v0.3.0

Added

• The AgentLink logo now appears at the top of the README, and brand/ holds a downloadable brand kit: logos, social images, the colour palette and plain-language usage rules (DOCS-BRAND-KIT). The usage terms for the name and logo are proposed; the owner confirms them at merge.
• agentlink init opens the first-run page (M1-11b-6, S2, 08 §1, D-120): run in your own terminal, it opens the AgentLink setup page in your browser with a one-time link, where you protect approvals with a passkey; the settings pages keep working until you press Ctrl+C (at most 30 minutes). When your AI runs init, no page opens and no link is shown: it tells you to run init yourself, named the way AgentLink was started. Setup is offered only while no owner exists anywhere on this computer: no owner key, no passphrase-file owner, and no other agent (an agent restored from a recovery kit counts). If no browser opens, agentlink owner init works as before.
• Setup page on first start (M1-11b-8, S2, 06 §7, D-120 (1)): after you install AgentLink and (re)start your AI app, its AgentLink server opens the setup page in your browser once, while this computer has no owner yet, so you can protect approvals with one passkey. Nothing opens when an owner exists, in CI, over SSH or without a display; your AI never sees the page's one-time link, and its tools still tell you which command to run if the page didn't open.
• agentlink ui (M1-11b-9, S1, 08 §1): run in your own terminal, it opens your AgentLink activity page in your browser with a one-time link, or the setup page while no owner exists, and stops on Ctrl+C or after 30 minutes. When your AI runs it, nothing opens and no link is shown: it tells you to run it yourself, named the way AgentLink was started. It is not an AI tool.
• The local web app has its Contacts page (M1-11c-a2, S2, D-118): your contacts by name, with their label. For a new contact it shows the 12-digit safety code with a short nudge to compare it by phone, and "They match", "They don't match" and "Skip". "They match" marks the contact Safety code checked after you confirm with your passkey or owner code; "They don't match" explains what that can mean and offers to remove the contact. You can also rename or remove a contact. With no contacts yet, it suggests asking your AI to create an invite.
• The local web app has its Files page (M1-11c-a3, S2, D-118, D-119): the folders your AI can send files from, and "Allow a folder". Before you confirm, the page shows the real folder that will be allowed (a link is followed), lists every warning in plain words with its own tick, and AgentLink refuses to make the change until each one is ticked. Folders that hold keys or AgentLink's own data, hidden folders and your whole home folder can't be allowed. Every change needs your passkey or owner code. With no folders yet, it says what to do next.
• The local web app has its Proofs and credits page (M1-11c-a4, S2, D-118): your proofs with when they were made and whether they were recorded, and your credits shown as proofs left with the dollar balance beside it. With no proofs yet, it suggests what to ask your AI. Adding credits is not available yet, and the page says so.
• Add credits by QR on the Gnosis test network (M1-11c-a4c, S2, D-122, D-123): Proofs & credits → Add credits shows your agent's address with a QR code and a copy button, the network and coin, and the privacy note (11 §5.6). After funds arrive, "Turn received funds into credits" (owner code, confirm screen) makes your agent add them to its credits, keeping a little for network costs. Base test network: coming soon.
• Withdraw credits (M1-11c-a4c, S2, D-122): returns unused credits to your agent's own account after a confirm screen and your owner code. Sending them to another account comes with a later update.
• Spec (proposed, owner confirms at merge): owner actions credits.deposit and credits.withdraw in 04 §2.5 and §2.5.1.
• The local web app has its Rules page (M1-11c-a5, S2, D-118, D-119): what your agent may do without asking, in two groups, "Everyday" (adding proof and its budget, new contacts, accepting terms) and "More rules" (unknown senders, files, exports and the limits for accepting terms on its own). Changes wait in an unsaved-changes bar. Before saving, the page lists in plain words everything the change lets your agent do without asking, you tick each one, and then you approve once with your passkey or owner code. The selling warning appears only while you turn selling on.
• agentlink policy allow-send-folder † (M1-36b-2-c, S2, D-121 D6; 04 §2.5, 06 §3, §8): for an agent that was set up before owner init and owner add-agent signed a first rule, it creates the empty AgentLink/Send folder in your home folder (readable only by you; an existing folder only when it is real and empty, never a link) and, with one owner code entry, adds only that folder to your rules. Nothing else in your rules changes, and AgentLink signs nothing wider, whatever was prepared. (Proposed, owner confirms at merge: the 06 §8 wording.)
• The first part of the always-on cloud agent for 0.4.0 (M2-3a, S2, D-131; 08 §3.1, §3.2): the agent's store, keys and inbox now run inside your own Cloudflare account. It checks your relays for new messages about once a minute, only for a moment each time, and keeps them encrypted at rest; its identity comes from a secret only your account holds. It does not act on messages by itself. Not usable from Claude yet: the connection to Claude, sign-in and setup pages follow in the next steps of 0.4.0.

