Vault Bridge v0.1.4 preview

Vault Bridge v0.1.4

This is a renderer-delivery fix on top of the v0.1.3 observability release.

Fix

The isolated renderer state subscription is now a one-way API. It no longer
returns a cleanup function across Electron's contextBridge, so renderer
bootstrap completes and both pushed state events and the passive reconciliation
loop remain active. Overview and Activity update after manual or unattended
synchronization without restarting the app.

The read-only MCP, strict SSH, Secure Tunnel, diagnostic and deployment
contracts are unchanged. ChatGPT receives only search and fetch.

Install

Use the versioned
Codex installation runbook.

The attached Apple Silicon DMG and ZIP are ad-hoc signed and integrity-checked,
but are not Developer ID signed or Apple notarized.

Verification

• Repository lint, type checking, tests, builds, Compose validation and release
  hygiene pass.
• The packaged app, DMG, ZIP, locked Electron fuses and SHA-256 manifest are
  verified locally.
• The owner installation passes standalone and concurrent live diagnostics,
  and the installed GUI updates after synchronization without restart.

Vault Bridge v0.1.3 preview

Vault Bridge v0.1.3

This is a UI-observability fix on top of the v0.1.2 consistency release.

Fix

Overview and Activity now reconcile with backend state after unattended
synchronization, even if a renderer event is delayed or missed. The app keeps
the push update path and adds a bounded passive refresh while visible plus an
immediate refresh when the window regains focus.

The installed diagnostic command now uses isolated ephemeral session data and
checks the healthy connected tunnel runtime without reopening Keychain on a
configured installation. Credential verification during configuration has a
15-second network bound.

The read-only MCP, strict SSH, Secure Tunnel, diagnostic and deployment
contracts are unchanged. ChatGPT receives only search and fetch.

Install

Use the versioned
Codex installation runbook.

The attached Apple Silicon DMG and ZIP are ad-hoc signed and integrity-checked,
but are not Developer ID signed or Apple notarized.

Verification

• Repository lint, type checking, tests, builds, Compose validation and release
  hygiene pass.
• The packaged app, DMG, ZIP, locked Electron fuses and SHA-256 manifest are
  verified locally.
• The owner installation passes live checks for vault, pinned SSH/Docker,
  OpenAI tunnel and synchronization.

Vault Bridge v0.1.2 preview

Vault Bridge v0.1.2

This is a small display-consistency fix on top of the v0.1.1 desktop and
reliability release.

Fix

After an accepted snapshot, Overview now refreshes the vault note and byte
totals from the same receipt used by Latest snapshot. A newly added or removed
note is therefore reflected immediately without restarting Vault Bridge.

The read-only MCP, strict SSH, Secure Tunnel, diagnostic and deployment
contracts are unchanged. ChatGPT receives only search and fetch.

Install

Use the versioned
Codex installation runbook.

The attached Apple Silicon DMG and ZIP are ad-hoc signed and integrity-checked,
but are not Developer ID signed or Apple notarized.

Verification

• Repository lint, type checking, 210 tests, builds, Compose validation and
  release hygiene pass.
• The packaged app, DMG, ZIP, locked Electron fuses and SHA-256 manifest are
  verified locally.
• The owner installation passes live checks for vault, pinned SSH/Docker,
  OpenAI tunnel and synchronization.

Vault Bridge v0.1.1

Vault Bridge v0.1.1

This preview replaces the original card-heavy desktop design with a compact
utility interface.

Changes

• Connections are shown as one compact three-part path on a consistent grid.
• Synchronization and the latest aggregate diff share a balanced grid.
• Activity is a time-oriented log with aggregate diffs and run metadata.
• Settings use a restrained native sheet.
• The application icon and project README were simplified.
• Strict SSH sync now supports macOS paths containing spaces and SSH aliases;
  early pipe closure is handled without an Electron main-process crash.
• vault-bridge doctor --json performs a live, redacted check of every runtime
  layer, and temporary deployment secrets are cleaned after each setup attempt.

The product remains read-only: ChatGPT receives only search and fetch.

Install

Use the versioned
Codex installation runbook.

The attached DMG and ZIP are Apple Silicon preview artifacts. They are ad-hoc
signed and integrity-checked, but they are not Developer ID signed or Apple
notarized. Do not bypass macOS security warnings for an untrusted download.

Verification

• Repository lint, type checking, tests, builds, Compose validation, and
  release hygiene pass.
• The packaged application, DMG, ZIP, locked Electron fuses, and SHA-256
  manifest are verified locally.
• A real owner-controlled read-only ChatGPT connection is already configured;
  this remains one deployment observation, not a guarantee for every account,
  server, or client.

See the
changelog,
threat model, and
public roadmap.

Vault Bridge v0.1.0 — public preview

Vault Bridge v0.1.0

Vault Bridge connects a private Obsidian-compatible vault to ChatGPT through a
self-hosted, read-only MCP runtime. The Mac remains the only reader of the
canonical vault; a replaceable snapshot is published over SSH to an isolated
Docker project, and the MCP reaches OpenAI through an outbound-only Secure MCP
Tunnel.

Highlights

• One macOS application for vault, server, OpenAI, sync, and activity status.
• Agent-first setup: copy one prompt into Codex instead of following a terminal
  tutorial.
• Exactly two ChatGPT tools: search and fetch.
• No vault writes, deletes, arbitrary paths, shell, raw SQL, public server
  ports, or server-to-Mac control channel.
• Startup and five-minute synchronization with atomic last-known-good
  snapshots and persistent aggregate change history.
• Exact SSH host identity pinning, encrypted local secret storage, hardened
  Electron packaging, and resource-bounded containers.

Install

The supported preview path is
Install with Codex.
The agent follows the versioned runbook and pauses only for account consent,
the restricted OpenAI tunnel key, the first SSH fingerprint, and any action
outside the read-only contract.

The attached DMG and ZIP are Apple Silicon preview artifacts for inspection
and testing. Both are ad-hoc signed and integrity-checked, but they are not
Developer ID signed or Apple notarized. Do not bypass macOS security warnings
to run a download you do not trust.

Verification

• Repository lint, type checking, tests, build, Compose contracts, and release
  hygiene pass.
• The macOS application, DMG, ZIP, locked Electron fuses, and artifact manifest
  are verified locally.
• The release manifest records exact SHA-256 digests and byte counts.
• A real owner-controlled deployment has been observed healthy with no
  published host ports and a working read-only ChatGPT connection. This is a
  deployment observation, not a guarantee about every VPS, account, or client.

Known limitations

• macOS Apple Silicon only for the downloadable preview.
• The desktop application must be running for new local vault changes to be
  scanned and published; ChatGPT can continue using the last healthy server
  snapshot while the Mac is offline.
• Phone-to-Mac freshness belongs to iCloud or the owner's chosen Obsidian sync
  provider.
• Secure MCP Tunnel supports private connections and developer-mode testing;
  it is not a public ChatGPT catalog listing.
• Vault write-back is intentionally absent from v0.1.0.

See the
changelog,
threat model, and
public roadmap.