OwnMesh v1.2.33

Note

Portable checksums are signed with minisign (key ID C596813EFB0946A4).
Verify: minisign -Vm SHA256SUMS -p minisign.pub then sha256sum -c SHA256SUMS.
GitHub artifact provenance is available. Authenticode and Apple notarization remain unsupported (W-SIGN).

OwnMesh v1.2.33

OwnMesh v1.2.33 resolves the D1 write-amplification outage class behind
Issue #224: operation, audit, and OAuth traffic no longer share one
unbounded write path, and quota exhaustion degrades explicitly instead of
killing OAuth while health stays green.

The machine-checked shipped contract remains
release/SUPPORTED_SURFACES.json.

D1 write-amplification reduction (plan F P1)

• Status transitions use a narrow compare-and-swap writing only mutable
  result columns; identity and exact-action binding columns are never
  rewritten post-claim.
• Hot OAuth paths verify-then-skip bootstrap with a single read (migration
  0022_plan_f_p1.sql seeds the rows); refresh keeps one batch-inner
  receipt cleanup; device-code polls degrade to zero-change conditional
  writes under their interval.
• Retention drains through a scheduled 5-minute cron sweep; request-path
  leases stay as fallback. Every batch stays indexed and capped.
• Five proven-redundant hot indexes are dropped with EXPLAIN proof
  (idempotency lookups state the partial-UNIQUE predicate so the planner
  keeps using them); idempotency, audit-listing, outbox, and retention
  plans stay index-backed with no table scans.

Tenant OperationRoom authority (plan F P2, opt-in)

• OperationStore facade with a behavior-identical D1 adapter (default)
  and a tenant-sharded OperationRoom Durable Object behind
  OWNMESH_OPERATION_STORE=device_do plus a per-tenant cutover cursor
  (operation_store_cutover; value d1 escapes back).
• Hybrid fallback keeps pre-cutover rows and in-flight transitions visible
  across the cutover; same-key retries converge without double execution.
• Room receipts double as the audit trail for device-routed calls;
  injection attempts and meta tools keep D1 audit rows. Transfers,
  approvals, and local tools stay D1.
• New OPERATION_ROOM binding and v3 DO migration; see
  ADR 0021 and the
  cutover runbook in deploy-cloudflare.md.

Budget admission and degraded modes (plan F P4)

• A cached single-row write probe drives the budget: any D1 write failure
  degrades to auth_only; OWNMESH_DEGRADED_MODE overrides manually.
• /health/ready reports auth_write_ready, budget_mode,
  budget_reset_at, and budget_probe_category, and is 503 while
  auth_only.
• MCP gates by risk class with structured non-retryable codes
  (OWNMESH_QUOTA_SIDE_EFFECT_DISABLED /
  OWNMESH_QUOTA_READ_ONLY_DISABLED) plus UTC-midnight reset; room-covered
  reads stay available.
• OAuth authorize, token (including refresh), device issuance, and device
  decisions answer 503 temporarily_unavailable plus Retry-After while
  auth_only; status polls stay available.

Connector recovery contract (Issue #227, CI-testable half)

• Quota exhaustion degrades without killing the refresh family; recovery
  needs no connector reinstall and response-loss retries converge.
• Transient 503, invalid_grant, and reuse stay distinct; a mid-rotation
  D1 failure throws without revoking the family.
• Same-key retries converge to the one durable operation; manual
  reauthorization keeps prior receipts reachable via ownmesh_get_operation.
• Operator recovery table and long-running-work rules are documented in
  chatgpt-connection.md.

Cloudflare migration and deployment

• Migration 0022_plan_f_p1.sql seeds bootstrap rows, drops the five
  redundant indexes, and adds quota_probe and operation_store_cutover.
• Enable the triggers.crons entry for the retention sweep; request-path
  leases cover deployments without cron.
• No R2/queue bindings are added (spec §5.1 fail-closed stands); audit
  amortization captures the capacity gain instead.

