v0.5.1

What's new in v0.5.1

Fixed

• The daemon no longer crashes at boot when the login keychain is locked. A
  required secret stored under @keyring (e.g. OPENAI_API_KEY) whose keychain
  read timed out — common when the login keychain is locked or slow at daemon
  launch — raised during config hydration and took down the whole node, leaving
  the setup UI (the very surface used to fix it) unreachable. Boot now leaves the
  @keyring sentinel in place and logs the failure (the same graceful handling
  optional secrets already had) instead of crashing; the secret resolves on the
  next boot once the keychain is reachable.
• fermix setup no longer opens the browser before the endpoint is live. On a
  readiness timeout the launcher printed the URL but still opened the browser,
  landing on "Safari can't connect to the server". It now opens the browser only
  once the endpoint actually answers; on timeout it hands back the URL to open
  manually.
• The setup 403 page is now actionable. Reaching the token-gated /setup page
  without an authorized session returns setup authorization required plus a line
  telling you to run fermix setup (the only thing that authorizes a browser
  session), instead of a bare error.

Verifying signatures

Each binary is signed with cosign using GitHub Actions OIDC keyless signing. Verify a download with:

cosign verify-blob \
  --certificate fermix_<target>.pem \
  --signature  fermix_<target>.sig \
  --certificate-identity-regexp "https://github.com/tezra-io/fermix/.github/workflows/release.yml@.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  fermix_<target>

The releases.json artifact lists every binary's URL, sha256, and signature URLs.