Skip to main content

Changes

Unreleased​

  • Prepare Mac build 8 / Linux revision 3 from the authenticated public core 0.26 / Library 0.22 installation archive. Native signing/publication and signed apt indexes remain distinct gates. Require the new first-launch controls during native Linux qualification and use their recovery-kit entry for GUI recovery.

0.26.0​

  • Expose saved-copy public verification instructions without granting trust or returning private keys. Keep original card and provenance bytes unchanged.

  • Include the existing conservative working-space reserve and observed free space in independent download reviews; enforce the same reserve again in the worker. No lower-space or integrity bypass is added.

  • Align the Mac build 7 and Linux revision 2 recipes with authenticated public core 0.25.0 / Library 0.21.0 bytes and their exact source revision. Native signing, publication and installed-app qualification remain separate.

  • Handle automatically removed AppleDouble metadata while replacing generated Mac console stubs. Keep unexpected-directory refusal.

0.25.0​

  • Start independent Find with complete signed selections ready for review, while keeping every supported signed listing inspectable and showing honest counts.

  • Offer explicitly reviewed alternate HTTP routes from followed sources for the same exact manifest. Keep supplier statements and the selected model-key policy separate; recheck statements before networking. Cached hints imply no health or independent custody. Protected/peer routes never become implicit gateways.

  • Show metadata connection choices before contacting HTTP mirrors; retain separate local-network, capture-key, byte-limit and private-receiving decisions.

  • Keep original already-public payload identities when defaults were omitted, preserve selected Linux folder whitespace, and return to actual visited Sharing and source-result page offsets.

  • Add independent Horizon backup folders, complete recovery-kit readback and standalone kit-verify; pin the original destination and refuse missing mounts, changed markers, replacement folders and overwrite attempts. Forgetting a destination keeps its files; no automatic retention or deletion is added.

  • Open HTTP sharing files offline in the independent app, retaining separate exact-copy key acceptance, connection permissions and verified PMF custody.

  • Prepare separate public copies through the existing public-only projection, preserving original card extensions and signed evidence. Require separate consent for finite HTTP mirror sessions, retain durable upload accounting and expose a recipient handoff only after verified serving selection. Stop keeps copies; restart opens no listener. Native peer sharing remains separate.

  • Decode original cards for public-content review without changing signed bytes; keep large proofs outside compact controls and reject changed preview metadata. Fence abandoned backup reviews, report selected-drive space, keep Linux pickers alive for bounded interaction and terminate them on cancellation/quit.

  • Refuse native peer policies in HTTP-only app sessions, permit a separately reviewed IPv4 route for isolated LANs, and withdraw handoffs on deselection.

  • Drain accepted backup review/setup calls before releasing owner exclusivity; page long Unicode destinations, refuse broader mirror selections, and expose explicit interrupted-staging cleanup while retaining all saved copies.

  • Advance only the independent owner's private journal to v2, retaining validated prior metadata. Signed card/archive/kit formats and trust roles are unchanged.

  • Add a narrowly scoped native Mac backup-folder picker and Linux picker dependency; preserve correct .foxhandoff filenames in native save dialogs.

  • Preserve complete signed selections with vision/audio/video metadata, named projectors, video companions and same-repository draft/active MTP files. Refuse missing or size-conflicting companions before downloading; keep whole external repositories without complete understood maps unsupported.

  • Share one exact source/revision/path file map between review and download, keeping original cards, extensions, registry proofs and recovery identities.

  • Show legacy reference-audio inputs and video soundtracks without inventing transcription, audio understanding or independent music-generation features.

  • Target native Mac build 6 at the attested core 0.24 / Library 0.20 cohort, bringing the Sovereign Horizon interface to the native app. Native signing, installation and publication remain separate from this recipe update.

  • Target native Mac build 5 at the attested core 0.24 / Library 0.19 cohort, including multimodal descriptions, declared input/output direction and selected-file caveats. Native signing, installation and publication remain separate from this recipe update.

0.24.0​

  • Describe model uses and input/output direction from complete captured tasks, structured capability claims and modalities, including image-text-to-text, reasoning and video understanding. Do not infer capabilities from model names or turn text compatibility flags on embedding models into chat support.

  • Include the exact selected card’s signed-catalog sidecar in local Find/review and saved-copy search. Retain claim source and selected-file limitations; a repository projector inventory is not proof it is in a selected download.

