v0.7.8

Six packages instead of four, an moca update that refuses to fight your package manager, an ACP sign-in method, and a README that claims only what the published benchmark supports.

macOS gets a package — there are six now

Release publishes linux, darwin and windows on amd64 and arm64. install.sh runs on macOS (the OS comes from uname -s; anything else is refused with a pointer at install.ps1), and moca update needed no code change at all — it composes its asset suffix from runtime.GOOS/GOARCH, so darwin was a matrix row.

This unblocks two things: a Homebrew formula (which can only install a prebuilt tarball, so without a darwin package every macOS user needs a Go toolchain) and the ACP registry, which rejects a binary distribution that does not cover darwin.

moca update refuses a copy a package manager owns

A brew-installed moca that rewrote its own binary would leave a stale Cellar entry, a broken symlink and a version brew upgrade then undoes — and homebrew-core forbids self-updating software outright. Same shape for Scoop's shims and winget's portable links.

moca update now matches the resolved executable path against those three trees (path only — no exec, no network) and prints the manager's own command — brew upgrade moca, scoop update moca, winget upgrade adeotek.moca — exiting 2. --force skips the guard; --check never reaches it, so it still answers on a managed copy.

The ACP front end advertises a way to sign in

initialize answered authMethods: [], which the ACP registry's CI rejects. It now advertises one method: id login, name Sign in, of ACP's default agent kind — not the terminal kind, which would re-run moca acp interactively rather than a login.

authenticate does real work: it runs the same credential check session/new makes, so a sign-in button reports success only when a credential really resolves, and otherwise carries the same -32603 message naming the fix. An id moca never advertised is -32602, and the response is {} rather than null.

The README says what the harness supports

The opening paragraph claimed moca "competes on cost per task". The published four-agent run says otherwise: moca was the most expensive zen agent per solved task ($0.051 vs OpenCode's $0.030) and last on accuracy (6/12). The headline is now the claims that survive scrutiny — one static binary, eight frozen tools, ~200 tokens of MCP, skills that migrate unchanged, fastest per agent-run (46 s median) — with the numbers in BENCHMARKS.md, which also states what the harness does not measure. ## Status points at the releases page instead of carrying a version string somebody has to keep current.

Also in this release: SECURITY.md, CONTRIBUTING.md and issue templates, the repository topics and description, the moca icon, a 22-second demo in the README, and scripts/release/render-acp-registry.py — the renderer that emits this agent's ACP registry entry and verifies all six archive URLs.

Full Changelog: v0.7.7...v0.7.8