Verification

• 535 control-plane tests (37 new: telemetry, narrow CAS, sweep, probe,
  cutover, room authority, hybrid fallback, budget, recovery contract),
  EXPLAIN proofs for every dropped index, full Rust cross-platform CI,
  dependency audits, SAST, secret scanning, SBOM, and release-quality
  gates are required before publication.
• The statement wrapper threads immutable bind() returns so instrumented
  writes execute bound on production D1 (caught pre-publish by the exact
  packaged-artifact workerd gate); a regression test pins both bind styles.
• Capacity figures are projections pending the Gate-1 production baseline;
  the device_do cutover runbook requires a 24h baseline first.

OwnMesh v1.2.32

Note

Portable checksums are signed with minisign (key ID C596813EFB0946A4).
Verify: minisign -Vm SHA256SUMS -p minisign.pub then sha256sum -c SHA256SUMS.
GitHub artifact provenance is available. Authenticode and Apple notarization remain unsupported (W-SIGN).

OwnMesh v1.2.32

OwnMesh v1.2.32 prevents benign duplicate OAuth refresh requests from
invalidating ChatGPT's newly issued credentials while preserving fail-closed
reuse detection.

The machine-checked shipped contract remains
release/SUPPORTED_SURFACES.json.

Bounded refresh retry convergence

• A refresh rotation atomically stores one encrypted receipt for 60 seconds.
• Concurrent exact requests and response-loss retries return the same successor
  access/refresh token pair; no second successor is minted.
• The receipt is bound to the old refresh token, token family, client,
  principal, tenant, scope, and resource/audience context.
• Receipt ciphertext is protected with AES-256-GCM using key material derived
  from the presented old refresh token. Token plaintext and hashes are not
  written to logs or audit summaries.
• Expired receipts, binding mismatches, and old-token reuse after the family
  advances continue to revoke the entire family fail-closed.

Cloudflare migration

• Migration 0021_refresh_rotation_receipts.sql adds the bounded D1 receipt
  table and its expiry index.
• Receipt cleanup is TTL-bounded and indexed; the fix does not introduce an
  unbounded token history.

Verification

• MemoryStore and SqlStore/D1 conformance tests cover concurrent refresh,
  response-loss retry, expiry, binding mismatch, and advanced-family reuse.
• The complete TypeScript suite, Rust cross-platform CI, dependency audits,
  SAST, secret scanning, SBOM, and release-quality gates are required before
  publication.

OwnMesh v1.2.31

Note

Portable checksums are signed with minisign (key ID C596813EFB0946A4).
Verify: minisign -Vm SHA256SUMS -p minisign.pub then sha256sum -c SHA256SUMS.
GitHub artifact provenance is available. Authenticode and Apple notarization remain unsupported (W-SIGN).

OwnMesh v1.2.31

OwnMesh v1.2.31 fixes completed device operation receipts accumulating until
the 4096-entry op-journal limit and bounds Cloudflare D1 audit retention.

The machine-checked shipped contract remains
release/SUPPORTED_SURFACES.json.

Automatic journal recovery

• DeviceRoom acknowledges a terminal operation only after its authoritative D1
  result and outbound room sequence are durable.
• The Agent removes only a positively completed local receipt with the exact
  acknowledged operation id. In-progress, uncertain, malformed, missing,
  non-terminal, and foreign-device records are never removed.
• On reconnect, v1.2.31 Agents offer completed receipts in pages of at most 64,
  allowing an existing full journal to drain safely. Lost responses are retried
  on the next connection.
• The exchange is feature-negotiated, so newer Agents do not send the additive
  request to older control planes.

Bounded D1 audit metadata

• Audit events default to 30-day retention and a 50,000-row per-tenant cap.
• A migration-maintained counter makes admission atomic without request-path
  COUNT(*) scans.
• Cleanup touches at most 128 rows through a retention index and is amortized by
  a per-tenant lease. Stored summaries are bounded as well.
• Operators may lower or raise the defaults with AUDIT_RETENTION_DAYS and
  AUDIT_MAX_PER_TENANT; hard ceilings prevent an accidental infinite setting.

Verification

• TypeScript type checking and the complete control-plane suite pass.
• Rust test targets type-check, including rollback and fail-closed journal
  reconciliation coverage. Cross-platform execution remains enforced by CI.
• Wrangler configuration, migration application, release-quality, catalog, and
  packaging gates are enforced before publishing.

