Project releases
RVM 1.7.0: a ruv:// name is a name, not permission
RVM is a runtime built for agents rather than for processes. Release 1.7.0 adds the ruv:// context namespace with a deliberate separation: resolving a name grants nothing, and the right to act arrives separately as a capability handle.
GitHub activity: · Published:
What RVM is
Agents do not fit the assumptions a virtual machine makes about a process. RVM is a Rust runtime built around how agents actually behave, spread across 19 runtime and library crates, with no_std compatibility and GPU backends.
What changed in 1.7.0
The release adds the ruv:// context namespace and the durable service behind it. The design decision is the story: a ruv:// URI names something across tenants and agents without becoming a way to reach it. Parsing grants nothing. Resolving a skill does not execute it.
Authority arrives separately as a capability handle that was deliberately handed over, can be narrowed on the way, and can be revoked. That matters because an agent is a confused deputy by construction: it holds credentials while taking instructions from elsewhere.
A follow up cut ruv:// parse cost by roughly 18 percent and stopped allocating during fingerprinting.
Get started
RVM is a Rust workspace rather than a one line npx install. Start from the user guide and the nightly releases, which are published automatically as new Claude Code versions appear.
git clone https://github.com/ruvnet/rvm.git
cd rvm
cargo build --releaseExpected result: a built workspace. Read the user guide before wiring it to anything.
No single documented npx entry point for the runtime itself. The context service hosts TLS, MCP and CLI surfaces; see the ADR index for the exact boundary.
Use it today
Practical case: naming skills and contexts across several agents without accidentally granting reach. Input is a ruv:// URI; the workflow is resolve, then request a narrowed capability; the output is an action that can be revoked later.
Acceptance test: resolve a ruv:// URI without holding a capability and attempt the action anyway. It must fail.
Push it further
Experimental commentary. Capability security is old, correct and almost never implemented in agent stacks. The exotic version is a fleet where every tool call carries a narrowable, revocable handle and nothing has ambient authority.
Falsifiable test: revoke a handle mid run and confirm the in flight agent loses the ability immediately rather than at the next restart.