v0.5.1

What's Changed

• Raise the iOS minimum deployment target to 15 by @rorystandley in #81
• Bump the app-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #79
• Bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #68
• Bump actions/setup-java from 5.4.0 to 5.6.0 by @dependabot[bot] in #73
• Bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in #74
• Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #76
• Bump actions/labeler from 6.1.0 to 7.0.0 by @dependabot[bot] in #77
• Register file selector plugins across desktop platforms by @rorystandley in #82
• Let users choose where exports are saved and reach them afterward by @rorystandley in #83
• Release 0.5.1 by @rorystandley in #84
• Compile Android against SDK 37 for flutter_secure_storage by @rorystandley in #85

Full Changelog: v0.5.0...v0.5.1

v0.4.1

What's Changed

• iOS polish: floating snackbars, footer safe area, FAB spacing, copy by @rorystandley in #59
• Dismiss snackbars when a new route is pushed by @rorystandley in #60
• One accent, one primary action for creating notes by @rorystandley in #61
• Release 0.4.1: version bump, changelog, Play release notes by @rorystandley in #62

Full Changelog: v0.4.0...v0.4.1

v0.4.0

What's Changed

• Make whisper build scripts find Homebrew cmake under GUI PATH by @rorystandley in #42
• Bump softprops/action-gh-release from 2.6.2 to 3.0.1 by @dependabot[bot] in #39
• README: rewrite to sell, add store badges + iOS screenshots by @rorystandley in #43
• Fix iOS App Store transcription: keep whisper FFI symbols through archive strip by @rorystandley in #44
• docs: add prioritized UX-additions section to the roadmap by @rorystandley in #45
• Pin notes to top with a Pinned section by @rorystandley in #46
• feat: undo delete + Recently Deleted with a 30-day purge window by @rorystandley in #47
• test: fix async throw assertions + cover irreversible delete paths by @rorystandley in #48
• Appearance controls: theme toggle, text size, editor measure by @rorystandley in #49
• Desktop keyboard shortcuts for the two-pane layout by @rorystandley in #50
• Esc clears search while typing on macOS (DismissIntent) by @rorystandley in #51
• Search that shows its work: highlighting, snippets, result count by @rorystandley in #52
• Note info sheet: timestamps, word/character count, reading time by @rorystandley in #53
• Swipe actions in the note list: pin and delete with haptics by @rorystandley in #54
• Markdown preview (read mode): headings, lists, links, tappable checkboxes by @rorystandley in #55
• Share & single-note export: native share sheet, copy as text, encrypted copy by @rorystandley in #56
• Trustworthy first run: zxcvbn strength meter + warmer empty state by @rorystandley in #57
• Release 0.4.0: version bump, changelog, Play release notes by @rorystandley in #58

Full Changelog: v0.3.1...v0.4.0

v0.3.1

What's Changed

• Add Play Store listing graphics by @rorystandley in #26
• ci: auto-publish to Google Play + add store badge by @rorystandley in #27
• ios: target iPhone-only for first App Store submission by @rorystandley in #28
• Fix lock screen title to say "Rune is locked" by @rorystandley in #30
• Add App Store iPhone screenshot set by @rorystandley in #29
• Add contributor automation: templates, labeler, stale bot, Dependabot, CodeRabbit by @rorystandley in #31
• Bump record from 7.1.0 to 7.1.1 in /app in the app-dependencies group by @dependabot[bot] in #38
• Bump lints from 5.1.1 to 6.1.0 in /packages/notes_core in the core-dependencies group by @dependabot[bot] in #37
• Bump actions/setup-java from 4.8.0 to 5.4.0 by @dependabot[bot] in #36
• Bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #35
• Bump actions/download-artifact from 4.3.0 to 8.0.1 by @dependabot[bot] in #34
• Bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by @dependabot[bot] in #33
• Bump actions/checkout from 4.3.1 to 7.0.0 by @dependabot[bot] in #32
• Ship real transcription, drop silent stub, single-source the version by @rorystandley in #40
• Fix release: fastlane gem perms + non-fatal Play publish by @rorystandley in #41

