Civitas Desktop 2.8.0

Next Actions now sees the work you actually do

Install this over 2.7.1. Next Actions was correct but under-powered on
real capture. Profiling a real several-week local database (read-only,
aggregate shape only) showed that Civitas records about 4,000 clicks and app
switches a day, that fewer than one row in ten carries a structured artifact
such as a pull request or ticket, and that nine in ten carry a window title.
The "where you left off" source could see only the artifact rows, and its
row budget covered about one day, so the thread you actually left was
usually invisible. This release fixes that and closes the feedback loop.

• Threads are named by what you worked in. An interrupted thread is now
  identified by its pull request, ticket or document reference, then by the
  file name, then by the normalised window title. The same document seen in
  an editor and a viewer is one thread, and the card names both apps. Titles
  that are generic (Inbox, New tab, Settings), mostly digits, or address-like
  never become threads, and Civitas' own windows are ignored. The source now
  reads ten days and up to 60,000 actions, keeps only substantial sessions,
  requires work on two distinct days, and treats a thread left up to four
  days ago as still yours to return to.
• Typed commitments meet captured work. A commitment you wrote whose words
  match a thread Civitas captured shows that work on the same card: a
  "Captured work matching this" sentence, up to three captured moments as
  evidence that open the Timeline, and both sources listed. Nothing is
  created or lowered by this; it only adds evidence you can check.
• Your ratings now teach the ranker, within a bounded margin. After three
  ratings on a kind of suggestion, later cards of that kind move by at most
  ±0.08, using a Beta(2,2) posterior of how often you kept them. The rank
  explanation shows the reason ("your feedback on this kind: kept 5 of 6").
  Done and Never remain permanent; the prior only reorders what survives.
• Confidence labels are measured. Each pull writes a content-free ledger
  of what it showed (candidate id, source, label, score, rank). The local
  quality report gains a calibration section: how often High, Supported and
  Review cards were later kept. No titles, evidence or captured content are
  stored, and the ledger is deleted with the rest of your local database.
• Guarded terms are no longer charged twice. A commitment that mentions
  production, deploy, payment or contract is already forced to the Review
  label; the score penalty for it drops from 0.12 to 0.06 so ordinary
  engineering commitments are not hidden under the confidence gate.

A context-transition predictor ("after A you usually open B") was designed,
measured against real capture, and rejected: the conditional probabilities
were 0.05 to 0.20 and dominated by navigation noise, so it could not clear
the evidence gate honestly. The reasoning is recorded in
docs/NEXT_ACTIONS.md §7.

Testing

Ranker tests now run against a fixed clock so the July fixtures cannot age
into staleness and fail on a later date. New unit and route tests cover
title normalisation, cross-app thread merging, corroboration (shared tokens,
identifiers, CJK bigrams), the bounded feedback prior, the shown ledger and
the calibration report.

Platform coverage

This release is macOS only. Both architectures are covered:

Download	For
Civitas-Desktop_2.8.0_aarch64.dmg	Apple Silicon (M1 and later)
Civitas-Desktop_2.8.0_x64.dmg	Intel

Both disk images are Developer ID signed, notarized by Apple, and stapled.
Requires macOS 13.0 or later. There is no Windows build; latest.json carries
no windows-x86_64 entry.

Verifying what you downloaded

shasum -a 256 -c SHA256SUMS --ignore-missing
gh attestation verify Civitas-Desktop_2.8.0_aarch64.dmg --repo civitass/civitas-desktop
spctl --assess --type open --context context:primary-signature -v Civitas-Desktop_2.8.0_aarch64.dmg

Full Changelog: v2.7.1...v2.8.0

Civitas Desktop 2.7.1

Startup no longer waits on the network

Install this over 2.7.0. On a first run with audio enabled, or whenever the
network was slow, filtered, or offline, the "Starting local capture" screen
could sit on starting audio pipeline for up to four minutes. The engine was
waiting, twice, on a two-minute download budget for the local speaker models
(segmentation and embedding), and the setup screen deliberately suppressed its
"stuck" state while a phase looked active, so there was no way out either.

