v0.9.3 — a clean release

A small one. Nothing changes in the apps.

• The release's last check, the one that verifies the Windows installer's
  signature, couldn't read the newer timestamps Microsoft now issues and
  failed v0.9.2 even though its installer was signed correctly. It checks
  them with OpenSSL now.
• /api/auth/admin-check answers yes only for a signed-in admin, so your own
  pages can sit behind the dashboard's sign-in through nginx.

Get it

Linux: curl -fsSL https://tektonix.io/install-linux.sh | sh, or download Tektonix_0.9.3_amd64.AppImage or the .deb below.
Windows: download Tektonix_0.9.3_x64-setup.exe below.
Installed apps update themselves. Everything new in 0.9.2 is in the v0.9.2 notes.

v0.9.2 — Tektonix on Linux

The desktop app runs on Linux now, and a few things got easier everywhere.

The Linux app

• One line installs it: curl -fsSL https://tektonix.io/install-linux.sh | sh.
  It checks the download against GitHub's checksum, adds Tektonix to your app
  menu and starts it. There's also an AppImage and a .deb on the release.
• No Docker? It installs it for you, Arch-based distros included. You type
  your password once and carry on. No logging out.
• It runs as you, so your projects folder doesn't fill up with root-owned
  files.
• The AppImage updates itself like the Windows app. The .deb updates when you
  install the next one.

Everywhere

• Sign in with a passkey. Your phone, laptop or security key is enough on its
  own, and your password and code still work as a backup.
• Quit actually quits. It stops the containers so they're not sitting on your
  memory, and asks first if a task is running.
• New installs size their sandboxes to your machine instead of 2 CPUs and 2 GB.
• Dropdowns look right on every platform.

Fixes

• Web search in planning works again, and the agent stops guessing at web
  addresses when a page won't load.
• The GitHub inbox stopped offering Tektonix its own pull requests, and its
  tools understand repository links.
• The Windows installer looks like Tektonix instead of a generic setup wizard.

Get it

Linux: curl -fsSL https://tektonix.io/install-linux.sh | sh, or download Tektonix_0.9.2_amd64.AppImage or the .deb below.
Windows: download Tektonix_0.9.2_x64-setup.exe below.
Installed apps update themselves. Host installs: pull, run pip install -r requirements.txt (passkeys need two new packages), rebuild the dashboard and restart the agent.

Tektonix v0.9.2-rc2

See CHANGELOG.md.

Tektonix v0.9.2-rc1

See CHANGELOG.md.

v0.9.1 — the Windows installer is signed

Windows names the publisher

The installer, the app inside it and its uninstaller are signed with an
Authenticode certificate issued to the author through Azure Artifact
Signing, and timestamped, so Windows shows a verified publisher instead of
"Unknown publisher". SmartScreen may still ask once or twice while the
certificate builds reputation. The signing runs inside the build, before the
updater signature is taken, and a release whose installer comes out
unsigned fails instead of publishing.

Windows: download Tektonix_0.9.1_x64-setup.exe below; installed apps update themselves. Everything else in 0.9 is in the v0.9.0 notes.

Tektonix v0.9.1-rc1

See CHANGELOG.md.

v0.9.0 — a Windows app that updates itself, a review gate you can trust, and a release you approve

The first full release since v0.8.0. Three things changed shape.

The desktop app. Tektonix installs on Windows as one app with its own
window and a desktop sign-in. It runs the release it came from, proven by
image id; it updates itself and the stack when the agent is idle, never
while a task runs and never by taking the window from you; and it pulls
each image by a digest the release signed. rc1 to rc12 testers reinstall
once by hand, because those builds ordered release candidates as text.

The review and merge path. The gate merges the exact commit that was
reviewed; a review that checked nothing, or whose only check was already
red on main, is escalated instead of passed; a harness failure is asked
again instead of handed to the coder; a long suite keeps the connection
alive; a task queued behind other reviews keeps waiting; an approval
carries over a rebase that changed nothing but the parent; and main moves
only on a green GitHub Actions run. Tasks that need you sit in their own
sidebar group until they are done.

