v0.2.0

Published: 2026-08-20

Murmur Documentation

Downloads for v0.2.0

filename	sha512 hash	size
mur-0.2.0-darwin-aarch64	77e951a108fd5265ce7d67752861db3cedc92a422fd4941c048473a43cd850a89737051e5cbfada818b45c1fe67e7ba54bcabb4bd2693ba4a047d1db37bf56ba	9.0MB
mur-0.2.0-darwin-x86_64	84648e86ea000f68a78478adb94d537c133e1f0514918ec5941a50a8532e11c68e2bfc37e891df678e0a9a6b84ebeb5ce4191114e54871e77d776c212ce4a7b5	12MB
mur-0.2.0-linux-x86_64	edbf9e760f22477b7841ce040ae2948dc1ca798bb7cbca2f0d04e01e3a1d897c1fe6a30ead43a93c74d507917b234c044253e2cbba64c3f487458acba21c55ff	15MB

Changes since v0.1.0

Features

• Declare the containment a capsule requires with capabilities.containment; the runtime probes what the host can actually enforce and refuses to launch below the declaration. (#34)
• New sealed containment class runs a capsule in its own mount namespace, on a root composed for that run, where nothing outside the workdir exists at all. (#36)
• Declare CPU, memory, process, open-file and disk ceilings under capabilities.resources, enforced by the kernel. (#33)
• Nothing a capsule writes into its own workdir can be executed unless the manifest declares capabilities.filesystem.workdir_exec. (#43)
• capabilities.shell.interpreter_runtime grants exactly the stdlib directories a path-based interpreter needs. (#23)
• mur run --explain-scope prints the enforcement tier the host resolved to and the mechanism backing it. (#34)
• The session trace records the complete effective grant set for the run, and the shell lifecycle event now carries the binary that was invoked. (#45, #29)
• Hooks can call inference through a host import, so a compaction hook runs the model itself. (#2)
• Set the compaction model, system prompt and prompt file from the manifest: inference.compaction.model, .system_prompt, .system_prompt_file. (#3, #4, #9)
• inference.compaction.dump_summaries writes each summary out for inspection. (#13)
• A hook can send a finished task back for more work, so end-of-task quality gates like regression checks can be enforced automatically — bounded by inference.max_task_reopens. (#21)
• Async hooks keep one instance across a session, receive the session environment, and are guaranteed to drain before a run ends, so telemetry no longer slows the agent down. (#54)
• inference.max_tokens sets the per-turn output token cap. (#6)
• mur run --system-prompt overrides a capsule's system prompt for a single run. (#59)
• mur doctor verifies lock integrity when a lockfile is present. (#15)

Bug Fixes

• Fixed shell commands being blocked from running on Linux. (#22, #37)
• Compaction now triggers on current context occupancy rather than cumulative tokens spent, so a long session no longer compacts far too early. (#12)
• Compaction no longer fails against drivers that require message content as a sequence of blocks. (#10, #11)
• mur install reports which artifacts installed and which failed instead of stopping at the first failure. (#16)
• mur deploy starts the remote capsule instead of failing on a flag mur run no longer accepts. (#58)
• Sandbox setup failures name the mechanism that failed instead of surfacing a bare EINVAL. (#24)

Other

• Breaking: hooks reach the network and filesystem only where the capsule manifest grants it, and a capsule can narrow a grant per artifact. Hooks that relied on ambient access need their grants declared. (#17, #18)
• Breaking: the host accepts exactly one version of each WIT interface and keeps no fallback. A hook built against a retired version fails at instantiation and must be rebuilt. (#31)
• Breaking: mur build packages a curated artifact instead of zipping the entire source directory, and rejects reserved names and unsafe payload shapes before packaging. (#5, #8)
• Breaking: a hook manifest that declares a commit policy its binding cannot honor is rejected at build time instead of failing mid-session. (#56)
• Breaking: the checkpoint-file signing mechanism was removed. (#14)
• Breaking: mur deploy reports deployment_id, not job_id. (#61)
• Capsule subprocesses run under a default-deny syscall allowlist rather than an allow-by-default filter. (#27)
• Capsule egress is enforced by the capsule's own network namespace plus a proxy, replacing the seccomp connect supervisor. (#42)
• AF_UNIX sockets are refused unless the manifest declares capabilities.network.unix_sockets, so a capsule cannot reach a host daemon socket such as the Docker socket. (#26)
• Capsule subprocesses can no longer create device nodes in the workdir to reach the host filesystem. (#25)
• The concepts and reference documentation was split into a page per subject, with a single diagnostics index covering every E-* and W-* code, and the containment pages rewritten to state the platform reality once. (#52, #57)
• The test suite runs in CI, with clippy and rustfmt findings enforced there. (#64, #66)

v0.1.0

Published: 2026-07-20