---
title: "Changelog"
description: "Release notes for the Murmur capsule runtime."
canonical_url: "https://murmur.nexus/changelog"
last_updated: "2026-09-12T18:31:37.294Z"
---

# v0.2.0

> Published: 2026-08-20

[Murmur Documentation](https://docs.murmur.nexus)

## Downloads for v0.2.0

| filename | sha512 hash | size |
| --- | --- | --- |
| [mur-0.2.0-darwin-aarch64](https://github.com/murmur-nexus/murmur/releases/download/v0.2.0/mur-0.2.0-darwin-aarch64) | `77e951a108fd5265ce7d67752861db3cedc92a422fd4941c048473a43cd850a89737051e5cbfada818b45c1fe67e7ba54bcabb4bd2693ba4a047d1db37bf56ba` | 9.0MB |
| [mur-0.2.0-darwin-x86_64](https://github.com/murmur-nexus/murmur/releases/download/v0.2.0/mur-0.2.0-darwin-x86_64) | `84648e86ea000f68a78478adb94d537c133e1f0514918ec5941a50a8532e11c68e2bfc37e891df678e0a9a6b84ebeb5ce4191114e54871e77d776c212ce4a7b5` | 12MB |
| [mur-0.2.0-linux-x86_64](https://github.com/murmur-nexus/murmur/releases/download/v0.2.0/mur-0.2.0-linux-x86_64) | `edbf9e760f22477b7841ce040ae2948dc1ca798bb7cbca2f0d04e01e3a1d897c1fe6a30ead43a93c74d507917b234c044253e2cbba64c3f487458acba21c55ff` | 15MB |

## Changes since v0.1.0


### Features

- Declare the containment a capsule requires with `capabilities.containment`; the runtime probes what the host can actually enforce and refuses to launch below the declaration. ([#34](https://github.com/murmur-nexus/murmur/pull/34))
- New `sealed` containment class runs a capsule in its own mount namespace, on a root composed for that run, where nothing outside the workdir exists at all. ([#36](https://github.com/murmur-nexus/murmur/pull/36))
- Declare CPU, memory, process, open-file and disk ceilings under `capabilities.resources`, enforced by the kernel. ([#33](https://github.com/murmur-nexus/murmur/pull/33))
- Nothing a capsule writes into its own workdir can be executed unless the manifest declares `capabilities.filesystem.workdir_exec`. ([#43](https://github.com/murmur-nexus/murmur/pull/43))
- `capabilities.shell.interpreter_runtime` grants exactly the stdlib directories a path-based interpreter needs. ([#23](https://github.com/murmur-nexus/murmur/pull/23))
- `mur run --explain-scope` prints the enforcement tier the host resolved to and the mechanism backing it. ([#34](https://github.com/murmur-nexus/murmur/pull/34))
- The session trace records the complete effective grant set for the run, and the shell lifecycle event now carries the binary that was invoked. ([#45](https://github.com/murmur-nexus/murmur/pull/45), [#29](https://github.com/murmur-nexus/murmur/pull/29))
- Hooks can call inference through a host import, so a compaction hook runs the model itself. ([#2](https://github.com/murmur-nexus/murmur/pull/2))
- Set the compaction model, system prompt and prompt file from the manifest: `inference.compaction.model`, `.system_prompt`, `.system_prompt_file`. ([#3](https://github.com/murmur-nexus/murmur/pull/3), [#4](https://github.com/murmur-nexus/murmur/pull/4), [#9](https://github.com/murmur-nexus/murmur/pull/9))
- `inference.compaction.dump_summaries` writes each summary out for inspection. ([#13](https://github.com/murmur-nexus/murmur/pull/13))
- A hook can send a finished task back for more work, so end-of-task quality gates like regression checks can be enforced automatically — bounded by `inference.max_task_reopens`. ([#21](https://github.com/murmur-nexus/murmur/pull/21))
- Async hooks keep one instance across a session, receive the session environment, and are guaranteed to drain before a run ends, so telemetry no longer slows the agent down. ([#54](https://github.com/murmur-nexus/murmur/pull/54))
- `inference.max_tokens` sets the per-turn output token cap. ([#6](https://github.com/murmur-nexus/murmur/pull/6))
- `mur run --system-prompt` overrides a capsule's system prompt for a single run. ([#59](https://github.com/murmur-nexus/murmur/pull/59))
- `mur doctor` verifies lock integrity when a lockfile is present. ([#15](https://github.com/murmur-nexus/murmur/pull/15))

