Arveil 0.2.0 — relay and CLI

Arveil 0.2.0 — relay and command-line client

Companion relay/CLI release for client beta 6 (0.1.0+27). Built from d660f087f8252adcbdfea226029e374f2aac01b5. Arveil remains experimental, uses wire protocol 0 and has not had an independent security review.

Changes since v0.1.0

• Registered credential lookup required by QR contact cards and conversation requests.
• Personal invitations: authorized owner issuance/list/revocation, durable admission and claim receipts, quotas and replay checks. The host CLI can promote an explicitly selected existing identity with make-owner.
• Joining links and terminal QR output, with configurable link base and advertised endpoint.
• Relay, CLI and container binaries report both the release tag version and full source commit. Core/protocol versions and the already published app packages are unchanged.

Artifacts and verification

Relay and CLI binaries are supplied for Linux x86-64 and macOS Apple silicon. Download the four binaries and SHA256SUMS-cli-relay.txt; run shasum -a 256 --check SHA256SUMS-cli-relay.txt. Verify each binary with gh attestation verify <binary> --repo Ulzuhan/arveil.

Container: ghcr.io/ulzuhan/arveil-relay:0.2.0 for Linux x86-64 and ARM64, also tagged with the full source commit. Verify provenance with gh attestation verify oci://ghcr.io/ulzuhan/arveil-relay:0.2.0 --owner Ulzuhan. Run arveil-relay -version or arveil version to check the release identity. macOS CLI binaries are not Apple-notarized.

Upgrade order

Back up the realm consistently before replacing the relay. This release upgrades relay schema 4 to 5; beta 6 migrates app profiles to schema 8. Upgrade the relay before clients that need credential lookup or personal invitations. Relay v0.1.0 does not implement these operations.

Keep each backup with its matching older binary. Do not run an older binary on a migrated database. Restore into a separate directory, preserve the realm keys and highest known signed-endpoint counter, and account for changes made after the backup; prefer a forward fix. An identity kit or history import does not restore live MLS sessions.

See operation and verification, invitations and owner setup and Podman deployment.

Verification and remaining acceptance

• Required PR CI passed before merge: PR #143, CI. Tagged binary build and container build identify the release commit.
• All four downloaded binaries matched their checksum manifest; GitHub provenance was verified against the release workflow and exact source commit. macOS ARM64 binaries report 0.2.0+d660f087f8252adcbdfea226029e374f2aac01b5 (protocol 0).
• Downloaded v0.1.0 and v0.2.0 macOS ARM64 CLI/relay packages: new contact credential lookup fails on v0.1.0 and the same profile succeeds after relay upgrade; old and new CLIs exchange messages in both directions. Relay schema 4→5 preserves memberships and realm keys. Known diagnostic limitation: the new CLI against the old relay reports a WebSocket connection reset, not an explicit upgrade-required message.
• Selected distributed v0.2.0 package acceptance passes: joining links; linking/number confirmation; wrong-number, duplicate, declined and expired links; contact verification/cards; accepted and declined contact requests. Complete phase-3b enrollment/mailbox/recovery-retry assertions also pass. These use the downloaded binaries; the selected phase-3 run excludes attachment crash injection and push fixtures.
• Installed Android beta 3/build 21 on a disposable Android 15/API 35 ARM64 emulator exchanges messages before and after upgrading the relay. Its own update screen sees beta 6/build 27, downloads/verifies it and opens Android's system installer. The in-place update keeps the profile, earlier conversation history and original install time; beta 6 then exchanges new messages in both directions. The installed APK matches the published beta 6 SHA-256. No app data clearing or re-enrollment was used.
• These are package/emulator checks. Physical phones, fresh downloaded Mac app acceptance, personal-invitation trials with external people, background notification reliability and independent security review remain in their existing issues.
• Public OCI manifest access and the commit tag match were checked without registry credentials; linux/amd64 and linux/arm64 are present. The exact index digest has verified GitHub provenance: sha256:74ffed4f5688e63c22ded35877a4eca00f54c6ffea7f7890ba772e510f5f2694.

Physical Android/clean Mac acceptance, the external-user trial, suspended notification behavior and independent security review remain tracked separately. See #133, #134, #135, #136, #137 and #140. Publishing these artifacts does not certify those device or production criteria.