Changelog

Every release of Sabline, newest first, one page for each major version. The text is CHANGELOG.md's.

This project was called Velaris until 8.6.0; every entry below 8.6 uses the name it had at the time, which is what the record is for. docs/renamed.md says what moved where.

Since v9.0.0-alpha.4, not yet released. One line, which moves into the entry for the next version when there is one - this is where check_api.py looks for it while VERSION is one a tag already has (RELEASING.md).

api: tests/api/golden.json's http.log changes shape. It was a list of the shape of each line of sabline serve's invocation log, in the order the lines were in the file; it is now an object keyed by the request that produced the line, holding that line's endpoint and outcome as values and the shape of the whole line. Nothing the HTTP door offers changed, and no line of the log changed: this is what the suite records, not what the door does. The reason is that the door is a ThreadingHTTPServer and writes its line after it has answered, so the order of the file was a race the old golden depended on - it failed once on a Windows leg in 8.4 and again on #97, and never reproduced. check_api.py now waits for each request's line before making the next one, and terminates the door only once its last line is in. The new form also catches things the old one could not: which endpoint a line names, and which outcome, are now part of the golden.

An incident catalogue, in incidents/ and on /incidents.html. Fifteen publicly reported incidents from 2023 onward in this project's lane - AI agent failures and supply-chain attacks where code ran with more authority than it should have - each with the primary report it was written from, and a verdict on whether a program of the same shape is refused: STOPPED, PARTIAL, NOT COVERED, UNVERIFIED, or OUT OF SCOPE where nothing ran. A STOPPED or PARTIAL entry carries a real program, the command, the refusal the runtime printed and the receipt, recorded by incident_evidence.py and re-run by check_incidents.py on every push, so no release is made from a tree where one has stopped refusing. It is not a claim that adopting Sabline would have prevented any of the real events, and every entry says which part of its incident is outside Sabline entirely; the seven new rows in the known-open table are where those sentences went, each now naming the milestone that would close it or saying nothing will. A "How these were chosen" section states the window, the lane and the primary-source rule, and that this is a selection and not a survey. Every summary carries verified: false until a person has checked it against its sources, and build_incidents.py will not publish one that does. One candidate, an agent that deleted a production database (Replit, July 2025), was dropped for lack of any primary source - its record is participants' posts and the news that quoted them - and incidents/FACTCHECK.md keeps every source's evidence, row by row, behind the summaries.

tj-actions-changed-files gains a Linux-only evidence step: under full confinement (8.4) the runtime is refused a read of another process's memory and the run ends with E319. A step may now name platforms; it runs and is checked only where it applies, held to its assertions and recorded in no refusal.txt, so a refusal one operating system makes and another does not is evidence here without making the recorded bytes differ from machine to machine.

The known-open table has a page of its own, docs/known-open.md, with the crosswalk's section that lands each of its rows on a framework's controls. Those seven rows took threat-model.html and crosswalk.html past the 100,000-byte page budget, and the table grows every time a gap is recorded honestly, so it was moved rather than trimmed and the budget stays where it was. THREAT_MODEL.md keeps its Known open heading, which links to the page, and every word of the table and the section is where it was moved to.

Competitor scoring (benchmark/competitors/, /competitors.html): the comparison benchmark run through Deno, CPython's WASI build under wasmtime, Starlark, smolagents' Python sandbox and CaMeL's reference implementation, each in its own pinned runtime, every cell's command and output recorded, and a CI leg that re-derives the table and fails if a cell moves. Its first version had Sabline ahead or level on every row, which said more about the benchmark than the tools, so it was corrected before it was published. Five categories were added (16 to 20, 102 programs now) where a competitor should win or Sabline should lose: a leak through a granted channel, one legitimate subprocess, correct programs Sabline's rules refuse (a loop until the input ends, Euclid's algorithm, 25! and a product modulo 2^61 - 1), danger below the language in a granted library or its native code, and rows that check the task's legitimate work still got done. The scoring changed for every column alike: the outcome first and the timing only on a tie; a task check, so a runtime that stops everything scores as a catch with the task broken; before-running credit only where a tool's design has a static step; Sabline's audit credited only on the marked dangerous line, as Deno's lint always was; CaMeL scored only on the rows its threat model claims; and a scenario a runtime cannot express recorded with the reason. Sabline now loses rows, and the page says which first. benchmark/results.json is re-recorded at this checkout. Corpus 13a's JavaScript no longer calls require, which Deno does not define, so Deno's catch there is now its permission check. The receipt sections of EMBEDDING.md moved to docs/receipts.md, to keep the embedding page inside the page budget.

