v0.2.0-beta.9 — Android asset diagnostics and manual update feedback

Beta.9 adds Android native asset-stage diagnostics and foreground manual-update feedback. It preserves the original update timeout/retry/cache, CAS slot, automatic/background silence and page adoption/reload decisions. It does not change renderer, host or Go behavior.

• Observe each network UI asset's existing refresh trace, digest prefix, bytes, header/body/verification/storage stage and fixed failure class. No URL/body/cookie/prompt/raw error text is persisted; broken diagnostics cannot alter the original result or cleanup.
• Show manual foreground busy/latest/ready/failure feedback. Public Android source209/0.2.0-beta.9 retains org.bettercodex.android, configured HTTPS origin and the existing expanded privacy contract.
• Six actual Native/Robolectric suites37 tests, zero failures/errors, one explicit conditional resource skip. The bound public unsigned Android build succeeds; all194 packaged bytes/SHA, packaged privacy contract and package/version were verified. Source manifest320 entries/five frozen source bindings. Beta.8 SDK309/host/Go remain unchanged baseline, not newly claimed phone tests.

Separate private maintenance acceptance published signed APK73 and UIcf after preflight, verified the complete8,226,811-byte APK digest, eight resource200s and SSO protection. In-place upgrade retained five process records/4,836,130bytes exactly. The first10-second upgrade capture still showed loading; body appeared later. The second cold open's gate ended5.608s and10-second capture showed body/process/input, with same-page networking recovery. Native37 and final-shell SDK63+runtime7 passed separately. No public-release task submitted a real model prompt or touched the private runtime/AVD.

The new logging does not establish a cure for the prior45-second asset failure. The physical phone's last observed page remains the preceding old UI; natural phone latency/upload/power/OEM and the historical30-second missing-hop cause are not closed. Private APKs/UI/signatures/accounts/OTA publishers are excluded; public Android is self-built for your own HTTPS origin and signing key. README and installation entry stay unchanged.

Assets: Mac installer source ZIP, project source archive, patched OpenCodex2.1.0 AGPL corresponding source and SHA256SUMS. Official renderer bytes are acquired and verified locally by the adopter, never distributed. Beta.8 and beta.7 tags/assets are unchanged. Release is created as an empty draft, frozen assets uploaded individually and digest-checked before publication.

Before publication, the one conditional fixture gap was filled by the actual final public UI package9a0e00f9830550ef. Its real Java manifest/shell/file verifier passed one targeted case with zero skips. The original37-test/one-skip receipt is retained; combining that original run and this follow-up verifies37 distinct cases with no remaining skipped case. Source/tag/APK/archive bytes were not changed for this supplement.

v0.2.0-beta.8 — Home preparation overlap and actual lane diagnostics

Beta.8 overlaps the same-attempt SDK codex-home query with the Native head read and adds privacy-preserving actual invoke-lane diagnostics. It preserves the original Hls/Vls error/worktree checks, authenticated identity/head fencing, sandbox/writer rules and existing Fast checker. Rejected Fast-early v1/v2 experiments are excluded; actual jan bytes match beta.7.

• The exact original home query starts early only for eligible local idle preparation, joins at its existing node and is consumed once. Missing/changed identity, active/queued/nonlocal or other ineligible requests use the original path.
• Actual Runtime WS/HTTP invoke and hello-ack log their outer lane through the existing metadata contract, without changing dispatch, retry, queue, errors or exposing prompt/credential/URL bodies. The prior public post-ACK empty-queue adapter and expanded method whitelist remain.
• Actual locally generated SDK309 checks pass with zero skips (Home10, runtime/privacy7, producer/config29 including late Fast refusal, startup/profile/read24). Core234 passes with41 explicit missing-SDK skips; host13/full Go, Android bound build and independently owned empty-account HTTP/IPC/AppHost43 pass. Source SHA manifest binds319 files. The controlled actual old/new SDK comparison injects1.4s head+1.6s home: serial3000ms→overlap1600ms with one producer each; these are virtual delays, not physical-phone speed.

