docs: v0.16.2 currency, runtime-wasm releases, host-connector manifest Q&A

package.json

@@ -13,7 +13,7 @@
   },
   "dependencies": {
     "astro": "7.4.0",
-    "traverse-embedder-web": "^0.16.1"
+    "traverse-embedder-web": "^0.16.2"
   },
   "devDependencies": {
     "@playwright/test": "^1.64.1"

src/pages/agents.astro

@@ -144,7 +144,7 @@ const _body = `<section class="page-hero">
             </div>
             <div class="checklist-item">
               <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/></svg>
-              <span><strong style="color:var(--fg)">The Oct 9 exact-ref demo is not this server.</strong> That write-up is an in-process MCP-shaped JSON-RPC façade over <code>ExactModelBrowserHost</code> under Node. Mode A <code>traverse-mcp</code> is the stdio server on this page. <a href="/questions/is-the-agent-mcp-demo-the-same-as-traverse-mcp.html">They are not the same.</a> Checksum-pinned Mode A binaries shipped with v0.16.0; the current set is <a href="https://github.com/traverse-framework/traverse/releases/tag/traverse-mcp-v0.16.1" target="_blank" rel="noopener"><code>traverse-mcp-v0.16.1</code></a> (Linux x64, Linux arm64, macOS arm64, Windows x64, with <code>SHA256SUMS</code> and provenance): download, <code>traverse-mcp sync</code>, <code>traverse-mcp prepare-cache</code>: no Rust toolchain.</span>
+              <span><strong style="color:var(--fg)">The Oct 9 exact-ref demo is not this server.</strong> That write-up is an in-process MCP-shaped JSON-RPC façade over <code>ExactModelBrowserHost</code> under Node. Mode A <code>traverse-mcp</code> is the stdio server on this page. <a href="/questions/is-the-agent-mcp-demo-the-same-as-traverse-mcp.html">They are not the same.</a> Checksum-pinned Mode A binaries shipped with v0.16.0; the current set is <a href="https://github.com/traverse-framework/traverse/releases/tag/traverse-mcp-v0.16.2" target="_blank" rel="noopener"><code>traverse-mcp-v0.16.2</code></a> (Linux x64, Linux arm64, macOS arm64, Windows x64, with <code>SHA256SUMS</code> and provenance): download, <code>traverse-mcp sync</code>, <code>traverse-mcp prepare-cache</code>: no Rust toolchain.</span>
             </div>
             <div class="checklist-item">
               <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/></svg>

src/pages/blog/index.astro

@@ -2,7 +2,7 @@
 import SubpageLayout from '@layouts/SubpageLayout.astro';
 
 const posts = [
-  { href: '/blog/model-execute-on-published-packages.html', title: 'One model capability, three published hosts, same answer', desc: 'Featured · Nov 5 · Published catalog model.execute@1.0.0, unchanged, runs a signed ONNX digits package (test-only key) on native (crates.io traverse-runtime 0.16.1), Node 24 and Chromium (npm traverse-embedder-web@0.16.1): identical output, identical 56-byte frame, six identical fail-closed cases (#1782), rerun weekly on a clean CI runner (#1783). Gaps: runtime.wasm comes from the tag (#1784), native frame readback (#1785), no Swift/Android/.NET activation API. Host-connector manifest invokes (#1772) on main, unreleased.' },
+  { href: '/blog/model-execute-on-published-packages.html', title: 'One model capability, three published hosts, same answer', desc: 'Featured · Nov 5 · Published catalog model.execute@1.0.0, unchanged, runs a signed ONNX digits package (test-only key) on native (crates.io traverse-runtime 0.16.1), Node 24 and Chromium (npm traverse-embedder-web@0.16.1): identical output, identical 56-byte frame, six identical fail-closed cases (#1782), rerun weekly on a clean CI runner (#1783). Gaps: native frame readback (#1785), no Swift/Android/.NET activation API. Since then, host-connector manifest invokes (#1772) shipped in v0.16.2 and runtime.wasm got its own release (#1784 closed).' },
   { href: '/blog/traverse-0-16-0-same-input-same-output.html', title: 'Traverse v0.16.0: same input, same output, on every host', desc: 'Featured · Nov 3 · The v0.16.0 release story. Every host feeds guests RFC 8785 canonical JSON (#1722): rerun on released bits, Node (npm 0.16.0) and the traverse-mcp-v0.16.0 binary give byte-identical core.authorize output, policy_hash 51a64653… on both. Mode A without Rust: prebuilt traverse-mcp for four targets, sync → prepare-cache → stdio. Four breaking changes, the wasmtime 48.0.7 sandbox-escape fix, crates.io at 0.16.0, and what the release does not claim.' },
   { href: '/blog/hash-converges.html', title: 'One audit fingerprint, every host', desc: 'Featured · Oct 30 · Weekly demo: same core.authorize@1.2.0 WASM, before and after. Browser on the v0.15.0-era runtime.wasm gives policy_hash 2a126b86…; Browser, Node and traverse-mcp built from traverse main 70f3ee7 all give 51a64653…, byte-identical from unsorted input (RFC 8785, #1739). traverse-mcp sync against live index-v412; no staged fixtures (#1720 closed); five freestyle moves still get typed refusals. Unreleased main, not v0.16.0; no prebuilt binary (#1721).' },
   { href: '/blog/same-wasm-two-hashes.html', title: 'Same WASM, two hashes. The bug wasn\'t in the WASM.', desc: 'Featured · Oct 30 · Why catalog core.authorize@1.2.0 gave a different policy_hash on traverse-mcp than on the embedders (traverse#1722), and the rule now on main: every host feeds guests RFC 8785 canonical JSON input or refuses with input_not_canonicalizable (Decision 118, #1739). Cross-host conformance fixture on native, runtime.wasm and Node. Ships in v0.16.0, not released yet.' },

