Astra 2.0.0

Astra 2.0.0

Astra 2.0 turns the project's “Linux of browsers” goal into things a user can inspect and exercise. The release is MPL-licensed, produces independently reproducible Linux binaries, puts the privileged core behind API 2.0, stores non-secret configuration as TOML, includes an offline CLI and an identity-free self-hosted sync stack, and ships two deliberately different shells over one core.

Download the right build

The default Linux x64 archive contains the full vertical-tab interface. The minimal archive contains a sparse horizontal browser shell without the sidebar, command bar, panels or assistant UI. Both contain the same byte-for-byte astra-core executable. Extract either archive and run ./astra/astra-browser.

Each archive has an adjacent .sha256 manifest. The release workflow builds both archives twice on separate clean runners and refuses to publish if either pair differs. After publication, a separate release-event job rebuilds the tag and compares the downloaded public archives with those fresh bytes.

What to inspect

• LICENSE, GOVERNANCE.md and FUNDING.md define file-level copyleft, public decisions and funding boundaries.
• REPRODUCIBLE_BUILDS.md gives the clean-room rebuild and comparison procedure.
• CORE_API.md and VARIANTS.md explain the core/shell boundary and the two official products.
• CONFIGURATION.md documents TOML layout, secret exclusions and every astractl operation.
• SYNC.md covers standalone deployment, pairing, encryption, visible metadata and the threat model.
• STANDARDS.md and docs/standards-audit.json inventory every custom surface and keep Astra-only APIs out of ordinary pages.
• docs/decisions.md closes the phase with a pillar-by-pillar account of what is proven and what remains unfinished.

Verification and limits

The candidate passed 58 unit, security and architecture tests; 17 sandboxed Electron browser/privacy tests; native lifecycle and MV3 execution tests; production builds for both shells; and native Windows x64, macOS arm64 and macOS x64 package runs. Reproducibility currently applies to the complete runnable Linux x64 archives, not AppImage, Debian, Windows or macOS installer formats. Astra is still an unincorporated project with a bootstrap steward, sync has not received a third-party cryptographic audit, and the current standards audit found no novel web primitive worth submitting. Those are boundaries of the release, not claims hidden in small print.

Astra 1.0.0

Astra 1.0.0

Astra 1.0 is the first complete product slice: a stranger can launch a packaged build, browse real sites, organize tabs into isolated named workspaces, jump through the local command bar, and inspect real privacy/resource signals. It adds split browsing, hibernation, Alt-hover Peek, reviewed unpacked MV3 extensions, encrypted per-site Boosts and a fully optional local page assistant.

Verification

The release candidate must pass npm run verify, the separate packaged executable smoke test, npm audit --omit=dev, and SHA-256 generation before artifacts are published. Linux verification is performed locally and in CI; Windows x64 and macOS x64/arm64 packages are built and exercised on native GitHub runners.

Local Linux verification passed on 2026-09-09. Astra-1.0.0.AppImage SHA-256 is 46529078fb4b776b7c6e617a416479d78f48e6cec9ed4a327d2d86ca49f6e5e0; astra-browser_1.0.0_amd64.deb SHA-256 is de365152b086a6e58dc92d5f009aced0acefe16f43c8bf6ca793b6b6f1c39278. The actual AppImage passed packaged browsing, sandbox isolation, license and command-bar checks.

Native CI run 34382766909 passed on Windows x64, macOS Apple Silicon and macOS Intel. Every job ran the full source suite, built its native installers, launched the packaged executable, rendered a real local HTTP page in Chromium, checked renderer isolation and exercised the command bar. The Linux browser gate also passed on the exact release commit. Checksums for every attached artifact are included in SHA256SUMS-1.0.0.txt.

Trust and limitations

There is no telemetry, updater, account or cloud dependency. Records persist only when an OS key store or passphrase vault can protect them. Website state is ephemeral. The tracker list is a baseline. Extensions are unpacked-only and limited by Electron's Chrome API compatibility. Community binaries are not commercially signed/notarized. The assistant is local extractive software, not an autonomous agent. These limits are visible because overstating them would violate Astra's transparency goal.

Astra 0.2.0 — workspaces and local commands

Astra 0.2.0 — workspaces and local commands

The second Linux alpha adds usable organization and conservative memory
management to the initial browser foundation. It is not the final release.