OwnMesh v1.2.30

Note

Portable checksums are signed with minisign (key ID C596813EFB0946A4).
Verify: minisign -Vm SHA256SUMS -p minisign.pub then sha256sum -c SHA256SUMS.
GitHub artifact provenance is available. Authenticode and Apple notarization remain unsupported (W-SIGN).

OwnMesh v1.2.30

OwnMesh v1.2.30 fixes repeated ChatGPT authentication expiry for the stable
ChatGPT CIMD client. The shipped tool and device capability surface is
unchanged.

The machine-checked shipped contract remains
release/SUPPORTED_SURFACES.json.

Persistent ChatGPT authorization

• ChatGPT's stable CIMD client ID
  https://chatgpt.com/oauth/client.json and callback
  https://chatgpt.com/connector_platform_oauth_redirect are now recognized as
  an exact trusted pair for refresh-token issuance.
• OwnMesh issues a rotating refresh token for that pair even when ChatGPT omits
  the optional offline_access scope. This prevents the connector from losing
  authorization when the 15-minute access token expires.
• Matching remains fail-closed and exact. Lookalike client IDs, callback path
  changes, and trailing-slash variants are not treated as ChatGPT.
• Legacy ChatGPT dynamic registration remains supported.

Verification

• Added table-driven coverage proving both stable CIMD and legacy dynamic
  registration receive access and refresh tokens without offline_access.
• Added negative tests for a lookalike client ID and a non-exact callback.
• Control-plane tests, TypeScript type checking, lint, Wrangler dry-run, Rust
  metadata/format/Clippy, and release-quality checks pass. Cross-platform Rust
  build and test gates are enforced by CI.

The current OpenAI authentication contract is documented in
Authentication — Plugins.

OwnMesh v1.2.29

Note

Portable checksums are signed with minisign (key ID C596813EFB0946A4).
Verify: minisign -Vm SHA256SUMS -p minisign.pub then sha256sum -c SHA256SUMS.
GitHub artifact provenance is available. Authenticode and Apple notarization remain unsupported (W-SIGN).

OwnMesh v1.2.29

OwnMesh v1.2.29 fixes ChatGPT OAuth linking on the production Cloudflare
Workers runtime. The shipped tool and device capability surface is unchanged.

The machine-checked shipped contract remains
release/SUPPORTED_SURFACES.json.

Cloudflare CIMD compatibility

• ChatGPT identifies itself with the HTTPS CIMD URL
  https://chatgpt.com/oauth/client.json during OAuth authorization.
• Cloudflare Workers supports follow and manual for outbound fetch
  redirects, but not the browser/Node error mode. The previous mode threw a
  runtime TypeError before ChatGPT metadata could be read.
• OwnMesh now uses manual and rejects every redirect response as non-success.
  It does not follow Location, forward credentials, or loosen the existing
  16 KiB document bound, HTTPS client-id policy, exact redirect matching,
  public-client method intersection, owner authentication, or consent replay
  protections.

Verification

• Added a regression assertion for the Cloudflare-compatible request mode.
• Added a negative test proving a 302 metadata response is rejected after one
  fetch without following the attacker-controlled destination.
• Ran the actual OwnMesh CIMD validator in a Cloudflare remote preview: the
  v1.2.28 implementation reproduced the Workers TypeError, while this release
  accepted ChatGPT's live production document.
• Control-plane tests, TypeScript type checking, lint, and release-quality
  checks pass for this release.

The current OpenAI authentication contract is documented in
Authentication — Plugins.

OwnMesh v1.2.28

Note

Portable checksums are signed with minisign (key ID C596813EFB0946A4).
Verify: minisign -Vm SHA256SUMS -p minisign.pub then sha256sum -c SHA256SUMS.
GitHub artifact provenance is available. Authenticode and Apple notarization remain unsupported (W-SIGN).

OwnMesh v1.2.28

OwnMesh v1.2.28 restores ChatGPT OAuth linking after ChatGPT adopted the
current Client ID Metadata Document (CIMD) token-authentication capability
format. The shipped tool and device capability surface is unchanged.

The machine-checked shipped contract remains
release/SUPPORTED_SURFACES.json.

