MrScripty · Nov 4, 2026 · Nov 4, 2026 · Nov 4, 2026 · Nov 4, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,11 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-## [0.8.0] - Unreleased
+## [0.8.0] - 2026-11-04
 
-Source manifests identify `0.8.0`. The date is set when the release is published.
-See [release notes and migration](docs/release-notes-0.8.0.md) and the
-[checkpoint qualification](docs/release-qa-0.8.0.md) before choosing a consumer pin.
+See the [release notes](docs/release-notes-0.8.0.md) for upgrade steps,
+downloads and known limitations.
 
 ### Added
 
@@ -40,6 +39,14 @@ See [release notes and migration](docs/release-notes-0.8.0.md) and the
 
 ### Changed
 
+- `ModelImporter::import` and `import_with_progress` require the lifecycle-owned
+  `ModelLibrary` from `PumasApi` or `PumasLibraryInstance`; a directly
+  constructed library returns `PumasError::Config` before staging.
+- `ModelImporter::discover_shard_recovery[_async]` returns a typed read-only
+  report; `recover_incomplete_shards[_async]` is deprecated and never starts
+  an inferred download.
+- Library merge refuses copied imports whose publication receipt is bound to
+  their current library root.
 - A model's category is metadata: re-detection never moves a model or changes
   its ID for a category change (only a family change still moves it).
   Detection prefers file facts and architectures over task tags: a GGUF
@@ -108,10 +115,10 @@ See [release notes and migration](docs/release-notes-0.8.0.md) and the
 - A desktop update that fails validation is no longer dropped silently, which
   had left views stale; the reason is reported and the view reloads.
 
-## [0.7.0] - Unreleased candidate
+## [0.7.0] - 2026-09-17
 
-See [0.7.0 release notes](docs/release-notes-0.7.0.md) for capabilities,
-upgrade guidance, and scope.
+See the [0.7.0 release](https://github.com/MrScripty/Pumas-Library/releases/tag/v0.7.0)
+for capabilities, upgrade guidance, and scope.
 
 ### Added
 

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -79,6 +79,7 @@ Run the smallest evidence set that proves the change. Common baselines are:
 | Rust | `./scripts/rust/check.sh` or targeted `cargo test --manifest-path rust/Cargo.toml -p <crate>` |
 | Frontend | `npm run -w frontend lint`, `check:types`, and targeted/full `test:run` |
 | Electron | `npm run -w electron lint`, `test`, and `validate` |
+| Desktop contract | `pnpm --dir electron check:desktop-contract` after changing a Rust wire type or an `electron/contracts/` schema |
 | Launcher | `npm run test:launcher` |
 | Torch | Ruff checks plus `python3 -m unittest discover -s torch-server/tests` |
 | Release startup | `./launcher.sh --build-release` and `--release-smoke` |

diff --git a/README.md b/README.md
@@ -35,7 +35,7 @@ The listener is loopback-only. Add `--no-default-features` to the build to omit
 
 ## Integrate it
 
-Use `pumas-library` from [pumas-core](rust/crates/pumas-core) for an embedded library, or [pumas-rpc](rust/crates/pumas-rpc/README.md) for a separate process. One `PumasApi` owns a library root; use `PumasLocalClient` to connect to an existing owner. Native bindings are experimental: check their [support status](docs/native-bindings.md) before choosing one.
+Use `pumas-library` from [pumas-core](rust/crates/pumas-core) for an embedded library, or [pumas-rpc](rust/crates/pumas-rpc/README.md) for a separate process. One `PumasApi` owns a library root; use `PumasLocalClient` to connect to an existing owner. HTTP consumers start from `GET /v1/served-models` and the [model operations contract](docs/contracts/model-operations-v1.md). No host-language binding is currently supported: see the [binding status](docs/native-bindings.md).
 
 Linux x64 is the primary runtime target. Windows x64 and macOS arm64 build artifacts exist, with narrower runtime qualification. See [release guidance](RELEASING.md).
 
@@ -47,4 +47,3 @@ Linux x64 is the primary runtime target. Windows x64 and macOS arm64 build artif
 - [Contributing](CONTRIBUTING.md) · [Security](docs/SECURITY.md)
 
 [MIT License](LICENSE).
-
diff --git a/RELEASING.md b/RELEASING.md
@@ -15,13 +15,13 @@ manual/tag behavior. All outputs remain
 unsigned, unverified candidates. The workflow has read-only contents permissions
 and never creates a tag or GitHub release.
 
