maxplayer 0.6.1

v0.6.1

Stable release following v0.6.1-rc10, incorporating the 0.6.1 release-candidate series
and subsequent changes on main. After publication, install with
npm install -g maxplayer@0.6.1. The stable tag publishes npm latest; the rc
dist-tag remains on its existing release candidate.

Highlights since stable v0.6.0

• Seller-issued credits over Nostr, credits-first buyer funding, and per-mint award
  reservations. The optional maxplayer-mint issuer remains a source-built sidecar.
• More reliable private contribution preparation and delivery: preloaded bases,
  pack forwarding, local base checkouts, fresh per-request push authorization, and
  durable MCP preparation handles that make slow posts safely pollable.
• Shared repository limits and Git-diff review, signed reviewer refusal responses,
  and configurable reviewer processing budgets.
• Updated Claude/Codex sandbox adapters, Opus 5.5 support, and explicit Docker
  Codex model/reasoning settings without weakening ChatGPT credential containment.
• Seller-side claim filtering and buyer [buyer] blocked_sellers, alongside
  completed-send wallet reconciliation and the seller relay-stall fixes below.

The historical RC sections below retain the detailed changes and rollout notes
for each stage; they are not new release announcements.

Included from v0.6.1-rc10

• Private delivery review no longer duplicates the offer and task evidence (#1147,
  fixes #1104). The reviewer accepts old and new request formats; clients use actual
  encrypted-message size checks, and open-pool task encoding avoids repeated JSON
  escaping. Size refusals name the measured size and limit, and deterministic review
  failures no longer misleadingly promise recovery by retrying unchanged input.

• Sellers budget private delivery review before agent execution, conservatively
  selecting Git when an inline answer would not fit. New answer text is capped at
  4 KiB; existing answer envelopes retain their decode compatibility. The task-body
  limit stays 16 KiB, including metadata; oversize posting errors point to input files.

• Seller daemon stays responsive when the relay stops acknowledging publications or stops
  finishing history reads. Relay events, housekeeping, outbox publishing and backfills run on one
  serialized work lane beside the loop, so heartbeats, the relay watchdog, the status line and
  shutdown are never held behind them. Outbox passes are bounded (15 s / 256 rows) and fair: rows
  never attempted go first, a row the relay hangs on rotates behind them, unacknowledged rows stay
  pending and are retried with the same event id, and new claims still get their first attempt
  while routine drains back off. A history read the relay never finishes is reported INCOMPLETE
  and retried (30 s, doubling) instead of being treated as empty. The watchdog judges each tick
  at its start and runs one probe/recovery at a time. Shutdown waits 3 s for in-flight work, or up
  to 60 s while a payment redeem is running. The status line now ends with the relay and work-lane
  state; see Reading the log. Payment guards (pay-once, receipt
  dedup, fail-closed redeem classification, the store-derived wrap cursor) are unchanged.

• Seller follow-ups to the above: private-content copies are paced on their own outcome, so the
  relay confirming outbox rows no longer keeps failing private copies retried every tick (and
  vice versa); a buyer-feedback publish holds the work lane at most 5 s; a backfill cut short by a
  relay recovery re-runs once the relay is back instead of being reported as a failed read.

• Reviewer startup waits briefly for its single-instance store lock during process
  replacement, while retaining exclusive ownership and refusing sustained contention
  (#1138).

• Vendored Buzz relay updated to upstream 30873ba46, retaining Maxplayer private-job
  ACLs and open-history behavior, with improved refusal, authentication and bounded
  history handling (#1134). Relay deployment is separate from client publication.

• Source-only Cashu trading sidecar: fixed-lot credit trading, receive/send workflows,
  Nostr-mint keyset handling, operator UX and build guidance (#1107, #1119, #1121,
  #1123, #1125, #1127, #1129). Follow-ups add mint backoff, bounded Nostr operations,
  unanswered-message retries, clearer errors and diagnostics, serve-driven receive,
  and lifecycle progress (#1128, #1130–#1133, #1140, #1141).

• Source-only approved-peer chat sidecar gains health reporting, catch-up pagination,
  signed-send retry and receive/storage hardening (#1136).

• Website: credit-trading market, Chat lab page and Mint product page; market cards
  stop showing the harness badge (#1118, #1120, #1135, #1137); the Tokens page is
  marked Lab in the footer (#1148). Website deployment is separate from npm client
  publication.

Changes since v0.6.1-rc10

• One-command mint and trade onboarding documentation, aligned install paths, and
  guidance to check trading capacity before issuance (#1152).

Upgrade and release scope

• Deploy the updated reviewer before updated clients. Old reviewers cannot read
  the new request format. The updated reviewer still accepts older clients.
• Restart buyer daemons, MCP servers and sellers after upgrading, preserving their
  existing homes, keys, wallets and state. Match Docker sandbox image overrides to
  the upgraded seller version.
• Retry collection of the existing stuck private job with review enabled; do not
  repost it or bypass review. Its real-world recovery remains unverified until that
  rollout and collection succeed. Passing regression tests is not production proof.
• This release does not add support for reviewing changed binaries/symlinks/submodules,
  screen seller input files at offer time, or increase task limits (#1144–#1146).
  Muse's non-blocking follow-ups remain separate: inline-check errors can reject
  before Git fallback, and control-character-heavy answers can exceed the serialized
  body limit despite fitting the raw-text cap. Smaller retry/classifier findings
  are also deferred; this release does not claim to resolve them.
• The bundled relay update has a one-way database migration. For a separate
  relay deployment, back up and follow crates/buzz/README.md ("Upgrading a deployed
  relay"); rollback requires restoring the database backup. Publishing the client
  does not deploy the relay or reviewer.
• The release workflow packages the maxplayer client and sandbox image. Mint,
  trade and chat sidecars remain separately source-built; website deployment is
  separate. This version PR does not publish or deploy any component.

v0.6.1-rc10

Tenth release candidate for 0.6.1, prepared for testing before a stable release.
After publication, install with npm install -g maxplayer@0.6.1-rc10.
Publish as a GitHub prerelease on npm rc; leave stable latest unchanged.

Changes since v0.6.1-rc9

• Private delivery review no longer duplicates the offer and task evidence (#1147,
  fixes #1104). The reviewer accepts old and new request formats; clients use actual
  encrypted-message size checks, and open-pool task encoding avoids repeated JSON
  escaping. Size refusals name the measured size and limit, and deterministic review
  failures no longer misleadingly promise recovery by retrying unchanged input.

• Sellers budget private delivery review before agent execution, conservatively
  selecting Git when an inline answer would not fit. New answer text is capped at
  4 KiB; existing answer envelopes retain their decode compatibility. The task-body
  limit stays 16 KiB, including metadata; oversize posting errors point to input files.

• Seller daemon stays responsive when the relay stops acknowledging publications or stops
  finishing history reads. Relay events, housekeeping, outbox publishing and backfills run on one
  serialized work lane beside the loop, so heartbeats, the relay watchdog, the status line and
  shutdown are never held behind them. Outbox passes are bounded (15 s / 256 rows) and fair: rows
  never attempted go first, a row the relay hangs on rotates behind them, unacknowledged rows stay
  pending and are retried with the same event id, and new claims still get their first attempt
  while routine drains back off. A history read the relay never finishes is reported INCOMPLETE
  and retried (30 s, doubling) instead of being treated as empty. The watchdog judges each tick
  at its start and runs one probe/recovery at a time. Shutdown waits 3 s for in-flight work, or up
  to 60 s while a payment redeem is running. The status line now ends with the relay and work-lane
  state; see Reading the log. Payment guards (pay-once, receipt
  dedup, fail-closed redeem classification, the store-derived wrap cursor) are unchanged.

• Seller follow-ups to the above: private-content copies are paced on their own outcome, so the
  relay confirming outbox rows no longer keeps failing private copies retried every tick (and
  vice versa); a buyer-feedback publish holds the work lane at most 5 s; a backfill cut short by a
  relay recovery re-runs once the relay is back instead of being reported as a failed read.

• Reviewer startup waits briefly for its single-instance store lock during process
  replacement, while retaining exclusive ownership and refusing sustained contention
  (#1138).

• Vendored Buzz relay updated to upstream 30873ba46, retaining Maxplayer private-job
  ACLs and open-history behavior, with improved refusal, authentication and bounded
  history handling (#1134). Relay deployment is separate from client publication.

• Source-only Cashu trading sidecar: fixed-lot credit trading, receive/send workflows,
  Nostr-mint keyset handling, operator UX and build guidance (#1107, #1119, #1121,
  #1123, #1125, #1127, #1129). Follow-ups add mint backoff, bounded Nostr operations,
  unanswered-message retries, clearer errors and diagnostic...

maxplayer 0.6.1-rc10

v0.6.1-rc10

Tenth release candidate for 0.6.1, prepared for testing before a stable release.
After publication, install with npm install -g maxplayer@0.6.1-rc10.
Publish as a GitHub prerelease on npm rc; leave stable latest unchanged.

Changes since v0.6.1-rc9

• Private delivery review no longer duplicates the offer and task evidence (#1147,
  fixes #1104). The reviewer accepts old and new request formats; clients use actual
  encrypted-message size checks, and open-pool task encoding avoids repeated JSON
  escaping. Size refusals name the measured size and limit, and deterministic review
  failures no longer misleadingly promise recovery by retrying unchanged input.

• Sellers budget private delivery review before agent execution, conservatively
  selecting Git when an inline answer would not fit. New answer text is capped at
  4 KiB; existing answer envelopes retain their decode compatibility. The task-body
  limit stays 16 KiB, including metadata; oversize posting errors point to input files.

• Seller daemon stays responsive when the relay stops acknowledging publications or stops
  finishing history reads. Relay events, housekeeping, outbox publishing and backfills run on one
  serialized work lane beside the loop, so heartbeats, the relay watchdog, the status line and
  shutdown are never held behind them. Outbox passes are bounded (15 s / 256 rows) and fair: rows
  never attempted go first, a row the relay hangs on rotates behind them, unacknowledged rows stay
  pending and are retried with the same event id, and new claims still get their first attempt
  while routine drains back off. A history read the relay never finishes is reported INCOMPLETE
  and retried (30 s, doubling) instead of being treated as empty. The watchdog judges each tick
  at its start and runs one probe/recovery at a time. Shutdown waits 3 s for in-flight work, or up
  to 60 s while a payment redeem is running. The status line now ends with the relay and work-lane
  state; see Reading the log. Payment guards (pay-once, receipt
  dedup, fail-closed redeem classification, the store-derived wrap cursor) are unchanged.

• Seller follow-ups to the above: private-content copies are paced on their own outcome, so the
  relay confirming outbox rows no longer keeps failing private copies retried every tick (and
  vice versa); a buyer-feedback publish holds the work lane at most 5 s; a backfill cut short by a
  relay recovery re-runs once the relay is back instead of being reported as a failed read.

• Reviewer startup waits briefly for its single-instance store lock during process
  replacement, while retaining exclusive ownership and refusing sustained contention
  (#1138).

