Skip to content

Locus v0.1.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Nov 10:50
v0.1.6
2d3aba8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

On-device GGUF models you can find and download inside Locus, a calmer chat for long agent tasks, a self-test and a storage screen, and every screen reworked after a full UI audit. This is also the first Locus release whose APKs reproduce byte for byte from source, so F-Droid can verify and publish Locus's own signed APKs.

Highlights

  • GGUF models on the phone. Run llama.cpp models alongside Gemma. Pick from a short list of small models that call tools, search Hugging Face, or add a model by URL or file. Downloads run in the background, resume where they stopped, and are checked against their published SHA-256.
  • Small models no longer loop on tools. On-device models under 1B parameters are now Chat only, new chats on them send no tool list, and every model stops after three steps in a row where every tool call was refused.
  • A calmer chat for long tasks. Each turn's work folds into one section, repeated test runs are one row, and the plan and composer share one band at the bottom.
  • Self-test and Storage in Settings → About & privacy → Diagnostics. Storage now counts GGUF models too.
  • Helpers hand back what they had when they time out or are stopped, and the helper time limit is a setting.
  • Clearer failures. ChatGPT and OpenAI errors say what failed, with Details and a way out. A check no longer says "passed" over a failed build.
  • UI audit. Every screen is on the design system, readable at 200% font, with AA contrast and tool names in words.
  • Security. Skills, helpers and the persona are sealed against changes made from Linux, workspace writes can't be redirected by a link, and local MCP servers' secrets are hidden from the rest of Linux.
  • Reproducible, attested releases. The APKs reproduce byte for byte apart from the signature, are signed in a separate job that never runs the build, and carry a build provenance attestation.

Full list: CHANGELOG.md.

Most of this is unit-tested and hasn't been tried on a phone yet; docs/STATE.md keeps the list. Locus is in active development, and the way data is stored can still change between versions.

Install

Download locus-v0.1.6-arm64-v8a.apk below and open it on an Android 8.0+ phone (allow installs from your browser or file manager when asked). It's the one for nearly every phone; locus-v0.1.6-x86_64.apk is for x86_64 Chromebooks and emulators. Both are signed with Locus's release key and install over earlier releases.

Checksums (SHA-256)

268ce18985c3868c92d1665983b471d63e99fe6e3e767dd2f7dcee9494601b1e  locus-v0.1.6-arm64-v8a.apk
c150bc5e3e36cb80d8ccf28ea06c00205325c8a2fc0e7bc98b26470919183784  locus-v0.1.6-x86_64.apk
22add3fbf83042b04475516b0b48afaa2dc7d6bbad9762f66d6a62dfa7788f2f  locus-v0.1.6-mapping.txt

Verify

sha256sum -c SHA256SUMS.txt
apksigner verify --print-certs locus-v0.1.6-arm64-v8a.apk
# certificate SHA-256 digest: 0fc4ab07aa5522dfabac92d818fd5cf075ead96da4e2b40a757ac80541490e1b
gh attestation verify locus-v0.1.6-arm64-v8a.apk --repo springmusk026/locus \
  --signer-workflow springmusk026/locus/.github/workflows/release.yml

To check it reproduces: in a fresh clone of the tag, run ./gradlew :app:assembleRelease -Plocus.abi=arm64-v8a -Plocus.unsigned=true, then apksigcopier compare locus-v0.1.6-arm64-v8a.apk --unsigned app/build/outputs/apk/release/app-arm64-v8a-release-unsigned.apk. Details in docs/FDROID.md.

The R8 mapping (locus-v0.1.6-mapping.txt) turns stack traces from these APKs back into readable names.

Assets 6
Loading