New Contributors

• @dependabot[bot] made their first contribution in #38

Full Changelog: v0.3.0...v0.3.1

v0.3.0

What's Changed

• [codex] Add optional biometric and OS-keystore unlock by @rorystandley in #24
• Release v0.3.0: optional biometric / OS-keystore unlock by @rorystandley in #25

Full Changelog: v0.2.0...v0.3.0

Rune v0.2.0

Highlights

Real on-device speech-to-text lands on macOS, Android, and iOS — voice
notes are transcribed entirely on your device with whisper.cpp (a bundled
quantized English model), no network. Verified transcribing real audio on a
physical Android device and a physical iPhone. Windows and Linux keep a
clearly-labelled stub until their native builds land.

• The microphone inside a note now appends to the open note instead of
  creating a new one.
• Fixed WAVE_FORMAT_EXTENSIBLE WAV decoding (e.g. macOS recordings).
• Fixed iOS release builds silently falling back to the stub.

Full notes in CHANGELOG.md.

Verifying this release

Every artifact carries SLSA build provenance and SHA256SUMS is cosign-signed —
see RELEASE.md → Verifying a release.

---

What's Changed

• Remove the F-Droid recipe from the app repo by @rorystandley in #13
• Add macOS on-device transcription (whisper.cpp) by @rorystandley in #14
• Decode WAVE_FORMAT_EXTENSIBLE WAV recordings by @rorystandley in #15
• Add Android on-device transcription (whisper.cpp) by @rorystandley in #16
• Make the gated whisper test runnable on-device; mark Android verified by @rorystandley in #17
• Document whisper.cpp submodule init in README setup by @rorystandley in #18
• Add iOS on-device transcription (whisper.cpp) by @rorystandley in #19
• Keep iOS whisper FFI symbols out of release dead-strip by @rorystandley in #20
• Voice note from the editor appends to the open note by @rorystandley in #21
• Docs: iOS transcription verified on a physical device by @rorystandley in #22
• Release v0.2.0: on-device transcription on macOS/Android/iOS by @rorystandley in #23

Full Changelog: v0.1.0...v0.2.0

v0.1.0

Rune 0.1.0

Private, local-first, encrypted notes — no cloud, no telemetry, no network.
First public release: a working MVP, not yet independently audited.

Everything you write is encrypted on your device with your passphrase (Argon2id
key derivation + XChaCha20-Poly1305). No account, no sync, no trackers — the app
makes no network calls at all.

In this release

• Passphrase-protected encrypted vault; encrypted at rest, a wrong passphrase can't decrypt.
• Notes: create, edit (autosave), delete, and local search.
• Lock / unlock; auto-lock on inactivity and when backgrounded.
• Encrypted backup export (plaintext export gated behind an explicit confirmation).
• Voice notes: local recording inserted into a note. On-device transcription is a clearly-labelled stub in this release (see the README).
• Apple-Notes-style UI: two-pane on desktop/tablet, single-pane on phone.

Downloads

Platform	File	Signing
Android	rune-android.apk / .aab	signed with the project's upload key
macOS	rune-macos.zip	Developer-ID signed + notarized
Linux	rune-linux-x64.tar.gz	—
Windows	rune-windows-x64.zip	—

(iOS via the App Store is planned.)

Verify your download

Every artifact carries SLSA build provenance, and SHA256SUMS is signed (keyless
cosign) by the release workflow — no maintainer keys are involved:

gh attestation verify <file> --repo rorystandley/rune
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-identity-regexp '^https://github.com/rorystandley/rune/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sha256sum -c SHA256SUMS

The Android build is reproducible — see docs/reproducibility.md.

Honest limitations

Working MVP, not independently audited; on-device transcription is a stub.
The threat model and the metadata that remains visible are documented in
SECURITY.md.