0.4.3: build the runner over the corrected Linux confinement backend

.github/workflows/release-binaries.yml

@@ -14,7 +14,7 @@ on:
         description: "The release tag the binaries are built from and attached to (e.g. 0.1.3)"
         required: true
       platform:
-        description: "The openkal-platform whose hosted arrangement builds the tools: the one whose version group holds the implementations the tag pins (0.1.5: 0.19.0; 0.1.6: 0.19.1; 0.1.7: 0.19.2; 0.1.8: 0.20.0; 0.1.9: 0.20.1; 0.3.0: 0.21.0; 0.3.1: 0.21.1; 0.4.2: 0.23.1)"
+        description: "The openkal-platform whose hosted arrangement builds the tools: the one whose version group holds the implementations the tag pins (0.1.5: 0.19.0; 0.1.6: 0.19.1; 0.1.7: 0.19.2; 0.1.8: 0.20.0; 0.1.9: 0.20.1; 0.3.0: 0.21.0; 0.3.1: 0.21.1; 0.4.2: 0.23.1; 0.4.3: 0.23.3)"
         required: true
         default: "0.21.0"
       mcpp_ref:
@@ -27,14 +27,14 @@ permissions:
 
 env:
   MCPP_SOURCE_REF: ${{ github.event.inputs.mcpp_ref || vars.MCPP_SOURCE_REF || '' }}
-  # 2026.11.2.1: openkal-platform 0.21.0's C library, openkal-musl 0.26.0,
-  # embeds its allocator (`embed') and states mcpp >= 2026.11.
-  MCPP_VERSION: 2026.11.2.1
+  # 2026.11.3.1 compiles the std module with the selected platform's flags.
+  # mcpp_ref supplies the candidate until this release is installable.
+  MCPP_VERSION: 2026.11.3.1
   # The platform whose hosted arrangement the programs are built over, named by
   # the dispatch beside the tag: a tag's tools pin exact implementations, and the
   # platform is the one whose version group holds them (0.1.4: 0.18.0; 0.1.5:
   # 0.19.0, openkal-linux 0.19.0; 0.1.6: 0.19.1; 0.1.7: 0.19.2; 0.1.8: 0.20.0; 0.1.9: 0.20.1;
-  # 0.3.0: 0.21.0; 0.3.1: 0.21.1; 0.4.2: 0.23.1).
+  # 0.3.0: 0.21.0; 0.3.1: 0.21.1; 0.4.2: 0.23.1; 0.4.3: 0.23.3).
   PLATFORM_VERSION: ${{ github.event.inputs.platform }}
   XLINGS_VERSION: v2026.10.26.1
   XLINGS_NON_INTERACTIVE: '1'

README.md

@@ -109,6 +109,11 @@ each start, and a snapshot compared among the implementation's facts was decline
 0.4.2 is built over openkal-macos 0.21.3, whose answers to an initialiser that runs before its own are
 the loader's record of the arguments and the environment.
 
+**Read-only confinement on Linux** (0.4.3): the runner is built over openkal-linux 0.24.1. It
+claims confinement only with Landlock ABI 3 or later, whose policy can prevent file truncation in
+a read-only grant. Earlier ABIs refuse a confinement request before starting a program. The
+implementation's ABI probe cache uses atomic accesses during concurrent first queries.
+
 ## What a start spends
 
 A program's resource preference (openkal 0.23: balanced, performance, economy) decides what

bind/mcpp.toml

@@ -1,7 +1,7 @@
 [package]
 namespace   = "mcpplibs"
 name        = "openkal-bind"
-version     = "0.4.2"
+version     = "0.4.3"
 # `mcpp::xpkg_request', `mcpp::decision' (protocol 15).
 mcpp        = ">=2026.10.1.3"
 description = "A build plugin: a library published as an ok image (.okso) and a C header is called from a program of any system, through a binding generated from the header and libokrun."

docs/bind.md

@@ -24,10 +24,10 @@ sources      = []
 include_dirs = ["include"]
 
 [target.'cfg(not(os = "openkal"))'.dependencies]
-openkal-run = "0.4.2"
+openkal-run = "0.4.3"
 
 [build-dependencies]
-openkal-bind = "0.4.2"
+openkal-bind = "0.4.3"
 ```
 
 ```cpp
@@ -111,4 +111,5 @@ llvm toolchain's clang converts the call.
 | 0.4.0 | No change of its own; released with the archive, whose loader places an image at the base `okld place` chose for it (openkal 0.23, `kal_exec_alloc_at`) and then applies only the relocations that name a symbol. |
 | 0.4.1 | No change of its own; released with the archive, whose runner on macOS is built over openkal-macos 0.21.2 (a sleep is no longer a spin of the processor; the granularity is the same at every start). |
 | 0.4.2 | No change of its own; released with the archive, whose runner on macOS is built over openkal-macos 0.21.3 (asked before the implementation's initialiser ran, it answers from the loader's record). |
+| 0.4.3 | No change of its own; released with the archive, whose runner on Linux uses openkal-linux 0.24.1 and requires Landlock ABI 3 before claiming confinement of read-only grants. |
 | 0.1.9 | No change of its own; released with the archive, whose runner on macOS is built over openkal-macos 0.17.1 (`kal_task_current` without a system call). |

ld/mcpp.toml

@@ -1,7 +1,7 @@
 [package]
 namespace   = "mcpplibs"
 name        = "openkal-ld"
-version     = "0.4.2"
+version     = "0.4.3"
 description = "libokld: the ok format (openkal image format) --- its definition, a reader of bytes, a checker, a signer, and a loader. Freestanding: no C library, no exceptions."
 license     = "Apache-2.0"
 authors     = ["mcpplibs"]

run/mcpp.toml

@@ -1,7 +1,7 @@
 [package]
 namespace   = "mcpplibs"
 name        = "openkal-run"
-version     = "0.4.2"
+version     = "0.4.3"
 description = "libokrun: the runner's core --- an ok image's names bound to this process's one openkal implementation, in the image's calling convention, and its entry entered."
 license     = "Apache-2.0"
 authors     = ["mcpplibs"]
@@ -15,7 +15,7 @@ openkal = "0.23.0"
 openkal-ld = { path = "../ld" }
 
 [target.linux.dependencies]
-openkal-linux = "0.24.0"
+openkal-linux = "0.24.1"
 
 [target.macos.dependencies]
 openkal-macos = "0.21.3"

tools/mcpp.toml

@@ -1,7 +1,7 @@
 [package]
 namespace   = "mcpplibs"
 name        = "openkal-tools"
-version     = "0.4.2"
+version     = "0.4.3"
 description = "okrun, which runs an ok image on this system, and okld, the format's tool on a build machine (check, note, sign, inspect)."
 license     = "Apache-2.0"
 authors     = ["mcpplibs"]