DSM v0.1.0-beta.4

DSM v0.1.0-beta.4

Plug an app in

dsm-app-host for Linux (x86-64, ARM64; Windows through WSL2)
and macOS (Apple silicon, Intel), the TypeScript and Python
clients, and the dsm-app, dsm-dev-wallet and
dsm-connect-starter commands, with no Rust and no protobuf
compiler. install.sh checks every download against
SHA256SUMS before it unpacks anything:

curl -fsSLO https://github.com/deterministicstatemachine/dsm/releases/download/v0.1.0-beta.4/install.sh
sh install.sh

The guide: https://deterministicstatemachine.github.io/dsm/

Artifacts

Artifact	SHA-256
dsm_storage_node-0.1.0-beta.4-linux-x86_64	38539241a14aab2d184759791fddf777713dd32e7da2605db49c354e061a6317
dsm-frontend-0.1.0-beta.4.tar.gz	1509be8534b7f16b930e352420286b4c9eb17ebd0ebe5ae5e7b330d8b4de48a2
dsm-sbom-0.1.0-beta.4.tar.gz	5c5bfcb7bde060e97ad53ef33eb7d2ea954c7dad0a74dee70f1c9f288d07d0c7

See SHA256SUMS for verification.

Verification

sha256sum -c SHA256SUMS

SBOM

The dsm-sbom-0.1.0-beta.4.tar.gz bundle contains the full
CycloneDX 1.5 inventory (Rust + frontend + Android + workspace
manifests) plus the TLA+ validation evidence from
dsm_vertical_validation tla-check captured at this tag.

Security

See SECURITY.md for the coordinated-disclosure
policy and the DSM Security PGP key.

