v2.3.3

Added

• cp: god-mode IAP auth bridge — owner web access via Google IAP (G5 gated)

Fixed

• install: claude-mem gate + doctor presence-beat scoping + team assert
• version: render the 2 out-of-marker README pins on every bump (durable)
• hud: restore swarm block dropped in the v2 statusline rewrite
• haid: derive machine from stable device name, not IP-shaped hostname
• ship: run all guards BEFORE the version bump (no dangling bump on failure)

Documentation

• version: sync 2 stale v2.2.6 prose/URL pins to 2.3.2 (outside renderer regex)

Tests

• share-card: pin identity in interactive-install check (hermeticity)
• cp: fix 3 pre-existing reds — all test-side, shipped code correct
• presence: fix 3 pre-existing failing suites + the watchdog fixture

Maintenance

• release: v2.3.3

Other

• session-end checkpoint (0 files)
• session-end checkpoint (1 files)
• session-end checkpoint (0 files)
• session-end checkpoint (0 files)
• session-end checkpoint (1 files)
• session-end checkpoint (0 files)
• session-end checkpoint (0 files)
• session-end checkpoint (1 files)
• session-end checkpoint (0 files)
• session-end checkpoint (0 files)
• session-end checkpoint (1 files)
• session-end checkpoint (0 files)

Full changelog: v2.3.2...v2.3.3

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.3/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.