Domios v1.17.0

Domios 1.17.0

Domios 1.17.0 gives each friend a receiving machine and a concierge whose
access follows the friendship's grants, with clearer conversation status
and controls throughout the app. Changes since v1.16.0:

Neighbors

• Choose where each friend is received. Receive one friend on this
  machine from the sidebar, concierge row or conversation, with explicit
  takeover confirmation. Other friends can keep receiving on their current
  machines. The all-friends control identifies this machine and the number
  of friends affected. Moving receiving away retires that friend's local
  concierge and its delegated access.
• Concierge access follows the friendship grant. Scope, memory,
  workspace, file and machine-access permissions govern the concierge and
  its delegated agents. Applying permissions starts a fresh concierge
  session with the new instructions; the friend's conversation remains.
  Restoring an unchanged grant resumes the existing session.
• General can edit the complete grant. Partial changes preserve other
  fields, including memory enabled/disabled, allowed memory areas,
  workspace access, files, tab requests, interactive content, machine
  access and folder scope. Memory can be turned off explicitly.
• Empty messages are refused before sending. Empty or whitespace-only
  text returns empty_body without queueing a submission. File-only
  messages remain supported. Receiver-takeover and non-receiving-machine
  errors explain why the operation was refused.
• Read receipts reflect actual reading or handling. A visible incoming
  message or confirmed concierge handling advances the read state after
  delivery acknowledgement is committed. Delivery alone does not mark a
  message read; reconnects preserve newer read status.
• See and stop concierge work. Conversations show incoming handling
  status and provide Stop for the friend's active concierge. Replies to an
  owner-stopped request are refused before sending and are not offered as
  retryable submissions.
• Flag suspicious incoming messages. Owners and authorized agents can
  flag instructions, requests for private data, malicious links, spam or
  other concerns. Flags stay local and appear with the message; they are
  not sent to the friend or forwarded to bridges.
• Choose concierge model, effort and speed from the providers and
  options that support concierge work. The selected model appears below
  the concierge in the sidebar.

Agents and interface

• Codex Cloud is available in the new-session picker. Environment
  discovery refreshes after sign-in and on request, so the picker can
  offer the available Cloud environments and execution modes.
• The bundled control skill is now named domios. Agent guidance and
  skill mirroring use the new name.
• Consistent loading states across the app, including terminal boot,
  with shared activity indicators and a Mesh card that keeps its size
  while loading.
• Clearer session controls: readable program names in command lines,
  and improved model and destination pickers. After a connection drops,
  the loaded app stays usable with a quiet reconnect pill while updates
  are paused; initial connection still has a loading state.
• Mesh discovery improvements include passive detection of macOS
  system-extension Tailscale and framed LocalAPI response handling.
• Jobs is easier to navigate. Import Blueprints from a file or
  repository through a dialog with a drop area; select General, a
  workspace or a Team with the shared destination picker. Jobs show as
  working only while a run executes, and an empty list has a clear empty
  state.

Upgrade note

• Upgrade both ends of a Mesh connection to 1.17.0. The running app's
  version is the peer minimum, so a 1.17.0 installation refuses older
  peers. Official plugins keep their independently managed versions and
  minimum-host requirements; the app version bump does not bump plugins.

Release candidate and qualification

Release head: 755d9e39d4b2874043387935cf0e759e18fa5834.
Source: pinned next 5d17471d8ad3e674d1ff8c0602524b2490677fcd, analytics key guard eba7a979bdb3550748417f655b225fffef906728, privacy fixture repair ae47075a5b1f383eae5337c65ac4527ced670531, and reset-confirmation pointer fix 8344312ba67df0c27f60e031ecb3bef80db37eb6. No unrelated 1.18 work is included. All lanes and prior unpublished release ancestry are preserved through real merges.

Product version: 1.17.0, with internal crates at 0.0.0. Plugin versions are independently managed; the app bump does not rewrite them. Bundled Codex 1.14.57 requires Domios 1.17.0. Both Mesh peers need 1.17.0.

The analytics guard separates cached builds by non-secret key fingerprints and verifies the production fingerprint in the staged server binary in every release build workflow. The reset confirmation stays mounted through pointerdown before redemption; canonical UsageBubble runtime regression, TypeScript and Biome passed (Elgar relay).

Read-only included-history resolution on this exact head passed: 796 commits, 8 remote calls, published v1.16.0 boundary 488b42f79477746e34d5d7ff9b10140cb5fd6fd1. Public-Issue and Repository-Issue sets are empty. Generated closing metadata reconciliation and commit audit passed; no invented closing claims.

Exact-head CI: https://github.com/domios-dev/domios/actions/runs/40779417247 . The full fast/Rust/native/embeddings qualification and signed six-platform dry-run packaging must pass together. The owner assigned broad qualification to CI; no local build, Rust test or release-preflight was run for this cut.

Witness live PASS was relayed on product source 59ab9136351726bcb98d6fdb55d8bf135a7449f4: a read-only concierge read outside cwd without approval and sent one non-empty linked answer (one send/ACK/read/delete, no duplicates); cold General became ready without UI activation or a stale concierge; earlier per-friend items passed. Subsequent additions above have explicit owner approval. Publication is authorized after exact-release CI and release gates pass.

Coordinate the production accounts/analytics default-on and per-friend receiving deployment with Turner at publication. Verify served updater bytes, signatures, legacy refusals, mirror and issue-closure evidence afterward. Scoop/Homebrew definitions remain unpublished templates; verify available release inputs without creating external package repositories.