Cookrew v0.1.2

Served crews take real money — a crew you publish can now be paid for and talked to by a stranger, on either rail. Both moved real funds in testing, not fixtures: x402 settled 7.5 USDC to the author's own payTo across three Base Sepolia transfers, and Stripe reached payment_status: paid with automatic_tax: complete. Callers pay the author directly — Cookrew never holds the money and takes nothing. The Stripe rail follows Stripe's own implementation plan for this business: a pinned API version, an idempotency key on every session, the AI-service tax code, and address plus tax-ID collection so a cross-border B2B sale can take reverse charge.

A served crew answers — an orch is now required before a crew can serve, closing the door that let a crew with no orch take a caller's prompt at a bare shell. Four delivery bugs went with it: a served agent that dies now says so instead of failing silently, a served harness finds its binary however the app was launched, detaching a mirror no longer kills the agent it mirrors, and a served ask waits on the backend that actually runs it.

The phone stops dying — zooming into a terminal on a heavy workspace was killing the companion. It was creating one WebGL context per pan, not one per session: every card clears the detail threshold on a phone stage, so panning flipped the overlay and churned contexts until iOS killed the web process. With per-workspace memory budgets, layer shedding while an overlay owns the stage, incremental live transcripts and single-parse SSE, the heaviest workspace now stays under budget.

Security — the owner's home directory no longer leaves the machine in a published preset: only registered workdirs were masked before, so a home path in a note, a card name, or a command travelled under a signed "placeholders" claim. The team's own name is now scanned like any other author-written field. A served sandbox is blind to every other service and to the owner's credential stores, and Cookrew refuses to boot from inside a terminal it is itself hosting.

Known gaps — a grant that cannot work refuses after the caller pays rather than at serve time; budgets are silent until exhausted.

Artifacts — macOS dmg/zip (arm64), Windows portable + NSIS installer (preview: persistence needs herdr there), auto-update manifests.