Releases and the box. A release builds only from a version tag on main
with green CI, pushes its images once by digest, and waits at the
installer for your approval on the release environment. The 2026-09-29
audit's 124 findings are resolved on main (docs/review-2026-09-29.md), the
code scanning backlog is at zero, and the LangChain family is current.

Upgrading from v0.8.0

• Host installs: pull, then pip install -r requirements.txt and
  .venv/bin/playwright install chromium (the Playwright upgrade wants a
  newer browser; web search in planning fails with "Executable doesn't
  exist" until it is installed), rebuild the dashboard, and restart the
  agent, both review services and the router.
• If your nginx vhost has a location /_review/ block, delete it,
  reload nginx and rotate REVIEW_CONTROL_SECRET in both .env and
  services/shared/.env. Restart with the new value exported
  (set -a; . ./.env; set +a; pm2 restart … --update-env): pm2 keeps a
  process's old environment otherwise. scripts/doctor.py checks both.
• Bundle: docker compose pull && docker compose up -d. Secrets move to
  one volume each on first start and are carried over from the old shared
  volume; init-secrets.sh --rotate rotates the database password.
• Forks that publish releases: protect a release environment with a
  required reviewer and a v* tag policy, and add the updater signing key
  as TAURI_SIGNING_PRIVATE_KEY.

A failed chain tells the caller the status, not the exception text

When every deployment in a chain failed, the router's 502 carried the last
exception's text to the caller. It names the upstream status and points at
the router ledger now; the full error stays there under the call id. This
closed the last open code scanning alert.

One task per package, and an approval that survives a rebase

The GitHub inbox made one task per Dependabot alert, so eleven undici
advisories on one lockfile became eleven tasks; one merge closed all
eleven and the other ten rebased, re-reviewed and merged a change that
fixed nothing. The inbox now makes one task per package and manifest,
naming every alert and the version that clears them all, and a task whose
alerts another change has closed concludes with "already fixed on main"
instead of taking the merge slot.

An approval used to be asked again after every merge that landed ahead
of a task, because a rebase makes a new commit. When the rebase changed
nothing but the parent, the approval now carries over; the reviewer still
judges the new commit.

A task queued at the reviewer keeps waiting

Approving several diffs of one project in a row put every task but the
first behind a rebase and a fresh review, and a request waiting behind
other reviews looked to the gate like one nobody would run, so it timed
out. The reviewer now writes its queue to its state, and the gate waits
for a branch it finds there the way it waits for a review in progress.

The 2026-09-29 audit, resolved

One hundred and twenty-four findings from a full read of the repository
(docs/review-2026-09-29.md, section 13 has the row for each). The ones
an operator will notice:

• Release pipeline. Every action is pinned to a commit; a tag builds
  only if it is a version, sits on main and CI passed on its commit;
  images are pushed once, by digest, without a moving latest, and the
  digest manifest is signed with the updater key so the desktop app pulls
  exactly what was released. The signing key is read behind a release
  environment. Operator: protect that environment with a required
  reviewer and add a tag ruleset for v*.
• Desktop app. The stack follows the app's own release and the app
  updates first; the automatic pass never restarts a busy agent, holds a
  lock against the panel, and pulls every image before retagging any.
  The console window keeps only the window controls and the panel
  switch; off-origin links open in the browser. Candidates rc1 to rc12
  reinstall by hand once.
• Review gate. The merge ships the reviewed commit itself; the
  reviewer never borrows the agent's workspace tools and installs its own
  in the sandbox, so a Windows install now runs an install per review; a
  committed symlink can no longer reach the live checkout or its secrets;
  each throwaway database is connectable by its owner alone; check output
  is fenced in the reviewer prompt; the only check red on main too is
  escalated instead of passed.
• Bundle. One volume per secret, an unprivileged router, PUID/PGID
  for the rest, a backup.sh --bundle, log caps on every service, and the
  checks network keeps its name under any compose project name.
• Agent. Auto mode asks about every delete it cannot read (wrappers,
  git reset --hard, a cd inside a subshell, mv onto a tracked
  file); a budget refusal survives an empty-reply retry; a stream the
  client abandons is still on the ledger; a used episode carries its real
  rank; the planning-cost carry and the live mirror take one lock; daily
  jobs take a file lock shared with the cron wrappers.
• Dashboard. Per-task state resets when you switch tasks, and a merge
  decision names the commit it saw; a planning session opened mid-turn
  connects at once; the desktop title bar sits above the sign-in; every
  admin sees the Users page; notifications open what they are about.

