v0.10.0

v0.10.0 is a large release that lands two foundational substrate efforts — a redesigned plugin capability and dependency model, and a single canonical invariant registry — alongside the first end-to-end web portal for scenes and the production activation of sensitive-event cryptography. Because the platform still has no live deployments to migrate, this release favored doing the architecture right over preserving intermediate shapes.

For the full mechanical commit list and signed artifacts, see the v0.10.0 GitHub Release.

Highlights

Unified plugin capability & dependency model

The plugin system was redesigned end to end (theme:plugin-capability-architecture, epic holomush-eykuh). The manifest requires field had been overloaded — driving both DAG load-order and Lua capability injection — so capability-backed requires silently fell back to a priority sort on every boot. The redesign delivers three guarantees:

• Runtime parity — binary and Lua plugins now consume host capabilities and plugin services through one identical host-brokered mechanism.
• Full dependency graph — plugin → host, host → plugin, and plugin → host → plugin dependencies are all expressible.
• Least privilege — the 23-RPC PluginHostService god-service was decomposed into 14 focused host.v1 capability services, with declaration-gated access and the plugin itself as an ABAC subject.

Shipped across the host-capability decomposition (holomush-eykuh.1), Lua parity (holomush-eykuh.2), least-privilege and plugin-trust enforcement (holomush-eykuh.3), the atomic brokered-only capability cutover (holomush-eykuh.4), binary capability-declaration enforcement (holomush-si3zs), and a Lua binding-stub generator for editor tooling (holomush-eykuh.9).

The web as a complete scenes portal

The web client advanced toward being a superset of telnet rather than a thin terminal (theme:web-portals / theme:social-spaces). v0.10.0 brings a unified authed workspace shell (holomush-q41kr) and a full scenes portal: create-scene (holomush-5rh.22), lifecycle End/Pause/Resume (holomush-5rh.24), settings management (holomush-5rh.24), membership directory and roster actions (holomush-5rh.24), collapsible slide-in panels (holomush-5rh.29), a shared communication-rendering seam (holomush-5rh.33, holomush-c5zol), and the E9.5 player workspace (holomush-5rh.8). Host-side character name resolution now backs the roster, pose order, and pose authorship (holomush-5rh.25).

Sensitive-event cryptography, activated

Payload cryptography went live for sensitive events: KEK-mandatory boot with a single activation gate (holomush-5rh.8.29.12), scene DEK genesis on first focus (holomush-5rh.8.29.13), and the wiring of sensitive-event crypto into the live publisher and subscriber paths (holomush-5rh.8.29). sensitivity:always is now enforced for core communication page/whisper/pemit (holomush-50zqs).

One canonical invariant registry

All named system invariants were consolidated into a single YAML-sourced registry with canonical INV-<SCOPE>-N identifiers (epic holomush-hz0v4). Every legacy invariant family was migrated to a scoped id, invariants.md is now generated from the YAML via a render-and-diff meta-test, and 30 test bindings were backfilled while closing a false-green coverage gap.

Session liveness

Reconnect handling now bounds its dedup window to a fixed LRU (holomush-rsoe6.21) and rejects lease/grace values below twice the gateway refresh cadence (holomush-rsoe6.22), tightening the liveness contract.

Fixes

• Scenes ABAC hardening: owner-only self-enforcement in UpdateScene (holomush-ug7sq), actor-binding cross-checks on CreateScene (holomush-lar7u) and state-mutating handlers including JoinScene (holomush-fgly4), surfaced roster-membership errors (holomush-eysl2), and guests gated from the Scenes nav (holomush-5rh.23).
• Core: monotonic NewULID under concurrency via a non-decreasing timestamp clamp (holomush-nri6e); stop leaking inner error text on codes.Internal (holomush-2dsxm).
• Crypto: resolve PlayerID at comms DEK genesis to close a player-branch AuthGuard asymmetry (holomush-5rh.8.29.11).
• Plugin/observability: thread derived context into Lua and stdlib hostfunc guard logs for trace correlation (holomush-135sn, holomush-thw6t); host-capability denials now carry a gRPC status rather than codes.Unknown (holomush-yc05l); instance-level ABAC for plugin stream.history reads on both runtimes (holomush-xakba).
• Web: composer textarea input when popped open (holomush-6k7d); scene-list sidebar persistence across /scenes sub-routes (holomush-5rh.30); theme and status-dot polish (holomush-5rh.26, holomush-5rh.27).

Other changes

This release also includes maintenance work that carries no dedicated feature bead. Nothing is omitted — these are grouped here for completeness:

• Security updates — protobufjs, dompurify (twice), vite, golang.org/x/crypto, and golang.org/x/net were bumped for flagged advisories.
• Dependency & container-image maintenance — routine npm, Go-module, and GitHub Actions bumps; Docker digest refreshes (postgres, caddy, cloudflared, dozzle, grafana, prometheus, the OpenTelemetry collector, and the Go builder); NATS, testcontainers-go, and @types/node updates; plus lock-file maintenance and dependency pinning.
• CI & build — pnpm pin aligned with packageManager, codecov action upgraded, and integration/e2e job parallelization and caching.
• Reliability — atomic remove-and-count on session disconnect, closing several stale session-store bugs (no bead reference on the commit).
• Documentation & housekeeping — roadmap grooming, CLAUDE.md workspace isolation and grepping-skill requirements, the invariant-registry contributor rule and binding-backfill notes, the event-type wire-convention docs, and routine beads updates.