src/pages/blog/model-execute-on-published-packages.astro

@@ -76,16 +76,18 @@ const _body = `
       <h2 id="not-yet">What isn't true yet</h2>
 
       <ul>
-        <li><strong><code>runtime.wasm</code> isn't in a package.</strong> npm doesn't ship it, and the last <code>runtime-wasm-v*</code> release is v0.11.0. The demo fetches it from the <code>v0.16.1</code> tag and checks the digest (<a href="https://github.com/traverse-framework/traverse/issues/1784" target="_blank" rel="noopener">#1784</a>; <a href="/questions/where-does-bundleembedder-get-runtime-wasm.html">where to get it today</a>). The test-signed model package also comes from the tag.</li>
+        <li><strong><code>runtime.wasm</code> isn't in a package.</strong> npm doesn't ship it, and the last <code>runtime-wasm-v*</code> release is v0.11.0. The demo fetches it from the <code>v0.16.1</code> tag and checks the digest (<a href="https://github.com/traverse-framework/traverse/issues/1784" target="_blank" rel="noopener">#1784</a>; <a href="/questions/where-does-bundleembedder-get-runtime-wasm.html">where to get it today</a>). The test-signed model package also comes from the tag. <strong>Update, November 5:</strong> <code>runtime.wasm</code> now has artifact-only releases again, <a href="https://github.com/traverse-framework/traverse/releases/tag/runtime-wasm-v0.16.1" target="_blank" rel="noopener"><code>runtime-wasm-v0.16.1</code></a> and <a href="https://github.com/traverse-framework/traverse/releases/tag/runtime-wasm-v0.16.2" target="_blank" rel="noopener"><code>runtime-wasm-v0.16.2</code></a> (#1784 closed by <a href="https://github.com/traverse-framework/traverse/pull/1797" target="_blank" rel="noopener">#1797</a>). npm still doesn't ship it.</li>
         <li><strong>Native frame readback.</strong> The one-call native <code>activate_exact_model_runtime</code> gives the same output, but a caller can't read the output frame back through it. The frame check uses <code>ExactModelMediatedConnector</code> directly (<a href="https://github.com/traverse-framework/traverse/issues/1785" target="_blank" rel="noopener">#1785</a>).</li>
         <li><strong>Swift, Android and .NET</strong> have no activation API for this yet, and weren't run. <code>traverse-mcp</code>, Maven and NuGet weren't used.</li>
         <li><strong>The browser run was by hand</strong> for the committed proof. The clean runner covers it in headless Chrome.</li>
         <li><strong>No live-Registry model rights claim.</strong> Validating against live registry records is <a href="https://github.com/traverse-framework/traverse/issues/1786" target="_blank" rel="noopener">#1786</a>. No host is Certified under Spec 529.</li>
       </ul>
 
-      <h2 id="on-main">On main, not released</h2>
+      <h2 id="on-main">Shipped in v0.16.2</h2>
 