  • Read original retained-card documents up to the existing 8 MiB metadata limit for optional descriptions, accommodating normal publication proofs above the former 512 KiB preview limit. Keep 1,536-byte display summaries, complete original objects, archive identities, trust checks and owner journals unchanged.

  • Target native Mac build 4 at the attested core 0.23 / Library 0.18 cohort, including the human-centered browsing, metadata and recovery interface. Native signing, notarization, installation and public final-container publication remain separate from this recipe update.

0.23.0​

  • Expose the bounded pure model metadata projection for hosts with installed cards that lack portable envelopes or pinned revisions. No card identity or trust is manufactured, and original metadata remains unchanged.

  • Add bounded descriptive views of preserved PMF metadata and original retained cards for the independent Library. Keep descriptions, tasks, origin, license attribution, text context and runtime notes separate from verification and execution authority. Unknown profiles stay opaque; original objects and the versioned owner journal are unchanged.

  • Support local everyday-purpose search and filters in the saved registry catalog. Bound descriptive responses inside the existing control-plane limit with exact forward pagination. Display reads fetch no weights or metadata.

  • Expose the actual active operation stage for plain-language progress; retain explicit starts, per-copy key acceptance and complete export/restore checks.

0.22.0​

  • Follow independently reviewed HTTP(S) source bootstraps and offline caches from the independent local owner. Keep explicit authenticated updates, local search, model-metadata inspection and copy-scoped key acceptance separate.
  • Preserve complete source-fed models and companions into PMF, pinning the original signed wrapper and reviewed mirror routes before any object fetch. Keep durable cancellation/history and no automatic network replay or sharing.
  • Retain public original-capture key candidates, thresholds and revocations in the optional foxlight.preservation-source-keys.v1 PMF profile. Default conversion identities remain unchanged; old generic PMF readers preserve the optional record. Reverse conversion still requires independent original trust.
  • Add pmf-import-preservation --retain-source-keys and preserve the candidate record in a reverse-conversion sidecar. Never turn embedded keys into authority.
  • Add relocatable bundled Mac commands and a separate final-container verification and attestation publication lane. Python releases and recipes do not themselves publish a signed native app. Existing archive/kit identities remain unchanged.
  • New source job kinds require the updated independent owner for Activity history. Older owners refuse unknown journal records; this does not invalidate portable archives or authorize resetting local state during a downgrade.

0.21.0​

  • Add the independent Sovereign local owner: authenticated preset discovery, offline search, exact complete model/companion downloading and private PMF custody without Skulk, a managed SDK, GPU or account. Retain all original card data and signed registry evidence, including unknown properties.
  • Journal finite work before starting; never replay downloads after restart. Keep completed receipts in paginated private history with durable request bindings. Explicit input-transfer cleanup keeps originals, saved copies and kits, and refuses transfers needed by active imports.
  • Preserve exact reviewed kit signature wrappers and capture thresholds during fresh-owner import/restore. Check publication freshness against observed TUF rollback floors. No model execution or sharing starts automatically.
  • Add the two-wheel public desktop installation profile. The Library archive includes its exactly pinned core from the same release source, separate hashed dependency locks, normal/offline installation and SDK-free local-host checks. Existing v1 core installation records and model/archive wire formats remain.

0.20.0​

  • Save source-fed mirror intake's original authenticated signed wrapper privately before receiving objects. Pin its exact bytes, source/catalog/entry attribution, independently selected trust/terms and original transfer allowance. Retry uses that wrapper rather than replacing provenance from an available supplier.
  • Extend offline inspection/recovery and explicit operator prune to these unfinished source copies. Complete bytes can recover after source/catalog loss; partial, corrupt, changed-authority and removed selections refuse. Shared objects remain protected by other unfinished selections; no deletion or sharing is automatic. Existing recovery kits and signed archive identities stay unchanged.
  • Require owner-state v5 for source metadata custody so older mirror owners refuse instead of ignoring partial source references during deletion. Existing v1-v4 wire/policy identities stay unchanged; local/native/HTTP configuration cannot downgrade v5. Legacy unattended restart requires a renewed explicit grant; ordinary manual startup can upgrade before any listener/worker starts.
  • Add transfer.inspect_envelope and optional exact original-wrapper fetch. Supplied metadata is reauthenticated before any objects; a different valid destination wrapper refuses rather than stripping its existing signatures.