• The audio pipeline now loads speaker models only if they are already cached.
  A missing model downloads in the background and the audio loop picks it up
  on its next refresh; transcription starts without speaker labels until then.
  Startup is bounded by local work again.
• The boot phase says what is happening: starting audio pipeline — local
  speech models download in the background on first run.
• After 45 seconds in any active phase, the setup screen offers Continue
  while it finishes (setup completes in the background) and Show logs,
  without misreporting a working engine as stuck. The status line is sentence
  case, announces to assistive tech, and shows elapsed time.

The startup scene

The "upgrading your memory" animation drew every letter on a fixed grid with a
proportional font, so wide and narrow glyphs collided into a smear, and it used
fixed light grays designed for dark mode, which vanished on the light shell.
Glyphs are now laid out from the measured widths of the final words, all marks
use the theme's ink at low alpha in both appearances, and prefers-reduced- motion paints one settled frame.

Platform coverage

This release is macOS only. Both architectures are covered:

Download	For
Civitas-Desktop_2.7.1_aarch64.dmg	Apple Silicon (M1 and later)
Civitas-Desktop_2.7.1_x64.dmg	Intel

Both disk images are Developer ID signed, notarized by Apple, and stapled.
Requires macOS 13.0 or later. There is no Windows build; latest.json carries
no windows-x86_64 entry.

Verifying what you downloaded

shasum -a 256 -c SHA256SUMS --ignore-missing
gh attestation verify Civitas-Desktop_2.7.1_aarch64.dmg --repo civitass/civitas-desktop
spctl --assess --type open --context context:primary-signature -v Civitas-Desktop_2.7.1_aarch64.dmg

Civitas Desktop 2.7.0

Next Actions learns from what you actually do

2.7.0 is about the "predict the next move" half of Civitas. Until now the only
learned source of suggestions depended on an AI provider having run; without
one, Next Actions was a list of things you had typed yourself. Two new sources
work with no provider at all, entirely from local capture, and nothing here
calls a model or leaves your computer.

Where you left off. Civitas already extracts structured references — pull
requests, issues, tickets, documents, files, branches — from window titles,
URLs, and document paths, without reading what you type. When you returned to
one of those across at least two sessions and then stopped touching it for a
few hours to three days, it now appears as a card. Every card opens the exact
captured moments that produced it. An artifact Civitas cannot name honestly is
rejected, never guessed.

Decisions awaiting follow-through. A decision you were party to (spoken in
a captured meeting, or on screen with a verbatim rationale), recorded one to
fourteen days ago, with no later state change captured for its subject, asks a
simple question: did it happen? A later state change removes the card.

Both sources pass the same secret-material and sensitive-domain abstention as
every other inferred suggestion, and all the existing rules hold: suggestions
are drafts, nothing executes, ambient delivery stays off.

Fixes

• Far-ahead deadlines now surface when due. A deadline or meeting
  preparation saved more than 45 days ahead was rejected as stale precisely
  when it became due, and anything saved 3–6 weeks ahead was penalised on
  recency while it was most urgent. Freshness now follows the due time.
• Done means done everywhere. Marking a commitment done also marks the
  memory you wrote done, in the same transaction, so Memories and Next Actions
  never disagree.
• Undo. Done, Later, and every dismissal (including Never show this,
  which was one permanent click) can be reverted from an inline confirmation.
• A user-authored deadline with a single memory row can now earn the High
  confidence label; previously only explicit commitments could.

The panel

One native surface: hairlines and whitespace instead of boxes inside boxes,
sentence case throughout, one control height, a keyboard-accessible dismiss
menu, and removal that animates over 180 ms (or not at all under reduced
motion). Confirmations are inline with Undo; toasts are reserved for failures.
The last pull is kept for the session, so leaving the section and returning
does not throw it away — the surface remains pull-only.

The full algorithm, the screening of the previous implementation, and the
design decisions are recorded in
docs/NEXT_ACTIONS.md.

Dependency advisories

Twelve JavaScript advisories published since 2.6.2 are cleared: @tiptap/*
moves to 3.31.3 (mergeAttributes prototype key, GHSA-cp6q-959q-f8rh), and
the desktop app pins browserslist 4.28.9, postcss-selector-parser 6.1.4,
@xmldom/xmldom 0.8.15, and fflate 0.8.3; the MCP package pins fast-uri
3.1.7 and qs 6.16.0. Only the tiptap editor and the fflate override are in
shipping desktop code; the rest sit in build tooling or the MCP server. The
exact-Bun 1.3.10 four-lockfile audit reports zero vulnerabilities and no
exception or baseline was added.