ChatGPT OAuth compatibility

• OwnMesh now reads token_endpoint_auth_methods_supported as the
  authoritative CIMD capability list when it is present.
• ChatGPT may keep private_key_jwt as its legacy singular preference while
  also advertising none in the plural capability list. OwnMesh selects only
  the shared none method because its token endpoint remains a public client
  with PKCE S256.
• Legacy CIMD documents that publish only
  token_endpoint_auth_method: "none" remain compatible.
• Documents without a public-client intersection still fail closed. Redirect
  URI exact matching, bounded/no-redirect metadata fetches, owner authentication,
  consent snapshots, and metadata revalidation remain unchanged.

Verification

• Added a regression fixture matching ChatGPT's current production CIMD,
  including the plural method list and the legacy singular preference.
• Added a negative case proving that a confidential-only capability list is
  rejected even if a conflicting legacy field claims none.
• Control-plane tests, TypeScript type checking, lint, release-quality checks,
  and the live ChatGPT metadata probe pass for this release.

The current OpenAI authentication contract is documented in
Authentication — Plugins.

OwnMesh v1.2.27

Note

Portable checksums are signed with minisign (key ID C596813EFB0946A4).
Verify: minisign -Vm SHA256SUMS -p minisign.pub then sha256sum -c SHA256SUMS.
GitHub artifact provenance is available. Authenticode and Apple notarization remain unsupported (W-SIGN).

OwnMesh v1.2.27

OwnMesh v1.2.27 hardens the self-hosted Cloudflare control plane after a
production D1 daily-limit outage. MCP operation admission, retention, waits,
and uncertain delivery recovery now have explicit per-request bounds while
preserving exact-action authorization and replay protection.

The machine-checked shipped contract remains
release/SUPPORTED_SURFACES.json; this
release changes availability and cost behavior, not the admitted tool surface.

Cloudflare cost and availability

• Replaced request-path COUNT(*) and tenant-wide operation cleanup with a
  transactionally maintained per-tenant counter and three partial-index-backed
  retention batches of at most 128 rows.
• Admission is one atomic SQLite statement, so concurrent claims cannot exceed
  MCP_OPS_MAX_PER_TENANT. Existing idempotency receipts continue to win even
  at capacity, and unexpired receipts are never evicted.
• Rewrote idempotency lookup as indexable equality predicates and added an exact
  unique binding for operations without a device.
• Replaced 100 ms wait_ms polling with a strict two-read exponential/deadline
  fallback. A 25-second wait no longer issues roughly 250 D1 reads.
• Recognized D1 runtime failures now return a sanitized retryable HTTP 503 for
  OAuth, MCP, API, and Agent connection paths instead of an uncaught Worker
  1101 page.

Delivery and reconnect recovery

• dispatch_uncertain rows use a durable compare-and-swap retry lease,
  exponential equal jitter, and a five-attempt ceiling. ownmesh_get_operation
  can recover delivery without replaying the original tool call.
• Every retry rechecks the original OAuth client and scope, current principal
  revocation authority, operation expiry, and cancellation fence; DeviceRoom
  still performs the final authoritative deduplication and dispatch check.
• Long-running command correlation now covers the admitted command timeout plus
  one minute of result-delivery grace. Detached work retains the 24-hour cap.
• Agent reconnect backoff now applies full jitter to avoid a synchronized surge
  when Cloudflare recovers.

Verification

• SQLite migration tests load both 10,000-row and 20,000-row fixtures and prove
  identical index-backed query plans for idempotency and retention.
• Regression coverage enforces the wait read budget, atomic quota failure,
  counter maintenance, status-driven retry leasing, long-command TTL, sanitized
  outage responses, and jitter bounds.
• Wrangler is updated to 4.128.0 with current Workers types and compatibility
  date 2026-08-28. Persistent Workers observability remains disabled by default;
  operators may opt in using the query-safe recipe in the deployment guide.

This release closes GitHub issues #194, #201, #202, and #206.

OwnMesh v1.2.26

Note

Portable checksums are signed with minisign (key ID C596813EFB0946A4).
Verify: minisign -Vm SHA256SUMS -p minisign.pub then sha256sum -c SHA256SUMS.
GitHub artifact provenance is available. Authenticode and Apple notarization remain unsupported (W-SIGN).

OwnMesh v1.2.26

OwnMesh v1.2.26 simplifies external CLI execution by removing the first-class
coding-agent Profile and vendor-adapter layer. External CLIs now use the same
generic exact-program command, process, PTY, and session capabilities as every
other executable.