0.19.0​

  • Add explicit offline mirror recover and its cancellable embedding API for complete pending copies after an interrupted intake/receipt. Authenticate original model keys, exact identity and all public terms; verify every actual object before promoting. A retained local intent can restore the unchanged original signed wrapper after publisher/input loss.
  • Keep missing/corrupt/removed copies unpromoted, preserve block/pin/policy and accounting, and clear restart permission after pending recovery. This starts no networking or sharing, enrolls no keys, deletes nothing and does not bypass separate recipient, registry or runtime trust. Library pending-copy adoption remains separate from its released retained recovery-kit controls.

0.18.0​

  • Inspect exact retained mirror state independently of catalog/application receipts or pagination with mirror selection. Corrupt/unavailable state refuses instead of appearing empty. mirror inspect authenticates original signed metadata and complete card/companion terms without scanning weights; a pending local intent is metadata, not proof of complete payload bytes.
  • Export a complete retained copy with mirror export-kit and the reusable standalone recovery API. Original wrapper bytes, every opaque card/companion and candidate public trust survive; every object is verified while copying into an atomic, non-overwriting kit. Existing serving need not stop. No new signer, network, runtime or recipient trust authority is granted.
  • Let enrolled hosts optionally pin the source store's device/inode during kit export, refusing a replaced directory before reading its metadata or objects. This changes no signed archive/kit format or existing identities.

0.17.1​

  • Allow a trusted embedding process owner to select the direct native peer session adapter without a nested Python module launcher. Qualified native command helpers remain in the caller's owned process group; standalone callers keep their default EOF-fenced supervisor. No model, network or restart authority is added by this programmatic adapter.
  • Isolate a direct runner's data deadline from its controller while sharing cancellation, so normal expiry and slow daemon teardown allow the next finite native session without marking the retained model failed.

0.17.0​

  • Choose HTTP serving independently of persistent IPFS/BitTorrent sessions with mirror http --enable or --disable. Disabled HTTP constructs no listener; native-only sessions keep their existing trust, budgets, Stop and retention.
  • Bind the choice into explicit owner-state v4 and clear restart permission when it changes. Older v1/v2/v3 state and restart policy identities remain unchanged; local admission and native configuration preserve v4 without downgrading it.
  • Native-only startup reports no HTTP port. It does not grant an unconfigured native transport, change outbound source permissions or start a router. A run with no selected serving transport refuses before worker/network effects.
  • Read startup policy under the owner lock. Add optional typed live activity observations and mirror run --observe, with bounded events and a final drained status. Worker/listener activity is not public reachability evidence.

0.16.0​

  • Admit an independently trusted exact public copy into a persistent mirror offline, without creating or following a catalog. mirror retain copies and verifies complete companions and original card/provenance bytes, pins the exact signed wrapper, and preserves operator pin/block/deletion policy.

  • New local selections invalidate standing restart consent and require explicit serving grants. Partial failures retain bytes but acquire no network repair authority. The owner-state v3 profile preserves legacy v1/v2 policy identities; unchanged HTTP/IPFS/BitTorrent sessions can serve the retained public v1 copy. PMF network transport remains separate and fails closed before local admission.

  • Retain signed intake metadata privately before copying, permitting exact operator prune of interrupted local copies after input loss while protecting shared objects. Explicit retry can restore a damaged wrapper only from the independently authenticated, originally pinned bytes.

  • Keep removed local selections as tombstones. Re-admission requires separate --confirm-reintake, keeps their block/accounting and clears restart consent. Persist signed metadata before ledger selection so interrupted admission or removed-copy retry cannot wedge deletion of another retained model.

  • Add bounded private per-attempt client/origin observations to the explicit synthetic public I2P drill. Controlled faults distinguish header/body timeouts, short bodies and invalid resume ranges without URL or exception-text logging. Ordinary transfers and immutable 0.15.1 artifacts remain unchanged.

0.15.1​

  • Bound mirror network writes separately from disk reads so continuously progressing slow HTTP receivers can complete and resume byte ranges without draining a 1 MiB write inside a single socket timeout. Request/concurrency limits and full-response upload reservations remain unchanged.
  • Recheck persistent mirror serving authority during slow writes. Revocation interrupts transfer, a stalled receiver still times out, and interruptions never refund a conservatively reserved response.