• Vendored Buzz relay updated to upstream 30873ba46, retaining Maxplayer private-job
  ACLs and open-history behavior, with improved refusal, authentication and bounded
  history handling (#1134). Relay deployment is separate from client publication.

• Source-only Cashu trading sidecar: fixed-lot credit trading, receive/send workflows,
  Nostr-mint keyset handling, operator UX and build guidance (#1107, #1119, #1121,
  #1123, #1125, #1127, #1129). Follow-ups add mint backoff, bounded Nostr operations,
  unanswered-message retries, clearer errors and diagnostics, serve-driven receive,
  and lifecycle progress (#1128, #1130–#1133, #1140, #1141).

• Source-only approved-peer chat sidecar gains health reporting, catch-up pagination,
  signed-send retry and receive/storage hardening (#1136).

• Website: credit-trading market, Chat lab page and Mint product page; market cards
  stop showing the harness badge (#1118, #1120, #1135, #1137); the Tokens page is
  marked Lab in the footer (#1148). Website deployment is separate from npm client
  publication.

Rollout and RC verification

• Deploy the updated reviewer before updated clients. Old reviewers cannot read
  the new request format. The updated reviewer still accepts older clients.
• Restart buyer daemons, MCP servers and sellers after upgrading, preserving their
  existing homes, keys, wallets and state. Match Docker sandbox image overrides to
  the upgraded seller version.
• Retry collection of the existing stuck private job with review enabled; do not
  repost it or bypass review. Its real-world recovery remains unverified until that
  rollout and collection succeed. Passing regression tests is not production proof.
• This RC does not add support for reviewing changed binaries/symlinks/submodules,
  screen seller input files at offer time, or increase task limits (#1144–#1146).
  Muse's non-blocking follow-ups remain separate: inline-check errors can reject
  before Git fallback, and control-character-heavy answers can exceed the serialized
  body limit despite fitting the raw-text cap. Smaller retry/classifier findings
  are also deferred; this RC does not claim to resolve them.
• The bundled relay update has a one-way database migration. For a separate
  relay deployment, back up and follow crates/buzz/README.md ("Upgrading a deployed
  relay"); rollback requires restoring the database backup. Publishing the client
  does not deploy the relay or reviewer.
• The release workflow packages the maxplayer client and sandbox image. Mint,
  trade and chat sidecars remain separately source-built; website deployment is
  separate. Stable publication is deferred until RC testing is accepted.

v0.6.1-rc9

Unreleased ninth release candidate for 0.6.1.

Changes since v0.6.1-rc8

• Buyers can exclude one or more seller public identities with [buyer] blocked_sellers.
  Automatic awards skip their claims while other eligible sellers remain selectable;
  manual and lower-level new awards refuse blocked sellers. This includes the buyer's
  own seller, public/private jobs, and paid/free jobs. Invalid entries fail startup.
  Empty/omitted lists retain existing behavior. Restart the buyer daemon and MCP
  server to load changes. Existing pinned awards and payment obligations are unaffected.
  See buyer configuration.

v0.6.1-rc8

Eighth release candidate for 0.6.1, including seller claim filtering (#1113),
completed-send reconciliation (#1114), and review/private-posting reliability
and contribution-base validation (#1116, addresses #1115). Once published, install
with npm install -g maxplayer@0.6.1-rc8. Publish on npm rc; leave stable
latest unchanged.

Changes since v0.6.1-rc7

• Sellers check requested model, harness family and capabilities against their
  live serving roster before claiming. Each claim remains independently eligible,
  so a newer incompatible claim no longer hides an older matching claim from
  automatic or manual award selection. Queued offers retain their requirements
  across restarts (additive seller schema v14).

• Wallet cleanup reconciles stale input-proof bindings for completed sends that
  have an exact outgoing transaction mapping. It clears them only after complete
  mint evidence confirms all inputs are spent, preserving transaction history and
  recipient token outputs. This does not add recipient-redemption tracking for
  pending output proofs (#314), reclaim tokens, or resend payments.

• Review requests are never silently lost again, in either direction:

  • The client checks the relay's OK on its own review-request publication and
    returns review: relay refused the review request: <reason> immediately.
  • The reviewer worker answers every authentic refused request with a signed
    terminal error review (stale_request, rate_limited, queue_full,
    invalid_subject, relay_configuration, review_store), encrypted to the
    requester on the private lane. Replies are budgeted (60/minute); only
    unauthorized or unparseable requests stay unanswered. A poisoned request or
    store row no longer ends the worker. The worker logs its version at start.
  • A review timeout whose request the relay accepted now says that, and points
    at the operator's maxplayer reviewer serve log.

• Private offers survive slow input preparation:

  • A buyer re-signs the prepared offer (fresh timestamp, same task envelope
    and uploads) when preparation exceeds 10 minutes, and moves the per-job
    repository binding to the new offer id. The relay permits that re-bind only
    while the job is unawarded, not closed, and the old offer id was never
    published.
  • A permanent relay refusal of a carrier (invalid:/blocked:) stops the
    retry loop and is recorded with the relay's reason. post_job and
    get_job surface it as publish_refused, and the auto-award parks with
    that reason instead of polling to the job deadline.

• Contribution-base readability is enforced at post time: an open-pool or
  public contribution job whose base sellers cannot read (a per-job private
  repository, or a source that refuses anonymous reads) is refused before the
  wallet opens, with the targeted-private alternative named in the error. The
  open-pool buyer also fetches the base with seller-equivalent (anonymous)
  identity, so buyer-only readability can no longer slip through. See
  docs/PRIVATE-JOBS.md (contribution bases).

• Public contribution posts validate their base by fetching it once before
  publication, with the identity a seller will use: a missing base_oid or a
  repository above the relay quotas is refused at post time with the cause
  named, instead of surfacing as a seller execution failure after the deadline
  started. The validated objects seed the delivery store for the later collect
  verify fetch. Public posts therefore take roughly one clone of the base.

• Time budgets widened for large repositories:

  • The reviewer's per-request processing budget is configurable
    (window_seconds in the worker JSON, 60..=3600) and its default rose from
    300 to 600 seconds, so a quota-sized Git fetch no longer consumes the whole
    window. The budget is...

maxplayer 0.6.1-rc9

v0.6.1-rc9

Unreleased ninth release candidate for 0.6.1.

Changes since v0.6.1-rc8

• Buyers can exclude one or more seller public identities with [buyer] blocked_sellers.
  Automatic awards skip their claims while other eligible sellers remain selectable;
  manual and lower-level new awards refuse blocked sellers. This includes the buyer's
  own seller, public/private jobs, and paid/free jobs. Invalid entries fail startup.
  Empty/omitted lists retain existing behavior. Restart the buyer daemon and MCP
  server to load changes. Existing pinned awards and payment obligations are unaffected.
  See buyer configuration.

v0.6.1-rc8

Eighth release candidate for 0.6.1, including seller claim filtering (#1113),
completed-send reconciliation (#1114), and review/private-posting reliability
and contribution-base validation (#1116, addresses #1115). Once published, install
with npm install -g maxplayer@0.6.1-rc8. Publish on npm rc; leave stable
latest unchanged.

Changes since v0.6.1-rc7

• Sellers check requested model, harness family and capabilities against their
  live serving roster before claiming. Each claim remains independently eligible,
  so a newer incompatible claim no longer hides an older matching claim from
  automatic or manual award selection. Queued offers retain their requirements
  across restarts (additive seller schema v14).

• Wallet cleanup reconciles stale input-proof bindings for completed sends that
  have an exact outgoing transaction mapping. It clears them only after complete
  mint evidence confirms all inputs are spent, preserving transaction history and
  recipient token outputs. This does not add recipient-redemption tracking for
  pending output proofs (#314), reclaim tokens, or resend payments.

• Review requests are never silently lost again, in either direction:

  • The client checks the relay's OK on its own review-request publication and
    returns review: relay refused the review request: <reason> immediately.
  • The reviewer worker answers every authentic refused request with a signed
    terminal error review (stale_request, rate_limited, queue_full,
    invalid_subject, relay_configuration, review_store), encrypted to the
    requester on the private lane. Replies are budgeted (60/minute); only
    unauthorized or unparseable requests stay unanswered. A poisoned request or
    store row no longer ends the worker. The worker logs its version at start.
  • A review timeout whose request the relay accepted now says that, and points
    at the operator's maxplayer reviewer serve log.

• Private offers survive slow input preparation:

  • A buyer re-signs the prepared offer (fresh timestamp, same task envelope
    and uploads) when preparation exceeds 10 minutes, and moves the per-job
    repository binding to the new offer id. The relay permits that re-bind only
    while the job is unawarded, not closed, and the old offer id was never
    published.
  • A permanent relay refusal of a carrier (invalid:/blocked:) stops the
    retry loop and is recorded with the relay's reason. post_job and
    get_job surface it as publish_refused, and the auto-award parks with
    that reason instead of polling to the job deadline.

• Contribution-base readability is enforced at post time: an open-pool or
  public contribution job whose base sellers cannot read (a per-job private
  repository, or a source that refuses anonymous reads) is refused before the
  wallet opens, with the targeted-private alternative named in the error. The
  open-pool buyer also fetches the base with seller-equivalent (anonymous)
  identity, so buyer-only readability can no longer slip through. See
  docs/PRIVATE-JOBS.md (contribution bases).

• Public contribution posts validate their base by fetching it once before
  publication, with the identity a seller will use: a missing base_oid or a
  repository above the relay quotas is refused at post time with the cause
  named, instead of surfacing as a seller execution failure after the deadline
  started. The validated objects seed the delivery store for the later collect
  verify fetch. Public posts therefore take roughly one clone of the base.

• Time budgets widened for large repositories:

  • The reviewer's per-request processing budget is configurable
    (window_seconds in the worker JSON, 60..=3600) and its default rose from
    300 to 600 seconds, so a quota-sized Git fetch no longer consumes the whole
    window. The budget is also the worst-case provider spend per request.
  • review.timeout_seconds on clients now accepts up to 3600 (default still
    300); a timeout still ends only the wait, and a retry collects the worker's
    persisted late result (the private reply scan now looks back 30 minutes).
  • Pack uploads scale their whole-request ceiling with pack size (300 s floor,
    one second per 128 KiB, 30-minute cap), and the relay's receive-pack window
    rose from 300 to 1800 seconds. A 1 GiB base now needs a ~0.6 MB/s uplink
    instead of a sustained 3.5 MB/s. Serving fetches keeps the 300-second bound.

Operator notes

• Upgrade and restart buyer/seller daemons and MCP servers to load the new client.
  Seller storage gains an additive schema migration; preserve the existing home,
  wallet and keys. Installing the package alone does not restart running processes.

• The full reliability changes also require the relay and reviewer updates below;
  publishing this client release does not deploy either service.

• Deploy the relay before buyers to enable offer re-binding; older relays
  refuse the re-provision and buyers fall back to the previous behavior (now
  loudly surfaced instead of silently retried).