This is an intentional breaking change for Profile-specific CLI, IPC, and MCP
automation. OwnMesh's own CLI, signed updater and rollback path, daemon, TUI,
Control Plane, installer, generic sessions, filesystem, transfer, approval,
policy, and audit capabilities remain supported.

The machine-checked shipped contract is
release/SUPPORTED_SURFACES.json. Its
registry-scoped completeness_claim is true because the admitted surface has no
unimplemented commands or surface-specific evidence waiver. The separate
release-evidence receipt remains false while the disclosed external platform,
packaging, ChatGPT automation, and independent-review blockers remain open.

Generic external CLI contract

• One-shot work uses exact-argument command execution. Interactive, login, or
  long-running work uses generic process or PTY sessions with bounded stream
  replay and the existing lifecycle controls.
• Callers supply the executable, arguments, and any vendor-defined resume flags.
  OwnMesh does not discover vendor installations, infer authentication state,
  select protocol dialects, normalize vendor events, or construct native resume
  requests.
• Generic structured pipes, PTY/process-tree cleanup, controller leases,
  idempotency, approvals, policy checks, audit, and workspace path resolution
  remain shared runtime infrastructure.

Removed Profile surface

• The Profile crate, official catalog, custom registry, vendor adapters,
  discovery and authentication probes, normalized event parsers, permission
  bridge, resume/cancel frame generation, fixtures, and live-provider receipt
  waiver are removed.
• The ownmesh profile command family and TUI Profiles screen are removed.
• Profile IPC methods and MCP tools are no longer published or callable.
  Profile-specific session kinds and request/state fields are no longer part of
  the public schema.
• MCP catalog v2 records this deliberate break. Catalog v1 remains historical
  evidence and is not a callable compatibility promise for v1.2.26.

Upgrade behavior

• Removed Profile RPC methods return bounded method-not-found responses.
• Generic session.open rejects old Profile fields and kinds with explicit
  invalid-parameter migration guidance; it never silently falls back to a PTY.
• Persisted Profile sessions are discarded rather than guessed into generic
  sessions. Obsolete Profile metadata on an otherwise generic session is
  ignored, so an upgrade cannot panic on old state.
• Existing automation should invoke the external CLI through exact program
  and args, following that CLI's current documentation for login and resume.
• Published ChatGPT integrations must scan and publish the catalog-v2 metadata;
  redeploying a Worker alone cannot rewrite an approved tool snapshot.

Security boundary

OwnMesh authorizes the launch and lifecycle of the external process/session,
including exact argv, selected workspace, policy, approval, replay, and audit.
It does not observe or authorize individual filesystem or tool actions performed
inside that child through a vendor protocol.

A workspace or cwd binding is path and policy context, not an operating-system
sandbox. An external process may exercise the ambient authority of the OwnMesh
OS user. Operators that need confinement must add the platform's process sandbox
or restricted execution boundary.

No privacy or authorization default is loosened. Telemetry, cloud file relay,
automatic update checks, and unsolicited network activity remain off by
default. Credentials, provider login, model configuration, and external CLI
updates remain under the user and that CLI's control.

Verification and remaining boundaries

The release workflow requires Rust 1.92 builds and tests on Linux, macOS, and
Windows; strict Clippy; frozen pnpm test, typecheck, and lint; dependency audits;
SAST; gitleaks; strict CycloneDX SBOMs; release-claim checks; and a packaged
Linux x64 workerd E2E covering device routing, filesystem, command, generic
session, restart/recovery, and two-Agent transfer paths.

Portable archives are protected by SHA-256, mandatory minisign verification,
and GitHub provenance. Authenticode, Apple notarization, native installers,
macOS/Windows privileged-route receipts, a fully automated published-ChatGPT
canary, and independent external security review remain disclosed boundaries.

OwnMesh v1.2.25

Note

Portable checksums are signed with minisign (key ID C596813EFB0946A4).
Verify: minisign -Vm SHA256SUMS -p minisign.pub then sha256sum -c SHA256SUMS.
GitHub artifact provenance is available. Authenticode and Apple notarization remain unsupported (W-SIGN).