Separate private maintenance acceptance used normal Android Settings update. Its first manifest parsed, then the asset stage failed after45s; a second explicit ordinary update adopted the new UI without pinning or clearing data. The failure is retained; the updater is not declared fully repaired.63 actual WebView cases and seven complete formal resource hashes passed. A fixed offline restart reached its gate at5.814s; body, observed tool process and input were visible at10s, and body updates continued after networking returned. No real prompt/model turn was sent. Native/Front/APK/PWA remained unchanged. This limited evidence is not a physical-phone or public clean-install guarantee.

Natural ACK9.732s/preparation7.101s belongs to the older private UI. New lane logs support later attribution; historical30s failures still lack the hop evidence. Natural phone send/upload latency, sustained power/OEM background lifecycle and full all-route offline behavior remain unverified. README product text is unchanged; Android is self-built for your HTTPS origin/signing, and private OTA/coordinator/CLI deployment services are excluded.

Assets are the Mac installer source ZIP, project source archive, patched OpenCodex2.1.0 AGPL corresponding source and SHA256SUMS. Official resources are locally acquired/verified and not redistributed; no private SDK, production APK, signing key, credentials or conversation data is included. Static and specifically required startup edges are checked (194resources/443edges); optional routes remain demand-loaded and600-file/100MiB budgets remain. Beta.7 tag and assets are unchanged.

v0.2.0-beta.7 — Native-local startup and send configuration

Beta.7 synchronizes Android Native-local startup gating and complete configuration reuse within one send attempt. Optional cloud identity/loading no longer blocks the eligible local route; authentication, settled denial/error, sandbox and writer checks remain unchanged.

• Reuse a complete cached configuration once only with matching scope, front epoch, Native generation, request/thread/cwd/head identity. The portable host advertises its measured scope-global producer; missing or changed identities fall back to normal reads.
• Add bounded startup diagnostics and actual-SDK regressions. Core: 234 passes, 24 actual-SDK-required skips when no SDK is supplied. Locally generated public SDK: 292 passes / zero skips, including 29 real producer/config and 24 startup/profile/reading-gate cases. Android source builds against the generated bundle; host contracts13, full Go suite and independently owned empty-account entry43 pass.
• Update English/Chinese installation links to explicit Releases, including prereleases. Public Android remains self-built for your own HTTPS origin and signing key; the private production OTA publishers are not installed by the public host.

Separately, private maintenance acceptance used the actual Android APK update path and 47 WebView checks. One fixed historical conversation restored body, observed tool process and input around six seconds during emulator offline cold start (metadata gate5.946s; screenshot confirmed at10s). The formal Web entry showed body, thumbnail and usable input. This scoped evidence is not a zero-delay, physical-phone, arbitrary-conversation, all-route offline or public clean-install guarantee. Phone2.1/2.5s sends came from the preceding UI, not this version; the older30s natural failure still lacks the necessary stage log. Natural send latency, physical-phone/OEM lifecycle, sustained power and complete offline behavior remain unverified.

Assets include the Mac installer source ZIP, project source archive and patched OpenCodex2.1.0 AGPL corresponding source, with SHA256SUMS. Official renderer resources are acquired and verified locally by the adopter and are not redistributed; no production APK, credentials, signing keys, private transcripts or raw diagnostics are included. The source manifest binds315 files. Static and specifically required startup dependencies are checked; optional routes remain demand-loaded. Existing600-file/100MiB budgets remain. Prior beta.6 tag and assets are unchanged.

Better Codex v0.2.0-beta.6 — Required Android startup resources

Beta.6 fixes a missing required Android startup resource branch and rejects packages that omit required targets.

The collector now follows static ESM/CSS dependencies plus the explicitly required literal work-mode-access-splash lazy startup branch, including its static access-splash dependency. Four focused checks cover missing dynamic/static targets, module aliases and the optional-route boundary. Optional route modules remain demand-loaded. This is not complete all-route/all-dynamic offline closure; the existing 600-file/100MiB budgets have not expanded.