• Redeploy the reviewer worker so refused requests answer with signed errors
  instead of log-only drops, and set window_seconds if the default 600 does
  not fit your repositories or provider budget.

v0.6.1-rc7

Seventh release candidate for 0.6.1, prepared from main with credits-first buyer
mint choice (#1100, fixes #1039). Once published, install with
npm install -g maxplayer@0.6.1-rc7. This is a prerelease: publish on npm rc,
leaving stable latest unchanged at v0.6.0.

Changes since v0.6.1-rc6

• Buyers spend credits (nostr:// mints) first when they hold enough there;
  otherwise they pay at the first funded https mint in the seller's order.
  Award selection uses the available balance after subtracting live reservations.
• A cross-mint payment hop never targets a credit mint. A claim that cannot be
  paid is refused at award time instead of failing after the seller delivers.
• Manual awards no longer hold the money lock while fetching from the relay,
  so a slow relay fetch does not block other money operations.
• Private jobs follow the public mint rule: any well-formed seller-listed mint
  is accepted, while payment stays within the signed payment request (creq).
• Mint deduplication preserves explicit ports, keeping wallet mint identities
  aligned with the seller's listed mints.

Operator notes

• Redeploy the reviewer service from this release. An old reviewer drops private
  claims whose mints are not on its own accepted list.
• Known limitations: pre-upgrade credits-only pinned reservations remain stuck.
  Pay-time sealed-mint enforcement is tracked in #1101. The public reproduction
  in #1069 remains unexplained.
• No protocol, relay or store migration is required.

v0.6.1-rc6

Sixth release candidate for 0.6.1, prepared from main after the private-contribution
speed and timeout fixes (#1096, #1097, #1098) and the seller mint fixes (#1091, #1092).
rc5 was prepared but never tagged; this release supersedes it. Once published, install with
npm install -g maxplayer@0.6.1-rc6. This is a prerelease: publish on npm rc,
leaving stable latest unchanged at v0.6.0.

Changes since v0.6.1-rc4

• Private jobs accept canonical nostr://<npub> mints when explicitly approved
  (lowercase npub with a valid checksum; no path, port, query or fragment).
  Mint membership checks are unchanged: every mint in a private claim, and the
  realized receipt mint, must still be in the validating client's
  accepted_mints; a mint only in extra_mints is still refused (#1092).

• wallet mints add and wallet setup --mint on a seller home print a one-line
  note when the mint is not in accepted_mints, since only accepted_mints
  reaches seller claims. accepted_mints is not modified (#1091).

• Private contribution jobs can use base_local_path, an absolute checkout or
  bare-repository path on the buyer daemon machine. The buyer uploads only the
  pinned commit and its history, not other branches or uncommitted files. The
  path stays local. An unavailable checkout falls back to the usual URL download.
  It works only for a direct job (seller_pubkey); an open-pool post with
  base_local_path is refused, because open-pool sellers must read the
  original URL before claiming. Symlinks and submodules remain unsupported.

• Private contributions on larger repositories no longer time out. The relay
  packs a whole repository before its first byte (about 11 s for 37 MB and 75 s
  for 300 MB), which outlasted the 10 s client on two reads:

  • Seller: the pre-claim read of private inputs and contribution bases uses the
    large-transfer client (300 s per leg) and runs off the seller event loop, so
    heartbeats, awards and shutdown keep running; a finished staging re-drives
    the offer. At most 4 run at once.
  • Buyer: posting keeps the fetched base under <home>/store-seeds/ (up to
    14 days), and collect imports it into the delivery store before fetching the
    delivered fork, so that fetch asks only for the seller's new commits (under
    0.3 s for the same 300 MB repository). Every verification gate still runs;
    a missing seed only means the old, slower fetch.
    No relay deployment is needed. ...

maxplayer 0.6.1-rc8

v0.6.1-rc8

Eighth release candidate for 0.6.1, including seller claim filtering (#1113),
completed-send reconciliation (#1114), and review/private-posting reliability
and contribution-base validation (#1116, addresses #1115). Once published, install
with npm install -g maxplayer@0.6.1-rc8. Publish on npm rc; leave stable
latest unchanged.

Changes since v0.6.1-rc7

• Sellers check requested model, harness family and capabilities against their
  live serving roster before claiming. Each claim remains independently eligible,
  so a newer incompatible claim no longer hides an older matching claim from
  automatic or manual award selection. Queued offers retain their requirements
  across restarts (additive seller schema v14).

• Wallet cleanup reconciles stale input-proof bindings for completed sends that
  have an exact outgoing transaction mapping. It clears them only after complete
  mint evidence confirms all inputs are spent, preserving transaction history and
  recipient token outputs. This does not add recipient-redemption tracking for
  pending output proofs (#314), reclaim tokens, or resend payments.

• Review requests are never silently lost again, in either direction:

  • The client checks the relay's OK on its own review-request publication and
    returns review: relay refused the review request: <reason> immediately.
  • The reviewer worker answers every authentic refused request with a signed
    terminal error review (stale_request, rate_limited, queue_full,
    invalid_subject, relay_configuration, review_store), encrypted to the
    requester on the private lane. Replies are budgeted (60/minute); only
    unauthorized or unparseable requests stay unanswered. A poisoned request or
    store row no longer ends the worker. The worker logs its version at start.
  • A review timeout whose request the relay accepted now says that, and points
    at the operator's maxplayer reviewer serve log.

• Private offers survive slow input preparation:

  • A buyer re-signs the prepared offer (fresh timestamp, same task envelope
    and uploads) when preparation exceeds 10 minutes, and moves the per-job
    repository binding to the new offer id. The relay permits that re-bind only
    while the job is unawarded, not closed, and the old offer id was never
    published.
  • A permanent relay refusal of a carrier (invalid:/blocked:) stops the
    retry loop and is recorded with the relay's reason. post_job and
    get_job surface it as publish_refused, and the auto-award parks with
    that reason instead of polling to the job deadline.

• Contribution-base readability is enforced at post time: an open-pool or
  public contribution job whose base sellers cannot read (a per-job private
  repository, or a source that refuses anonymous reads) is refused before the
  wallet opens, with the targeted-private alternative named in the error. The
  open-pool buyer also fetches the base with seller-equivalent (anonymous)
  identity, so buyer-only readability can no longer slip through. See
  docs/PRIVATE-JOBS.md (contribution bases).

• Public contribution posts validate their base by fetching it once before
  publication, with the identity a seller will use: a missing base_oid or a
  repository above the relay quotas is refused at post time with the cause
  named, instead of surfacing as a seller execution failure after the deadline
  started. The validated objects seed the delivery store for the later collect
  verify fetch. Public posts therefore take roughly one clone of the base.

• Time budgets widened for large repositories:

  • The reviewer's per-request processing budget is configurable
    (window_seconds in the worker JSON, 60..=3600) and its default rose from
    300 to 600 seconds, so a quota-sized Git fetch no longer consumes the whole
    window. The budget is also the worst-case provider spend per request.
  • review.timeout_seconds on clients now accepts up to 3600 (default still
    300); a timeout still ends only the wait, and a retry collects the worker's
    persisted late result (the private reply scan now looks back 30 minutes).
  • Pack uploads scale their whole-request ceiling with pack size (300 s floor,
    one second per 128 KiB, 30-minute cap), and the relay's receive-pack window
    rose from 300 to 1800 seconds. A 1 GiB base now needs a ~0.6 MB/s uplink
    instead of a sustained 3.5 MB/s. Serving fetches keeps the 300-second bound.

Operator notes

• Upgrade and restart buyer/seller daemons and MCP servers to load the new client.
  Seller storage gains an additive schema migration; preserve the existing home,
  wallet and keys. Installing the package alone does not restart running processes.

• The full reliability changes also require the relay and reviewer updates below;
  publishing this client release does not deploy either service.

• Deploy the relay before buyers to enable offer re-binding; older relays
  refuse the re-provision and buyers fall back to the previous behavior (now
  loudly surfaced instead of silently retried).

• Redeploy the reviewer worker so refused requests answer with signed errors
  instead of log-only drops, and set window_seconds if the default 600 does
  not fit your repositories or provider budget.

v0.6.1-rc7

Seventh release candidate for 0.6.1, prepared from main with credits-first buyer
mint choice (#1100, fixes #1039). Once published, install with
npm install -g maxplayer@0.6.1-rc7. This is a prerelease: publish on npm rc,
leaving stable latest unchanged at v0.6.0.

Changes since v0.6.1-rc6

• Buyers spend credits (nostr:// mints) first when they hold enough there;
  otherwise they pay at the first funded https mint in the seller's order.
  Award selection uses the available balance after subtracting live reservations.
• A cross-mint payment hop never targets a credit mint. A claim that cannot be
  paid is refused at award time instead of failing after the seller delivers.
• Manual awards no longer hold the money lock while fetching from the relay,
  so a slow relay fetch does not block other money operations.
• Private jobs follow the public mint rule: any well-formed seller-listed mint
  is accepted, while payment stays within the signed payment request (creq).
• Mint deduplication preserves explicit ports, keeping wallet mint identities
  aligned with the seller's listed mints.

Operator notes

• Redeploy the reviewer service from this release. An old reviewer drops private
  claims whose mints are not on its own accepted list.
• Known limitations: pre-upgrade credits-only pinned reservations remain stuck.
  Pay-time sealed-mint enforcement is tracked in #1101. The public reproduction
  in #1069 remains unexplained.
• No protocol, relay or store migration is required.

v0.6.1-rc6

Sixth release candidate for 0.6.1, prepared from main after the private-contribution
speed and timeout fixes (#1096, #1097, #1098) and the seller mint fixes (#1091, #1092).
rc5 was prepared but never tagged; this release supersedes it. Once published, install with
npm install -g maxplayer@0.6.1-rc6. This is a prerelease: publish on npm rc,
leaving stable latest unchanged at v0.6.0.

Changes since v0.6.1-rc4

• Private jobs accept canonical nostr://<npub> mints when explicitly approved
  (lowercase npub with a valid checksum; no path, port, query or fragment).
  Mint membership checks are unchanged: every mint in a private claim, and the
  realized receipt mint, must still be in the validating client's
  accepted_mints; a mint only in extra_mints is still refused (#1092).

• wallet mints add and wallet setup --mint on a seller home print a one-line
  note when the mint is not in accepted_mints, since only accepted_mints
  reaches seller claims. accepted_mints is not modified (#1091).

• Private contribution jobs can use base_local_path, an absolute checkout or
  bare-repository path on the buyer daemon machine. The buyer uploads only the
  pinned commit and its history, not other branches or uncommitted files. The
  path stays local. An unavailable checkout falls back to the usual URL download.
  It works only for a direct job (seller_pubkey); an open-pool post with
  base_local_path is refused, because open-pool sellers must read the
  original URL before claiming. Symlinks and submodules remain unsupported.