0.15.0​

  • Add explicit receive-only I2P HTTP catalog refresh and trusted legacy archive downloads through a selected numeric loopback proxy. Hash-addressed I2P routes only; no DNS, redirects, address helpers, ambient proxies or direct fallback.
  • Preserve enrolled TUF authority, root/version floors, last-good offline search, independent model trust, exact envelopes, companion completeness, byte budgets and range recovery. Ordinary transfer receipt identities remain unchanged.
  • I2P downloads can resume progressing interruptions within an explicit bounded attempt count; two stalled attempts stop a supplier. Cancellation, original signatures, final-object hashes and cumulative byte/deadline bounds remain.
  • Direct transports refuse I2P/onion names before DNS. This is a pilot boundary, not qualified public-network anonymity. The separately operated router can relay other traffic; see I2P HTTP.

0.14.0​

  • Add an optional standalone I2PSnark recovery-kit pilot: offline I2P-only offers, independently authenticated receiving and finite opt-in hosting, with original legacy/PMF evidence preserved. Receive requires separate payload-sharing consent. Native software is explicitly built/selected, controller loss fences the owned client and local inputs are retained. Public-network privacy and Library integration are unqualified; see pilot limits.

  • Explicit PirateFace exact-repository lookup records bounded untrusted routing candidates without rescue requests, hooks, account enrollment or peer sessions.

  • Offline original-repository torrent intake authenticates the original legacy or PMF capture under independent trust and verifies every file, companion and source document before publishing a new complete archive. Signatures and card data stay unchanged; nothing uploads, executes, deletes inputs or grants trust. See PirateFace interoperability for workflow and limits.

0.13.0​

  • Explicit persistent IPFS/BitTorrent mirrors use isolated per-model native custody, bounded rotating sessions and durable upload reservations. Public transport configuration invalidates restart consent; receive-only defaults, independently supplied model/terms policy and original signed evidence remain.
  • Block/pause/expiry and abrupt controller loss stop native serving while keeping caches/pins. Journaled exact operator prune includes selected native custody. Offline exports provide standard torrents and original-evidence peer handoffs.
  • A combined optional requirements-mirror.lock covers peer/BitTorrent Python dependencies without Skulk; native Kubo software remains separately selected. See persistent peer mirrors for bounds and exposure.

0.12.0​

  • Release installation archives include exact runtime versions/hashes, the wheel, source, source-revision record and an installer that starts no services. The workflow attests the archive and retained verification bundle; offline install uses a retained wheelhouse without indexes/cache fallback. Skulk remains optional.

  • Persistent standalone HTTP mirrors follow authenticated sources under separate model keys and exact reviewed terms. Explicit manual serving and a distinct expiring restart grant preserve operator control; durable UTC budgets survive crashes and refusal/withdrawal/expiry never delete retained models or pins.

  • Offline mirror plan/status, pause/block/pin/retry, completed-intent recovery and explicit stopped-controller prune preserve shared objects and interrupted deletion intent. No Skulk dependency, automatic eviction or native seeding. See persistent mirrors and the systemd recipe.

  • Portable .foxhandoff wrappers retain original signed model/source references and bounded numeric peer contacts. handoff-create/handoff-inspect work offline; handoff-fetch/handoff-follow/handoff-refresh keep independent model/source trust and explicit network permissions. Skulk remains optional.

  • peer-share verifies one complete public closure and publishes its handoff in a finite, separately opted-in native session. Stop, expiry and caller loss stop the daemon and retain the operator's archive; no automatic deletion, eviction, restart or persistent service is introduced.

  • Releases are built, checked and attested by .github/workflows/release.yml from the pushed v* or library-v* tag. GitHub build-provenance attestations cover the wheel, sdist and SHA256SUMS; see verifying a release. PyPI Trusted Publishing is prepared but not enabled.

  • Peer receiving fails over to the next IPFS content root after a root serves bytes that fail verification; previously every later root failed at once. OperationControl.fork() gives each nested attempt its own control while sharing the parent's stop request and deadline.

  • fetch, fetch-catalog, plan-fetch and source-fetch accept --deadline-seconds (default 3,600, at most 86,400). Rerunning resumes.

  • Pack and fetch keep an existing envelope's signatures for the identical payload, so re-signing or a lower-threshold fetch cannot strip another signer.

  • Newly initialized peer profiles run no circuit-relay or AutoNAT service and do not announce private/loopback addresses unless private peers are allowed. Existing profiles keep their recorded configuration.

  • A provably stale Kubo API marker (dead loopback port, held writer lock) is cleared instead of blocking peer-run and peer-bootstrap-set.

  • kit-export/kit-import stop cooperatively on Ctrl-C, and no command prints a traceback when interrupted.

