Protocol v2. This is a hard break: a 0.4.x app cannot talk to a 0.5.0 relay, and existing circles have to be created again.
What changed
Forward secrecy. Content keys advance every ten minutes and the old ones are destroyed. A phone can only decrypt the window its owner chose to keep, from ten minutes up to a day, and that setting is worded as the trade it is.
Removing somebody actually removes them. A re-key mixes fresh entropy and moves the circle to a new channel. Whoever was removed does not get the new key and cannot follow. In v1 removal was a request.
Invite links are one-time. They commit to the inviter's identity, and somebody has to compare a safety number before anyone is admitted. A v1 link was a bearer token: anyone who ever saw it held the keys forever.
Safety numbers, with a screen for checking them and an explicit accept when a member's keys change.
Help links are per person, revocable, and expire. Sending one to a friend no longer means everyone who was ever sent one can watch.
Honest limits
Starling has not been audited by a human being. Six rounds of adversarial review went into this release and each one found real defects in the code the round before had passed, including an invite link that was a full takeover of the joining device and a re-key field that let any member erase every other member's circle. Those are fixed. The rate they were being found at is the reason for this paragraph.
docs/AUDIT.md is written for whoever looks at this next, and docs/THREAT-MODEL.md says plainly what the relay still learns.
Until somebody qualified has actually reviewed it, this is not something to hand to a person whose safety depends on it.
Verify this build
sha256 45f4a9fb569cd24fff030039c73a59ff8dfe5a29b679a72dd287b18ddb094033 starling-0.5.0.apk
signing key SHA-256 DB:B0:C4:91:53:0F:74:75:40:9C:4C:29:53:E9:F6:8A:52:51:9C:2F:68:1D:D9:E5:F6:99:38:F3:BF:9B:8C:9E