• Private contributions on larger repositories no longer time out. The relay
  packs a whole repository before its first byte (about 11 s for 37 MB and 75 s
  for 300 MB), which outlasted the 10 s client on two reads:

  • Seller: the pre-claim read of private inputs and contribution bases uses the
    large-transfer client (300 s per leg) and runs off the seller event loop, so
    heartbeats, awards and shutdown keep running; a finished staging re-drives
    the offer. At most 4 run at once.
  • Buyer: posting keeps the fetched base under <home>/store-seeds/ (up to
    14 days), and collect imports it into the delivery store before fetching the
    delivered fork, so that fetch asks only for the seller's new commits (under
    0.3 s for the same 300 MB repository). Every verification gate still runs;
    a missing seed only means the old, slower fetch.
    No relay deployment is needed. Update sellers and buyers.

• Git upload retries no longer mistake HTTP-status digits or auth words in a
  repository URL for an authentication refusal. Actual permission refusals still
  stop immediately.

• A permanent relay refusal of a private input upload (a 4xx other than 408, 409,
  421, 425 or 429, such as a quota or symlink/submodule refusal) is no longer
  retried with a full re-upload, and the post error names the refusal. Relay: a
  failure of the relay's own repository inspection now returns 503 (retryable)
  instead of 400; this part needs a relay redeploy.

• Private contribution preparation forwards a single fetched pack unchanged to
  an empty input repository when the...

maxplayer 0.6.1-rc7

v0.6.1-rc7

Seventh release candidate for 0.6.1, prepared from main with credits-first buyer
mint choice (#1100, fixes #1039). Once published, install with
npm install -g maxplayer@0.6.1-rc7. This is a prerelease: publish on npm rc,
leaving stable latest unchanged at v0.6.0.

Changes since v0.6.1-rc6

• Buyers spend credits (nostr:// mints) first when they hold enough there;
  otherwise they pay at the first funded https mint in the seller's order.
  Award selection uses the available balance after subtracting live reservations.
• A cross-mint payment hop never targets a credit mint. A claim that cannot be
  paid is refused at award time instead of failing after the seller delivers.
• Manual awards no longer hold the money lock while fetching from the relay,
  so a slow relay fetch does not block other money operations.
• Private jobs follow the public mint rule: any well-formed seller-listed mint
  is accepted, while payment stays within the signed payment request (creq).
• Mint deduplication preserves explicit ports, keeping wallet mint identities
  aligned with the seller's listed mints.

Operator notes

• Redeploy the reviewer service from this release. An old reviewer drops private
  claims whose mints are not on its own accepted list.
• Known limitations: pre-upgrade credits-only pinned reservations remain stuck.
  Pay-time sealed-mint enforcement is tracked in #1101. The public reproduction
  in #1069 remains unexplained.
• No protocol, relay or store migration is required.

v0.6.1-rc6

Sixth release candidate for 0.6.1, prepared from main after the private-contribution
speed and timeout fixes (#1096, #1097, #1098) and the seller mint fixes (#1091, #1092).
rc5 was prepared but never tagged; this release supersedes it. Once published, install with
npm install -g maxplayer@0.6.1-rc6. This is a prerelease: publish on npm rc,
leaving stable latest unchanged at v0.6.0.

Changes since v0.6.1-rc4

• Private jobs accept canonical nostr://<npub> mints when explicitly approved
  (lowercase npub with a valid checksum; no path, port, query or fragment).
  Mint membership checks are unchanged: every mint in a private claim, and the
  realized receipt mint, must still be in the validating client's
  accepted_mints; a mint only in extra_mints is still refused (#1092).

• wallet mints add and wallet setup --mint on a seller home print a one-line
  note when the mint is not in accepted_mints, since only accepted_mints
  reaches seller claims. accepted_mints is not modified (#1091).

• Private contribution jobs can use base_local_path, an absolute checkout or
  bare-repository path on the buyer daemon machine. The buyer uploads only the
  pinned commit and its history, not other branches or uncommitted files. The
  path stays local. An unavailable checkout falls back to the usual URL download.
  It works only for a direct job (seller_pubkey); an open-pool post with
  base_local_path is refused, because open-pool sellers must read the
  original URL before claiming. Symlinks and submodules remain unsupported.

• Private contributions on larger repositories no longer time out. The relay
  packs a whole repository before its first byte (about 11 s for 37 MB and 75 s
  for 300 MB), which outlasted the 10 s client on two reads:

  • Seller: the pre-claim read of private inputs and contribution bases uses the
    large-transfer client (300 s per leg) and runs off the seller event loop, so
    heartbeats, awards and shutdown keep running; a finished staging re-drives
    the offer. At most 4 run at once.
  • Buyer: posting keeps the fetched base under <home>/store-seeds/ (up to
    14 days), and collect imports it into the delivery store before fetching the
    delivered fork, so that fetch asks only for the seller's new commits (under
    0.3 s for the same 300 MB repository). Every verification gate still runs;
    a missing seed only means the old, slower fetch.
    No relay deployment is needed. Update sellers and buyers.

• Git upload retries no longer mistake HTTP-status digits or auth words in a
  repository URL for an authentication refusal. Actual permission refusals still
  stop immediately.

• A permanent relay refusal of a private input upload (a 4xx other than 408, 409,
  421, 425 or 429, such as a quota or symlink/submodule refusal) is no longer
  retried with a full re-upload, and the post error names the refusal. Relay: a
  failure of the relay's own repository inspection now returns 503 (retryable)
  instead of 400; this part needs a relay redeploy.

• Private contribution preparation forwards a single fetched pack unchanged to
  an empty input repository when the server supports it, including jobs that also
  attach input files (the base is staged and uploaded separately, first), avoiding redundant
  libgit2 delta search. Other layouts retain the existing upload path; quotas,
  per-request authorization, redirect refusal and ref acknowledgement stay intact.

• MCP post_job now returns a durable preparation handle for slow work. Poll it
  with get_job; identical retries do not publish duplicate offers (a repeated
  success says deduplicated: true, a repeated failure says so in its message).
  Without request_id, a successful post dedupes identical arguments for 10
  minutes; an explicit request_id never expires. Input files are fingerprinted
  by content, in parallel and within 8 seconds; if that budget runs out the call
  claims and posts nothing and says so. Reusing a request_id with different
  arguments is refused with what that key already did (still preparing, posted
  job id, or a possibly-live offer). A failure before any offer was queued re-runs on retry; once an
  offer was queued, failures and restarts are never re-run, for either key kind,
  and the error names the offer id; abandoned owned staging directories are
  cleaned without touching live work or legacy unlabelled temporary directories.
  Buyer state adds an additive v8 preparation table; restart the buyer daemon and
  MCP server together after upgrading. No relay deployment is needed.

Rollout

The relay must already contain #1093 (required since rc4) before buyers upgrade. The
503-instead-of-400 relay change from #1096 takes effect only after a relay redeploy;
it is optional and has no ordering constraint. Restart the buyer daemon and MCP server
together after upgrading (buyer state adds the v8 preparation table). Upgrade sellers
to get the longer, off-loop pre-claim fetch (#1097). No sandbox image change is
needed beyond rc4's.

For paid private jobs using nostr:// mints (#1092): redeploy the reviewer and list
each such mint explicitly in its accepted_mints; a binary upgrade alone does not
approve them. Buyers and sellers must also list the mint in accepted_mints. No relay
redeploy is needed for #1092.

v0.6.1-rc4

Fourth release candidate for 0.6.1, prepared from main after the private-job delivery
fixes. Once published, install with npm install -g maxplayer@0.6.1-rc4.
This is a prerelease: publish on npm rc, leaving stable latest unchanged at v0.6.0.

Changes since v0.6.1-rc3

• Container delivery requests fresh, branch-scoped authorization from the seller
  host immediately before every Git HTTP request and retry, rather than reusing a
  short-lived token. Failed token hand-offs stop further refreshes so late replies
  cannot authorize later requests. The signing key remains outside the container
  (#1081).
• Container upload POSTs have a five-minute request ceiling, a 15-second connection
  timeout, and on Linux a 60-second bound on unacknowledged TCP data. This is not a
  progress-aware or unlimited upload policy; existing job deadlines still apply.
  Host-side delivery and buyer payment-verification timeout contracts are unchanged
  (#1081).
• Buyers preload the exact starting commit and its reachable history before
  publishing either targeted or open-pool private contribution offers. Sellers then
  upload only missing contribution data. Preparation failures prevent publication;
  existing jobs are not retroactively preloaded. Open-pool bidders still inspect the
  public source, and private-repo reads remain restricted until seller selection
  (#1093).
• Buyer preparation requests have a five-minute ceiling, including downloading the
  starting history, with a 15-second connection timeout. Input uploads get up to
  three attempts with fresh authorization and backoff. Before retrying, the buyer
  checks the exact remote ref to recover a lost success response or reject a
  conflicting commit. Repository quotas and payment behavior are unchanged (#1093).
• Mint-sidecar test helper cleanup resolves two clippy warnings; no mint runtime
  behavior changes (#1088).

Rollout

Deploy the relay containing #1093 before upgrading buyers: old relays reject
open-pool input preparation before publication. No new schema migration is required
for these delivery fixes. Upgrade/restart buyer daemons to use the new preparation
path.

Upgrade the seller daemon and versioned sandbox image together for #1081. A new
container with an old daemon fails closed when authorization refresh is unanswered;
a daemon-only upgrade leaves old images without the fix. Test the combined rollout
with a newly posted private job.

v0.6.1-rc3

Third release candidate for 0.6.1, prepared from main after the seller-credits stack
merged (#1084–#1087). Once published, install with npm install -g maxplayer@0.6.1-rc3.
This is a prerelease: publish on npm rc, leaving stable latest at v0.6.0.

Release scope

RC3 is the first build from main with seller credits. It includes everything in RC2
and the nostr:// mint support and maxplayer-mint sidecar that RC1 tested from the
unmerged stack, so RC1 testers can move to RC3. Known gap from RC1: a cross-mint hop
that RC1 journaled with a nostr:// source is no longer swept automatically;
reconcile it by hand.

Chan...

maxplayer 0.6.1-rc6

v0.6.1-rc6

Sixth release candidate for 0.6.1, prepared from main after the private-contribution
speed and timeout fixes (#1096, #1097, #1098) and the seller mint fixes (#1091, #1092).
rc5 was prepared but never tagged; this release supersedes it. Once published, install with
npm install -g maxplayer@0.6.1-rc6. This is a prerelease: publish on npm rc,
leaving stable latest unchanged at v0.6.0.

Changes since v0.6.1-rc4

• Private jobs accept canonical nostr://<npub> mints when explicitly approved
  (lowercase npub with a valid checksum; no path, port, query or fragment).
  Mint membership checks are unchanged: every mint in a private claim, and the
  realized receipt mint, must still be in the validating client's
  accepted_mints; a mint only in extra_mints is still refused (#1092).

• wallet mints add and wallet setup --mint on a seller home print a one-line
  note when the mint is not in accepted_mints, since only accepted_mints
  reaches seller claims. accepted_mints is not modified (#1091).