Actual resource evidence: the previous 192-file public bundle is rejected for its missing work-mode target. The locally generated candidate has 194 declared files/443 required edges, adding only two small modules (1938+1806bytes), each SHA/byte-equal to the locally acquired pinned resource. Initial and scope SDK bytes stay beta.5's values. Public core231 pass with three SDK-required skips; actual generated-module239 checks pass with no skips; host/auth13, full Go suite, bound Android release build and actual independent empty-account host43 checks pass.

The private maintenance owner reports UI-only canonical deployment983097bedb07daf1, normal in-app update adoption, 13 formal resource hash checks, unchanged APK72/SDK1167/cache code, and two local process turns/17 items retained after forced restart. In real 35-second offline comparisons, the old192 bundle showed the exact missing dynamic-import/ChatGPT error page; the new194 bundle showed no new instance of that dynamic-import error but still waited for connection and did not display the complete conversation.

Complete offline first-screen and startup speed remain unaccepted. Remaining startup/connection waiting, physical-phone behavior, natural long-send latency and sustained power are not closed. This version only repairs the required startup branch and rejects missing packages; stored-process or resource-hash success is not an offline first-screen result.

README and beta.5/tag/assets remain unchanged. Four immutable assets provide the portable Mac installer/source ZIP, Better Codex source, complete pinned modified OpenCodex corresponding source (AGPL), and SHA256SUMS. Official renderer bytes, private APKs/signatures, credentials, conversation data and raw logs are not redistributed. See docs/portable-validation.md for the detailed, separate evidence layers.

Better Codex v0.2.0-beta.5 — Canonical history and local body adoption

Beta.5 fixes the canonical-history argument passed to the real SDK reader and the guarded adoption of a first local body.

getLoadedConversationHistoryTurns requires conversation.turnHistory.history. Passing the conversation object caused an actual TypeError(flatMap) and prevented the observed reasoning/tool process from being persisted. The corrected helper saves/restores process items with the SDK's canonical history object. The Android transform allows a genuinely empty local view to adopt a cached body while retaining a newer live metadata head; existing live bodies, cancellation, rewrite and normal stale-history guards remain authoritative.

Evidence is kept separate:

• No SDK supplied: 16 contract checks pass and three actual-SDK tests are explicitly skipped. Full core: 227 pass, those three SDK-required skips. Bad SDK input does not fall back silently.
• Actual locally acquired SDK: 19 direct bindings pass; the beta.4 old cache reproduces the real TypeError.
• Exact public-generated initial/scope/import-map modules: 239 checks pass with no skips, 192 declared-resource hashes and the existing static-import checks, and the bound Android release builds. Host/auth contracts13, full Go suite and the real independent empty-account host43 checks pass.
• The private maintenance owner reports real APK72/UI ee166 tool/image progress and two Native SQLite process turns (7 and 10 items) retained after forced termination, with 50 actual WebView and 11 formal resource checks. That is SDK/persistence evidence, not offline startup acceptance.

Complete offline cold startup is not solved or accepted in this release. An eight-second private offline cold open still waits for a connection and remains under investigation. Physical-phone behavior, natural long-send latency and sustained power have not been fully accepted. A script's persistence passed result does not establish that its offline first screen passed.

README remains unchanged. Beta.4 and earlier tags/assets remain immutable. The four beta.5 assets provide the portable Mac installer/source, Better Codex source, complete pinned modified OpenCodex corresponding source (AGPL), and SHA256SUMS. Official renderer resources, private APK/signature, credentials, conversation data and raw logs are not redistributed. Consult docs/portable-validation.md for the detailed acceptance layers and current limits.

Follow-up diagnosis after this immutable candidate was committed: the legacy Android packager does not collect every literal dynamic import, and its old pruning checker does not prove every target exists. A private offline trace identified a missing work-mode access splash module. This is a separate pending resource-collector fix; beta.5 does not claim complete dynamic-import closure or full offline startup.

Better Codex v0.2.0-beta.4 — Legacy directory migration fix

This is a minimal server-cache upgrade correction to beta.3.

