v0.2.0

Breaking

• Local credential storage changed (ADR-0015): the archive's encryption key
  and the Sia app key are now stored together as one bundled OS-keychain
  item, replacing the two independent items used through 0.1.x. A config
  file written by an older release fails to load with a clear message
  rather than being silently reinterpreted — there is no automatic
  migration. To keep reading archives created under 0.1.x, stay on
  obsidianlog v0.1.1. To move to 0.2, run obsidianlog init --force:
  this generates a new encryption key, so previously archived data will no
  longer be decryptable under it.

Fixed

• A fresh obsidianlog init (local or Sia) produced multiple separate
  macOS Keychain authorization prompts, one per keychain call. The new
  bundled-credential storage, combined with a direct "create only" macOS
  Keychain write instead of the generic check-then-write pattern, brings
  this down to exactly one prompt for a clean fresh install (local or Sia
  alike) and for a plain repair (config file missing, credential still
  present). A repair that also introduces new credential material — e.g.
  choosing Sia while an existing bundle was local-only — costs more than
  one operation by design, prioritizing correctness (the existing
  encryption key is always read and preserved exactly) over shaving that
  rarer case's call count.
• default_key_store (credential-store resolution) treated any error from
  the OS keychain, including the user cancelling or denying an
  authorization prompt, as "keychain unavailable, fall back to a plain
  file instead." Only genuine unavailability now triggers that fallback;
  a cancellation or denial surfaces as a real error.
• obsidianlog init --force read the credential bundle twice: once in a
  preflight "is setup already complete?" check whose result was then
  discarded, and again inside the rotation itself to preserve any existing
  Sia key. The preflight read is now skipped when --force is already
  explicit, cutting a forced rotation from three keychain operations down
  to two (or to a single write when a new Sia key is chosen in the same
  run).
• Onboarding to Sia only validated the recovery phrase after the browser
  approval step completed, so a mistyped phrase (including SEED in the
  wrong case) burned a full approval round-trip — and one of a
  possibly-limited number of app-connection slots on the indexer — before
  failing with a generic parse error. The phrase is now validated locally
  first, and seed is matched case-insensitively.
• A re-run of obsidianlog init against an existing but incomplete setup
  (or one where Reuse it? is declined) re-probed the keychain with a
  create() attempt and a second read(), even though the bundle's
  contents were already read once for the integrity/reuse check moments
  earlier. That known bundle is now reused directly instead of being
  discarded and re-fetched, cutting this case from up to four keychain
  operations down to at most two.

Changed

• A repair that finds config.toml missing but the credential bundle
  still present (e.g. after accidentally deleting just the config file)
  re-collects every wizard answer — there's no config left to read the old
  ones from — which read as "did this just reset my key?" obsidianlog init now prints a status line making the outcome explicit: "Existing
  credentials preserved; rebuilding configuration." for a plain reuse, or
  "Existing encryption key preserved; Sia app key saved." when the repair
  also adds a Sia app key.
• The official release binaries now build obsidianlog with the sia
  Cargo feature enabled, instead of shipping local-only and pointing Sia
  users at a source build. obsidianlog init still defaults to the local
  backend regardless — this only changes what's compiled in, not what
  happens without choosing Sia explicitly. obsidianlog-ingest (the
  standalone, minimal ingest-only binary) stays local-only, unchanged.

v0.1.1

Fixed

• obsidianlog init made up to 6 redundant OS keychain calls in a single
  run (two exact-duplicate existence checks, plus a delete that ran
  unconditionally right before an overwrite that already made it a no-op),
  each able to trigger its own macOS authorization prompt. A fresh install
  now makes 3 calls (4 if the Sia backend is chosen), and --force key
  rotation drops from 6 to 3. No behavior change.
• The README's release-binary install instructions used literal
  vX.Y.Z-<target> placeholder syntax that broke when copy-pasted into a
  shell (</> are redirection operators, not just visual placeholders).
  Replaced with a real, tested example plus a note to swap in the actual
  downloaded filename.

Changed

• Cleaned up README prose for readability throughout: shorter sentences,
  em dashes replaced with clearer punctuation. No content or command
  changes.
• Documented that macOS's init keychain prompt should be answered with
  "Always Allow" to avoid repeat prompts on later serve/query/verify
  runs, and that canceling it aborts the whole init run rather than
  resuming.

v0.1.0

v0.1.0