• Private contribution jobs can use base_local_path, an absolute checkout or
  bare-repository path on the buyer daemon machine. The buyer uploads only the
  pinned commit and its history, not other branches or uncommitted files. The
  path stays local. An unavailable checkout falls back to the usual URL download.
  It works only for a direct job (seller_pubkey); an open-pool post with
  base_local_path is refused, because open-pool sellers must read the
  original URL before claiming. Symlinks and submodules remain unsupported.

• Private contributions on larger repositories no longer time out. The relay
  packs a whole repository before its first byte (about 11 s for 37 MB and 75 s
  for 300 MB), which outlasted the 10 s client on two reads:

  • Seller: the pre-claim read of private inputs and contribution bases uses the
    large-transfer client (300 s per leg) and runs off the seller event loop, so
    heartbeats, awards and shutdown keep running; a finished staging re-drives
    the offer. At most 4 run at once.
  • Buyer: posting keeps the fetched base under <home>/store-seeds/ (up to
    14 days), and collect imports it into the delivery store before fetching the
    delivered fork, so that fetch asks only for the seller's new commits (under
    0.3 s for the same 300 MB repository). Every verification gate still runs;
    a missing seed only means the old, slower fetch.
    No relay deployment is needed. Update sellers and buyers.

• Git upload retries no longer mistake HTTP-status digits or auth words in a
  repository URL for an authentication refusal. Actual permission refusals still
  stop immediately.

• A permanent relay refusal of a private input upload (a 4xx other than 408, 409,
  421, 425 or 429, such as a quota or symlink/submodule refusal) is no longer
  retried with a full re-upload, and the post error names the refusal. Relay: a
  failure of the relay's own repository inspection now returns 503 (retryable)
  instead of 400; this part needs a relay redeploy.

• Private contribution preparation forwards a single fetched pack unchanged to
  an empty input repository when the server supports it, including jobs that also
  attach input files (the base is staged and uploaded separately, first), avoiding redundant
  libgit2 delta search. Other layouts retain the existing upload path; quotas,
  per-request authorization, redirect refusal and ref acknowledgement stay intact.

• MCP post_job now returns a durable preparation handle for slow work. Poll it
  with get_job; identical retries do not publish duplicate offers (a repeated
  success says deduplicated: true, a repeated failure says so in its message).
  Without request_id, a successful post dedupes identical arguments for 10
  minutes; an explicit request_id never expires. Input files are fingerprinted
  by content, in parallel and within 8 seconds; if that budget runs out the call
  claims and posts nothing and says so. Reusing a request_id with different
  arguments is refused with what that key already did (still preparing, posted
  job id, or a possibly-live offer). A failure before any offer was queued re-runs on retry; once an
  offer was queued, failures and restarts are never re-run, for either key kind,
  and the error names the offer id; abandoned owned staging directories are
  cleaned without touching live work or legacy unlabelled temporary directories.
  Buyer state adds an additive v8 preparation table; restart the buyer daemon and
  MCP server together after upgrading. No relay deployment is needed.

Rollout

The relay must already contain #1093 (required since rc4) before buyers upgrade. The
503-instead-of-400 relay change from #1096 takes effect only after a relay redeploy;
it is optional and has no ordering constraint. Restart the buyer daemon and MCP server
together after upgrading (buyer state adds the v8 preparation table). Upgrade sellers
to get the longer, off-loop pre-claim fetch (#1097). No sandbox image change is
needed beyond rc4's.

For paid private jobs using nostr:// mints (#1092): redeploy the reviewer and list
each such mint explicitly in its accepted_mints; a binary upgrade alone does not
approve them. Buyers and sellers must also list the mint in accepted_mints. No relay
redeploy is needed for #1092.

v0.6.1-rc4

Fourth release candidate for 0.6.1, prepared from main after the private-job delivery
fixes. Once published, install with npm install -g maxplayer@0.6.1-rc4.
This is a prerelease: publish on npm rc, leaving stable latest unchanged at v0.6.0.

Changes since v0.6.1-rc3

• Container delivery requests fresh, branch-scoped authorization from the seller
  host immediately before every Git HTTP request and retry, rather than reusing a
  short-lived token. Failed token hand-offs stop further refreshes so late replies
  cannot authorize later requests. The signing key remains outside the container
  (#1081).
• Container upload POSTs have a five-minute request ceiling, a 15-second connection
  timeout, and on Linux a 60-second bound on unacknowledged TCP data. This is not a
  progress-aware or unlimited upload policy; existing job deadlines still apply.
  Host-side delivery and buyer payment-verification timeout contracts are unchanged
  (#1081).
• Buyers preload the exact starting commit and its reachable history before
  publishing either targeted or open-pool private contribution offers. Sellers then
  upload only missing contribution data. Preparation failures prevent publication;
  existing jobs are not retroactively preloaded. Open-pool bidders still inspect the
  public source, and private-repo reads remain restricted until seller selection
  (#1093).
• Buyer preparation requests have a five-minute ceiling, including downloading the
  starting history, with a 15-second connection timeout. Input uploads get up to
  three attempts with fresh authorization and backoff. Before retrying, the buyer
  checks the exact remote ref to recover a lost success response or reject a
  conflicting commit. Repository quotas and payment behavior are unchanged (#1093).
• Mint-sidecar test helper cleanup resolves two clippy warnings; no mint runtime
  behavior changes (#1088).

Rollout

Deploy the relay containing #1093 before upgrading buyers: old relays reject
open-pool input preparation before publication. No new schema migration is required
for these delivery fixes. Upgrade/restart buyer daemons to use the new preparation
path.

Upgrade the seller daemon and versioned sandbox image together for #1081. A new
container with an old daemon fails closed when authorization refresh is unanswered;
a daemon-only upgrade leaves old images without the fix. Test the combined rollout
with a newly posted private job.

v0.6.1-rc3

Third release candidate for 0.6.1, prepared from main after the seller-credits stack
merged (#1084–#1087). Once published, install with npm install -g maxplayer@0.6.1-rc3.
This is a prerelease: publish on npm rc, leaving stable latest at v0.6.0.

Release scope

RC3 is the first build from main with seller credits. It includes everything in RC2
and the nostr:// mint support and maxplayer-mint sidecar that RC1 tested from the
unmerged stack, so RC1 testers can move to RC3. Known gap from RC1: a cross-mint hop
that RC1 journaled with a nostr:// source is no longer swept automatically;
reconcile it by hand.

Changes since v0.6.1-rc2

• Wallet support for nostr://<npub> mints, reached over Nostr relays instead of
  HTTPS (#1085). Accept one by adding its URL to accepted_mints and running
  maxplayer wallet mints add <url>. Melting is refused on every nostr:// mint,
  including through cross-mint hops, and a nostr:// melt saga is never resumed
  automatically. In-flight requests hold their inputs and cdk recovery until they can
  no longer land.

• maxplayer-mint, an opt-in sidecar that lets a seller issue its own credits
  (1 credit = 1 sat) over Nostr, with no HTTP server and no open port (#1086). It
  serves no minting or melting and says so in its info. It is not part of the
  maxplayer binary or the npm package; build it from source
  (crates/maxplayer-mint/README.md). A CI guard keeps cdk's mint code out of the
  default build.

• Seller-credits design spec (#1084), operator guide with backup and service setup,
  and the end-to-end harness (#1087).

• Buyer awards are reserved against the mint that will fund the job, not only the
  default mint, so a buyer funded at an extra mint is no longer refused at award
  (#1077). Refusals name the mint. The buyer store moves to schema v7 (an additive
  column; older binaries still open it).

• Website: production page-view analytics through Vercel, with query strings and
  fragments stripped (#1083).

• Docker Codex seats can explicitly select a model and reasoning effort through
  [sandbox.harnesses.codex] (model = "gpt-5.6-sol", `reasoning_effort = "h...

maxplayer 0.6.1-rc4

v0.6.1-rc4

Fourth release candidate for 0.6.1, prepared from main after the private-job delivery
fixes. Once published, install with npm install -g maxplayer@0.6.1-rc4.
This is a prerelease: publish on npm rc, leaving stable latest unchanged at v0.6.0.

Changes since v0.6.1-rc3

• Container delivery requests fresh, branch-scoped authorization from the seller
  host immediately before every Git HTTP request and retry, rather than reusing a
  short-lived token. Failed token hand-offs stop further refreshes so late replies
  cannot authorize later requests. The signing key remains outside the container
  (#1081).
• Container upload POSTs have a five-minute request ceiling, a 15-second connection
  timeout, and on Linux a 60-second bound on unacknowledged TCP data. This is not a
  progress-aware or unlimited upload policy; existing job deadlines still apply.
  Host-side delivery and buyer payment-verification timeout contracts are unchanged
  (#1081).
• Buyers preload the exact starting commit and its reachable history before
  publishing either targeted or open-pool private contribution offers. Sellers then
  upload only missing contribution data. Preparation failures prevent publication;
  existing jobs are not retroactively preloaded. Open-pool bidders still inspect the
  public source, and private-repo reads remain restricted until seller selection
  (#1093).
• Buyer preparation requests have a five-minute ceiling, including downloading the
  starting history, with a 15-second connection timeout. Input uploads get up to
  three attempts with fresh authorization and backoff. Before retrying, the buyer
  checks the exact remote ref to recover a lost success response or reject a
  conflicting commit. Repository quotas and payment behavior are unchanged (#1093).
• Mint-sidecar test helper cleanup resolves two clippy warnings; no mint runtime
  behavior changes (#1088).

Rollout

Deploy the relay containing #1093 before upgrading buyers: old relays reject
open-pool input preparation before publication. No new schema migration is required
for these delivery fixes. Upgrade/restart buyer daemons to use the new preparation
path.

Upgrade the seller daemon and versioned sandbox image together for #1081. A new
container with an old daemon fails closed when authorization refresh is unanswered;
a daemon-only upgrade leaves old images without the fix. Test the combined rollout
with a newly posted private job.

v0.6.1-rc3

Third release candidate for 0.6.1, prepared from main after the seller-credits stack
merged (#1084–#1087). Once published, install with npm install -g maxplayer@0.6.1-rc3.
This is a prerelease: publish on npm rc, leaving stable latest at v0.6.0.

Release scope

RC3 is the first build from main with seller credits. It includes everything in RC2
and the nostr:// mint support and maxplayer-mint sidecar that RC1 tested from the
unmerged stack, so RC1 testers can move to RC3. Known gap from RC1: a cross-mint hop
that RC1 journaled with a nostr:// source is no longer swept automatically;
reconcile it by hand.

Changes since v0.6.1-rc2

• Wallet support for nostr://<npub> mints, reached over Nostr relays instead of
  HTTPS (#1085). Accept one by adding its URL to accepted_mints and running
  maxplayer wallet mints add <url>. Melting is refused on every nostr:// mint,
  including through cross-mint hops, and a nostr:// melt saga is never resumed
  automatically. In-flight requests hold their inputs and cdk recovery until they can
  no longer land.

