v0.3.0 — public app release candidate
This release turns the validated Nextcloud provider core into a production-deployment and OpenAI
review candidate while preserving the separation between bridge identity and Nextcloud credentials.
Highlights
- OAuth-protected stateless universal MCP application
- isolated multi-user identity, connection, profile, and encrypted credential stores
- Nextcloud Login Flow v2 without password collection
- DNS-rebinding-resistant HTTPS egress and network-isolated Docker composition
- rate limits, request limits, trusted hosts, security headers, health, migrations, and maintenance
- exact public-endpoint release preflight
- complete hosted tool contracts and reviewer cases
- Codex plugin package, original project artwork, and public landing-site source
Compatibility
The unchanged WebDAV/OCS provider core has passed live read, write, move, download, and cleanup
validation against Nextcloud 33.0.7, including the extended app/share/household flow. Native
Nextcloud Context Agent MCP was unavailable, so that run exercised the intended standards fallback.
Release boundary
This tag publishes source and reproducible artifacts. It does not activate a public hosted service,
claim OpenAI approval, or include production credentials. Real OAuth, domains, operator policies,
reviewer accounts, domain verification, and OpenAI review remain deliberate deployment actions.
See submission/FINAL_CHECKLIST.md for the exact handoff.