v0.3.0

MealCircuit v0.3.0

MealCircuit v0.3.0 is the first public multi-device release: a local-first Python desktop app and a native Android app now share the same encrypted, versioned data model without making an account or a server mandatory.

Choose an asset

Platform	Release asset	Intended use
Windows x64	MealCircuit-0.3.0-windows-x64-setup.exe	Install MealCircuit.
Windows x64	MealCircuit-0.3.0-windows-x64-portable.zip	Extract and launch MealCircuit.exe without an installer.
Linux x86_64	MealCircuit-0.3.0-linux-x86_64.AppImage	Mark executable and run locally.
Android 8.0+	app-release.apk	Install directly on a device.
Android distribution	app-release.aab	Upload to Play Console or another bundle distributor; it is not a directly installable app.
macOS	MealCircuit-0.3.0-macos-universal.dmg	Install the universal desktop build on Apple silicon or Intel hardware.

The release also includes SHA256SUMS.txt and MealCircuit-v0.3.0.cdx.json. Verify the SHA-256 entry for every downloaded executable or package before opening it.

Highlights

• Native Android client built with Kotlin, Compose and Room; local records, status, tasks, food library, memories, settings, AI providers and Portable Data work without a server.
• Language-neutral Domain v1 revisions, explicit SQLite/Room migrations, managed content-addressed assets and encrypted .mcx backup/restore.
• Optional E2EE Sync v1 with self-hosted FastAPI/PostgreSQL relay, encrypted photo chunks, recovery strings, one-use QR pairing, device revocation, conflict center and staged account-key rotation.
• Desktop pywebview packaging for Windows, macOS and Linux while retaining the browser and Agent CLI workflows.
• Android release signing now explicitly declares the PKCS12 keystore format, preventing a filename or provider default from changing how the production key is read.

Upgrade and recovery

The first desktop start creates a SQLite Backup API snapshot before each schema migration and preserves legacy IDs. Export an encrypted .mcx before upgrading and rehearse a restore using docs/backup-restore.md. Android Room migrations preserve existing Domain data.

Sync is disabled by default. There is no official hosted service: deploy sync_server/compose.yaml or use another compatible Sync v1 endpoint. Losing all authorized devices and the recovery string makes the remote ciphertext unrecoverable by design.

Security and trust boundary

Remote entities and assets are encrypted on clients with AES-256-GCM and opaque HMAC-derived identifiers. API keys, recovery strings, Account Data Keys and authentication tokens are excluded from Domain data and Portable archives. This cryptographic implementation has cross-language vectors and negative tamper tests but has not received an independent third-party audit.

• Android APK and AAB assets are built only with the configured release key. CI verifies the APK with apksigner and verifies the AAB strictly against the restored release keystore and alias. The Gradle signing configuration explicitly uses PKCS12, including when the key file has a .jks filename.
• Windows portable ZIP and installer artifacts are currently unsigned. They are runnable, but Windows may display an Unknown Publisher warning until an Authenticode certificate is configured.
• The macOS app is ad-hoc signed. The DMG does not use an Apple Developer ID and is not notarized; Gatekeeper can require an explicit user override.
• The Linux AppImage is unsigned.

Those platform-signing caveats are separate from checksum verification: always compare every downloaded file with SHA256SUMS.txt.