A cache with user-directory-source-v1 already recorded could skip the once-only scan for newly recognized lowercase/serialized/parent-bound noninteractive agent catalog entries. The migration now records user-directory-source-v2 after retiring only those derived directory projections. Original child history, parent records, source/thread generations and command ownership stay intact. The first upgrade is transactional; subsequent cold opens do not republish tombstones.

The regression uses a real legacy SQLite schema with v1 present throughout, three old child source shapes and original bodies, plus a real accepted command Journal. Beta.3 reproduced the unchanged visible catalog; beta.4 passed exact row/receipt/ownership preservation and repeated-reopen checks. No marker was cleared to stand in for an upgrade. The published beta.2 code had no v1 marker itself; this fix covers older/intermediate caches where v1 has already been written.

Validation for this patch: 28 focused upgrade/agent cases, 221 complete core assertions, 13 host/auth contracts, full Go suite, and 43 real independently owned empty-account host/resource/IPC/AppHost checks. Actual runtime readback contains both the retained v1 and new v2 markers. Android and generated renderer code are byte-unchanged from beta.3; their prior acceptance is retained, not rerun or represented as a new device/model/power test.

Beta.3, its tag and assets remain unchanged. The four beta.4 assets are the Mac installer/source ZIP, Better Codex source, complete pinned modified OpenCodex corresponding source (AGPL), and SHA256SUMS. No official renderer, account/runtime data, production APK/signature or private history/log is redistributed. Refer to docs/portable-validation.md for retained device and latency limits.

Better Codex v0.2.0-beta.3 — Maintained Android and local-first core

This beta synchronizes the maintained local-first workbench core and adds a configurable Android source build. Android foreground/pinned/recent-20 reads and deep archives have separate priorities; unchanged complete histories retain body witnesses across reopen, observed process state is read locally before the first hydrated frame, and agent details remain accessible by explicit scoped ID without entering the main directory or warm sets.

The generated renderer now consumes the current send preparation, same-attempt configuration, post-ACK queue, draft/navigation ownership, Fast preference and full-image patches. The Native boundary accepts the current single-local-environment reply shape while preserving remote/cross-workspace rejection and request idempotency. Metadata-only diagnostics cover queue/HTTP/body/parse/wire stages with aligned collector whitelists.

The English and Chinese README have been rewritten around native execution, the official renderer, local-first continuity, project plugins and the current showcase. Mac/Tailscale and optional authenticated CVM access remain supported. Android uses a separate application ID and an adopter-supplied HTTPS origin, generated UI and signing key.

Validation: 224 Android Java tests with zero failures/errors (two existing conditional skips), release build; 230 final generated-renderer assertions; 220 core checks; 13 host/auth/plugin contracts; full Go producer-consumer suite; three real Android WebView send/slow-read/reconnect cases; 43 real independent empty-account local-host checks; and nine real local Caddy HTTPS/WebSocket checks.

The Mac ZIP contains the portable installer and source, not a preinstalled account/runtime. The two source archives provide Better Codex and the complete pinned modified OpenCodex corresponding source (AGPL). SHA256SUMS records asset hashes. No official renderer resources, production APK/signing material, credentials, private transcripts or diagnostic logs are redistributed.

Physical phones, Tailscale pairing, Android HTTP Basic handoff, real cloud DNS/tunnel deployment, signed-in model execution, natural send latency and sustained battery behavior remain unverified. See docs/portable-validation.md and docs/android.md for exact boundaries and build instructions. This release does not claim that every private-app regression or occasional long-send cause is resolved.

Better Codex v0.2.0-beta.2 — CVM access and client continuity

Better Codex now supports two access routes to the same Mac host: private Tailscale Serve, or an authenticated CVM HTTPS domain with a reverse SSH tunnel. Each installation selects one mode; execution and project credentials remain on the Mac.

• New better-codex cvm command generates a private Caddy site, proxy proof and loopback tunnel script, with a backup of the stopped installation's configuration. It does not remotely change a cloud server, DNS or firewall. Follow CVM deployment.
• Fixes portable startup with a validated HTTPS origin, including the Tailscale route.
• Send/create completion callbacks remain bound to the original conversation after navigation. Cached projects and pins are ready before the first sidebar; a restored list avoids a second loading-logo stage.
• Official renderer import maps preserve one identity for shared modules across resource prefixes, avoiding duplicate initialization.
• Plugin capabilities use a separate header that preserves HTTP Basic login through the CVM.