• maxplayer-mint, an opt-in sidecar that lets a seller issue its own credits
  (1 credit = 1 sat) over Nostr, with no HTTP server and no open port (#1086). It
  serves no minting or melting and says so in its info. It is not part of the
  maxplayer binary or the npm package; build it from source
  (crates/maxplayer-mint/README.md). A CI guard keeps cdk's mint code out of the
  default build.

• Seller-credits design spec (#1084), operator guide with backup and service setup,
  and the end-to-end harness (#1087).

• Buyer awards are reserved against the mint that will fund the job, not only the
  default mint, so a buyer funded at an extra mint is no longer refused at award
  (#1077). Refusals name the mint. The buyer store moves to schema v7 (an additive
  column; older binaries still open it).

• Website: production page-view analytics through Vercel, with query strings and
  fragments stripped (#1083).

• Docker Codex seats can explicitly select a model and reasoning effort through
  [sandbox.harnesses.codex] (model = "gpt-5.6-sol", reasoning_effort = "high"),
  including ChatGPT subscription seats. ACP acknowledgments determine the advertised
  model; authentication containment and behavior without the setting are unchanged.

• Seller sandbox: update Codex ACP from 1.2.0 to 2.1.1 (Codex dependency
  currently resolves to 0.159.3), refreshing support for current Codex models.
  Available models still depend on the seller account. Ships with the next
  versioned sandbox image; existing images are unchanged.

• Seller sandbox: update Claude ACP to 0.85.0 (SDK 0.3.286 / Claude Code
  2.1.286) and the standalone Claude CLI to 2.1.286, enabling Opus 5.5
  (requires Claude Code >=2.1.280). Ships with the next versioned sandbox image.
  To select it per seat, set ANTHROPIC_MODEL=claude-opus-5-5 on the seller
  daemon and add forward_env = ["ANTHROPIC_MODEL"] under [sandbox], then
  restart the seat. Keep any existing forwarded variables.

v0.6.1-rc2

Second release candidate for 0.6.1, prepared from main after the shared repository
limits and Git diff review changes (#1072). Once published, install with
npm install -g maxplayer@0.6.1-rc2. This is a prerelease: publish on npm rc,
leaving stable latest at v0.6.0.

Release scope

RC1 was a separate seller-credits test build from the unmerged #1034/#1036/#1037
stack. RC2 does not include those unmerged changes, including nostr:// mint
support or the mint sidecar. RC1 seller-credit testers should remain on RC1 until
that feature stack is included in a later release; RC2 is not its feature superset.
The RC1 notes below are preserved as the record of that published test build.

Changes since stable v0.6.0

• Unified public/private repository defaults: 1 GiB compressed storage/upload,
  5 GiB unique uncompressed Git objects, 100 MiB per file and one million objects.
  Remove separate file-count and commit-count caps in clients, relay and reviewer.
• Git delivery security reviews now send the task plus the diff against the
  contribution's pinned starting commit, including additions, deletions, edits,
  mode changes and surrounding context. Artifact jobs diff against the empty tree.
  Small diffs stay together; large hunks split with task/path/location context.
  Every batch must succeed; independent requests can still miss interactions.
• Disk-backed relay downloads and review requests reduce whole-input memory copies;
  raise the Git-only reverse-proxy upload allowance. No transcript collection.
• Website/market updates: Try it on Buy and revised copy (#1068), graceful Try it
  safety declines (#1073), updated first-job video (#1074), and delivery-aware
  market lamps/removal of seller-profile Overdue status (#1075). Try it remains
  controlled by its existing deployment flags.
• Private-job documentation and v0.6.0 accuracy corrections (#1071).

Coordinated rollout

Deploy matching relay, reviewer and Git reverse-proxy configuration, then update
and restart buyer/seller clients and MCP servers. Prepare client builds first:
older clients reject the changed private-repository provisioning limits. The
checked-in NixOS #relay deployment includes relay, reviewer and Nginx together.
Preserve existing wallets, keys, databases and repository data.

Public seller repositories still share storage across job branches. The new
limits do not change repository layout or retention. Large reviews can still
exceed provider/time budgets; batching is not proof of safe execution or a full
code-correctness review. Changed binary files, symlinks and submodules remain
unsupported review inputs. No paid full-size JEV benchmark is claimed.

Release publication alone does not deploy services or prove live compatibility.
Smoke-test private provisioning/delivery/collection and a reviewed Git contribution
after updating the server and clients.

v0.6.1-rc1

First release candidate for 0.6.1, cut to test seller credits before they merge.
This is a prerelease; stable remains v0.6.0. Install with npm install -g maxplayer@rc.
It is built from the seller-credits PR stack (#1034, #1036, #1037), not from main.

Changes since v0.6.0

• Wallet support for nostr://<npub> mints: a Cashu mint reached over Nostr relays
  instead of HTTPS (seller credits stage 1, #1034). Buyers and sellers can pay and
  accept tokens from such a mint when it is on their accepted-mint list.
• In-flight nostr:// requests hold their inputs and cdk saga recovery until the
  request can no longer land, so a slow relay cannot cause a double spend (#1034).
• maxplayer-mint, an opt-in mint sidecar that serves a cdk mint over Nostr
  (stage 2, #1036), plus a local end-to-end harness (stage 3, #1037). The sidecar
  is not part of the maxplayer binary or the npm package; build it from source
  with cargo build --manifest-path crates/maxplayer-mint/Cargo.toml. A CI guard
  keeps cdk's mint code out of the default maxplayer build.

Existing installations

Nothing changes unless a nostr:// mint is added to the wallet or accepted-mint
configuration; HTTPS mints behave as in v0.6.0. GitHub marks this as a prerelease,
npm publishes it under rc, and stable latest stays at v0.6.0.

v0.6.0

Stable 0.6.0 release, incorporating the RC1–RC8 fixes and the new homepage.
Install with npm install -g maxplayer@latest.

Highlights since v0.5.11

• Private job flow with en...

maxplayer 0.6.1-rc3

v0.6.1-rc3

Third release candidate for 0.6.1, prepared from main after the seller-credits stack
merged (#1084–#1087). Once published, install with npm install -g maxplayer@0.6.1-rc3.
This is a prerelease: publish on npm rc, leaving stable latest at v0.6.0.

Release scope

RC3 is the first build from main with seller credits. It includes everything in RC2
and the nostr:// mint support and maxplayer-mint sidecar that RC1 tested from the
unmerged stack, so RC1 testers can move to RC3. Known gap from RC1: a cross-mint hop
that RC1 journaled with a nostr:// source is no longer swept automatically;
reconcile it by hand.

Changes since v0.6.1-rc2

• Wallet support for nostr://<npub> mints, reached over Nostr relays instead of
  HTTPS (#1085). Accept one by adding its URL to accepted_mints and running
  maxplayer wallet mints add <url>. Melting is refused on every nostr:// mint,
  including through cross-mint hops, and a nostr:// melt saga is never resumed
  automatically. In-flight requests hold their inputs and cdk recovery until they can
  no longer land.

• maxplayer-mint, an opt-in sidecar that lets a seller issue its own credits
  (1 credit = 1 sat) over Nostr, with no HTTP server and no open port (#1086). It
  serves no minting or melting and says so in its info. It is not part of the
  maxplayer binary or the npm package; build it from source
  (crates/maxplayer-mint/README.md). A CI guard keeps cdk's mint code out of the
  default build.

• Seller-credits design spec (#1084), operator guide with backup and service setup,
  and the end-to-end harness (#1087).

• Buyer awards are reserved against the mint that will fund the job, not only the
  default mint, so a buyer funded at an extra mint is no longer refused at award
  (#1077). Refusals name the mint. The buyer store moves to schema v7 (an additive
  column; older binaries still open it).

• Website: production page-view analytics through Vercel, with query strings and
  fragments stripped (#1083).

• Docker Codex seats can explicitly select a model and reasoning effort through
  [sandbox.harnesses.codex] (model = "gpt-5.6-sol", reasoning_effort = "high"),
  including ChatGPT subscription seats. ACP acknowledgments determine the advertised
  model; authentication containment and behavior without the setting are unchanged.

• Seller sandbox: update Codex ACP from 1.2.0 to 2.1.1 (Codex dependency
  currently resolves to 0.159.3), refreshing support for current Codex models.
  Available models still depend on the seller account. Ships with the next
  versioned sandbox image; existing images are unchanged.

• Seller sandbox: update Claude ACP to 0.85.0 (SDK 0.3.286 / Claude Code
  2.1.286) and the standalone Claude CLI to 2.1.286, enabling Opus 5.5
  (requires Claude Code >=2.1.280). Ships with the next versioned sandbox image.
  To select it per seat, set ANTHROPIC_MODEL=claude-opus-5-5 on the seller
  daemon and add forward_env = ["ANTHROPIC_MODEL"] under [sandbox], then
  restart the seat. Keep any existing forwarded variables.

v0.6.1-rc2

Second release candidate for 0.6.1, prepared from main after the shared repository
limits and Git diff review changes (#1072). Once published, install with
npm install -g maxplayer@0.6.1-rc2. This is a prerelease: publish on npm rc,
leaving stable latest at v0.6.0.

Release scope

RC1 was a separate seller-credits test build from the unmerged #1034/#1036/#1037
stack. RC2 does not include those unmerged changes, including nostr:// mint
support or the mint sidecar. RC1 seller-credit testers should remain on RC1 until
that feature stack is included in a later release; RC2 is not its feature superset.
The RC1 notes below are preserved as the record of that published test build.

Changes since stable v0.6.0

• Unified public/private repository defaults: 1 GiB compressed storage/upload,
  5 GiB unique uncompressed Git objects, 100 MiB per file and one million objects.
  Remove separate file-count and commit-count caps in clients, relay and reviewer.
• Git delivery security reviews now send the task plus the diff against the
  contribution's pinned starting commit, including additions, deletions, edits,
  mode changes and surrounding context. Artifact jobs diff against the empty tree.
  Small diffs stay together; large hunks split with task/path/location context.
  Every batch must succeed; independent requests can still miss interactions.
• Disk-backed relay downloads and review requests reduce whole-input memory copies;
  raise the Git-only reverse-proxy upload allowance. No transcript collection.
• Website/market updates: Try it on Buy and revised copy (#1068), graceful Try it
  safety declines (#1073), updated first-job video (#1074), and delivery-aware
  market lamps/removal of seller-profile Overdue status (#1075). Try it remains
  controlled by its existing deployment flags.
• Private-job documentation and v0.6.0 accuracy corrections (#1071).

Coordinated rollout

Deploy matching relay, reviewer and Git reverse-proxy configuration, then update
and restart buyer/seller clients and MCP servers. Prepare client builds first:
older clients reject the changed private-repository provisioning limits. The
checked-in NixOS #relay deployment includes relay, reviewer and Nginx together.
Preserve existing wallets, keys, databases and repository data.

Public seller repositories still share storage across job branches. The new
limits do not change repository layout or retention. Large reviews can still
exceed provider/time budgets; batching is not proof of safe execution or a full
code-correctness review. Changed binary files, symlinks and submodules remain
unsupported review inputs. No paid full-size JEV benchmark is claimed.

