0.8.0

The first stable release of Parachute v0.8. The npm package is @openparachute/core and the command is parachute.
npm's latest moves from 0.8.0-pre.1 to 0.8.0, so a plain npm i -g @openparachute/core (or bun add -g) now
gets it. 0.8.0 is 0.8.0-pre.4 with the suffix dropped: the same code, built and tested again by CI.

Since 0.8.0-pre.2 (CHANGELOG.md has the full list):

• Semantic search works from a fresh install. The bundle carries the embedding stack for its own platform and the
  pinned model, and embeds offline. The vault's /health and info say embeddings.state (off, loading, ready,
  failing), and the info says why when it fails. 0.8.0-pre.1 left the stack out (#50).
• Safer by default: a vault's description needs an admin pass; a tag-scoped pass stays off whole-vault routes and
  counts only what it can see; the consent page shows where an app sends you back, and names that pass for
  Parachute's own are refused; mirror import takes only https:// and ssh (#52, #53, #54).
• Right answers: bare filters find booleans, numbers and null; list items with a colon round-trip; since means
  changed; a restart no longer renames notes whose paths differ only by case or extension; a batch that fails
  part-way keeps nothing on cloud; a long description reads back whole (#47, #48, #58, #59, #63).
• parachute probe opens one vault through the hub and prints one line, with systemd units in docs/probe/ (#56).
• 0.8 reports its own version in status, /health and doctor (#46). A crashing MCP tool leaves one log line (#57).
  A browser MCP client can call a box (#63).
• A fresh parachute init runs 0.8's own vault (#42). Exports link attachments to the exported files and name
  pathless notes by title (#35, #41).
• npm publishes only after every contracts job passed on the same commit (#55).

Built by CI from this tag's commit, never on a laptop:

• parachute-core-0.8.0-darwin-arm64.tar.gz, signed ad hoc with the hardened runtime. It is the tree that
  embedded/bundle, embedded/embeddings and Benjamin's compatibility suite passed on, on macos-15.
• parachute-core-0.8.0-linux-x64.tar.gz, the tree every contract suite ran on. It is about 118 MB now that it
  carries the embedding stack.
• SHA256SUMS for both tarballs: shasum -a 256 -c SHA256SUMS (Linux: sha256sum -c SHA256SUMS).
• openparachute-core-0.8.0.tgz and npm-SHA256SUMS: the npm package the release workflow tested and published
  (its npm-package artifact), tested with npm i -g and bun add -g, with Benjamin's suite run on the npm install.

Run it: unpack, then bin/parachute --help. For a host application: bin/parachute bootstrap --embedded --json,
then bin/parachute serve --embedded --home <dir> --listen 127.0.0.1:<port> --vault-listen 127.0.0.1:<port>.
See docs/PRISM.md.

From an earlier 0.8: stop the service, install 0.8.0, start it. The vault's data needs no step.
On a machine with 0.7: parachute takeover (with --dry-run first) moves the home the old hub and vault keep
onto 0.8, keeps the old programs installed but off, and parachute takeover --rollback goes back. Back up a home you
care about first.

0.8.0-pre.2

The second prerelease of Parachute v0.8, the test build for Prism's Nov 9 handoff. The npm package is
@openparachute/core and the command is parachute.

Since 0.8.0-pre.1 (none of it touches the embedded contract; Benjamin's suite passes unchanged):

• Wikilinks longer than 48 bytes resolve on Durable Objects (#23).
• Import resolves wikilinks once from a title index and commits in chunks (#25).
• Tag queries over 100+ child tags, path_prefix and rename-tag stay under Durable Object SQLite's caps (#27, #28).
• A rename's cascade writes reach live subscribers (#29).
• Restoring an old snapshot keeps its metadata exact (#32).
• OAuth refresh ignores a resource it can't match (as 0.7.6 did); /oauth/token answers a non-form body 400 and logs it (#22, #31).
• Takeover reads the old units' environment as systemd does (#13, #20, #30).
• The darwin-arm64 bundle is built on macos-15 (GitHub retires macos-14 on Nov 2) (#33).

Built by CI from this tag's commit, never on a laptop:

• parachute-core-0.8.0-pre.2-darwin-arm64.tar.gz, signed ad hoc with the hardened runtime (runtime/bun with
  allow-jit only). It is the tree that embedded/bundle and Benjamin's compatibility suite passed on, on macos-15.
• parachute-core-0.8.0-pre.2-linux-x64.tar.gz, the tree every contract suite ran on.
• SHA256SUMS for both tarballs: shasum -a 256 -c SHA256SUMS (Linux: sha256sum -c SHA256SUMS).
• openparachute-core-0.8.0-pre.2.tgz and npm-SHA256SUMS: the npm package, tested by CI with npm i -g and
  bun add -g, with Benjamin's suite run on the npm install. It is not on npm yet: the CI publish was refused (404) because the package has no trusted publisher
  set on npmjs.com (RELEASING.md, one-time setup step 3). Until it is, npm's next stays at 0.8.0-pre.1. This file is
  byte-identical to the one the release workflow tested and will publish (its sha256 is in npm-SHA256SUMS).

Run it: unpack, then bin/parachute --help. For a host application: bin/parachute bootstrap --embedded --json,
then bin/parachute serve --embedded --home <dir> --listen 127.0.0.1:<port> --vault-listen 127.0.0.1:<port>.
See docs/PRISM.md.

On a machine with 0.7: parachute-core takeover (with --dry-run first) moves the home the old hub and vault
keep onto v0.8, keeps the old programs installed but off, and parachute-core takeover --rollback goes back. This is
a prerelease: back up a home you care about first.

0.8.0-pre.1

The first prerelease of Parachute v0.8: the vault and the hub as one program. The npm package is
@openparachute/core and the command is parachute (parachute-core is the same program under another name).

Built by CI from this tag's commit, never on a laptop:

• parachute-core-0.8.0-pre.1-darwin-arm64.tar.gz, signed ad hoc with the hardened runtime (runtime/bun with
  allow-jit only). It is the tree that embedded/bundle and Benjamin's compatibility suite passed on, on macos-14.
• parachute-core-0.8.0-pre.1-linux-x64.tar.gz, the tree every contract suite ran on.
• SHA256SUMS for both tarballs: shasum -a 256 -c SHA256SUMS.
• openparachute-core-0.8.0-pre.1.tgz and npm-SHA256SUMS: the npm package. It is tested by CI with
  npm i -g and bun add -g, with Benjamin's suite run on the npm install. It is not on npm yet; the first
  publish is done by hand (RELEASING.md).

Run it: unpack, then bin/parachute --help. For a host application: bin/parachute bootstrap --embedded --json,
then bin/parachute serve --embedded --home <dir> --listen 127.0.0.1:<port> --vault-listen 127.0.0.1:<port>.
See docs/PRISM.md.

To install it for yourself: bin/parachute install, which links parachute and parachute-core into
~/.local/share/parachute-core/bin. On a machine with Parachute 0.7 it leaves the old parachute alone and tells
you to use parachute-core. Read the README's "Install" section before using bun add -g there.

On a machine with 0.7: parachute-core takeover (with --dry-run first) moves the home the old hub and vault
keep onto v0.8, keeps the old programs installed but off, and parachute-core takeover --rollback goes back. This is
a prerelease: back up a home you care about first.