | registry + CLI state |
 | `GLASS_SERVER_URL` | `https://glass.teamofsilicons.com` | Glass sync server (pull/push) |
-| `SILICON_RELEASE_MANIFEST_URL` | `<GLASS_SERVER_URL>/api/v1/silicon-release/latest.json` | signed schema-1 release manifest |
-| `SILICON_RELEASE_TRUSTED_KEYS` | packaged production keys | JSON map of key id to base64 raw Ed25519 public key; additive for self-hosting/key rotation |
-| `SILICON_UPDATE_ALLOW_UNSIGNED_GIT` | *(empty)* | explicit compatibility opt-in; select exact-revision Git instead of the signed channel |
-| `SILICON_STEMCELL_REPO` | `teamofsilicons/silicon-stemcell` | base for `new` |
+| `SILICON_STEMCELL_REPO` | `teamofsilicons/silicon-stemcell` | GitHub repository used by `new`, `pull`, and `update` |
 | `SILICON_PYTHON` | `python3` | interpreter used to run a silicon's `main.py` |
 | `SILICON_INTERFACE_CLI_PACKAGE` | `@teamofsilicons/silicon-interface-cli` | npm package used to install the Silicon Interface CLI |
 | `SILICON_INTERFACE_CLI_TARBALL` | versioned npm tarball | fallback package URL if registry metadata is briefly unavailable |
@@ -87,7 +85,7 @@ and durable update jobs.
 | `SILICON_INTERFACE_CLI_SKIP` | *(empty)* | set to `1` to skip interface CLI setup |
 | `SILICON_INTERFACE_DAEMON_SKIP` | *(empty)* | set to `1` to install the CLI without starting its listener daemon |
 | `SILICON_RUNTIME` | *(empty)* | default pull uses Docker; set to `local` to opt out |
-| `SILICON_RUNTIME_IMAGE` | signed release manifest | bootstrap-only exact digest when no runtime digest is persisted; it cannot retarget an installed release |
+| `SILICON_RUNTIME_IMAGE` | published Stemcell tag metadata | bootstrap-only exact digest when no runtime digest is persisted; it cannot retarget an installed release |
 | `SILICON_DOCKER_ROOT` | `~/silicons` | Docker-backed instance root |
 | `SILICON_DOCKER_COMPOSE` | `<root>/compose.yml` | generated Compose file path |
 | `SILICON_DOCKER_SHARED_HOME` | `<root>/.shared-home` | VM-wide Claude/Codex auth home mounted into every container |
@@ -114,14 +112,15 @@ documented by Docker. The CLI never downloads or executes `get.docker.com` (or
 any other mutable installer) as root.
 
 `silicon pull` first checks Docker and Compose without selecting an image. It
-then verifies the signed Silicon release manifest, reads the exact
-`registry/repository@sha256:<digest>` runtime identity covered by that signature,
-pulls it, and verifies Docker reports that same repository digest before any
-instance or credential is created. The digest is persisted on each instance and
-generation; updates switch it only at activation, and rollback restores the
-prior generation's digest. A cached image is reusable only when that exact
-digest verifies. Pull completes only after each active Docker Silicon exposes
-the pinned Silicon Extend package and its `silicon-extend` command.
+then resolves the highest published stable Stemcell Git tag, verifies that
+tag's exact object, commit, version, files, and tree, and reads its exact
+`registry/repository@sha256:<digest>` runtime identity. It pulls the image and
+verifies Docker reports that same repository digest before any instance or
+credential is created. The digest is persisted on each instance and generation;
+updates switch it only at activation, and rollback restores the prior
+generation's digest. A cached image is reusable only when that exact digest
+verifies. Pull completes only after each active Docker Silicon exposes the
+pinned Silicon Extend package and its `silicon-extend` command.