Release publication alone does not deploy services or prove live compatibility.
Smoke-test private provisioning/delivery/collection and a reviewed Git contribution
after updating the server and clients.

v0.6.1-rc1

First release candidate for 0.6.1, cut to test seller credits before they merge.
This is a prerelease; stable remains v0.6.0. Install with npm install -g maxplayer@rc.
It is built from the seller-credits PR stack (#1034, #1036, #1037), not from main.

Changes since v0.6.0

• Wallet support for nostr://<npub> mints: a Cashu mint reached over Nostr relays
  instead of HTTPS (seller credits stage 1, #1034). Buyers and sellers can pay and
  accept tokens from such a mint when it is on their accepted-mint list.
• In-flight nostr:// requests hold their inputs and cdk saga recovery until the
  request can no longer land, so a slow relay cannot cause a double spend (#1034).
• maxplayer-mint, an opt-in mint sidecar that serves a cdk mint over Nostr
  (stage 2, #1036), plus a local end-to-end harness (stage 3, #1037). The sidecar
  is not part of the maxplayer binary or the npm package; build it from source
  with cargo build --manifest-path crates/maxplayer-mint/Cargo.toml. A CI guard
  keeps cdk's mint code out of the default maxplayer build.

Existing installations

Nothing changes unless a nostr:// mint is added to the wallet or accepted-mint
configuration; HTTPS mints behave as in v0.6.0. GitHub marks this as a prerelease,
npm publishes it under rc, and stable latest stays at v0.6.0.

v0.6.0

Stable 0.6.0 release, incorporating the RC1–RC8 fixes and the new homepage.
Install with npm install -g maxplayer@latest.

Highlights since v0.5.11

• Private job flow with encrypted execution-review requests and results, and
  optional execution reviews for jobs (#1033, #1022).
• Docker Desktop seller compatibility: ignore dormant fallback tunnel devices
  and select a verified u32 egress backend when flower is unavailable (#1044, #1047).
• Reviewer startup, credential staging, shared-identity defaults, subscription
  recovery, and SQLite POSIX-lock lifetime fixes (#1042, #1045, #1051, #1054,
  #1056, #1061).
• Private Git provisioning, ref/auth handling, pre-run review and pinned-commit
  fetch fixes (#1055, #1058, #1059).
• Seller Git results echo the offer's output type, fixing buyer rejection of
  public deliveries with non-text/plain output (#1066, fixes #1065).
• New buyer-first homepage, seller page and first-job video; live marketplace
  moves to /market (#1053).

Upgrade and rollout

Upgrade buyers and sellers and restart daemons/MCP servers. Operators upgrading
from 0.5.11 or early RCs must also deploy the matching relay/reviewer revision.
Keep existing wallets, signing keys and job state. For existing explicit trust
settings on the Maxplayer relay, follow the v0.6.0-rc5 identity guidance below;
a binary upgrade does not overwrite those settings or re-encrypt old jobs.

Before stopping a reviewer affected by the pre-RC7 lock bug, preserve its main
database and orphaned WAL consistently through its live file descriptors unless
you explicitly accept losing those records. Recovery must be performed on copies.
Already-published malformed result tags are not repaired or paid automatically.
See the RC7 and RC8 sections for these data/re-delivery limitations.

Relative to RC8, no new runtime protocol/schema/key migration is introduced.
Publication is not proof of live deployment or an end-to-end job test: verify
public/private jobs through review, delivery and settlement after rollout.

This is a stable GitHub release; npm latest advances to 0.6.0. The npm rc
channel remains on RC8. Seller-credit and Try it proposals are not included.

v0.6.0-rc8

Eighth release candidate for 0.6.0. This is a prerelease; stable remains v0.5.11.
Install with npm install -g maxplayer@rc.

Changes since v0.6.0-rc7

• Fix seller Git results to echo the offer's declared output type instead of
  hardcoding text/plain, including resumed deliveries (#1066, fixes #1065).
  Public jobs requesting types such as application/json can now produce
  results that pass the buyer's existing output-type...

maxplayer 0.6.1-rc2

v0.6.1-rc2

Second release candidate for 0.6.1, prepared from main after the shared repository
limits and Git diff review changes (#1072). Once published, install with
npm install -g maxplayer@0.6.1-rc2. This is a prerelease: publish on npm rc,
leaving stable latest at v0.6.0.

Release scope

RC1 was a separate seller-credits test build from the unmerged #1034/#1036/#1037
stack. RC2 does not include those unmerged changes, including nostr:// mint
support or the mint sidecar. RC1 seller-credit testers should remain on RC1 until
that feature stack is included in a later release; RC2 is not its feature superset.
The RC1 notes below are preserved as the record of that published test build.

Changes since stable v0.6.0

• Unified public/private repository defaults: 1 GiB compressed storage/upload,
  5 GiB unique uncompressed Git objects, 100 MiB per file and one million objects.
  Remove separate file-count and commit-count caps in clients, relay and reviewer.
• Git delivery security reviews now send the task plus the diff against the
  contribution's pinned starting commit, including additions, deletions, edits,
  mode changes and surrounding context. Artifact jobs diff against the empty tree.
  Small diffs stay together; large hunks split with task/path/location context.
  Every batch must succeed; independent requests can still miss interactions.
• Disk-backed relay downloads and review requests reduce whole-input memory copies;
  raise the Git-only reverse-proxy upload allowance. No transcript collection.
• Website/market updates: Try it on Buy and revised copy (#1068), graceful Try it
  safety declines (#1073), updated first-job video (#1074), and delivery-aware
  market lamps/removal of seller-profile Overdue status (#1075). Try it remains
  controlled by its existing deployment flags.
• Private-job documentation and v0.6.0 accuracy corrections (#1071).

Coordinated rollout

Deploy matching relay, reviewer and Git reverse-proxy configuration, then update
and restart buyer/seller clients and MCP servers. Prepare client builds first:
older clients reject the changed private-repository provisioning limits. The
checked-in NixOS #relay deployment includes relay, reviewer and Nginx together.
Preserve existing wallets, keys, databases and repository data.

Public seller repositories still share storage across job branches. The new
limits do not change repository layout or retention. Large reviews can still
exceed provider/time budgets; batching is not proof of safe execution or a full
code-correctness review. Changed binary files, symlinks and submodules remain
unsupported review inputs. No paid full-size JEV benchmark is claimed.

Release publication alone does not deploy services or prove live compatibility.
Smoke-test private provisioning/delivery/collection and a reviewed Git contribution
after updating the server and clients.

v0.6.1-rc1

First release candidate for 0.6.1, cut to test seller credits before they merge.
This is a prerelease; stable remains v0.6.0. Install with npm install -g maxplayer@rc.
It is built from the seller-credits PR stack (#1034, #1036, #1037), not from main.

Changes since v0.6.0

• Wallet support for nostr://<npub> mints: a Cashu mint reached over Nostr relays
  instead of HTTPS (seller credits stage 1, #1034). Buyers and sellers can pay and
  accept tokens from such a mint when it is on their accepted-mint list.
• In-flight nostr:// requests hold their inputs and cdk saga recovery until the
  request can no longer land, so a slow relay cannot cause a double spend (#1034).
• maxplayer-mint, an opt-in mint sidecar that serves a cdk mint over Nostr
  (stage 2, #1036), plus a local end-to-end harness (stage 3, #1037). The sidecar
  is not part of the maxplayer binary or the npm package; build it from source
  with cargo build --manifest-path crates/maxplayer-mint/Cargo.toml. A CI guard
  keeps cdk's mint code out of the default maxplayer build.

Existing installations

Nothing changes unless a nostr:// mint is added to the wallet or accepted-mint
configuration; HTTPS mints behave as in v0.6.0. GitHub marks this as a prerelease,
npm publishes it under rc, and stable latest stays at v0.6.0.

v0.6.0

Stable 0.6.0 release, incorporating the RC1–RC8 fixes and the new homepage.
Install with npm install -g maxplayer@latest.

Highlights since v0.5.11

• Private job flow with encrypted execution-review requests and results, and
  optional execution reviews for jobs (#1033, #1022).
• Docker Desktop seller compatibility: ignore dormant fallback tunnel devices
  and select a verified u32 egress backend when flower is unavailable (#1044, #1047).
• Reviewer startup, credential staging, shared-identity defaults, subscription
  recovery, and SQLite POSIX-lock lifetime fixes (#1042, #1045, #1051, #1054,
  #1056, #1061).
• Private Git provisioning, ref/auth handling, pre-run review and pinned-commit
  fetch fixes (#1055, #1058, #1059).
• Seller Git results echo the offer's output type, fixing buyer rejection of
  public deliveries with non-text/plain output (#1066, fixes #1065).
• New buyer-first homepage, seller page and first-job video; live marketplace
  moves to /market (#1053).

Upgrade and rollout

Upgrade buyers and sellers and restart daemons/MCP servers. Operators upgrading
from 0.5.11 or early RCs must also deploy the matching relay/reviewer revision.
Keep existing wallets, signing keys and job state. For existing explicit trust
settings on the Maxplayer relay, follow the v0.6.0-rc5 identity guidance below;
a binary upgrade does not overwrite those settings or re-encrypt old jobs.

Before stopping a reviewer affected by the pre-RC7 lock bug, preserve its main
database and orphaned WAL consistently through its live file descriptors unless
you explicitly accept losing those records. Recovery must be performed on copies.
Already-published malformed result tags are not repaired or paid automatically.
See the RC7 and RC8 sections for these data/re-delivery limitations.

Relative to RC8, no new runtime protocol/schema/key migration is introduced.
Publication is not proof of live deployment or an end-to-end job test: verify
public/private jobs through review, delivery and settlement after rollout.

This is a stable GitHub release; npm latest advances to 0.6.0. The npm rc
channel remains on RC8. Seller-credit and Try it proposals are not included.

v0.6.0-rc8

Eighth release candidate for 0.6.0. This is a prerelease; stable remains v0.5.11.
Install with npm install -g maxplayer@rc.

Changes since v0.6.0-rc7

• Fix seller Git results to echo the offer's declared output type instead of
  hardcoding text/plain, including resumed deliveries (#1066, fixes #1065).
  Public jobs requesting types such as application/json can now produce
  results that pass the buyer's existing output-type validation.
• Add buyer-side evidence and seller-side output-tag regression coverage.

Rollout and verification

Upgrade and restart sellers before testing new public Git jobs. Buyers may
upgrade as well; buyer validation is unchanged. This fix introduces no relay,
reviewer, database-schema, key or configuration migration.

Already-published results with incorrect signed output tags are not repaired by
upgrading. Re-delivery or separate settlement requires deliberate follow-up;
this release does not automatically settle those jobs. The separate
relay_answered=false diagnostic remains outside this fix.

Retest a new public Git job through delivery and payment. This release does not
claim a live end-to-end verification. GitHub remains a prerelease, npm uses rc,
and stable latest is unchanged.

v0.6.0-rc7

Seventh release candidate for 0.6.0. This is a prerelease; stable remains v0.5.11.
Install with npm install -g maxplayer@rc.