OwnMesh v1.2.25

OwnMesh v1.2.25 is the next stable patch release after v1.2.24. It hardens
command custody and restart behavior, adds backward-compatible support for the
modern MCP protocol, and makes the release pipeline test and describe the exact
artifacts it publishes.

No privacy or authorization default is loosened. Telemetry, cloud file relay,
automatic update checks, and unsolicited network activity remain off by
default. The machine-checked product contract is
release/SUPPORTED_SURFACES.json, and its
completeness_claim remains false while the disclosed external evidence
waivers remain open.

Runtime execution custody

• Elevated commands now follow the same admit/execute/finalize split as
  ordinary commands. Policy, exact-action binding, credential generation,
  expiry, journal reservation, and executable pins are captured during
  admission; broker connect, wait, cancellation, output collection, and
  post-response custody re-attestation run without holding the global daemon
  runtime mutex. Finalization can commit only the originating operation's
  in-progress marker (ADR 0015).
• Session supervisor calls remain bounded by their five-second IPC deadline but
  still pass through the runtime mutex. Per-session transition ownership and
  high-concurrency session stress remain explicit follow-up work.
• On restart, a prior-process in_progress operation is durably classified
  recoverable_orphaned and returned as OWNMESH_E_OPERATION_ORPHANED. It is
  never auto-retried. Generic command PID/birth identity is not journaled, so
  automatic process reattachment is not claimed.

Linux script and interpreter binding

• Linux shebang execution now treats the script and interpreter as one pinned
  compound. Both are re-attested and handed to the child through sealed memfd
  snapshots and proc-fd paths, closing interpreter/script substitution between
  approval and spawn (ADR 0013).
• A bounded Node loader preserves the approved module URL, argv, child
  process behavior, and relative imports when the sealed script snapshot is
  executed. Regression tests cover relative-module loading and both script and
  interpreter swaps.
• Supported /usr/bin/env shebang forms preserve deterministic interpreter
  resolution. Unsupported option syntax fails closed instead of falling back
  to an unverified path lookup. macOS and Windows retain their existing
  prepared-executable paths.

Dual-era MCP and catalog compatibility

• One registry and authorization core now serves legacy MCP 2025-03-26 and
  modern stable MCP 2026-07-28 (ADR 0017). Existing clients keep
  initialization and optional session IDs; modern clients use stateless
  request metadata and mirrored HTTP headers.
• Modern requests receive strict method/name/version validation, typed
  HeaderMismatch and UnsupportedProtocolVersion errors,
  server/discover, result types, and deterministic cache hints. Unit tests and
  real workerd E2E exercise both protocol eras.
• Catalog version 1 is frozen against unversioned breaking changes. Existing
  names remain accepted by tools/call for the 1.x window, including
  deprecated aliases hidden from the latest list. CI rejects removal of
  callable names, new required fields, property changes, or effect-hint drift.
• Optional core, admin, and agents catalog surfaces are enforced at call
  time. Hiding a tool is never treated as authorization.

OAuth public-client modernization

• The authorization server advertises and validates bounded Client ID Metadata
  Documents after owner authentication. Retrieval is credential-free HTTPS,
  does not follow redirects, and is revalidated at consent time.
• Authorization responses include RFC 9207 iss; existing redirect, issuer,
  resource, PKCE S256, refresh rotation, and token-family bindings remain in
  force. Dynamic Client Registration remains available as the compatibility
  fallback for current ChatGPT and legacy clients.
• Private-key JWT is not advertised or accepted. This release adds no client
  path that can bypass the public-client and owner-consent contract.

Release artifact evidence

• The tag workflow still requires reusable CI and Security gates plus all five
  Windows, macOS, and Linux archives. It now downloads and checksum-verifies the
  packaged Linux x64 archive and uses its binaries—not workspace debug
  binaries—for workerd device, filesystem, command, profile, session,
  restart/recovery, and two-Agent resumable-transfer tests.
• Publication remains blocked until the exact-artifact gate succeeds.
  Cross-platform archive construction is CI-gated; the deterministic packaged
  runtime E2E executes on Linux.
• Each release emits ownmesh-release-evidence.json from exact artifact hashes,
  the current catalog receipt, its frozen compatibility baseline, and release
  gate facts. The receipt is included in the signed checksum chain and GitHub
  provenance. It does not turn fixtures into external-provider evidence.