 
 ```bash
 pip install silicon-cli
@@ -160,7 +159,7 @@ silicon codex --version
 The runtime image contains the complete Silicon runtime contract: Silicon CLI,
 Silicon Browser, Silicon Extend, Silicon Interface CLI, Claude Code, Codex,
 Node 22+, Python tooling, and Git. `silicon pull` verifies every command,
-minimum supported version, and the Python dependency graph in the exact signed
+minimum supported version, and the Python dependency graph in the exact pinned
 image digest before it asks Glass to claim or register a Silicon. Immutable
 releases use the updater's pre-staged, hash-locked dependency environment. Only
 a legacy flat installation falls back to creating `/silicon/.venv` from its
@@ -198,8 +197,8 @@ silicon docker compose
 ```
 
 Build and publish the runtime image from this repo, then record the registry's
-immutable digest in Glass as `SILICON_RELEASE_RUNTIME_IMAGE` before publishing
-the matching Stemcell release:
+immutable digest as `runtime_image` in the Stemcell's `silicon.info` before
+creating and pushing the matching stable Git tag:
 
 ```bash
 docker build -f docker/runtime/Dockerfile -t ghcr.io/teamofsilicons/silicon-runtime:<version> .
@@ -326,7 +325,7 @@ Before stopping anything, the updater verifies a canonical recovery snapshot.
 It records the exact services that were running, atomically switches the active
 generation, restores that service state, and requires stable health checks
 before committing. A failure after the stop boundary automatically reactivates
-an authenticated reconstruction of the prior generation rather than trusting a
+a verified reconstruction of the prior generation rather than trusting a
 writable dormant directory. The mutable data root, memory, credentials,
 conversations, and local customization overlay are kept outside immutable
 release generations.
@@ -348,46 +347,28 @@ Cancellation is accepted only before the service-stop boundary. `resume`
 finishes or safely recovers an interrupted update according to its fsynced
 journal; it never guesses from a partially copied directory. Retention keeps
 the active, prior-known-good, and every nonterminal transaction generation even
-when old unreferenced generations are pruned. A durable highest-accepted signed
-release sequence remains in force even after an explicit runtime rollback.
-
-The default release channel accepts only an expiry-checked HTTPS manifest with
-at least one valid Ed25519 signature from a pinned public key. The manifest pins
-the exact content-addressed artifact and every extracted file; candidate code is
-never executed to perform or validate the update. Key rotation is additive:
-ship a new `key_id` and raw 32-byte public key in the CLI keyring before Glass
-begins signing with it, retain the old public key through the supported-client
-window, then remove it in a later CLI release. A self-hosted public-only keyring
-uses this operator-ready format:
-
-```bash
-export SILICON_RELEASE_TRUSTED_KEYS='{"release-2026-01":"<base64 of the raw 32-byte Ed25519 public key>"}'
-```
-
-The matching private key belongs only in Glass's secret store as
-`SILICON_RELEASE_SIGNING_PRIVATE_KEY`; it must never be placed in this CLI,
-an instance directory, or the JSON above. Until the production key is securely
-provisioned and its public half is packaged, signed updates fail closed.
-
-Production release-key handoff is deliberately explicit:
-
-1. Generate the Ed25519 keypair offline or in an HSM.
-2. Put only the standard-base64 raw 32-byte public key, under a stable key ID,
-   in `silicon_cli/release_trust_anchors.json`.
-3. Run
-   `python -m silicon_cli.updater.signatures --check-packaged`; a clean source
-   tree intentionally fails this gate until a real production anchor exists.
-4. Build and publish the wheel, then configure Glass's release signer with the
-   matching private key from its secret store/HSM.
-5. For rotation, ship and deploy the new public anchor before Glass uses it,
-   and retain the previous anchor until every supported CLI has crossed the
-   overlap window.
-
-For a deliberate compatibility operation,
-`--allow-unsigned-git` (or `SILICON_UPDATE_ALLOW_UNSIGNED_GIT=1`) selects the
-exact-revision Git source. It is never an automatic downgrade. That mode pins a
-single commit and verifies the downloaded tree and archive by SHA-256, but it
-cannot authenticate the publisher and always emits a warning.
+when old unreferenced generations are pruned. A durable highest-accepted
+published-version floor remains in force even after an explicit runtime
+rollback.
+
+Git is the sole source of truth for normal Stemcell releases. The updater lists
+the canonical repository's tags, considers only exact stable
+`vMAJOR.MINOR.PATCH` tags, and numerically selects the highest version. It never
+uses `main`, timestamps, prereleases, GitHub's separate “latest release” object,
+or an older fallback tag.
+
+The selected tag is pinned to both its advertised tag object and peeled commit.
+The updater fetches that exact ref, detects a tag that moves during the fetch,
+requires `silicon.info.version` to match the tag, requires an immutable runtime
+digest, and seals the downloaded tree into a deterministic SHA-256-verified
+artifact. Candidate Stemcell code is never executed by the updater. A durable
+SemVer floor rejects downgrades and detects a rewritten tag that reuses an
+accepted version with different content.
