v0.2.5 - Chronos
Release 008 · August 9, 2026 · Current
VEX 0.2.5
Vex arrives on Windows - signed, verified, and updating itself.
A platform release. Vex now ships on all three desktop platforms: the first
Windows build joins macOS and Linux, signed and wired into the same
auto-update pipeline. Under the hood, this release also lays the complete
groundwork for AgentScan activity reporting - and deliberately leaves it
switched off. For macOS and Linux users, nothing visible changes.
01 · Vex on Windows
The Windows build is not a port; it is the same app, held to the same
release bar as macOS: signed, timestamped, and verified before anything is
published.
01 A signed installer. Vex-0.2.5-win-x64.exe is signed as
VEX LABS PTE. LTD. through Azure Trusted Signing, with an RFC3161
timestamp so the signature stays valid long after the short-lived signing
certificate rotates. Windows shows a named publisher instead of
"Unknown publisher".
02 Updates check their author before they install. From this version on,
Vex on Windows updates itself. Before an update is applied, the downloaded
installer's signature must be attributed to VEX LABS PTE. LTD. exactly, or
it is refused. This pairing gets its first real-world exercise with the next
release.
03 Every binary is verified before it ships. The release pipeline fails
closed unless the installer and every executable inside it are signed,
timestamped, and attributed correctly. An unsigned Windows build cannot be
published, the same way an un-notarized macOS build cannot.
04 What signing does not buy. SmartScreen reputation attaches to the
certificate identity and starts at zero, so early downloads may still see a
warning until reputation accrues - that is expected and fades. And a
self-custodial wallet is antivirus bait: signing sharply reduces false
positives, it does not eliminate them.
02 · AgentScan reporting, built dark
Vex's activity feed already records everything the agent does locally. This
release builds the lane that could one day report that activity to
AgentScan - and ships it fully off.
01 Off by default, and there is no default. The reporter only wakes if a
service endpoint is configured, and this release configures none. Until a
public AgentScan domain is announced, nothing is sent anywhere.
02 Privacy by construction, not by filter. A report event is built only
from named, allowlisted fields; excluded columns are never read - there is
no line of code that touches them. Registration uses a random identity
generated on your machine. Values that fail validation are sent as null
rather than silently repaired.
03 Once, and only once. Reporting diffs the activity feed against a
permanent report log, so an event can be reported exactly once, and the
money-path code gained zero hooks. Server verdicts are honored: quarantine
or revocation stops the lane permanently; only transient failures retry.
03 · Before you update
One new database migration ships in this release. It runs automatically on
first start. No manual action is required.
AgentScan reporting stays off; no new data leaves your machine in this
release. On macOS and Linux, 0.2.5 is otherwise identical to 0.2.4.
On Windows, the first install is manual - download the installer from this
release. Updates arrive automatically from then on.