Edge diagnostics

• The machine-endpoint probe now uses two independent HTTP stacks and reports
  stable categories for DNS/TLS/connect timeout, Cloudflare edge 1010/denial,
  Worker authentication and 4xx/5xx responses, malformed JSON, and catalog
  mismatch.
• Retries are bounded, output has an explicit JSON schema version, and
  Cloudflare cf-ray is reported for operator diagnosis without exposing
  bearer tokens, bodies, or user content.
• Multi-egress scheduling and a narrow Cloudflare WAF skip remain operator
  infrastructure. The release does not silently change a user's zone rules.

Upgrade and compatibility

1. Upgrade installed device binaries with ownmesh update or a verified
   release archive.
2. Redeploy the Control Plane from this tag to obtain dual-era MCP, OAuth, and
   catalog behavior. Publishing a GitHub release cannot update a user's
   self-hosted Cloudflare deployment.
3. Run ownmesh doctor --json; add --check-network only when an explicit
   control-plane probe is desired.
4. For a developer-mode ChatGPT connection, refresh its tool metadata. For a
   published plugin, the publisher must run Scan Tools, submit a new
   metadata version for review, and publish it; a Worker deploy or new chat
   cannot rewrite OpenAI's approved snapshot.

No public CLI command or existing MCP tool name is removed. Existing legacy
MCP clients remain supported, and catalog additions do not invalidate callable
1.x snapshots.

Verification and remaining boundaries

The release candidate is gated on Rust 1.92 across Linux, macOS, and Windows,
workspace tests, Clippy with warnings denied, frozen pnpm test/typecheck/lint,
dependency audits, SAST, secret scanning, strict CycloneDX SBOM generation,
catalog compatibility, release-quality checks, and the exact packaged-binary
E2E described above.

Portable archives remain protected by SHA-256, a mandatory minisign signature,
strict SBOMs, and GitHub build provenance. The following are still disclosed,
not claimed as completed proof:

• live nine-profile provider receipts on Linux, macOS, and Windows;
• macOS/Windows native broker receipts and the complete public MCP-to-broker
  route receipt;
• a fully automated external published-ChatGPT canary;
• Authenticode, Apple notarization, MSI/NSIS, and native macOS packages;
• an independent external security review.

OwnMesh v1.2.24

Note

Portable checksums are signed with minisign (key ID C596813EFB0946A4).
Verify: minisign -Vm SHA256SUMS -p minisign.pub then sha256sum -c SHA256SUMS.
GitHub artifact provenance is available. Authenticode and Apple notarization remain unsupported (W-SIGN).

OwnMesh v1.2.24

OwnMesh v1.2.24 is the next stable release after v1.2.23. It focuses on two
things: keeping long-running command/session paths from stalling the device, and
making the nine official coding-agent profiles report and execute only the
structured contracts that are actually supported.

No privacy or authorization default is loosened. Telemetry, cloud file relay,
and unsolicited network checks remain off by default. The machine-checked
product contract remains release/SUPPORTED_SURFACES.json.

Device availability and command concurrency

• Non-elevated command.run no longer holds the daemon runtime mutex while the
  child is running. Policy admission, revocation/lockdown checks, exact-once
  reservation, executable identity checks, and custody still occur under the
  authority-bearing path; only the external child wait is moved outside the
  mutex (#160, ADR 0015).
• The authenticated Control Plane approval.decision path now follows the same
  unlocked execution model when an approval releases a deferred non-elevated
  command. A command that required Ask therefore no longer has a special path
  that can stall every unrelated operation on the device (#160).
• Off-lock commands are bounded by an explicit global semaphore acquired before
  the runtime mutex, journal reservation, and executable preparation. Capacity
  waits therefore do not consume an idempotency key or pin executable custody.
  If a queued remote operation is cancelled before capacity becomes available,
  it never spawns later. Detached commands retain their own stricter cap.
• Finalization keeps the exact-once in-progress marker as the compare-and-swap
  target. Approval/journal rollback is scoped to the entries owned by that
  operation, so an interleaved unrelated commit is never overwritten by a
  whole-map snapshot restore.
• system.diagnose keeps the bounded runtime_queue view from #169 so a live
  unlocked execution is distinguishable from a stale in-progress journal row
  without exposing argv, paths, output, or other command content.