+
+Published stable tags are immutable release records: protect the `v*` tag
+namespace in GitHub and never force-push, move, or reuse one. Build the final
+runtime first, commit its digest and matching version in `silicon.info`, and
+only then create and push the tag.
 
 ## Implementation notes
 

{silicon_cli-1.0.20 → silicon_cli-1.0.22}/docker/runtime/Dockerfile

@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1.24.0@sha256:87999aa3d42bdc6bea60565083ee17e86d1f3339802f543c0d03998580f9cb89
 FROM node:22-bookworm-slim@sha256:6c74791e557ce11fc957704f6d4fe134a7bc8d6f5ca4403205b2966bd488f6b3
 
-ARG SILICON_CLI_SPEC=silicon-cli==1.0.20
-ARG SILICON_BROWSER_SPEC=silicon-browser==1.0.7
+ARG SILICON_CLI_SPEC=silicon-cli==1.0.22
+ARG SILICON_BROWSER_SPEC=silicon-browser==1.0.8
 ARG SILICON_EXTEND_SPEC=silicon-extend==0.1.1
-ARG SILICON_INTERFACE_CLI_SPEC=@teamofsilicons/silicon-interface-cli@2.0.0
+ARG SILICON_INTERFACE_CLI_SPEC=@teamofsilicons/silicon-interface-cli@2.0.1
 ARG CLAUDE_CODE_SPEC=@anthropic-ai/claude-code@2.1.220
 ARG CODEX_SPEC=@openai/codex@0.145.0
 ARG PIP_SPEC=pip==26.1.2

{silicon_cli-1.0.20 → silicon_cli-1.0.22}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "silicon-cli"
-version = "1.0.20"
+version = "1.0.22"
 description = "Silicon CLI — create, run, and manage your silicon instances."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -18,7 +18,6 @@ classifiers = [
 ]
 dependencies = [
   "certifi>=2024.2.2",
-  "cryptography>=46.0",
   "silicon-extend==0.1.1",
 ]
 
@@ -31,6 +30,3 @@ silicon = "silicon_cli.cli:main"
 
 [tool.setuptools.packages.find]
 include = ["silicon_cli*"]
-
-[tool.setuptools.package-data]
-silicon_cli = ["release_trust_anchors.json"]

{silicon_cli-1.0.20 → silicon_cli-1.0.22}/silicon_cli/__init__.py

@@ -1,2 +1,2 @@
 """Silicon CLI — manage silicon instances. Python port of the original bash manager."""
-__version__ = "1.0.20"
+__version__ = "1.0.22"

{silicon_cli-1.0.20 → silicon_cli-1.0.22}/silicon_cli/cli.py

@@ -293,7 +293,6 @@ def cmd_help() -> None:
   silicon backup [name] [now|stop|status] Alias for silicon push
   silicon update <target>     Stage, drain, checkpoint, update, validate, and restart
   silicon update --dry-run <target>  Show the exact merge/update plan
-  silicon update --allow-unsigned-git <target>  Explicit compatibility source
   silicon update status [name]       Show generation and transaction state
   silicon update cancel [name]       Cancel an update before its stop boundary
   silicon update resume [name]       Resume an interrupted transaction

{silicon_cli-1.0.20 → silicon_cli-1.0.22}/silicon_cli/config.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import shutil
 import stat
 from pathlib import Path
@@ -14,18 +15,23 @@ REGISTRY_FILE = REGISTRY_DIR / "registry.json"
 
 # Glass sync server (pull/push). Override with GLASS_SERVER_URL to point elsewhere.
 GLASS_SERVER_URL = os.environ.get("GLASS_SERVER_URL", "https://glass.teamofsilicons.com").rstrip("/")
-SILICON_RELEASE_MANIFEST_URL = os.environ.get(
-    "SILICON_RELEASE_MANIFEST_URL",
-    f"{GLASS_SERVER_URL}/api/v1/silicon-release/latest.json",
-)
-SILICON_UPDATE_ALLOW_UNSIGNED_GIT = os.environ.get(
-    "SILICON_UPDATE_ALLOW_UNSIGNED_GIT", ""
-).lower() in {"1", "true", "yes", "on"}
 
-# Stemcell — the base every new silicon is hydrated from.