0.10.0​

  • Add peer-runtime-plan and peer-runtime-install: pinned, verified Kubo 0.43.1 acquisition for macOS/Linux ARM64/AMD64 into a private directory, with packaged archive/executable identities and no PATH or system changes.

0.9.1​

  • Add portable .foxpeer-model invitations, offline peer model review and durable, resumable peer receiving into the selected store volume.

0.9.0​

  • Add optional IPFS/IPNS peer discovery (peer extra, separately installed Kubo): .foxpeer source files, dedicated receive-only or mirror node profiles and the same TUF and model trust as direct sources. No default bootstrap list.

0.8.0​

  • Add followed-source discovery: stock-TUF-authenticated listings over the signed catalog, an owner-only offline cache, offline search, explicit refresh with rollback floors, and the source-* commands. Following grants listing authority only; model downloads still need independent bundle trust.

0.7.1​

  • Support PMF recovery kits (kit v2) and authenticated archive dispatch between legacy v1 and PMF manifests. Legacy captures still export byte-identical v1 kits.

0.7.0​

  • Add the draft Portable Model Format 0.1 schema, local pmf-* pack/verify/restore commands and a lossless round trip for existing preservation-v1/Skulk archives.

0.6.0​

  • Add portable public invitations with the original signed manifest, offline candidate-signature inspection and explicitly trusted bounded mirror receiving. Embedded keys never enroll themselves or grant registry authority. New CLI commands: invite, inspect-invitation and fetch-invitation.
  • Add pure metadata-only publication review and optional bounded, explicitly supplied publisher notices. Original required notices remain intact; supplied text does not become original signed upstream evidence. Full publication still checks all source/output bytes and the exact reviewed identity.
  • Preserve existing bundle identities, opaque future card metadata and receive-only defaults. No new account, hosted resolver or network transport.

0.5.3​

  • Bind HTTP mirrors without the standard server's incidental reverse-DNS lookup. Numeric loopback and public listeners no longer depend on reverse name service during startup. Selected signed files, budgets and protocol paths are unchanged.

0.5.2​

  • Expose read-only HTTP mirror response-budget reservations for host-owned progress and stop controls. Charges remain conservative after interrupted responses; this does not change wire formats, receiving or public consent.

0.5.1​

  • Retain additive model-card properties and new string vocabulary names without changing existing card identities. Keep known structural validation and closed, versioned artifact/manifest contracts; runtime admission remains separate.

0.4.0​

  • Add reviewed public-only publication under a separate signing identity, retaining required model data/original notices and excluding private installed evidence.
  • Add optional libtorrent metainfo/web-seed export and explicit seed-only sessions, with native rate/concurrency limits, monitored lifetime and an observed payload stop threshold. Default receiving/verification still import no native binding.
  • Add standalone plan/publish/export/seed commands and real local peer tests. No anonymity, durable daily upload quota or default torrent receiving is claimed.
  • Mark the public Python API as typed (PEP 561) so strict runtime consumers can validate the shipped annotations without copied or incomplete type stubs.

0.3.0​

  • Publish the open model-card envelope/body profile and content-identity reader without a Skulk runtime dependency. Any publisher can create and retain cards.
  • Add bounded offline TUF proofs for exact card publication, independent root enrollment, consecutive threshold-verified rotations and receiver rollback floors.
  • Keep fresh and explicitly historical verification separate. Historical recovery does not discover later revocations or turn expired metadata into a fresh update.
  • Add typed retained cards and per-member publication/file-evidence reports. Missing signed SHA-256 evidence stays visible; owner hashes never acquire registry authority. Contradictory evidence fails without silent downgrade.
  • Add standalone card/proof commands and byte-verifying evidence inspection. Runtime installation, repository-code permission and qualification remain separate; this release does not yet install models into Skulk.

0.2.0​

  • Add read-only pack, fetch and restore plans with separate logical, unique, verified reuse and unverified partial-file accounting.
  • Add bounded progress, cooperative cancellation and structured failure codes to worker entry points; expose planning/progress and Ctrl-C handling in the CLI.
  • Add explicit operation IDs and durable object-byte reservations across process restarts, bound to exact request/trust/policy and pinned destination identity.
  • Reject dot-only paths and reuse verified objects before copy-capacity checks.
  • Preserve v1 bundle identities, independent owner trust, receive-only operation and publish-last verification. No registry proof or runtime integration added.

0.1.0​

Initial standalone signed bundle, verification, receive/restore, catalog and opt-in mirror core. Synthetic conformance and controlled model recovery; independent custody, runtime integration and privacy qualification remain separate.