QCue v1.1.0 🔓🚀 — first public open-source release (AGPL-3.0) + the first public Android APK

QCue v1.1.0 is the first public release of QCue and the point where the project goes open
source under AGPL-3.0: the full source — the LLM harness core, the idea engine, and the multi-tenant
Axum backend (qcue-rs/), plus the offline-first Flutter app (qcue_app/) — is now public, alongside
the first public Android APK, built from this very v1.1.0 source tag. Earlier 1.0.x builds
were private/internal and pre-public; the public release line starts here, from a clean, audited
history.

QCue itself is unchanged: a capture-first second brain — jot or speak a fleeting thought, a BYOK LLM
distills your stream into a linked, Karpathy-style markdown wiki ([[wikilinks]], index.md,
log.md), and a nightly Auto-Dream keeps it consolidated.

🤖 Works out of the box — the app ships pointing at QCue's hosted backend, so just sign up in-app (one tap with Google), no key needed to start.
The attached APK is upload-key (release) signed; on a sideloaded install allow "install unknown
apps." Android 7.0+. Verify the download against the attached SHA256SUMS first.

📦 Downloads

Android	iOS
⬇️ arm64-v8a APK — 23.8 MB, virtually every phone from ~2017 on (Android 7.0+). Built from the public v1.1.0 tag.	🍎 Download on the App Store — QCue: Capture Your Mind. iOS remains the functional reference (verified on iPhone 16).

Verify integrity: the SHA-256 of the asset is in the attached SHA256SUMS.

Why one arm64-v8a APK? It covers essentially every phone from ~2017 on at ~24 MB — versus a ~64 MB "universal" APK that also bundles the emulator-only x86_64 and legacy 32-bit slices. (Need 32-bit? Build armeabi-v7a yourself from the v1.1.0 source.)

---

🧭 The road here — v0.1.0 → v1.0.5 (what shipped before the public debut)

A concise recap of the private/internal builds that led to this release:

• v0.1.0–v0.1.6 — the capture-first second brain takes shape: a daily capture feed, the BYOK
  harness that distills captures into a [[wikilinked]] markdown wiki, agentic recall, and the nightly
  Auto-Dream consolidation. Multi-tenant cloud sync goes live; first Android launch.
• v0.2.0–v0.2.2 — the harness gets real tools: live web search + multi-provider tool use;
  voice capture matures (on-device STT + cloud fallback); Android reaches iOS parity (recall
  picker, capture editing, brand icon).
• v1.0.0 — first official release: Android slimmed ~64% via split-per-ABI APKs, an
  App-Bundle/upload-key build pipeline, bundle id cn.qcue.app.
• v1.0.1–v1.0.3 — sign-in hardening: Sign in with Google (native OS picker, release-signed),
  leak-proof account switching, Sign in with Apple (iOS), refreshed brand + Android themed icons.
• v1.0.4 — seamless self-updating: Shorebird code-push + an in-app updater (unified, git-derived
  build numbers across iOS & Android).
• v1.0.5 — security hardening: verified Android App Links (closing the qcue:// hijack),
  signed-APK integrity check, and a client+backend audit (cleartext guard, no-redirect HTTP client,
  per-item biometric Keychain ACL, CSPRNG magic-link tokens).

From here on, release notes will cover only the incremental changes per version.

---

✍️ Capture — never lose a thought

• 📝 Always-ready field; ideas land newest-first in a daily feed.
• 🎙️ Voice capture — on-device speech-to-text with live partials + an editable cloud-transcription fallback.
• 📤 Share-sheet ingest + 🧩 a home-screen quick-capture widget that deep-links into compose.
• 💾 Offline-first — every capture persists to local storage before the network, then flushes in
  order, idempotently. Queued captures are never evicted.

📚 Wiki — your notes, distilled

• 🧠 A BYOK LLM distills your raw stream into a Karpathy-style markdown wiki — [[wikilinks]], an
  index.md, a running log.md — fully browsable with backlinks, and editable (it re-distills to match).