+# Stemcell — stable SemVer tags are the source for new and updated Silicons.
 STEMCELL_REPO = os.environ.get("SILICON_STEMCELL_REPO", "teamofsilicons/silicon-stemcell")
+_stemcell_repository_parts = STEMCELL_REPO.split("/")
+if (
+    re.fullmatch(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+", STEMCELL_REPO)
+    is None
+    or len(_stemcell_repository_parts) != 2
+    or any(
+        part in {".", ".."} or len(part) > 100
+        for part in _stemcell_repository_parts
+    )
+):
+    raise RuntimeError(
+        "SILICON_STEMCELL_REPO must be one GitHub owner/repository pair"
+    )
 STEMCELL_GIT_URL = f"https://github.com/{STEMCELL_REPO}.git"
-STEMCELL_ZIP_URL = f"https://github.com/{STEMCELL_REPO}/archive/refs/heads/main.zip"
 
 # Silicon Interface CLI. During local development, silicon-cli will auto-detect
 # a sibling silicon-interface checkout; in production this package spec is used.
@@ -35,7 +41,7 @@ SILICON_INTERFACE_CLI_PACKAGE = os.environ.get(
 )
 SILICON_INTERFACE_CLI_TARBALL = os.environ.get(
     "SILICON_INTERFACE_CLI_TARBALL",
-    "https://registry.npmjs.org/@teamofsilicons/silicon-interface-cli/-/silicon-interface-cli-2.0.0.tgz",
+    "https://registry.npmjs.org/@teamofsilicons/silicon-interface-cli/-/silicon-interface-cli-2.0.1.tgz",
 )
 SILICON_INTERFACE_CLI_SOURCE = os.environ.get("SILICON_INTERFACE_CLI_SOURCE", "")
 SILICON_INTERFACE_CLI_SKIP = os.environ.get("SILICON_INTERFACE_CLI_SKIP", "").lower() in {

{silicon_cli-1.0.20 → silicon_cli-1.0.22}/silicon_cli/docker_runtime.py

@@ -128,8 +128,8 @@ def _require_runtime_image(image: object, *, context: str) -> str:
         )
         return value
     raise RuntimeError(
-        f"{context} has no signed, immutable runtime image. Fetch a signed "
-        "Silicon release first; the image must be "
+        f"{context} has no published, immutable runtime image. Fetch a "
+        "published Silicon release first; the image must be "
         "registry/repository@sha256:<digest>. Mutable tags such as :latest "
         f"are refused. Set {UNPINNED_IMAGE_OPT_IN}=1 only for isolated local "
         "development."
@@ -240,8 +240,8 @@ def init(
             ui.info(f"Runtime image: {chosen_image}")
         else:
             ui.info(
-                "Runtime image: awaiting the digest from the signed Silicon "
-                "release channel"
+                "Runtime image: awaiting the digest committed to the "
+                "published Stemcell tag"
             )
         if docker_sudo:
             ui.info("Docker commands will run through sudo for this runtime.")
@@ -508,7 +508,7 @@ def _ensure_image(config: dict, *, refresh: bool = False) -> None:
             ui.info("Using the existing local-development image.")
         return
     raise RuntimeError(
-        f"Could not pull and verify the signed Docker image: {image}. "
+        f"Could not pull and verify the pinned Docker image: {image}. "
         "Authenticate to its registry if it is private, then retry."
     )
 
@@ -566,13 +566,13 @@ def ensure_ready(
 
 
 def prepare_release_image(image: str) -> dict:
-    """Pull and verify a signed image without changing active runtime state."""
+    """Pull and verify a published image without changing active runtime state."""
 
     pinned = str(image or "").strip()
     if not runtime_image_is_pinned(pinned):
         raise RuntimeError(
-            "Docker releases require a signed immutable runtime image digest; "
-            "unsigned Git releases cannot select a Docker runtime"
+            "Docker releases require the immutable runtime image digest "
+            "committed in the published Stemcell Git tag"
         )
     cfg = {**load_config(required=True), "image": pinned}
     _ensure_image(cfg)
@@ -592,6 +592,8 @@ def inspect_runtime_contract(config: dict, image: str) -> dict:
             *_docker_cmd(config),
             "run",
             "--rm",
+            "--pull",
+            "never",
             "--entrypoint",
             "/opt/silicon-runtime/bin/python",
             selected,
@@ -627,7 +629,7 @@ def inspect_runtime_contract(config: dict, image: str) -> dict:
 
 
 def verify_runtime_contract(config: dict, image: str) -> dict[str, str]:
-    """Prove the signed image contains the complete supported toolchain."""