What's Changed

• Connect: a disconnect reaches the application, and one session per application by @cryptskii in #1121
• sdk: the inbox-route tests open their own device database by @cryptskii in #1138
• Security audit 2026-10-15: every fix by @cryptskii in #1139
• chore(deps): bump the npm_and_yarn group across 1 directory with 17 updates by @dependabot[bot] in #1141
• chore(deps): bump quote from 1.0.45 to 1.0.47 by @dependabot[bot] in #1125
• Security audit 2026-10-18: record SA-61..160, fix the 23 clear-cut items by @cryptskii in #1142
• Record every validated frontier, reads included (A19); R05, R06, R01 tests by @cryptskii in #1146
• Spike: the economic SMT path as a Plonky3 STARK, with what one root advance costs to prove by @cryptskii in #1147
• Revert the STARK spike merged by mistake (#1147) by @cryptskii in #1154
• fix(deps): ctutils 0.4.2 -> 0.4.5 for RUSTSEC-2026-0385 by @cryptskii in #1155
• Prove no counterfeit value is ever accepted, online or offline (Lean) by @cryptskii in #1149
• Counterfeit tests, offline sending (phase 2 sender), offline receive recording, DBRW removal, crypto-bigint advisory by @cryptskii in #1148
• Security audit round five: SA-69, 71, 75, 76, 104, 141, 143, 144, 145, 147; Coverage stack by @cryptskii in #1152
• feat: a count on the app icon of money received and not yet looked at by @cryptskii in #1151
• fix(deps): every open Dependabot alert, in one PR (fast-uri, follow-redirects, launch-editor, serialize-javascript) by @cryptskii in #1157
• Beta completion: DSM core, SoFi and offline software, with §6.95–§6.116 records by @cryptskii in #1158
• fix(economic,ci): what main's first run found after the ancestry commit by @cryptskii in #1177
• ci: the code map runs by hand only by @cryptskii in #1184
• fix(connect): an approval as the listener stops is never left unheard by @cryptskii in #1181
• ci: CodeQL init and analyze move to 4.39.1 together by @cryptskii in #1185
• feat(offline): an offline payment needs a board on both sides (R5 on today's code) by @cryptskii in #1182
• fix(anchor): everything findable before the first burn, and the try-run by @cryptskii in #1180
• feat(dev): build an app on DSM: local set, app account, clients, starter, dev wallet by @cryptskii in #1183
• build(deps): bump actions/cache/save from 4.3.0 to 6.1.0 by @dependabot[bot] in #1159
• build(deps): bump Swatinem/rust-cache from 2.9.2 to 2.9.3 by @dependabot[bot] in #1160
• build(deps): bump actions/cache/restore from 4.3.0 to 6.1.0 by @dependabot[bot] in #1173
• build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1176
• build(deps-dev): bump ts-loader from 9.6.0 to 9.6.2 in /dsm_client/frontend by @dependabot[bot] in #1165
• build(deps): bump react-dom and @types/react-dom in /dsm_client/frontend by @dependabot[bot] in #1168
• build(deps-dev): bump @types/node from 26.4.1 to 26.6.6 in /dsm_client/frontend by @dependabot[bot] in #1169
• build(deps): bump uuid from 1.26.1 to 1.29.0 by @dependabot[bot] in #1162
• build(deps): bump rstest from 0.26.1 to 0.28.0 by @dependabot[bot] in #1164
• build(deps): bump webpki-roots from 1.0.10 to 1.0.11 by @dependabot[bot] in #1166
• build(deps): bump proptest from 1.11.0 to 1.12.0 by @dependabot[bot] in #1167
• build(deps): bump flate2 from 1.1.9 to 1.1.10 by @dependabot[bot] in #1170
• build(deps): bump log from 0.4.33 to 0.4.35 by @dependabot[bot] in #1171
• chore(deps): bump lru from 0.18.1 to 0.18.5 by @dependabot[bot] in #1126
• feat(storage): each operator's own CA, and one-line setup for public nodes by @cryptskii in #1179
• fix(ci): main's red jobs — fmt, offline boundary schema 3, tag count by @cryptskii in #1188
• feat(clients): plug your app into DSM: every grant and request, in plain words by @cryptskii in #1186
• ci: split the SDK tests across runners and run only what a change touches by @cryptskii in #1189
• ci: a push to main runs only what it touched; the full run is by hand by @cryptskii in #1190
• Feat/plug in clients by @cryptskii in #1191
• chore(fleet): the beta storage set runs on the owner's OVHcloud project by @cryptskii in #1192
• Plug-in onboarding: the beta network by default, a local set by choice; app-cli for trades and matches by @cryptskii in #1193
• The developer walkthrough as written pages, published with mdBook on GitHub Pages by @cryptskii in #1215
• docs: the README up to date, and the apps plugged into DSM in it and in the guide by @cryptskii in #1217
• connect: the wallet and app host speak the plug-in words by @cryptskii in #1218
• docs: the snippets pick a connected wallet, and what an app runs is said plainly by @cryptskii in #1219
• Plug in with no Rust: prebuilt dsm-app-host, install.sh, clients without protoc by @cryptskii in #1220
• CI: resolve Ubuntu's package servers through public DNS when GitHub's runners cannot by @cryptskii in #1216
• Audit 2026-11-12: node slots held to the write, unanswered sends, install ownership by @cryptskii in #1221
• deps: nineteen Dependabot bumps as one change by @cryptskii in #1223
• Anchor: an authorization serves once, spare pairing slots refuse a birth, one Secure crossing at a time by @cryptskii in #1222
• feat(anchor): the prepare image takes the board in hand, and the OTP procedure keeps a secret already sealed by @cryptskii in #1194
• Application cells, contributions and the state scope (generic facilities for applications) by @cryptskii in #1224
• Fix red main: objects read once under concurrent readers; the Secure heap is 154 KiB by @cryptskii in #1225
• chore(deps-dev): bump webpack from 5.107.2 to 5.112.2 in /dsm_client/frontend by @dependabot[bot] in #1206
• chore(deps-dev): bump webpack-dev-server from 5.2.6 to 5.2.7 in /dsm_client/frontend by @dependabot[bot] in #1197
• chore(deps-dev): bump eslint-plugin-security from 4.0.0 to 4.2.1 in /dsm_client/frontend by @dependabot[bot] in #1201
• chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.15 in /dsm_client/frontend by @dependabot[bot] in #1204
• offline: a phone that received offline goes on paying offline from what it loaded by @cryptskii in #1226
• deps: fix main's red security audit (quinn-proto 0.11.19, quinn-udp 0.5.16) by @cryptskii in #1227
• docs: the 0.1.0-beta.4 changelog, and the README's SoFi section on the routes that exist by @cryptskii in #1228
• sbom: the assurance record draws nothing from CONFORMANCE_GAPS.md by @cryptskii in #1229
• android: make android-release builds on the pinned toolchain and keeps the board firmware in the APK by @cryptskii in #1230
• formal: the DSM trace replay and the crossing config follow A33's relationship lifecycle (unblocks the release) by @cryptskii in #1231

Full Changelog: v0.1.0-beta.3...v0.1.0-beta.4