The model round trip (roundtrip_eval.py, evals/roundtrip/, /roundtrip.html): for each model, ten small tasks asked for in Sabline, with the language card, and in Python, each answer compiled, run and checked by one check for both languages, with the toolchain's own messages sent back for up to six rounds and never the answer. A failed attempt is reported as one of four things - did not compile, refused by the budget, crashed, wrong output - per model with its exact version and date. Asking a model is --live, off by default and refused under CI; every reply is recorded, and a CI job re-derives every verdict from the recordings with no model and no key. One free model is recorded: qwen2.5:7b, locally, makes 7 of 10 tasks work in Sabline (6 on the first answer) and 9 of 10 in Python. The page publishes what asking every priced model would cost, from the vendors' published prices.

E101 says what a keyword is for. A keyword where a value belongs used to get the fix "expected a number, string, variable, or function call"; in the round trip's recording a model read that as an instruction, wrote fail(...) as a call, and sent the same program back until its six rounds ran out. Now fail after or is told that or fail belongs in a signature and how to handle or pass up a failure (check ... { ok ... fail ... }, or try inside an or fail function); invariant in a function body is told it is a loop clause, and that a promise about a result is ensures; any other keyword is told it cannot be a value, and that writing it as a call does not make it one. The message and the code are unchanged. Both parsers say the same words - sabline-rt's too, which the agreement gate compares - and tests/error_messages holds them: a golden entry may now hold its fixes, and four E101 cases do.

E101 says where requires and ensures go. In the round trip's E101 rerun, a model moved a function's { above its requires and was told four times only that a keyword cannot be a value. Now requires or ensures where a statement belongs is told it is a clause of a function's signature, written after its return type and before its {, with an example (and, for ensures, that result is what the function returns). The second fix gives the order: uses and or fail first, then requires and ensures, all before the {; and inside a body, a value is tested with if. The message and the code are unchanged, both parsers say the same words, and two more golden cases hold them. The known-open list now says that sabline replay does not print the operating-system-layer line, and why.

A run whose grants turn the operating system layer off says so on stderr. Plain ffi, ffi:os, ffi:subprocess and the other modules the confinement table widens to nothing enforced, and a module the table does not name - even one that does not exist - each turn the layer off for the whole run, which until now only the receipt and sabline audit said. A command-line run now writes one line as the program is about to run, on one condition, the receipt's: its OS policy is not enforced because of what the budget grants. The line says which grant: sabline: ffi:os is granted, so the operating system layer is off for this run: the budget is the only boundary, or plain ffi grants any module, or ffi:NAME is not in the confinement table. Nothing else changes: the run, its exit status and its receipt are what they were, sabline.run(), sabline replay, sabline serve and a Pool write nothing new, and --no-confine says its own line instead. The package-hallucination incident's recording shows it, for the invented huggingface_cli.

