peerd-preview-v0.7.3

Added

• App manifests can define a dedicated, code-first developer actor. Peerd binds
  that actor to the exact App, owning root task, manifest revision, and caller
  authority; the actor can use one sealed app_code program to observe,
  exercise, and test the running App before editing its readable working tree.
  App authors define a bounded semantic observe/act adapter, while messages
  entered through the host-owned in-tab drawer join that bound actor's same
  continuing mailbox. App code can reveal the drawer on a user gesture but never
  receives prompt submission, model access, provider credentials, or actor authority.
• Dweb App bundles have a signed version-2 transport with deterministic,
  version-pinned compression before chunking. Descriptors commit to the
  encoding, compressed and uncompressed sizes and hashes, and every decoded
  file's kind, size, and hash. Existing version-1 bundles remain readable.

Changed

• Installed Apps keep their readable source files and byte-exact binary assets
  in the OPFS Git working tree. JavaScript can address separate textures and
  audio through the narrow peerd.assets API, while compression stays outside
  the working tree as a network transport concern.
• Seeders retain and serve the verified compressed chunks that were signed,
  without rebuilding or recompressing them. Isomorphic Git continues to see
  only the decoded source and binary bytes.
• Publisher-provided App actor instructions are rendered with package
  provenance beneath Peerd's host policy instead of being represented as
  user-authored /system instructions.

Fixed

• Release publication now requires only one manual approval. The peerd.ai
  notification job keeps its own narrowly scoped environment, so a failed
  notification can be retried without repeating irreversible Firefox signing.
• App actor attachment, reuse, and runtime calls now reconcile manifest and
  owner-authority changes, require an exact owner-bound tab, suspend across
  edits, and preserve cancellation or unknown-outcome custody through the
  sealed code runner.
• Dweb room transitions are serialized and cancellation-aware, preventing a
  delayed consent or late join result from leaking a room, resolving a newer
  request, or corrupting the App bridge's current-room state.
• Bundle admission verifies compressed chunks and their aggregate hash before
  bounded streaming decompression. Per-file and total output ceilings reject
  oversized descriptors, surplus output, and compression bombs.
• Large canonical base64 files are validated in linear, constant-stack time,
  allowing readable multi-megabyte App sources to round-trip reliably.

---

Install (preview): Firefox: click the .xpi on this page. Chrome: drag
the .crx into chrome://extensions with Developer mode on. Most users
want the store packages (see the README). The auto-update feeds are
attached here and served at peerd.ai/updates/.