-For a build-only rehearsal, first have the parent review the exact source and
-run action. Set `PUMAS_REHEARSAL_SHA` to that reviewed full commit, then dispatch
-this branch (or the accepted branch containing this workflow):
+For a build-only rehearsal, first have the maintainer review the exact source
+and run action. Set `PUMAS_REHEARSAL_BRANCH` to the branch holding that source
+and `PUMAS_REHEARSAL_SHA` to its reviewed full commit, then dispatch:
 
 ```bash
 gh workflow run build.yml --repo MrScripty/Pumas-Library \
-  --ref release/v080-package-qualification-20261014 \
+  --ref "$PUMAS_REHEARSAL_BRANCH" \
   -F build_candidates=true -f expected_source="$PUMAS_REHEARSAL_SHA"
 ```
 
@@ -168,7 +168,7 @@ and macOS ARM64 archives through `headless_inference_ci.py` and the existing
 strict `headless_inference_build.py` producer. Candidate assembly requires all
 three in addition to the thirteen existing assets. A missing or failed native
 job blocks the combined candidate. No workflow step publishes a release.
-Pull requests and manual workflow runs also run the bounded Linux-only
+Pull requests and ordinary (non-candidate) manual runs also run the bounded Linux-only
 `review-inference-linux` job on the existing `ubuntu-24.04` runner. It checks out
 the exact PR head (or manual run SHA), uses the same strict release producer,
 extracts the archive, and compares authenticated core/RPC startup identities.
@@ -181,11 +181,16 @@ untrained ONNX graph through its own extracted Pumas binary, observes the pinned
 native runtime mapping, and requires graceful shutdown. Its separately labeled
 fixture hashes and lifecycle log are execution evidence, not pretrained Nomic
 acceptance or embedding-quality evidence. No model weights are downloaded.
-The source version is `0.8.0`. Setting it does not publish a tag or release and
-does not qualify native model execution.
-The producer requires source version 0.8; older 0.7 sources fail before compilation.
-After manifest or dependency changes, regenerate/review the matching `<version>`
-and `<version>-s3` attribution directories. The generator and inference producer
+
+The bounded PR/manual `review-audio-dependencies` job separately requires the
+frozen non-model audio dependency cohort to execute under real Linux confinement.
+Unsupported confinement or recipe mismatch fails the job. Its evidence contains
+the exact source head/tree, probe report and log; installed runtime bytes are not
+uploaded. This dependency probe does not qualify a pretrained ASR model.
+
+The producer requires source version 0.8; older 0.7 sources fail before
+compilation. After manifest or dependency changes, regenerate/review the
+matching `<version>` and `<version>-s3` attribution directories. The generator and inference producer
 select those source-version paths without retaining a hard-coded 0.7 directory.
 
 `onnx-runtime-pins.json` records the official CPU 1.24.2 GitHub release archive
@@ -250,9 +255,9 @@ also passed against the pinned library in this environment. A separate C harness
 executed a real CPU session using a synthetic two-element Identity graph, observed
 the pinned mapped runtime, released its native handles and exited successfully.
 That bounded untrained graph is not Pumas/Nomic or pretrained-model evidence.
-This development environment has not executed a v0.8 release build, pretrained ONNX model, native Windows/macOS
-startup, signing/notarization, final SBOM or security qualification. Preserve those
-gates before the maintainer's publication decision.
+None of these local checks executes a release build, a pretrained ONNX model,
+native Windows/macOS startup, signing/notarization, a final SBOM or security
+qualification. Those remain gates before the maintainer's publication decision.
 
 ## Complete candidate metadata
 
@@ -281,10 +286,14 @@ SPDX/provenance or treat installer-only checksums as final publication coverage.
 ## Reviewed trained fixture
 
 The documented fixture is Nomic's public `nomic-ai/nomic-embed-text-v1.5`, using
-`onnx/model_fp16.onnx` plus its matching tokenizer/config files. The
-[fixture investigation](docs/plans/v080-packaging/reports/nomic-fixture.md) records
-the official revision, publisher license declaration, exact weight identity and
-remaining byte-verification limits. A provided directory is copied into an
+`onnx/model_fp16.onnx` plus its matching `tokenizer.json`, `config.json`,
+`tokenizer_config.json` and `special_tokens_map.json`, all at the immutable
+revision `ac6fcd72429d86ff25c17895e47a9bfcfc50c1b2` (publisher license:
+Apache-2.0). The publisher's Git-LFS pointer gives `onnx/model_fp16.onnx` as
+273,859,028 bytes with SHA-256
+`cf5b5a86edb00f895561803cfc04729090a958340b8ca2ad76c143f565f6bb04`; that digest
+comes from upstream and has not been recomputed locally. Fetch only those five
+paths, never the whole (about 2.2 GB) repository. A provided directory is copied into an
 isolated library and never modified. The lifecycle receipt records the copied
 bytes; it does not itself authenticate their model provenance or establish model
 quality. No model is bundled in release artifacts or silently downloaded by this
@@ -298,17 +307,19 @@ unmounts it, compares packaged resources, checks ARM64 executables and runs both
 RPC and desktop startup from the copied application. Reproduce on a Mac with
 `python3 scripts/release/smoke-macos-package.py CANDIDATE_DMG`. This check requires
 the matching staged RPC and frontend inputs. It does not qualify Gatekeeper,
-notarization, native chooser recovery or interactive desktop behavior. macOS
-remains a required target; its native results are pending until that job runs.
+notarization, native chooser recovery or interactive desktop behavior. macOS is
+a required target.
 