-      <p>Application manifests and CLI activation can now declare host-connector invokes. That is <a href="https://github.com/traverse-framework/traverse/issues/1772" target="_blank" rel="noopener">#1772</a>, merged November 4 via <a href="https://github.com/traverse-framework/traverse/pull/1788" target="_blank" rel="noopener">#1788</a>, on top of the published <code>traverse-registry</code> 0.31.0 invoke union. It isn't in any release yet. A v0.16.2 release PR (<a href="https://github.com/traverse-framework/traverse/pull/1793" target="_blank" rel="noopener">#1793</a>) is open as of this writing.</p>
+      <p>Application manifests and CLI activation can now declare host-connector invokes. That is <a href="https://github.com/traverse-framework/traverse/issues/1772" target="_blank" rel="noopener">#1772</a>, merged November 4 via <a href="https://github.com/traverse-framework/traverse/pull/1788" target="_blank" rel="noopener">#1788</a>, on top of the published <code>traverse-registry</code> 0.31.0 invoke union. When this post went up it was on main and not in a release.</p>
+
+      <p><strong>Update, November 5, 2026:</strong> it shipped in <a href="https://github.com/traverse-framework/traverse/releases/tag/v0.16.2" target="_blank" rel="noopener">Traverse v0.16.2</a> (November 4, via <a href="https://github.com/traverse-framework/traverse/pull/1793" target="_blank" rel="noopener">#1793</a>). All six crates, npm, Maven Central and nuget.org are at 0.16.2 (<a href="/questions/can-a-traverse-application-manifest-invoke-a-host-connector.html">what a host-connector invoke looks like</a>).</p>
 
       <h2 id="reproduce">Reproduce it</h2>
 
@@ -104,8 +106,8 @@ node src/compare.mjs      # fails if the run differs from proof/comparison.json<
           <li><strong>Claim:</strong> published catalog <code>model/model.execute@1.0.0</code> (<code>5ccfa372…</code>) over signed <code>traverse.digits-onnx@1.0.0</code> (test-only key) gives identical success output, an identical 56-byte frame and six identical fail-closed cases on native (crates.io <code>traverse-runtime</code> 0.16.1), Node 24.16.0 and Chromium 152 (npm <code>traverse-embedder-web@0.16.1</code>). Native adds <code>placement_evidence</code> (Spec 1719 FR-014).</li>
           <li><strong>Evidence:</strong> traverse#1782 (<code>docs/evidence/model-execute-published-2026-11-03</code>, <code>all_identical: true</code>); clean-runner CI traverse#1783 (<code>published-model-execute-demo.yml</code>, weekly Mondays, pinned to v0.16.1); #1776 closed.</li>
           <li><strong>Web API (v0.16.1):</strong> <code>BundleEmbedder.activateMediatedConnector</code> + <code>exactModelMediatedConnector</code>, <code>submitAsync</code>; sync <code>submit</code> → <code>async_submit_required</code>.</li>
-          <li><strong>Gaps:</strong> <code>runtime.wasm</code> (<code>7a322a17…</code>) and the model package come from the v0.16.1 tag (#1784); native frame readback (#1785); no Swift/Android/.NET activation API; live-Registry rights #1786; no Spec 529 certification.</li>
-          <li><strong>Unreleased on main (Nov 4):</strong> host-connector invokes in application manifests and CLI activation (#1772 via #1788, registry 0.31.0); v0.16.2 release PR #1793 open.</li>
+          <li><strong>Gaps:</strong> the model package comes from the v0.16.1 tag; <code>runtime.wasm</code> (<code>7a322a17…</code>) came from the tag at run time and is now also on the <code>runtime-wasm-v0.16.1</code> release (#1784 closed by #1797); native frame readback (#1785); no Swift/Android/.NET activation API; live-Registry rights #1786; no Spec 529 certification.</li>
+          <li><strong>Shipped in v0.16.2 (Nov 4):</strong> host-connector invokes in CLI workspace application manifests (#1772 via #1788, registry 0.31.0).</li>
           <li><strong>Lead claim:</strong> one shared runtime; hosts are clients that answer connector calls. Discover → execute → trace.</li>
         </ul>
       </div>
@@ -120,7 +122,7 @@ node src/compare.mjs      # fails if the run differs from proof/comparison.json<
           <li><a href="#what-matched">What matched</a></li>
           <li><a href="#why">Why three hosts agree</a></li>
           <li><a href="#not-yet">What isn't true yet</a></li>
-          <li><a href="#on-main">On main, not released</a></li>
+          <li><a href="#on-main">Shipped in v0.16.2</a></li>
           <li><a href="#reproduce">Reproduce it</a></li>
           <li><a href="#facts-for-agents">Facts for agents</a></li>
         </ul>