🔎 Recall — ask your second brain

• 💬 Agentic retrieval over your vault (full-text + fuzzy, CJK-aware), blended with curated memory.
• 🌊 Streamed answers with inline citations + a collapsible reasoning disclosure.
• 🌐 Live web search; 🎚️ per-question model & reasoning-effort, ChatGPT-style.

🌙 Auto-Dream — it tidies up while you sleep

• 🛌 A nightly consolidation agent (Orient → Gather → Consolidate → Prune) that merges, links, prunes.
• 💸 Cost is checked before any model call; every proposed edit goes through a reversible approve/reject gate.

🎛️ Bring your own model (BYOK)

• 🔑 Your keys, your providers; 🔁 multi-provider with mid-flight fallback (DeepSeek → OpenAI → Anthropic).
• 📊 Per-day cost ledger. Cloud account sync works with no key; only notes→wiki & recall need a provider key.

🔐 Privacy & security

• 🛡️ BYOK secrets are AES-GCM in a vault, decrypted into a zeroize-on-drop key only at dispatch,
  redacted at every storage/log boundary. 👆 Biometric-gated vault reads.
• 🏢 True multi-tenant isolation via Postgres Row-Level Security — the client never sends a tenant id.
• 🔗 Verified Android App Links + signed-APK integrity check (from v1.0.5).

🎨 The app — 5 screens, 3 themes

• 🧭 Capture · Wiki · Recall · Activity · Settings, tab-preserving navigation.
• 🎨 Clean Light · Anthropic Warm · Night, switchable live, all WCAG-AA. 📲 Multi-device read-sync.

---

🔓 New in v1.1.0 — QCue goes open source

• 📜 AGPL-3.0 source release — the entire stack (qcue-rs/ Rust workspace + qcue_app/ Flutter app)
  is public, in a repository with a clean, audited, independent history (no private history exposed).
• 🤖 First public Android APK, built from this public v1.1.0 source tag (not from private
  history) and upload-key signed — reproducible from the source you can read.
• 🧾 Complete third-party notices, including the Flutter engine license sidecar.
• 🌏 Bilingual README (English / 简体中文) and full public governance docs (SECURITY.md,
  CONTRIBUTING.md, CODE_OF_CONDUCT.md, NOTICE, CHANGELOG.md).
• 🛡️ Generated only through a whitelist export workflow — ops docs, internal references, production
  configs and secrets are never exported.

✅ Verification

• 🏷️ versionName 1.1.0, versionCode 2110 — versionName is read straight from pubspec.yaml (1.1.0+110); 2110 is Flutter's standard per-ABI offset (1000×2 + 110) for the arm64-v8a split.
• 🌱 Built from the public v1.1.0 tag of SparkyWen/qcue via flutter build apk --release --split-per-abi.
• 🔐 Upload-key (release) signed (apksigner verify ✓, v2 scheme): signer CN=QCue — not a debug build.
• #️⃣ arm64-v8a APK SHA-256: 8c71e62f43b75c3f99cfec32d12df85968ba23069a85826a05cda9d9daae2af5 (also in the attached SHA256SUMS).
• 🧪 flutter analyze clean; flutter test 502 passed / 2 skipped / 0 failed.
• ☁️ Ships pointing at QCue's hosted backend by default — no server setup needed to start.

📝 Notes

• 🏪 Google Play distribution is not available yet — this APK is for direct sideload.
• 🍎 iOS is live on the App Store, not distributed via GitHub; iOS is the functional reference.
• 🔑 notes→wiki & recall need a BYOK provider key (Settings → key vault) or a server default;
  cloud account sync (Google / email / Apple) works with no key.
• 🧱 The public source is AGPL-3.0 — you can build your own APK from this tag.
• 🐛 Issues & feedback welcome on the tracker.