0.2.0 — Identity v3: one identity, from the sign-in door to the served door

Your account is now the only thing that speaks for you — on a second Mac, at a served door, and on your own Wi-Fi.

What you can do that you could not

• Use your account on a second Mac. Sign in with your username and password, or take an eight-character code from a device you already hold. The old build could only offer to claim a new name, and told you your own username belonged to somebody else.
• Buy a seat once. A seat bought on the web admits the desktop with no second payment, because the desktop now identifies as your account at a listed door instead of a key it minted for itself. The marketplace no longer enrols browsers at all.
• Answer everything in one place. A device asking to join, a phone asking for your Mac's Wi-Fi, and a guest asking for a seat all arrive in the same queue, answerable from any device you hold. Approving a join asks for the number shown on the asking machine.
• Revoke and mean it. Revoking a device ends its access at the account, at every door, and on the Wi-Fi of every Mac — not just in a list.
• Stop losing your doors on the thirtieth day. The session renews on the device key. The password becomes a threshold for the acts that need one: changing it, removing a factor, revoking another device, minting a join code, taking over a door.

Also in here

Leaving an account on one Mac without touching the canvas. Device names you can tell apart. Doors that follow an account claimed after startup. A lock screen that says who is waiting.

What the reviews caught

A branch review blocked this release with one CRITICAL and eight HIGH findings, all fixed before it shipped. The CRITICAL: a step-up threshold the asking session could cross by approving its own request. Also fixed — two ways a revoked device kept access, an event feed a stranger could flush, an APPROVE button that was dead and deleted your own pending sign-in after three taps, and two hardcoded production addresses that made isolated testing impossible.

A pass on the real interface found the approval request was invisible on a first run: the poll was started once at launch, before there was an account to poll for.

Verification

8386 tests, none failing. Typecheck clean. The end-to-end script runs against a real registry with two accounts standing in for two Macs.

Known

Four product decisions ship without a ruling and are named in PR #88. The Windows build remains a preview: agents do not survive a restart there, by design, because the terminal multiplexer it needs does not exist on Windows.