Session and process-state honesty

• session.open refuses to publish running when the attested child is already
  dead, including the short-lived zombie race covered by the #169 path.
• The structured-session supervisor now also folds OS liveness into its status
  boundary. An exited-but-unreaped child is reported exited even when a
  descendant still holds stdout/stderr open, while the durable process-birth
  witness remains the plain PID-reuse witness (#31).
• Linux /proc state Z and absence/probe ambiguity are explicitly documented;
  a probe failure is not silently promoted into a successful reap claim.

Windows installer readiness

• The portable installer continues polling authenticated ownmesh --json status
  until the daemon reports the version that was just installed, rather than
  relying on the old fixed 500 ms delay (#154).
• The readiness deadline now uses a monotonic Stopwatch, so wall-clock/NTP
  changes cannot silently extend the wait. Native stderr, partial JSON, and
  not-yet-ready replies remain retryable startup states.
• Task Scheduler state is interpreted from authoritative result/state values,
  not localized display text. A task probe that itself fails is not treated as
  proof that the task disappeared. The existing 20-second default and
  OWNMESH_DAEMON_READY_TIMEOUT_SECONDS override are preserved.

Official nine-profile adapter correctness

• Codex, Claude Code, Kimi, OpenCode, Pi, AGY, Qwen Code, Hermes Agent, and
  Qoder now use source-backed, dialect-aware structured adapter contracts rather
  than one generic JSON classifier (#170/#171).
• Versioned fixtures cover ACP v1, Codex app-server, Claude stream-json, Pi RPC,
  and AGY stream-json. Malformed, oversized, unknown, and future records remain
  bounded typed adapter errors, and a bad record does not hide a later valid
  record.
• Detection, version probing, shebang interpreter resolution, and launch share a
  deterministic child PATH. A discovered npm-style wrapper can no longer be
  reported ready when its interpreter is not launchable from the service
  environment.
• installed, authentication evidence, and structured-protocol readiness are
  separate states. A version probe alone cannot become a false compatibility
  PASS.
• ACP filesystem/terminal requests and vendor permission/approval requests fail
  closed with correlated typed responses. OwnMesh does not auto-approve vendor
  requests or advertise client capabilities it does not implement.
• Resume and cancellation are dialect-specific, and local/remote structured
  profile sessions share the persistent supervisor path. Prompt text is passed
  as a protocol/argv value rather than shell syntax.

Startup and custody diagnostics

• Setup, ownmesh doctor, and the TUI Repair Agent path inspect the same
  config/state/runtime ancestor custody requirements used at daemon start. A
  writable ancestor is surfaced as a dedicated layout.custody problem with a
  bounded non-recursive remediation path (#168/#169).
• macOS restricted Apple system binaries keep the #169/#164 backing-path custody
  behavior; the v1.2.24 availability changes do not weaken executable identity
  or prepared-image guarantees.

Verification

The merged pull requests were gated on Linux, macOS, and Windows with Rust 1.92,
workspace tests, Clippy with warnings denied, frozen pnpm tests/typecheck/lint,
dependency audits, SAST, secret scanning, strict CycloneDX SBOM generation,
release-quality checks, and the release/security dependency graph. Focused
regressions cover Control Plane approved-command lock release, queued
cancellation without idempotency burn, entry-scoped rollback, supervisor zombie
attestation, and delayed Windows readiness.

Formal release assets remain tag-gated by both CI and Security workflows. The
release job produces Windows x64, macOS arm64/x64, and Linux musl arm64/x64
archives, signed SHA-256 metadata, strict SBOMs, installers/Homebrew metadata,
and GitHub build provenance.

Compatibility and remaining gaps

• No protocol version or public CLI command is removed by this release.
• Clients holding an MCP session from an older catalog revision still need to
  reinitialize after a deployment, as documented in v1.2.23.
• Authenticode, Apple notarization/native installers, macOS/Windows native broker
  receipts, fully automated external ChatGPT verification, and independent
  external security review remain separately disclosed evidence/packaging gaps.
• The nine-profile implementation/fixture coverage does not fabricate live
  provider credentials or receipts that were not collected; evidence claims
  remain bounded by the release-quality registry and waiver structure.