Changed

• Documentation-only changes merge faster (CHORE-CI-DOCS-FASTLANE, S1, ci-cd.md): a merge-queue group that holds only docs runs the checks for the affected packages instead of the full suite, and a docs-only push to a feature branch skips the heavy jobs. Any code change, an unknown diff base, or a push to main still runs everything. Pull requests that change docs-site/ now need an independent review like other public docs, except the generated status page.
• The owner confirmed nine details of the 0.4.0 cloud agent (CLOUD-SPEC-DECIDE, S2, D-131; 08 §3, 04 §2.5, §7, 06 §2.3): your recovery code is also the fallback when a passkey is lost; sending files from the cloud agent comes in a later release; template updates go out only after the owner's click; connected apps sign in again about once a month; fetched files open through a 15-minute link and are deleted after 7 days; connected apps start with the ones we have tested (Claude first, ChatGPT on the web next), others only under Advanced; the agent checks for messages every minute; pages offer "Open in Safari" or "Open in Chrome" when a passkey can't be used; and the rest of the cloud work comes in later 0.x releases.
• The always-on cloud agent is now planned as AgentLink 0.4.0, right after the usable local app in 0.3.0 (CLOUD-SPEC, S2, D-131; 08 §3, 04 §2.5, §7, §8): it runs in your own Cloudflare account and works first with Claude on the web and in the Claude iPhone and Android apps, with approvals by Face ID or fingerprint on your agent's own page. ChatGPT on the web comes later. The spec records one narrow exception to the crypto rule, for the OAuth library inside your own cloud agent only, which never handles keys or message content.
• Spec and backlog now mark four decisions as owner-confirmed on 23 Oct 2026 (DOCS-CONFIRM-1023): a refreshed file link never extends retention, the 80 % "near the limit" storage threshold, the agentlink mcp --advanced network override, and 16 downloads per drop object.
• Docs publishing (DOCS-GITBOOK-ONE-SPACE, decided by Tali, 2026-10-26): GitBook is one space, the 4thTech Docs site at wiki.4thtech.io; the AgentLink guide and technical docs are copied into it from each release tag, screenshots are dark theme only, and the GitHub wiki of this repo is a short map of links.
• One docs system for every page (DOCS-MODEL, S1, docs only): page types, plain-first pages with a marked "For the technically curious" part, screenshot rules, templates, and the Files page of the local app rewritten as the first example, with a table linking each part of the page to the code behind it.
• The README is now a plain-language landing page: what AgentLink does, how to get started, what works in 0.2.0 and what is coming (DOCS-README-LANDING). The status block now says v0.2.0 is released.
• Spec for the 0.3.0 first run (DOCS-UXV2-SPEC, D-130, 04 §2.5, 06, 08 §1, 11 §5.5 and §6): Touch ID or Windows Hello is the main way to approve, one confirmation at first run sets up approvals and allows the Send folder, the backup code is shown once with a save step, and your AI may open AgentLink's pages in your browser but never gets a link or a code and can never approve.
• The terminal approve card no longer prints the invite link; it shows a plain summary of who and what instead (M1-11a-ux-c, S1, 08 §1).
• The approval page is styled from the design (light and dark, phone width). Each request leads with a plain sentence, for example "Connect with “Ana” (self-declared)", and an accept-invite request never shows the invite link. The owner code field is full width, takes codes and passphrases of any length, can be shown and hidden, and says where the code comes from (M1-11a-ux).
• When your agent tries to send a file and no folder is allowed yet, it now tells you the exact command to run in your own terminal, policy allow-send-folder (M1-36b-2-c). Your AI can't set up the folder itself.
• policy allow-folder with a path spelled differently from the folder on disk (for example in upper or lower case) shows the exact path and asks Use <exact path>? (y/N) instead of refusing; it still allows only the real folder, and a path through a link is still refused (M1-36b-2-c).
• agentlink init asks once to set up all found apps, shows a "Skipped" line for each declined app, ends with a per-app summary, and waits for Claude Desktop to be quit before writing its settings (M1-36k, S1).
• The setup page leads with Touch ID, Windows Hello or a passkey: one confirmation protects approvals, sets up this agent and allows the new ~/AgentLink/Send folder (with Inbox and Proofs beside it). Your backup code is then shown once, with "Save in my password manager", a secondary Copy and "I saved it". A browser without a usable passkey is told which browser works, or continues with the backup code only (M1-UX-FIRSTRUN-V2, S2, D-130).

Fixed

• init (M1-11b-8, IR-M1-11b-6-1 L-1): a re-run with nothing to change offers the setup page only when no other agent is on this computer, like a fresh setup.
• Run through npx -y @4thtech-io/agentlink, the next-step hints now show the npx command instead of a bare agentlink that the user cannot run (M1-36a-c, S1, 06 §2.5). A global install still shows agentlink.
• policy allow-send-folder now sees ~/AgentLink/Send in your rules as already allowed and doesn't ask for your owner code again (M1-36b-2-d, L2).
• When two contacts share a name, tools now list the candidates with their owner fingerprint and a short ID, so the AI asks which one you mean. agentlink_list_contacts and agentlink_status show the fingerprint next to a duplicated name (M1-9zg, S1, 06 §2).
• First run, owner init and owner add-agent (M1-UX-FIRSTRUN-V2-b, S2, 04 §2.5): your first rule allows only the AgentLink/Send folder that was checked. If that folder is replaced before the rule takes effect, even after you approve, no folder is allowed. Starting setup again right after an earlier attempt ended keeps your folders, and a setup that fails never removes folders an owner set up elsewhere may be using.

Security

• A folder allowed for sending is pinned to where it really was when you allowed it (M1-36b-2-d, S2, 04 §4, IR-M1-36b-2-c-1 L3). If that folder, or a folder above it, is later replaced by a link, AgentLink no longer uses it for sending, so a link can't widen what your AI may send. To use it again, allow the real folder again in your own terminal.
• policy allow-send-folder checks the Send folder again after you type your owner code, just before your rules change (M1-36b-2-d, L1). If it was renamed, replaced, turned into a link or given files in the meantime, nothing changes.