Left open, on the list in docs/todo.md: a warm install cache for
reviews of a foreign live install, the rebase recursion's log merge,
the planner's quiet retry seat, and the bundle's keys/ directory not
being a volume.

A stream the client abandons is still on the ledger

A task that hung up mid-stream, or a stall the watchdog cut, left no
ledger line for the tokens it had spent, and a stream whose every
deployment refused came back as an empty success. The line is written
whatever ends the stream, and a total refusal is the same 502 the
buffered path returns.

A used episode carries its real rank

The recall log remembered only the first five results, so an episode
used from rank six or worse was recorded as never offered, the opposite
of what the rank is for. Every offered result is remembered per task,
a second search no longer erases the first, and "never offered" is its
own field.

The merge lands the reviewed commit, not whatever the branch holds now

The merge route fast-forwarded to the branch name and pushed the branch,
so a commit that arrived after the verdict would have shipped under it.
It now merges and pushes the reviewed commit itself, and a branch that
moved past it is refused.

The only check red on main too verifies nothing

A project with one configured check, red on the base commit as well, was
passed as pre-existing: a review that checked nothing. It is escalated
now, in its own words. A failure main already has still counts as
pre-existing while another check verified the commit.

The database check streams too

The database drift and seed check answered in one piece, so a slow run
hit the reviewer's five-minute cut-off the way the ordinary checks used
to. It keeps the connection alive the same way now; a bad request is
still refused before the first byte.

The budget ceiling survives an empty-reply retry

The retry of an empty, reasoning-exhausted reply swallowed every error,
including the budget guard's refusal, so a task past its ceiling ran on.
The refusal propagates.

Recall records where the memory it used was ranked

A used episode carries the rank the search offered it at, and a section
read carries its position in the memory index. The log held offers and
uses as separate events nobody joined, so the question a re-ranker would
answer could not be asked. The vector leg of episode recall is switched on
on the reference deployment.

Auto mode reads a delete through a variable

The coder kept its scratch path in a shell variable and deleted through
it, and auto mode asked for approval on every cleanup because it could
not read the target. A variable assigned a plain value earlier in the same
command is resolved now; one holding a substitution still asks.

The LangChain family moves up

langgraph 1.2.12, langchain 1.4.3, langchain-core 1.6.6, langchain-openai
1.6.6, langchain-anthropic 1.7.4, langchain-google-genai 4.4.0 (with
google-genai 2.25.0), langsmith 0.14.1 and deepagents 0.7.19. Twelve
deepagents releases of fixes: the task tool rejects unknown arguments
instead of dropping them, subagent state reaches provided middleware,
compaction recovery is bounded, and clipped tool output says so. The
suite passes unchanged.

A workspace-internal package resolves inside the check container

The reviewer linked a monorepo's internal package to the worktree by its
host path, which does not exist inside the check container, so every app
importing it failed typecheck with "cannot find module" in any review that
borrow...

Tektonix v0.9.0-rc29

See CHANGELOG.md.

Tektonix v0.9.0-rc28

See CHANGELOG.md.

Tektonix v0.9.0-rc9

See CHANGELOG.md.