v0.1.0-alpha.14

Gateway 0.1.0-alpha.14 (hub ADR 010: setup without a cable).

• factory-provision and label: factory-provision PORT --device ID --gateway NAME[:PORT] runs a relay preflight, checks the board, and writes the device token, relay name and port, CA, a per-device hotspot passphrase and a setup code over USB, with no Wi-Fi details. It prints the setup label and writes it as text, a WIFI: QR PNG and a printable SVG; label ID reprints it (#158). New dependency: segno 1.6.6.
• Both MCP eras: rehearse calls the six tools with initialize and with the 2026-07-28 server/discover era (--protocol); request-log lines carry protocol; sign-in metadata states client_id_metadata_document_supported: false; docs/daily-use.md says what to do if Grok Bot stops connecting (#175).
• Relay port and DNS preflight: new relays default to device port 8444 (Cloudflare proxies 8443); relays and gadgets already on 8443 keep it with :8443. relay-check NAME[:PORT] refuses a proxied record and checks the relay CA on the port; wifi-provision --gateway runs it first (#177).

On 14 October 2026 the owner factory-provisioned one ESP32-S3 OLED kit with this code, then joined it to home Wi-Fi from an iPhone and from an Android phone with the computer closed. It went Online through the relay, and Grok Bot on the iPhone showed text on it (hub record). One kit; nobody else has repeated it yet.

Assets are attached by the release workflow: wheel, source archive and SHA256SUMS.

Grok Gadgets Gateway v0.1.0-alpha.13

Gateway 0.1.0-alpha.13 (hub ADR 009, stage 1: Mac-free route).

• Relay device listener: serve --device-listen ADDRESS[:PORT] (port 8443, off unless set) runs a TLS device listener on an always-on host. It has per-address and global limits, logs device_* lines and never logs a token (#154).
• DNS names: device-cert NAME issues the relay certificate; wifi-provision --gateway NAME[:PORT] --ca FILE provisions a board for a relay (#155).
• Relay host: examples/docker and docs/relay-host.md, with a container route and a Linux user-service route (#156).
• usage --calibrate 0 now saves nothing.

Evidence: on 13 October 2026 the owner's ESP32-S3 OLED kit connected to this listener on a small Linux server. Grok Bot on the iPhone, on cellular, showed text on it while the Mac slept. Server reboot, remote off, revoke, re-enroll, re-provision and a wrong CA also passed (hub record). The run used one kit and one server, and no second person has repeated it. The board needs ESP32 SDK 0.2.0-alpha.14 or later for a DNS gateway name.

Assets: wheel, source archive and SHA256SUMS from the release workflow.

Grok Gadgets Gateway v0.1.0-alpha.12

Grok Gadgets Gateway v0.1.0-alpha.12 makes the Grok Bot route safe to leave on.

• Sign-in floods cannot lock you out: unused registered clients are pruned, waiting sign-ins drop the oldest (2 per client), and registration, refresh and page requests have separate per-caller and total budgets. A hit limit writes one oauth_flood line a minute (#144).
• The request log and the service log rotate at 5 MiB and keep 5 files; usage reads the rotated files (#145).
• service status shows the allowed host, --oauth, the kill switch, live sign-ins, the last remote call and any recent sign-in flood (#146).
• docs/daily-use.md: the tunnel client as a user service, a daily check, sleep settings and floods. service install --usage-hook passes a hook to the service, and examples/usage-hooks/macos-notify.py posts a local macOS notification for each remote call (#147).

Evidence: software tests only for these changes. Daily use through a fixed hostname is being recorded in hub #251. Native Grok Bot calls were recorded once on 13 October 2026 with alpha.11 (hub ADR 007).

Install: pip install --pre grok-gadgets-gateway. Files and SHA256SUMS are attached by the release workflow.

Grok Gadgets Gateway v0.1.0-alpha.11

Grok Gadgets Gateway v0.1.0-alpha.11 lets your existing Grok Bot call your gadgets itself, from the Mac and the phone.

• serve --oauth makes the gateway its own OAuth sign-in server behind a tunnel you run. Grok Bot adds the server from chat with only the URL; you approve each sign-in on the Mac with grok-gadgets-gateway oauth approve CODE --name grok-bot. No password or token is typed into a page or a chat (#71). Guide: docs/tunnel.md.
• Tunnel hardening: remote requests need a named token or sign-in, grok-gadgets-gateway remote off is a kill switch, --allowed-host requires the request log, and the device port refuses HTTP (#130).
• Usage tracking: per-call bytes, grok-gadgets-gateway usage by token, device, capability and day, an opt-in --usage-hook, and estimates that are always labelled (#132). Guide: docs/usage.md.

Evidence: on 13 October 2026 the owner's Grok Bot called the six tools natively from the Mac and the iPhone through this release's code; the gateway log recorded nine calls and the owner saw the OLED text (hub #154, ADR 007). One owner setup; not independently reproduced.

Install: pip install --pre grok-gadgets-gateway. Files and SHA256SUMS are attached by the release workflow.

Grok Gadgets Gateway v0.1.0-alpha.9

Grok Gadgets Gateway v0.1.0-alpha.9 keeps the simulator away from your real devices.

