v0.8.0 — Verified updates and coordinated recovery

v0.8.0 adds authenticated package updates, clearer runtime diagnostics and explicitly enabled update/recovery runners. Ordinary installation keeps automatic updates and recovery disabled.

Highlights

• Verify the original manifest's GitHub Actions provenance before v0.8.0+ package-update execution. Use a trusted preinstalled gh 2.103.3+ and independently obtained roots; unsigned historical releases require explicit manual review.
• Inspect the declared baseline, CLI binary, daemon binary and running backend separately. Add read-only local bundle inspection and bounded GitHub rate-limit backoff.
• Coordinate local watchdog and integrated external recovery through durable budgets, stop intent and unknown-result fences. Optional managed stale-socket cleanup requires prior ownership evidence.
• Add opt-in source updates with scheduling controls and transaction/recovery fences. No cron, system service or VM startup hook is installed.
• Fix new-incident cooldown confirmation when healthy external SSH/ping carries the supported prior_boot watchdog diagnostic (#75). Existing sample timing, first-success and daily limits remain enforced.
• Bound shim connection admission while retaining healthy long-lived streams, maintain pinned CI/static checks, and provide private security-reporting guidance.

Upgrade and trust boundaries

New installations retain Tailscale 1.104.4. Source-package updates do not update the Tailscale CLI/daemon pair. Older baseline installations still require the separate reviewed runtime upgrade/baseline migration.

An installed pre-v0.8.0 updater cannot enforce the new provenance policy retroactively. Authenticate the exact original manifest and all four source hashes independently before its first upgrade; retain an independent cloud recovery terminal. See the provenance/bootstrap guide and usage guide.

The ten named assets are the original verified Actions candidate, not a rebuild. SHA256SUMS covers the other nine assets. The manifest binds the four executable sources, and the original manifest and named ZIP/tar.gz archives carry portable attestation evidence. The descriptor/checksums do not authenticate themselves; independently prepare trust roots. GitHub's automatically generated Source code archive links are distinct from the named attested archives.

Validation and support scope

Source: a54688e.

• Core checks: Python 3.11/3.13 each passed 541 tests; manifest, shell and static checks passed.
• Research checks: Python 3.12/3.13 each passed 243 research and 11 lifecycle tests.
• Runtime artifact smoke and signing workflow passed.
• Independent real-signature/content/negative verification accepted the intended subjects and rejected modified bytes/signatures and wrong provenance identities. These are not live-update or universal platform tests.

The advanced self-hosted MCP path remains experimental. #45 retains cross-account and lifecycle support gates; no immediate delivery, arbitrary VM-replacement recovery or unattended-service SLA is established. Existing MCP tasks are not automatically migrated by a package installation. Broker-first/relay-second rollout is required for the explicit-health protocol, preserving integrated mail/OAuth and operating ledgers.

Release notes and operating boundaries · Security policy

Operating rollout and diagnostic follow-up (2026-10-30)

The existing private broker core and Mac observation relay were updated while preserving integrated code, policy, credentials and ledgers. One existing Dots installation completed an independently authenticated offline bootstrap from 0.7.0 to 0.8.0; manifest integrity, existing node/SSH identity, a new SSH connection and peer ping passed. Tailscale remained 1.104.4. Existing monitoring/subscription resumed; automatic package updates and new local/external coordination remained disabled. This is one normal rollout, not a VM-replacement or fault-injection qualification.

Known diagnostic limitation: the baseline classifier does not yet recognize an official backend long identifier with both -t...-g... components and can label it prerelease / nonstable_version. The raw backend version remains visible; this was observed alongside matching 1.104.4 CLI/daemon binaries and healthy connectivity. Upstream long-version formats distinguish these release-build identifiers from development builds. This classification needs a separate follow-up; the signed v0.8.0 asset bytes are unchanged.