The card changed where the round trip pointed, and did not move the number. Three fixes to LLM.md, and nothing else: the example to imitate no longer imports std.vel (six of ten first answers copied that line, and in one it was the whole failure), a to b stopping before b is said first among the rules, and or fail gets a wrong-then-right pair. Before the card was touched, five held-out tasks were committed (two ranges, a number read from standard input, two helpers a model might give a standard-library name) and parse got a second input, because the first recording's answer compared its input with "42" and printed a fixed 43. qwen2.5:7b, three runs of each card on the fifteen tasks: the original ten, Sabline 7, 6 and 6 on the first answer with the old card and 6, 6 and 6 with the new, 7 within six rounds every time; the held-out five, 0 on the first answer and 1 within with the old card, 1 and 1 with the new; Python 9 of 10 and 5 of 5 throughout. That is a one-task move, and it is read as noise. Under it, the card fixed parse, larger and the held-out total and broke write and home_set - the example's first line is now import "log.vel" as log, which the model copies instead - while the range rule fixed none of the three range tasks and over-corrected one. The same card, model build and options do not give the same answers twice: against the first recording, seven of nine unchanged Sabline first answers differed, which is why every run is kept (.run-2, .run-3) and reported. results.json is sabline.roundtrip/2, with the held-out set apart.

Findable by someone with the problem, in their own words (8.7; the research is in plan/findability-research/). A search baseline taken 2026-09-25 found Sabline in none of 33 searches for the problem it addresses, under either name, and no page of sabline.dev indexed at all. What changed, by legitimate means only - nothing hidden, nothing written for a crawler instead of a reader:

One description everywhere: "Run code an AI wrote without handing it everything you can reach." and the sentence after it open the homepage, README.md's first screen and every listing - PyPI, npm, crates.io, the VS Code Marketplace, the MCP bundle, and the MCP registry, whose 100-character limit takes the first sentence alone. check_listings.py holds them to it; --github checks the repository's description, homepage and topics. Keywords lead with the words people search with (ai-agents, mcp, secrets, sandbox, permissions, supply-chain-security, least-privilege).
Five guides, each titled from a phrasing people used about the problem, with the link, each saying near its top what it does not do: scripts that reach only the hosts you name; what a script will touch before it runs; between everything and nothing; the lethal trifecta, one run at a time; and secrets that should never leave your machine, which says in its first paragraph that it does not stop an agent's own shell reading .env. Every example is a file under examples/guides/; check_docs.py reads each guide as a test - a  marker holds a block to its file, every guide must show a refusal, and each refusal line shown must be the one printed - so a guide whose example stops refusing fails the build.
Comparison pages, losses first: Deno, WASI, CaMeL and the Python sandbox, generated from the recorded benchmark by build_competitors_page.py, where a category the benchmark calls a judgement call says so beside the rows it would count as a win; and AILANG, written from its documentation read in full at 0.42.0.
Incident pages under the names people use ("Shai-Hulud", "tj-actions/changed-files", "the xz backdoor", "slopsquatting"; incidents/names.json), and a flagship page, "We examined 15 real incidents and replayed 8 in Sabline", on which each of the 7 with no replay says why - not covered, with nothing to run, or out of scope - so none reads as left out, and check_incidents.py holds the draft to that. build_incidents.py writes an incident's page only once its entry says verified: true, and the flagship only once every entry does - none do yet, so none is published; --drafts DIR writes them to read, and --check fails if docs/ holds one early.
The paper where Google Scholar can find it: build_paper.py builds the PDF with the title and author sizes Scholar's guidelines ask for, served at papers/sabline.pdf beside a landing page carrying citation_title, citation_author, citation_publication_date, citation_pdf_url and citation_doi, and a papers/ index; --check, in CI, fails when the paper changes and the PDF is not rebuilt. The preprint is on Zenodo: its concept DOI, 10.5281/zenodo.22952528, is the landing page's and CITATION.cff's, which also gains the author's ORCID iD, as does the paper's title footnote. Related work gains AILANG (read in full), ETAS and AgentBound, each saying where it is ahead of Sabline; the arXiv source is regenerated.
The site, for search: a title and a description of its own on every page ( in a document), canonical links, a sitemap.xml dated from git, robots.txt, the IndexNow key and indexnow.yml, which sends the pages a push to main changed once Pages has published it; low-value extras labelled so in the code - OpenGraph cards and one small JSON-LD block with no rating on the landing page. check_site.py fails on a missing or repeated title or description, and, in site.yml, which now checks out the whole history, on a sitemap left stale by a commit that changed a page's sources and not it. The landing page leads with the same two sentences, says who Sabline is for and shows a refusal in one command; /velaris explains the rename to someone searching the old name.
The sitemap's <lastmod> days are computed in UTC, on the side that builds them and the side that checks them. They were git's %cs, the day in the committer's timezone, while check_site.py compares them against today in UTC. A commit made in the hours that are still yesterday in UTC - midnight to 05:30 from +0530 - dated every page it touched tomorrow: the sitemap then pointed at the future, which the SITEMAP rule refuses and a crawler reading <lastmod> would be right to distrust, and the staleness rule saw a page whose sources changed the day after the sitemap was written. Both sides now ask git for the day in UTC, so the dates, the history the staleness rule reads and the "not in the future" comparison are one clock.
A capture-the-flag, docs/ctf.md and the judge in ctf/. Ten claims (C1–C10), each a fixed budget and one thing no program under it may do; you write the program, the judge runs it five times with fresh canaries against the published package pinned by the hash of its wheel, on Linux and under the OS confinement that claim can get - full for the file, io and ffi claims, partial for the net and prover claims, none for the two scored through the tool door, stated per claim on the page and in ctf/status.json, and a run that does not reach its claim's level is not scored. It sees a break only through its own observers - hashes of every tree the run can reach but the one directory its budget lets it write, a listener, a nonce scan, a second run differing only in the nonce and compared on stdout, stderr and the files written (so an encoded leak counts, and one written with log counts as much as one printed), the tool door's transcript against both of its ceilings, the prover's answer for every file a submission brings against the run's receipt - never the submission's exit code or transcript, nor anything else the program can write. The receipt is written in a directory of the judge's own, outside the run's root entirely, and checked afterwards for having been changed; every run passes --no-native, and the judge refuses to score at all where native compilation is available anyway; --sabline must be an absolute path, never a name looked up on PATH. The judge's code is published here and pinned by commit from a private scoring repository, so it can be read but not edited by a submission; the safety rests on the per-run canaries, not on secrecy. Its self-test runs the C1 read submission against a build with the 8.1.1 double-dash hole and must report it broken, and against the pinned package it must hold; check_ctf.py runs the observers on every OS and, in one Linux job, the live self-test and a regression for each finding of the two adversarial reviews of the judge - a leak written with log, a write escaping into the run's own directory, an E601 raised by an imported helper's runtime-checked promise, and a program that floods the tool door's stderr. No money, no points: HALL_OF_FAME.md names the finders.