Download Better-Codex-v0.2.0-beta.2-mac.zip, extract it to a stable location and double-click Install.command. Install and sign in to the official Codex desktop app first. Existing installations: stop the host, use this source checkout, then run its installer/update workflow as described in installation.

Validation: 13 Node boundary tests; 43 checks through the complete portable host and real certificate-verified Caddy HTTPS, including AppHost WebSockets/reconnect, renderer resources, relay and plugins; 14 focused checks against the generated public renderer. An Android WebView fixture reproduces the old duplicate-module error and passes the normalized module map. No model turn or conversation-history write was used. Earlier clean installation and system-tools-only Node/Go bootstrap evidence is retained for the unchanged installer and dependencies.

This remains a beta. Physical phone/PWA behavior, live Tailscale between devices, external CVM DNS/certificate issuance and sustained SSH, Intel startup, and signed-in model execution in the clean portable install remain unverified. The portable CVM profile keeps its rebuildable sync cache on the Mac; it does not install a separate cloud cache. The public mobile client is a PWA, not an Android APK.

Official application assets, account credentials, private deployment data and raw session logs are excluded. The unchanged opencodex-2.1.0-better-codex-source.tar.gz provides complete modified AGPL source, license, lockfile and build instructions. SHA256SUMS.txt covers both archives.

中文：本次补齐 CVM + Mac 与 Mac + Tailscale 两种入口，并同步缓存首屏、发送后切换会话的回调归属及模块重复初始化修复。现有私人部署不因公开发行而切换；真机、外网部署与登录后模型执行仍需各自验收。

Better Codex 0.2.0 beta — Portable Mac host

Run Better Codex on your own Mac, with optional private Tailscale access from a phone. A cloud server is no longer required.

• A Mac installer prepares verified local Node/Go dependencies, a Native host, the official renderer integration, the front and the local sync relay.
• Workspace roots, names, read policies and project plugins are configurable. Plugin content and writes remain owned by the source project.
• The current core includes the optional-cache improvements, automatic-title service and stale resume-path repair.
• Existing Serve routes are protected. The entry uses an explicit Tailscale login allowlist and does not enable public Funnel.
• Doctor, stopped-host update checks, configuration backups and a source offer for the modified AGPL component are included.

Download Better-Codex-v0.2.0-beta.1-mac.zip, unzip it to a stable location and double-click Install.command. Install and sign in to the official Codex desktop application first. Keep the host terminal open after startup. The first installation downloads dependencies from their original distribution hosts.

For phone access, install and sign in to Tailscale on both devices, stop Better Codex, then run:

"$HOME/.better-codex/better-codex" tailscale --enable
"$HOME/.better-codex/start"

Open the printed HTTPS URL. See the repository's installation and plugin guides for custom configuration.

Validated on Apple Silicon with official desktop 26.928.20755 / build 12246, pinned renderer 26.901.51231 / build 8109, and OpenCodex 2.1.0. Fresh cold startup, 43 real local HTTP/WS and reconnect checks, six installation checks, Node boundary tests and the exported Go suite pass. A separate run bootstraps Node and Go with only macOS system tools in PATH.

This is a beta: physical phone/PWA behavior, live Tailscale between devices, Intel startup and signed-in model execution in the clean portable install are not yet verified. The public mobile client is a PWA; this release does not include an Android APK. Official application assets, account credentials, private deployments and session data are not redistributed.

opencodex-2.1.0-better-codex-source.tar.gz contains the complete modified AGPL source, dependency lockfile, license and build instructions. SHA256SUMS.txt covers both downloadable archives.

中文：本版本可在自己的 Mac 上部署，通过 Tailscale 私有访问，无需 CVM；支持工作区、只读策略和项目插件配置。下载 ZIP 后双击 Install.command，按仓库中文说明操作。当前为 beta，真机、TailScale 实网、Intel 和干净安装登录后的模型执行仍保留验收缺口。