Changes since v0.6.0-rc6

• Close permission-check file handles before SQLite opens the reviewer and
  private-content databases, preserving SQLite POSIX locks and preventing
  orphaned-WAL review data loss (#1061).
• Stabilize wallet worker-send and child-process custody tests with offline
  fixtures and deterministic synchronization (#1062).

Rollout and existing data

Deploy and restart the reviewer with this revision. Upgrade buyers and sellers
for the private-content store fix, then restart their daemons/MCP servers.
No protocol, schema, signing-key or configuration migration is required by RC7.
Client installation does not deploy the relay/reviewer host.

Before restarting an affected reviewer, preserve the main database and any
orphaned WAL through the running process's /proc/<pid>/fd/ descriptors, with
writes paused for a consistent capture. Recover on copies. Operators may skip
recovery only if they accept permanently losing the stranded review records.
The fix prevents future lock loss; it does not recover already orphaned rows.

Verify the restarted reviewer retains its database lock and persists new reviews;
retest a private job end to end. This release does not claim live-host verification.
GitHub remains a prerelease; npm uses rc, and stable latest is unchanged.

v0.6.0-rc6

Sixth release candidate for 0.6.0, containing the private-job fixes merged since
RC5. This is a prerelease; stable remains v0.5.11.
Install with npm install -g maxplayer@rc.

Changes since v0.6.0-rc5

• Resolve the reviewer's systemd state directory before opening SQLite (#1054).
• Seed the repository manifest when provisioning a private job, allowing its
  first input or delivery push (#1055).
• Recover reviewer subscriptions after NIP-42 authentication, reconnects and
  subscription closures; isolate malformed requests and retain the client default
  accepted mints (#1056).
• Correct private Git ref names and signed input-read headers; use the encrypted
  review path for the seller's pre-run offer check (#1058).
• Advertise support for fetching reachable commits by their pinned ID (#...

maxplayer 0.6.1-rc1

v0.6.1-rc1

First release candidate for 0.6.1, cut to test seller credits before they merge.
This is a prerelease; stable remains v0.6.0. Install with npm install -g maxplayer@rc.
It is built from the seller-credits PR stack (#1034, #1036, #1037), not from main.

Changes since v0.6.0

• Wallet support for nostr://<npub> mints: a Cashu mint reached over Nostr relays
  instead of HTTPS (seller credits stage 1, #1034). Buyers and sellers can pay and
  accept tokens from such a mint when it is on their accepted-mint list.
• In-flight nostr:// requests hold their inputs and cdk saga recovery until the
  request can no longer land, so a slow relay cannot cause a double spend (#1034).
• maxplayer-mint, an opt-in mint sidecar that serves a cdk mint over Nostr
  (stage 2, #1036), plus a local end-to-end harness (stage 3, #1037). The sidecar
  is not part of the maxplayer binary or the npm package; build it from source
  with cargo build --manifest-path crates/maxplayer-mint/Cargo.toml. A CI guard
  keeps cdk's mint code out of the default maxplayer build.

Existing installations

Nothing changes unless a nostr:// mint is added to the wallet or accepted-mint
configuration; HTTPS mints behave as in v0.6.0. GitHub marks this as a prerelease,
npm publishes it under rc, and stable latest stays at v0.6.0.

v0.6.0

Stable 0.6.0 release, incorporating the RC1–RC8 fixes and the new homepage.
Install with npm install -g maxplayer@latest.

Highlights since v0.5.11

• Private job flow with encrypted execution-review requests and results, and
  optional execution reviews for jobs (#1033, #1022).
• Docker Desktop seller compatibility: ignore dormant fallback tunnel devices
  and select a verified u32 egress backend when flower is unavailable (#1044, #1047).
• Reviewer startup, credential staging, shared-identity defaults, subscription
  recovery, and SQLite POSIX-lock lifetime fixes (#1042, #1045, #1051, #1054,
  #1056, #1061).
• Private Git provisioning, ref/auth handling, pre-run review and pinned-commit
  fetch fixes (#1055, #1058, #1059).
• Seller Git results echo the offer's output type, fixing buyer rejection of
  public deliveries with non-text/plain output (#1066, fixes #1065).
• New buyer-first homepage, seller page and first-job video; live marketplace
  moves to /market (#1053).

Upgrade and rollout

Upgrade buyers and sellers and restart daemons/MCP servers. Operators upgrading
from 0.5.11 or early RCs must also deploy the matching relay/reviewer revision.
Keep existing wallets, signing keys and job state. For existing explicit trust
settings on the Maxplayer relay, follow the v0.6.0-rc5 identity guidance below;
a binary upgrade does not overwrite those settings or re-encrypt old jobs.

Before stopping a reviewer affected by the pre-RC7 lock bug, preserve its main
database and orphaned WAL consistently through its live file descriptors unless
you explicitly accept losing those records. Recovery must be performed on copies.
Already-published malformed result tags are not repaired or paid automatically.
See the RC7 and RC8 sections for these data/re-delivery limitations.

Relative to RC8, no new runtime protocol/schema/key migration is introduced.
Publication is not proof of live deployment or an end-to-end job test: verify
public/private jobs through review, delivery and settlement after rollout.

This is a stable GitHub release; npm latest advances to 0.6.0. The npm rc
channel remains on RC8. Seller-credit and Try it proposals are not included.

v0.6.0-rc8

Eighth release candidate for 0.6.0. This is a prerelease; stable remains v0.5.11.
Install with npm install -g maxplayer@rc.

Changes since v0.6.0-rc7

• Fix seller Git results to echo the offer's declared output type instead of
  hardcoding text/plain, including resumed deliveries (#1066, fixes #1065).
  Public jobs requesting types such as application/json can now produce
  results that pass the buyer's existing output-type validation.
• Add buyer-side evidence and seller-side output-tag regression coverage.

Rollout and verification

Upgrade and restart sellers before testing new public Git jobs. Buyers may
upgrade as well; buyer validation is unchanged. This fix introduces no relay,
reviewer, database-schema, key or configuration migration.

Already-published results with incorrect signed output tags are not repaired by
upgrading. Re-delivery or separate settlement requires deliberate follow-up;
this release does not automatically settle those jobs. The separate
relay_answered=false diagnostic remains outside this fix.

Retest a new public Git job through delivery and payment. This release does not
claim a live end-to-end verification. GitHub remains a prerelease, npm uses rc,
and stable latest is unchanged.

v0.6.0-rc7

Seventh release candidate for 0.6.0. This is a prerelease; stable remains v0.5.11.
Install with npm install -g maxplayer@rc.

Changes since v0.6.0-rc6

• Close permission-check file handles before SQLite opens the reviewer and
  private-content databases, preserving SQLite POSIX locks and preventing
  orphaned-WAL review data loss (#1061).
• Stabilize wallet worker-send and child-process custody tests with offline
  fixtures and deterministic synchronization (#1062).

Rollout and existing data

Deploy and restart the reviewer with this revision. Upgrade buyers and sellers
for the private-content store fix, then restart their daemons/MCP servers.
No protocol, schema, signing-key or configuration migration is required by RC7.
Client installation does not deploy the relay/reviewer host.

Before restarting an affected reviewer, preserve the main database and any
orphaned WAL through the running process's /proc/<pid>/fd/ descriptors, with
writes paused for a consistent capture. Recover on copies. Operators may skip
recovery only if they accept permanently losing the stranded review records.
The fix prevents future lock loss; it does not recover already orphaned rows.

Verify the restarted reviewer retains its database lock and persists new reviews;
retest a private job end to end. This release does not claim live-host verification.
GitHub remains a prerelease; npm uses rc, and stable latest is unchanged.

v0.6.0-rc6

Sixth release candidate for 0.6.0, containing the private-job fixes merged since
RC5. This is a prerelease; stable remains v0.5.11.
Install with npm install -g maxplayer@rc.

Changes since v0.6.0-rc5

• Resolve the reviewer's systemd state directory before opening SQLite (#1054).
• Seed the repository manifest when provisioning a private job, allowing its
  first input or delivery push (#1055).
• Recover reviewer subscriptions after NIP-42 authentication, reconnects and
  subscription closures; isolate malformed requests and retain the client default
  accepted mints (#1056).
• Correct private Git ref names and signed input-read headers; use the encrypted
  review path for the seller's pre-run offer check (#1058).
• Advertise support for fetching reachable commits by their pinned ID (#1059).

Coordinated rollout and verification

Upgrade buyers and sellers and restart their daemons/MCP servers. Deploy the
relay and reviewer from a revision containing these fixes as well: installing a
client package does not deploy the server. Preserve the RC5 shared identity and
existing keys; explicit old client settings still require the RC5 migration below.

These fixes are merged and their main-branch CI passed. This publication does not
claim a newly verified live private-job round trip. Retest a new private job from
input upload through offer review, seller execution, delivery review and collection.
Do not treat old jobs as migrated or re-encrypted by this upgrade.

GitHub remains a prerelease; npm uses rc, and stable latest is unchanged.

v0.6.0-rc5

Fifth release candidate for 0.6.0. This is a prerelease; stable remains v0.5.11.
Install with npm install -g maxplayer@rc.

Changes since v0.6.0-rc4

• Reuse the deployed reviewer public identity (31b18b42…) as the shared
  private-content/reviewer default (#1051). Client and relay service defaults agree.
• Keep the existing reviewer private key in place; no OpenClaw secret-store export
  or reviewer signer replacement is required for this migration.
• Document coordinated configuration changes and old-job limitations.

Existing installations

Upgrading does not overwrite explicit client settings. Set privacy.service_pubkey
and the wss://relay.maxplayer.ai reviewer entry to
31b18b42bcef9842c10e518834d32da2a0f8f6f8f3758124e25cc392ada1fe5c, then restart
buyer/seller daemons and MCP servers. Align the relay's MAXPLAYER_PRIVATE_SERVICE_PUBKEY
override (or deploy its new default) and restart the relay. Verify the worker actually
uses the matching existing signer and prove a new private job through offer and
delivery review before calling the rollout complete.

This release does not change live credentials, rewrite existing repository access
records, or re-encrypt old jobs. Preserve old keys and job state. GitHub remains a
prerelease; npm uses rc, and stable latest is unchanged.

v0.6.0-rc4

Fourth release candidate for 0.6.0. This is a prerelease for testing, not a
replacement for stable v0.5.11. Install with npm install -g maxplayer@rc.

Changes since v0.6.0-rc3

• Unify the default execution-reviewer identity with the existing private-content
  service identity (#1049). Both now use 7e6b3b05…; the reviewer default references
  the service constant rather than maintaining a competing public key.
• Add a regression check that fresh-home reviewer, privacy and relay-protocol
  identity defaults agree. Preserve custom relay trust, explicit reviewer maps,
  empty maps and disabled review settings.
• Correct operator setup guidance to reuse the existing content-service private
  key, keep the relay identity separate, and coordinate signer/client migration.

Re...