 ## Required release acceptance
 
 The candidate workflow rejects missing, empty, duplicate, stale-version, and
-unexpected installer archives, and hashes the exact staged bytes. It checks
-native RPC startup from staging and both extracted Linux installers, compares
-packaged Linux resources against their build inputs, and checks Linux desktop
-startup. These
-are bounded startup checks, not installer installation or complete user flows.
+unexpected artifacts, and hashes the exact final bytes. It checks native RPC
+startup from staging on each target, compares packaged resources against their
+build inputs on Linux, macOS and Windows, starts the packaged RPC and desktop
+(Linux under Xvfb, the copied macOS application, the installed and portable
+Windows applications), and asserts inference-route absence for each
+no-inference package. These are bounded startup checks, not complete user
+flows.
 
 Before tagging or publishing, satisfy the remaining artifact-plan obligations:
 
@@ -328,8 +339,8 @@ Before tagging or publishing, satisfy the remaining artifact-plan obligations:
   embed the accepted notices and project license in each distributable.
 - Run current Cargo and pnpm vulnerability/license checks and review their
   results against the shipped dependency closure.
-- Verify the final publication inventory and regenerate checksums after adding
-  release metadata. Candidate checksums cover installers only.
+- Verify the final publication inventory. Candidate checksums cover every final
+  artifact and metadata file; regenerate them if anything is added or changed.
 - If shipping a Torch runtime, verify its resolved dependencies and real
   load/inference/control behavior on each claimed device/platform tuple. Unit
   fakes and source adapters do not qualify a runtime distribution.
@@ -350,8 +361,8 @@ no-follow traversal, a pinned execution lock file, native handle-relative rename
 and writable directory flushes. Durable JSON publication retains the same explicit
 failure and durability states across Linux, macOS, and Windows. Native startup
 checks do not establish signing, SmartScreen acceptance, or interactive workflows.
-See the [dependency review](docs/dependency-review-0.7.0.md) for the remaining
-security and attribution decisions.
+Run the vulnerability and license checks for the exact shipped closure, and
+re-confirm the [accepted advisory exceptions](docs/SECURITY.md#accepted-advisory-exceptions).
 
 ## Tag and publish
 
@@ -366,21 +377,3 @@ version. Failed workflow artifacts are diagnostics, never distribution assets.
 (The v0.7.0 tag was moved once before any publication because its original
 commit never passed CI and no release was cut from it; that pre-publication
 move is the exception, not the practice.)
-
-## Why this workflow changed for 0.7
-
-The histories leading to v0.1–v0.6 repeatedly needed last-minute fixes for
-binding-generator invocations, pnpm/native optional dependencies, action pins,
-platform paths and symlinks, test isolation, lint, and Windows RAM-disk behavior.
-The previous pipeline also shipped outputs excluded by the current artifact
-plan and allowed missing uploads. The replacement removes RAM-disk setup and
-unsupported bundle generation, locks Cargo resolution, reads the Rust toolchain
-pin once, makes headless execution a separate gate, and rehearses installer
-assembly before tags. Release failures remain visible instead of being converted
-into partial success.
-
-The bounded PR/manual `review-audio-dependencies` job separately requires the
-frozen non-model audio dependency cohort to execute under real Linux confinement.
-Unsupported confinement or recipe mismatch fails the job. Its evidence contains
-the exact source head/tree, probe report and log; installed runtime bytes are not
-uploaded. This dependency probe does not qualify a pretrained ASR model.
diff --git a/bindings/README.md b/bindings/README.md
@@ -1,41 +1,10 @@
 # Generated Bindings
 