+    """Prove the pinned image contains the complete supported toolchain."""
 
     selected = _require_runtime_image(
         image,
@@ -641,19 +643,19 @@ def verify_runtime_contract(config: dict, image: str) -> dict[str, str]:
         else:
             detail = "the runtime probe failed without structured diagnostics"
         raise RuntimeError(
-            "the signed Silicon runtime image is missing or has outdated "
+            "the published Silicon runtime image is missing or has outdated "
             f"required dependencies: {detail}. Publish a fresh runtime image "
             "containing Silicon CLI, Silicon Browser, Silicon Extend, Silicon "
             "Interface CLI, Claude Code, Codex, Node 22+, Python, and Git; "
-            "then publish that digest in the signed Silicon release."
+            "then commit that digest in the published Stemcell tag."
         )
     versions = payload.get("versions")
     if not isinstance(versions, dict):
         raise RuntimeError(
-            "the signed Silicon runtime dependency probe returned no version "
+            "the published Silicon runtime dependency probe returned no version "
             "inventory"
         )
-    ui.success("Verified the complete signed Silicon runtime toolchain.")
+    ui.success("Verified the complete published Silicon runtime toolchain.")
     return {
         str(name): str(version)
         for name, version in versions.items()
@@ -666,7 +668,7 @@ def bind_release_runtime(
     installs: Iterable[registry.Install] = (),
     pull: bool = True,
 ) -> dict:
-    """Verify and persist the exact image authenticated by a release.
+    """Verify and persist the exact image committed by a release.
 
     The image is pulled and content-address verified before either config or
     registry metadata changes. With no selected install this establishes the
@@ -684,8 +686,8 @@ def bind_release_runtime(
     else:
         if not runtime_image_is_pinned(pinned):
             raise RuntimeError(
-                "Docker releases require a signed immutable runtime image "
-                "digest"
+                "Docker releases require the immutable runtime image digest "
+                "committed in the published Stemcell Git tag"
             )
         candidate = {
             **load_config(required=True),
@@ -725,7 +727,7 @@ def bind_release_runtime(
 
 
 def active_generation_runtime_image(inst: registry.Install) -> str:
-    """Return the signed image bound to the selected code generation."""
+    """Return the pinned image bound to the selected code generation."""
 
     from .updater.generation import GenerationError, GenerationStore
 
@@ -945,10 +947,9 @@ def ensure_pull_runtime() -> bool:
     if runtime_opted_out():
         ui.info("SILICON_RUNTIME is set to local/host; pulling without Docker runtime.")
         return False
-    # At this point no authenticated release has been fetched yet, so there is
+    # At this point no published Stemcell tag has been fetched yet, so there is
     # deliberately no image to pull. ``stemcell.prepare_hydration`` binds the
-    # digest from the verified signed manifest before any target or secret is
-    # written.
+    # digest committed to that exact tag before any target or secret is written.
     ensure_ready(
         auto_init=True,
         install=True,
@@ -1467,7 +1468,7 @@ if (
         raise RuntimeError(
             f"Docker Silicon '{inst.name}' does not have the required "
             f"Silicon Extend {SILICON_EXTEND_VERSION} runtime. Ensure the "
-            "signed runtime image and Stemcell requirements lock include it, "
+            "published runtime image and Stemcell requirements lock include it, "
             "then rerun the same pull."
         )
 
@@ -1486,7 +1487,7 @@ def prepare_environment(
     if not lockfile.is_file():
         if requirements.is_file():
             raise RuntimeError(
-                "signed Docker release has requirements.txt but no "
+                "published Docker release has requirements.txt but no "
                 "hash-pinned requirements.lock"
             )
         return None
@@ -1952,7 +1953,7 @@ def cmd_docker(args: list[str]) -> None:
             render_compose(cfg)
         else:
             ui.info(
-                "Docker prerequisites are ready. The next signed `silicon "
+                "Docker prerequisites are ready. The next published `silicon "
                 "pull` binds and pulls its immutable runtime image digest."
             )
         return