v0.3.0

Python and embedded Linux. On-remote format unchanged (bothy_format = 1). The Python
package (bothy on PyPI) and the Flutter package have their own changelogs.

Added

• bothy-oauth: the Google OAuth helpers (loopback sign-in with PKCE, device flow, token
  refresh, revoke, a keyring/file token store and a refreshing AccessTokenProvider), moved
  out of the CLI so other front ends can use them. The CLI uses it; its behaviour is unchanged.
• crates/bothy-ffi (not published): the start of a C ABI with a cbindgen header, for
  embedding the engine in C and C++ programs.

Changed

• The default Argon2id cost for new key files is 64 MiB, 2 passes, 1 lane (was 3 passes),
  bothy::crypto::DEFAULT_KDF_COST. Three passes took 1.09 s per unlock on a Cortex-A53
  board. Existing key files keep the parameters stored in them.

Fixed

• The blocking API's runtime had no IO driver, so Drive requests from it (the Python
  binding) panicked.

Security

• ctutils 0.4.5 in the lockfile (RUSTSEC-2026-0385), which cargo install --locked bothy-cli uses.

Packages

• crates.io: bothy, bothy-cli, bothy-oauth
• PyPI: bothy 0.3.0, abi3 wheels for CPython 3.9+ on Linux (x86_64, aarch64, armv7), macOS (universal2) and Windows (x64); see bindings/python/CHANGELOG.md
• pub.dev: bothy 0.3.0; see bindings/flutter/CHANGELOG.md

Tested end to end on an arm64 board (4x Cortex-A53, Ubuntu 22.04, ROS 2 Humble): the robot agent in examples/pi-agent took a mission from the Flutter demo, synced 48 hours of offline telemetry (2,880 records) without loss, peaked at 28 MiB while syncing, and bridged missions and telemetry to ROS 2 topics.