Konclave v0.7.0

The app

Security

• A device could be made to sign a payment other than the one on its screen. Before it signs,
  each device works out for itself what the transaction is, and refuses a request that names a
  different one. In the second step of a signature the device receives a package from the member
  coordinating the round, and it checked the label on that package and not the package. The label
  and the contents travel as two separate things, and the signature is made over the contents. So
  the coordinating member, or anyone who took the coordinator's seat while it stood empty, could
  label a package with the approved payment and fill it with another, and an honest device would
  add its part to that other payment while its screen showed the approved one. Turning that into
  a payment still took a complete transaction spending the vault's funds, built with the vault's
  viewing key, which every member holds. This is the protection a group vault exists for, so it
  is the most serious fault recorded in this file. The device now hands the payment it worked
  out to the step that signs, and that step refuses a package made over anything else. There is
  no longer a way to ask for a signature without it. Open since the first signature made in a
  browser: the correction of 2026-08-27 closed the label and left the contents. Found on
  2026-09-29 by a review of our own claims, not by a report. We have no sign that it was used.
  Live on the web since 2026-09-29, and in this desktop release.

Fixed

• A refused vote or payroll named the wrong problem. When the coordinator refused a vote because
  it carried a name that was not the seat which signed it, the screen said the vote no longer
  applied or conflicted with another. When it refused a payroll, for any reason at all, the screen
  said the address was not recognized. Both now say what was actually refused, and so does a name
  that is not on the vault's member list. It is the fault that was already fixed for the vote and
  then for the payment, left standing in the third place it lived.

• Changing your own name failed on any vault with signed actions turned on. The app signed
  votes, payments and sends, and never the rename, which the coordinator has required to be signed
  since early September. So the rename was refused every time, and the screen said only that it had
  failed. It is signed now, like the others, and the Members screen explains a refusal in the
  same words as the rest of the app.

• The proof screen showed eight transactions when the record has nineteen. The Proof screen and
  the in-app docs kept a list of their own, written when there were eight, and nothing tied it to
  the record in docs/PROOF.md, which went on growing. The screen now lists every transaction in
  the record, in the same order, and each one says how the key of its vault was made. That matters
  because the docs described the first payment as made with a key that was never whole, and its
  vault was one of six that a trusted dealer split, where the whole key existed on one machine at
  creation. The docs also still called a payment signed on two separate computers an open
  milestone, more than a month after it was made. Checking all of them from the screen now asks
  the public explorer for one at a time, since asking for nineteen at once gets some refused.

The desktop shell and shared parts

Services deployed when this was cut (2026-09-29): coordinator 80e3a18, relay 03bb736890c63e86.
The web app is this release's own commit. The two services are deployed by hand and may be
older than it - recording what they were ANSWERING is the point, not what they should have been.

Security

• The signer refuses a package that signs anything but the payment the device worked out.
  The second step of a signature used to sign whatever package it was given. The check that the
  package was the right one lived beside it, in the app, and compared the wrong thing (the app's
  changelog has the account). The message the device derived is now an argument of the function
  that signs, which refuses a package made over any other. For anyone building on the SDK:
  participantRound2WithRandomizer takes a fifth argument, the sighash your device computed,
  and a call without it is refused.

• A member's name is tied to their seat in one place now. The check that a signed action comes
  from the seat whose name it carries existed only in the coordinator's rename, in a copy of its
  own, so the vote and the proposal never asked it. It is part of the shared rule now, and every
  action that records a name goes through it. What that closed, and for whom, is in
  helper-server/CHANGELOG.md. The desktop app's own local service is
  unchanged: it serves the one device it runs on and takes no signed actions.

Desktop installers (Windows / macOS / Linux) are attached below.