• Named workspaces separate website cookies/storage, with encrypted tab
  membership and shared local bookmarks/history.
• Ctrl/Cmd+K searches tabs, workspaces, history, bookmarks and actual commands
  locally. Typing does not contact a suggestion service.
• Tabs reorder by dragging or Alt+Shift+arrow keys. Order survives vault restart.
• Ctrl/Cmd+B collapses the sidebar to a narrow tab rail; the setting is saved
  with encrypted records.
• Background pages beyond the configured limit hibernate, with draft/audio
  safeguards, beforeunload protection and navigation/scroll restoration.
• “Behind the page” reports actual request/block counts and renderer-process
  memory. The memory figure may cover shared pages; it is not a per-tab total.
• Native Stay/Leave protects explicit navigation and closure. Address identity
  remains tied to committed documents when navigation is stopped or cancelled.
• Packaged resources now include Astra and Doto font license notices.

See keyboard controls and architecture decisions.

Verification and limits

Source verification passes 19 unit tests, 11 real Electron integration tests
and the native lifecycle suite. Linux CI is active on every work branch and
main. Packaged runtime tests check rendering, page isolation, command execution
and notices. One initial packaged command-bar timeout did not reproduce in
six subsequent fresh-profile runs; failure-state diagnostics are retained.
Direct AppImage execution also passes the same rendering/isolation/command
checks with Chromium's sandbox enabled. A separate live HTTPS smoke check
rendered example.com successfully. Both published package hashes were checked
against the generated manifest before upload.

Website logins are still memory-only and clear on quitting. The bundled tracker
list is small, sensitive permissions are denied by default, and hibernation
reloads a page rather than serializing its running JavaScript heap. A secure OS
key store or explicit passphrase is required for persistent browsing records.
No telemetry, updater, cloud service or AI request runs in the background.

Split view, extensions, per-site customization, link previews, optional AI and
native Windows/macOS packages are not included yet. Screen-reader operation and
broad website compatibility still need manual verification. Debian archive
structure is inspected, but installation on Debian/Ubuntu has not been tested.
This remains an early alpha, not a hardened replacement for a mature browser.

Linux x64 artifacts

• Astra-0.2.0.AppImage: mark executable and launch.
• astra-browser_0.2.0_amd64.deb: install using your Debian/Ubuntu package manager.
• SHA256SUMS-0.2.0: verify downloads with sha256sum -c SHA256SUMS-0.2.0 in the
  directory containing both packages.

Close Astra before changing package versions. Existing passphrase vaults keep
their format; unlock them as before. Missing/corrupt keys are never replaced
automatically. Retain a backup of your vault directory before testing alphas.

Astra 0.1.0 — first Linux alpha

Astra 0.1.0 — first Linux alpha

A working browser foundation, shipped approximately 32 minutes after the build
started. This is an early alpha, not the final 24-hour release.

Browse real HTTP/HTTPS pages with back, forward, reload, search and vertical tabs.
Save bookmarks and history in an encrypted SQLite vault, using an OS key store
or an explicit passphrase. Saved tabs restore on selection. Choose dark, light
or system appearance. Inspect actual request and tracker-blocking counts in
“Behind the page.”

Privacy defaults include a bundled basic tracker host list, tested third-party
HTTP/document cookie blocking, denied sensitive site permissions, no telemetry
or updater, and memory-only website storage. Website logins do not survive
quitting. Click the storage status at the bottom to set up or unlock encrypted
browser records when a secure key store is unavailable.

Linux x64 downloads:

• Astra-0.1.0.AppImage: mark executable and launch.
• astra-browser_0.1.0_amd64.deb: install with your Debian/Ubuntu package manager.
• SHA256SUMS: verify artifact hashes.

Verified on this Arch Linux desktop: source build, four unit tests, three
Electron integration tests, live example.com rendering, passphrase restore,
cookie isolation, packaged executable launch, and direct AppImage launch with
sandbox enabled. Debian archive structure was inspected; installation on a
Debian/Ubuntu host has not been tested. npm audit reports zero findings.

Not included yet: workspaces, command palette, split view, tab hibernation,
extensions, per-site customization, AI, native Windows/macOS packages, or a full
accessibility and compatibility audit. Downloads use Electron's native save
behavior; there is no download manager yet. The tracker list is deliberately
small. Do not treat this alpha as a hardened substitute for a mature browser.