-This directory is the local output and test area for experimental Pumas host
-bindings. The stable implementation boundary is the Rust adapter in
-`rust/crates/pumas-uniffi`; generated language files are build artifacts.
-
-Supported generators currently target Python, Kotlin, Swift, Ruby, and C#.
-There is also an experimental Rustler crate for Elixir/Erlang, but it does not
-currently expose the core library API. None of these surfaces has a complete
-host/runtime support matrix yet.
-
-## Generate
-
-From the repository root:
-
-```bash
-./scripts/generate-bindings.sh python
-./scripts/generate-bindings.sh csharp
-./scripts/generate-bindings.sh all
-```
-
-Generation builds `pumas-uniffi` and may require separately installed,
-version-compatible bindgen tools. Generated files and their native library are
-one compatibility cohort: do not combine output from different commits,
-versions, targets, or profiles.
-
-## Check and Package
-
-```bash
-./scripts/check-uniffi-surface.sh
-./scripts/check-uniffi-csharp-smoke.sh
-./scripts/package-uniffi-csharp-artifacts.sh
-```
-
-The C# smoke proves that generated code compiles, the matching native library
-loads, and a synchronous version call works. It does not prove async APIs or a
-complete model-library workflow.
-
-Generated output belongs in ignored directories and must not be hand-edited.
-See [Native bindings](../docs/native-bindings.md) for the boundary, runtime
-loading, packaging, and promotion requirements.
+Local output and test area for the experimental host-language bindings. Only
+this README, `support-matrix.json` and the C# smoke sources are tracked;
+everything generated here is a build artifact and must not be hand-edited.
+
+`support-matrix.json` is the machine-readable support decision: it currently
+accepts no host tuple. See [Native bindings](../docs/native-bindings.md) for
+the status, boundary, generation and check commands, runtime loading and the
+evidence required before any tuple is admitted.
diff --git a/bindings/csharp/PACKAGE-README.md b/bindings/csharp/PACKAGE-README.md
@@ -9,7 +9,8 @@ commit, target, and build profile. Place the native library beside the host
 executable or on the platform's native-library search path before loading the
 binding.
 
-These bindings are experimental. The current smoke evidence covers native
-loading and a synchronous version call, not the full async or model-library API.
+These bindings are experimental and not a supported SDK. The current smoke
+evidence covers native loading and a synchronous version call, not the full
+async or model-library API.
 See `docs/native-bindings.md` in the archive for integration constraints and
 the evidence required before claiming host support.
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -77,10 +77,9 @@ of admitted work. The primary drains local effects and downloads during composed
 shutdown. See the [core contract](../rust/crates/pumas-core/README.md#local-intent-interface)
 for availability evidence, restart, retry, deletion and downgrade limits.
 
-Existing operational consumers remain supported. Desktop and UniFFI intent
-adoption is separate from this native/local transport increment. Node, fleet,
-remote discovery and additional network features are deferred until after the
-next Pumas release.
+Existing operational consumers remain supported. The desktop bridge and UniFFI
+do not expose the intent methods. Nodes, fleet management, remote discovery and
+additional discovery networks are later scope.
 
 ## Storage
 
@@ -100,6 +99,17 @@ Import, download, reconciliation, migration, and deletion must keep filesystem,
 metadata, index, and event history consistent. Recovery outcomes must remain
 distinguishable from normal success.
 
+A model's category (what it is used for, such as `llm`, `decision`, `video` or
+`embedding`) is metadata. It groups models for display and never decides where
+a model is stored or what its ID is; only a family change moves a model. Core
+owns detection and the person's explicit choice (`set_model_category`), which
+later re-detection keeps. See the
+[core guide](../rust/crates/pumas-core/README.md#model-categories).
+
+The download store is schema 7. Older supported stores need the explicit,
+one-way offline upgrade in [Opening an older library](library-upgrade.md);
+ordinary startup never converts them.
+
 ## Desktop Boundary
 
 The renderer accesses only `window.electronAPI`; it has no direct Node access.
@@ -167,12 +177,11 @@ boundary split is recorded in
 The default `pumas-rpc` build enables inference plugins. The library-only
 desktop variant combines `pumas-rpc --no-default-features` with the frontend
 `library-only` Vite mode. `PUMAS_INFERENCE_PLUGINS=false` selects that pair in
-the shared launcher.
+the shared launcher. Releases ship both variants (see [Releasing](../RELEASING.md)).
 
-The `pumas-core` HF/process/GPU feature names do not currently remove their
-underlying dependency or public module surfaces. Do not describe its
-`--no-default-features` build as minimal until the feature contract is fixed and
-verified.
+The [Rust guide](../rust/README.md#features-and-variants) owns the Cargo feature
+facts, including why `pumas-library --no-default-features` is not a minimal
+build.
 
 ## Known Boundary Work