Blockula v1.0.2

Blockula v1.0.2: launch your own chain, and every node serves its own passkey wallet. UNSIGNED, like every release so far.

This release is not signed. The offline ML-DSA-65 release key doesn't exist yet, so there is no
checksums.txt.sig and no release key id to pin, and blockula release install refuses to install without one.

The one-line install.sh and the MCP's install_node check each archive's SHA-256 against checksums.txt
(first line # blockula-release v1.0.2). With a logged-in gh, they also check its SLSA build provenance
(gh attestation verify <file> --repo jackdishman/blockula --source-ref refs/tags/v1.0.2), and they report
which checks ran. A compromised GitHub account or release workflow could produce both. The stronger check is
a bit-for-bit rebuild of the Linux archives:
COMMIT=e3b5f95c24303d02729c0746b6bbc7851aeef906 scripts/reproduce-release.sh v1.0.2.

Each chain's coins have no value: nobody sells them, buys them or gets paid in them.

What's new

• blockula launch (#97, #98) makes and starts a chain of your own in about a minute. It asks four
  questions:

  • a name and a ticker, both bound by the genesis hash;
  • who can reach it (this machine, Tailscale, a home network or the internet);
  • a block time and a faucet;
  • whether to serve it over HTTPS on your tailnet.

  It prints the one command friends run to join, and keeps it all in ~/.blockula/<chain id>/LAUNCH.md.
  docs/LAUNCH.md

• Every node serves the passkey wallet at /wallet/ (#100), so a friend needs only the node's link.

  • The wallet uses the node it comes from, is titled with the chain's name, and shows amounts in the chain's
    ticker.
  • /api/status gains "wallet": "/wallet/".
  • Each page's CSP allows only 'self' and a hash of each of its inline scripts.
  • The wallet is built once, reproducibly, as blockula-wallet.tar.gz, which is listed in checksums.txt.
    Every binary embeds that archive.

• The explorer's Start page (#100) walks through:

  • making a wallet and a first payment;
  • programs, on chains that have them;
  • inviting friends and validators;
  • changing the apps with Claude Code and deploying them.

  It also has a live tokenomics graphic, an invite page, and a prompt that connects a coding agent to the chain.

• The CLI shows amounts in the chain's own ticker (#100). Tailscale addresses (100.64.0.0/10, *.ts.net)
  count as private for plain http in the CLI and MCP.

• The public testnet is retired (#96). There's no built-in testnet RPC, and the CLI, SDK and MCP default to
  a local chain. Releases still ship blockula-testnet-2's genesis and checkpoints for its archive.

Upgrading

• Node/CLI: a drop-in replacement for v1.0.1. The protocol versions are the same, and nothing changes in
  state, consensus or the wire format. Every PR replays the recorded v1 history. The binary grows by about
  1.6 MiB, for the wallet.
• SDK and MCP: @blockula/sdk and @blockula/mcp go to 1.0.2, matching the tag. summon_chain takes
  name and token.

Commit: e3b5f95c24303d02729c0746b6bbc7851aeef906 (PR #101 merge).

• Built by release.yml. CI rebuilt the wallet archive and the x86_64 Linux archive bit for bit on second
  runners.
• Also rebuilt outside GitHub. The wallet archive and the aarch64 Linux archive were rebuilt bit for bit on the maintainer's machine, in the pinned build images. scripts/check-release-files.sh accepts this release against the reviewed commit.
• Every file's build provenance verifies against release.yml at refs/tags/v1.0.2, and every file matches
  checksums.txt.