Skip to content

3.0 candidate outbound CLI qualification

All 16 synthetic outbound CLI cases passed on 2026-10-27 after the final Rust test-module layout correction. The workflow used the 3.0.0 debug binary built with one Cargo job and reduced debug information. It exercises real manifest loading, policy, exact terminal approvals, credentials, response filtering, signed journals and interrupted-invocation retry refusal. It does not qualify worker containment or the eventual release-profile binary.

The candidate was uncommitted when tested, based on 89f5e2dc7c22be38997c31febb0dbda19c97a89c. Its source-content digest, rather than that base revision alone, identifies the code under test. The final release still requires exact-commit CI qualification.

Reproduce with scripts/test-outbound-capabilities.py --binary /absolute/path/to/symbi --report /absolute/new/report.json. The fixture uses synthetic credentials and local services; it makes no paid provider calls. Reports retain hashes and verification observations, not private signing keys. Historical containment bundles remain separately scoped.

Restricted-host diagnostic

The preliminary binary's platform diagnostic passed the expected namespace-refusal check with Landlock ABI 8. Supervised launch and cleanup succeeded; private native-workspace setup was refused with no host fallback. Cleanup, unchanged binary and unchanged host policy were confirmed. qualified remains false: this is not a passing native-worker qualification. The report predates the test-module layout correction and identifies its own binary hash. Publication qualification must independently exercise the final release artifact on a supported host.