Schema and API

• next_action_feedback is rebuilt (v4) with the two new source kinds and a
  nullable completed_memory_id; every existing row is preserved.
• POST /next-actions/feedback accepts an optional completesMemoryId with
  done and returns feedbackRowId and memoryCompleted.
• New DELETE /next-actions/feedback/{id} reverts exactly one row.
• No new network destination, permission, model download, or telemetry.

Platform coverage

This release is macOS only. Both architectures are covered:

Download	For
Civitas-Desktop_2.7.0_aarch64.dmg	Apple Silicon (M1 and later)
Civitas-Desktop_2.7.0_x64.dmg	Intel

Both disk images are Developer ID signed, notarized by Apple, and stapled.
Requires macOS 13.0 or later. There is no Windows build in this release; the
Windows leg does not run until Authenticode signing is provisioned, and
latest.json carries no windows-x86_64 entry.

Verifying what you downloaded

shasum -a 256 -c SHA256SUMS --ignore-missing
gh attestation verify Civitas-Desktop_2.7.0_aarch64.dmg --repo civitass/civitas-desktop
spctl --assess --type open --context context:primary-signature -v Civitas-Desktop_2.7.0_aarch64.dmg

Civitas Desktop 2.6.2

Fixes the crash in 2.6.0 and 2.6.1

Install this one. Both earlier releases are withdrawn: they quit
unexpectedly on macOS as soon as you interacted with the permission prompt.

2.6.1 added the localization bundle the permission UI needs, but that was only
half the problem. The dependency that loads it looks for the bundle in exactly
two places — beside the .app, where macOS code signing forbids any content,
and in the directory it was built in, which exists only on the build machine.
Neither can ever hold it in a signed, shipped application, and the dependency
treated "not found" as unrecoverable and terminated the process.

This release changes how the bundle is located rather than where it is put, so
it resolves from inside the application. It also removes the failure mode
entirely: if the bundle ever cannot be found, the permission screen falls back
to English and logs the reason instead of quitting. A missing translation can
no longer end the app.

The permission screens are now localized in 11 languages, including Simplified
and Traditional Chinese, which were shipped but unreachable before.

Also in this release: h2 moves to 0.4.18, clearing an advisory
(RUSTSEC-2026-0258) where a
peer could hold an HTTP/2 stream open with unbounded empty frames. Three
advisories in build-only JavaScript tooling were cleared too; none of those
shipped in the application.

Platform coverage

This release is macOS only. Both architectures are covered:

Download	For
Civitas-Desktop_2.6.2_aarch64.dmg	Apple Silicon (M1 and later)
Civitas-Desktop_2.6.2_x64.dmg	Intel

Both disk images are signed with a Developer ID certificate, notarized by
Apple, and stapled — the ticket is attached to the DMG itself, not only to the
app inside it, so the first launch does not need to reach Apple's notarization
service and an offline install works. Requires macOS 13.0 or later.

There is no Windows build in this release. The Windows packaging leg did
not run, so there is no .exe, no Windows updater archive, and no
windows-x86_64 entry in latest.json — existing Windows clients correctly
see no update available rather than a broken one. Windows returns once
Authenticode signing is provisioned.

Verifying what you downloaded

SHA256SUMS covers every published asset, civitas-desktop-2.6.2.spdx.json is
the SBOM, and each artifact carries a build provenance attestation:

shasum -a 256 -c SHA256SUMS --ignore-missing
gh attestation verify Civitas-Desktop_2.6.2_aarch64.dmg --repo civitass/civitas-desktop
spctl --assess --type open --context context:primary-signature -v Civitas-Desktop_2.6.2_aarch64.dmg

See docs/RELEASE_VERIFICATION.md
for the full procedure.

---

Full Changelog: v2.6.1...v2.6.2

Civitas Desktop 2.6.1

Warning

Withdrawn — do not install. Use the next release instead.

This build still crashes on macOS when you interact with the permission
prompt. 2.6.1 shipped the missing localization bundle, but the dependency
that loads it only looks for it beside the .app, where macOS code signing
forbids any content — so the lookup still failed and its failure path calls
fatalError. The fix required changing how that dependency resolves the
bundle, not where the bundle is placed.

Signing, notarization, and checksums are unaffected: the package is
authentic, the application inside it is defective.