• serve --simulator and stdio --simulator without --credentials serve only the simulated light. They never read your device registry and open no device port, so the five-minute first success runs even beside a gateway you already use. Add --credentials to serve enrolled devices as well (#96).

No protocol change. Native Grok Bot MCP calls are not verified. Install from the attached wheel or source archive; SHA256SUMS covers both. Not on PyPI yet.

Grok Gadgets Gateway v0.1.0-alpha.8

Grok Gadgets Gateway v0.1.0-alpha.8 makes first-time setup friendlier.

• wifi-provision opens the serial port and checks the board's device ID before it asks for the Wi-Fi name and password. Ctrl-C or end of input prints "Cancelled; nothing was sent to the board." (#98). Checked on the owner's kit.
• stdio and serve stop with a one-line message when the device port is taken ("Another gateway may be running") instead of a traceback. The simulator demo never loads your real devices (#96).

No protocol change. Native Grok Bot MCP calls are not verified. Install from the attached wheel or source archive; SHA256SUMS covers both. Not on PyPI yet.

Grok Gadgets Gateway v0.1.0-alpha.7

Grok Gadgets Gateway v0.1.0-alpha.7 is a maintenance release.

• grok-gadgets-gateway --version prints the version and exits (#17).
• A hand-started release packages workflow builds each release, writes SHA256SUMS with plain file names and checks it, so shasum -a 256 -c SHA256SUMS works right after gh release download (#90, hub #151). It can also publish to PyPI through trusted publishing; the package is not on PyPI yet.
• Tests run with a private home directory, so they pass beside a running gateway and never read your credentials (#88).
• Docs match the 12 October evidence: one owner ESP32-S3 kit passed over USB and Wi-Fi, and Grok Bot ran approved rehearse commands. Native Grok Bot MCP calls are not verified.

No protocol or runtime change beyond --version. Install from the attached wheel or source archive; SHA256SUMS covers both.

Grok Gadgets Gateway v0.1.0-alpha.6

Grok Gadgets Gateway v0.1.0-alpha.6 lets Wi-Fi gadgets reach the gateway on your home network:

• serve --lan-listen ADDRESS[:PORT]: an opt-in TLS device listener (port 8767) on one private IPv4 address of this computer. It is off unless set, refuses all, loopback, shared and public addresses, accepts private peers only, and limits sessions, handshakes, new connections and frame rate.
• init creates a local CA. New commands: lan-cert, lan-ca show|rotate and wifi-provision (USB serial provisioning; the Wi-Fi password prompt does not echo, and the password and token are never printed or stored by the tool).
• Same protocol 0.1.0 frames and device tokens as USB; revoke ends a live Wi-Fi session on its next frame.
• The request log records LAN connects, hellos, rejected tokens, TLS failures, rejected peers and rate limits, without tokens.
• Closing a vanished TLS device no longer prints a traceback.

The ESP32-S3 OLED kit passed physical acceptance over Wi-Fi through this listener on the owner's kit on 12 October 2026 (record). Grok Bot reached it through the documented local rehearse route. Native Grok Bot MCP calls are not verified. Guide: docs/wifi-devices.md.

Install from the attached wheel or source archive. SHA256SUMS covers both package files.

Grok Gadgets Gateway v0.1.0-alpha.5

Grok Gadgets Gateway v0.1.0-alpha.5 adds the pieces for evidence-first Grok Bot tests and a future remote route:

• serve --request-log PATH and stdio --request-log PATH: an opt-in, mode-0600 JSON line per tool call (time, client name, token name, tool, device, command, non-secret arguments, result). Tokens are never written.
• Named MCP tokens: mcp-token issue|list|revoke, stored as hashes and applied without a restart.
• Per-token limits on tool calls, commands, open requests, body size and request time.
• docs/tunnel.md: an owner-run TLS tunnel guide. It is untested with Grok Bot.
• rehearse identifies itself as grok-gadgets-rehearse.

The six Grok Bot tools and the device protocol are unchanged. In the 12 October owner test, Grok Bot ran approved local rehearse commands and the request log recorded them. Native Grok Bot MCP calls and physical devices are not verified.

Install from the attached wheel or source archive. SHA256SUMS covers both package files.

Grok Gadgets Gateway v0.1.0-alpha.10

Grok Gadgets Gateway v0.1.0-alpha.10 keeps your Wi-Fi gadget connected without a terminal.

• service install|uninstall|status|logs runs serve as a per-user background service: a launchd agent on macOS, a systemd user unit on Linux. It starts at every login and needs no administrator rights. Guide: docs/always-on.md (#109).
• lan-cert, serve --lan-listen and wifi-provision --lan accept your computer's mDNS name, such as my-mac.local. The certificate names only the name, and serve follows the computer's address when it changes (#110). Boards need ESP32 SDK v0.2.0-alpha.12 for names.
• Fixes: service status reported a running agent as stopped (#113); the macOS agent now runs as a standard process (#115).

On 12–13 October 2026 the owner's Mac and OLED kit passed name, two address-change and restart checks (docs/verification/always-on-2026-10-13.md). Linux systemd is not yet tested on a real host. Native Grok Bot MCP calls are not verified. Install from the attached wheel or source archive; SHA256SUMS covers both.

13 October 2026 update: grok-gadgets-gateway 0.1.0a10 is now on PyPI. The existing release tag and attached files are unchanged.