### Bug Fixes

- Fixed shell commands being blocked from running on Linux. ([#22](https://github.com/murmur-nexus/murmur/pull/22), [#37](https://github.com/murmur-nexus/murmur/pull/37))
- Compaction now triggers on current context occupancy rather than cumulative tokens spent, so a long session no longer compacts far too early. ([#12](https://github.com/murmur-nexus/murmur/pull/12))
- Compaction no longer fails against drivers that require message content as a sequence of blocks. ([#10](https://github.com/murmur-nexus/murmur/pull/10), [#11](https://github.com/murmur-nexus/murmur/pull/11))
- `mur install` reports which artifacts installed and which failed instead of stopping at the first failure. ([#16](https://github.com/murmur-nexus/murmur/pull/16))
- `mur deploy` starts the remote capsule instead of failing on a flag `mur run` no longer accepts. ([#58](https://github.com/murmur-nexus/murmur/pull/58))
- Sandbox setup failures name the mechanism that failed instead of surfacing a bare `EINVAL`. ([#24](https://github.com/murmur-nexus/murmur/pull/24))

### Other

- Breaking: hooks reach the network and filesystem only where the capsule manifest grants it, and a capsule can narrow a grant per artifact. Hooks that relied on ambient access need their grants declared. ([#17](https://github.com/murmur-nexus/murmur/pull/17), [#18](https://github.com/murmur-nexus/murmur/pull/18))
- Breaking: the host accepts exactly one version of each WIT interface and keeps no fallback. A hook built against a retired version fails at instantiation and must be rebuilt. ([#31](https://github.com/murmur-nexus/murmur/pull/31))
- Breaking: `mur build` packages a curated artifact instead of zipping the entire source directory, and rejects reserved names and unsafe payload shapes before packaging. ([#5](https://github.com/murmur-nexus/murmur/pull/5), [#8](https://github.com/murmur-nexus/murmur/pull/8))
- Breaking: a hook manifest that declares a commit policy its binding cannot honor is rejected at build time instead of failing mid-session. ([#56](https://github.com/murmur-nexus/murmur/pull/56))
- Breaking: the checkpoint-file signing mechanism was removed. ([#14](https://github.com/murmur-nexus/murmur/pull/14))
- Breaking: `mur deploy` reports `deployment_id`, not `job_id`. ([#61](https://github.com/murmur-nexus/murmur/pull/61))
- Capsule subprocesses run under a default-deny syscall allowlist rather than an allow-by-default filter. ([#27](https://github.com/murmur-nexus/murmur/pull/27))
- Capsule egress is enforced by the capsule's own network namespace plus a proxy, replacing the seccomp connect supervisor. ([#42](https://github.com/murmur-nexus/murmur/pull/42))
- `AF_UNIX` sockets are refused unless the manifest declares `capabilities.network.unix_sockets`, so a capsule cannot reach a host daemon socket such as the Docker socket. ([#26](https://github.com/murmur-nexus/murmur/pull/26))
- Capsule subprocesses can no longer create device nodes in the workdir to reach the host filesystem. ([#25](https://github.com/murmur-nexus/murmur/pull/25))
- The concepts and reference documentation was split into a page per subject, with a single diagnostics index covering every `E-*` and `W-*` code, and the containment pages rewritten to state the platform reality once. ([#52](https://github.com/murmur-nexus/murmur/pull/52), [#57](https://github.com/murmur-nexus/murmur/pull/57))
- The test suite runs in CI, with clippy and rustfmt findings enforced there. ([#64](https://github.com/murmur-nexus/murmur/pull/64), [#66](https://github.com/murmur-nexus/murmur/pull/66))


# [v0.1.0](https://github.com/murmur-nexus/murmur/blob/main/CHANGELOG/v0.1.0.md)

> Published: 2026-07-20