interpose v3.7.0

Install

curl -fsSL https://github.com/interposed/interpose-releases/releases/download/v3.7.0/install.sh | sh

Or pin to this version explicitly:

curl -fsSL https://github.com/interposed/interpose-releases/releases/download/v3.7.0/install.sh | sh -s -- --version v3.7.0

Verify

Every artifact is signed with Sigstore cosign (keyless — no key to trust,
the signature is bound to this repo's release workflow and logged in Rekor).
Each <file> ships a <file>.sig and <file>.pem. To verify a download:

cosign verify-blob \
  --certificate interpose-v3.7.0-linux-amd64.tar.gz.pem \
  --signature   interpose-v3.7.0-linux-amd64.tar.gz.sig \
  --certificate-identity-regexp "^https://github.com/interposed/interpose/.github/workflows/release.yml@" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  interpose-v3.7.0-linux-amd64.tar.gz

---

v3.7.0 — per-device approval method + single-target routing

• Per-device approval method: org.Device.ApprovalMethod (off|pin|phone|key),
  member-signed, so the receiving device already knows how to prove.
• Single-target routing (Model B): a session's prompt goes to the sole approval
  device, else the session-starter — never fanned to N installs.
• Approve-the-plan-once: no double-gate on the follow-up syscall.
• Members can resolve prompts pushed to them; a session's prompt fans to every
  install of the owning member.
• Designated Conduit leader so distribution nodes can't steal key brokering.
• Roster: multi-node cluster (P3) + relayless mesh mode (P4), real-time
  distribution and convergence.
• Approval gate (WS1): enforce per-operation accepted methods.