Fixes the crash in 2.6.0

Install this instead of 2.6.0. That release traps on macOS the moment you
interact with the permission prompt, and has been withdrawn.

The app was missing a localization bundle that the permission UI loads at
runtime. The dependency that owns it calls fatalError when the bundle is
absent rather than falling back, so the process died instead of showing an
untranslated label. The bundle is now built into the app, which also restores
the eleven languages the permission screens were silently missing, including
Simplified and Traditional Chinese.

A release check now reads every resource bundle the binary expects and refuses
to publish if the app does not carry it, so this cannot ship again. Run against
the 2.6.0 build, it reports the missing bundle.

This release also clears two high-severity advisories in build-time JavaScript
dependencies (nanoid, and extract-zip via the end-to-end test tooling).
Neither shipped in the application binary.

Platform coverage

This release is macOS only. Both architectures are covered:

Download	For
Civitas-Desktop_2.6.1_aarch64.dmg	Apple Silicon (M1 and later)
Civitas-Desktop_2.6.1_x64.dmg	Intel

Both disk images are signed with a Developer ID certificate, notarized by
Apple, and stapled — the ticket is attached to the DMG itself, not only to the
app inside it, so the first launch does not need to reach Apple's notarization
service and an offline install works. Requires macOS 13.0 or later.

There is no Windows build in this release. The Windows packaging leg did
not run, so there is no .exe, no Windows updater archive, and no
windows-x86_64 entry in latest.json — existing Windows clients correctly
see no update available rather than a broken one. Windows returns once
Authenticode signing is provisioned.

Verifying what you downloaded

SHA256SUMS covers every published asset, civitas-desktop-2.6.1.spdx.json is
the SBOM, and each artifact carries a build provenance attestation:

shasum -a 256 -c SHA256SUMS --ignore-missing
gh attestation verify Civitas-Desktop_2.6.1_aarch64.dmg --repo civitass/civitas-desktop
spctl --assess --type open --context context:primary-signature -v Civitas-Desktop_2.6.1_aarch64.dmg

See docs/RELEASE_VERIFICATION.md
for the full procedure.

---

Full Changelog: v2.6.0...v2.6.1

Civitas Desktop 2.6.0

Warning

Withdrawn — do not install. Use the next release instead.

This build crashes on macOS as soon as you interact with the permission
prompt ("Grant access"). The app is missing a localization bundle that a
dependency requires at runtime, and the missing-bundle path in that
dependency calls fatalError, so the process traps instead of degrading.
Nothing is wrong with the signing, notarization, or checksums — the package
is authentic, the application inside it is defective.

This release has been marked pre-release so it is no longer offered as the
latest download. It carries no updater entry change, so existing
installations are unaffected until a fixed release is published.

Platform coverage

This release is macOS only. Both architectures are covered:

Download	For
Civitas-Desktop_2.6.0_aarch64.dmg	Apple Silicon (M1 and later)
Civitas-Desktop_2.6.0_x64.dmg	Intel

Both disk images are signed with a Developer ID certificate, notarized by
Apple, and stapled — the ticket is attached to the DMG itself, not only to the
app inside it, so the first launch does not need to reach Apple's notarization
service and an offline install works. Requires macOS 13.0 or later.

There is no Windows build in this release. The Windows packaging leg did
not run, so there is no .exe, no Windows updater archive, and no
windows-x86_64 entry in latest.json — existing Windows clients correctly
see no update available rather than a broken one. Windows returns once
Authenticode signing is provisioned.

Verifying what you downloaded

SHA256SUMS covers every published asset, civitas-desktop-2.6.0.spdx.json is
the SBOM, and each artifact carries a build provenance attestation:

shasum -a 256 -c SHA256SUMS --ignore-missing
gh attestation verify Civitas-Desktop_2.6.0_aarch64.dmg --repo civitass/civitas-desktop
spctl --assess --type open --context context:primary-signature -v Civitas-Desktop_2.6.0_aarch64.dmg

See docs/RELEASE_VERIFICATION.md
for the full procedure.

---

What's Changed

• Prepare Civitas Desktop for public local-first release by @StevenWang-CY in #1
• Clear the last log-injection alert in the perf harness by @StevenWang-CY in #2

New Contributors

• @StevenWang-CY made their first contribution in #1

Full Changelog: https://github.com/civitass/civitas-desktop/commits/v2.6.0