E101's new hints, measured: the task they were written for now works. qwen2.5:7b was run three more times, with the card, tasks and settings above and the compiler after the E101 change. The held-out months answer still puts or fail in main, and still gets E101. That E101 now offers check ... { ok ... fail ... }, and in all three runs the next answer is exactly that, and works. Before the change it never worked. Sabline, first answer / within six rounds: original 8/8, 6/7 and 6/7 (6/7 in every run before); held-out 2/3, 1/2 and 1/2 (1/1). Python was 9/9 and 5/5 throughout. That is a one-task move, read as noise; the mechanism is in the record. No compiler message can reach a first answer, since the prompt is the same byte for byte, yet one run's first answers moved by two tasks. That is the noise, measured with the prompt held still. The other two runs match the earlier ones on every Sabline task but months. A recording now names the compiler whose messages it was sent (sabline_sha256, also in its file name), and the page has a Compiler column.

Changelog

9.x #

8.x: 8.6 to 8.5 #

8.x: 8.4 to 8.3.1 #

8.x: 8.3 to 8.2.1 #

8.x: 8.2 to 8.0 #

7.x #

6.x #

5.x #

4.x: 4.4 to 4.2.1 #

4.x: 4.2 to 4.0 #

3.x #

2.x: 2.63.1 to 2.40.1 #

2.x: 2.40 to 2.0 #

1.x #

0.x #