latest (1.0.0)

conflux 1.0.0, built from cd4a1fb963b55e4048440d706e9ab6dc71cfd9b3 on version3, with anchor's newest release build embedded.

Changes since 1.0.0-pre

anchord: root, or a capability, only where the host needs it (#24)

anchord is the network-facing daemon, and it ran as root in every mode. It now runs as conflux's own unprivileged account wherever that costs no operation and no function. It keeps exactly what the host and the configuration need, and conflux status says what it has and why. The supervisor (conflux serve) stays root. anchor itself is unchanged: this uses anchord's existing flags only.

One-line installers; release notes that summarise (#22)

conflux can now be installed with one command, curl -fsSL https://raw.githubusercontent.com/veil-net/conflux/HEAD/install.sh | sh (or irm …/install.ps1 | iex on Windows), which installs the binary and starts nothing; conflux up stays the user's to run. Release notes now summarise each pull request instead of listing every commit. No Go code changes.

Release at the version and at latest; conflux update; 1.0.0 (#21)

Releases are reworked, the anchor release fetcher is renamed, and conflux can now update itself. VERSION becomes 1.0.0.

maintenance 2026-10-13: anchor 3a4b842, one supervisor per root, stamped set, pinned actions (#20)

Maintenance pass of 2026-10-13. conflux is synced to anchor 3a4b842 (origin/main, which is also the shelf's commit) and to the live API at api.veilnet.com.au. The embedded pair was rebuilt from anchor's pinned make release using the pin derived from the live genesis, which matches the shelf manifest's pin.

maintenance 2026-10-06: taints are the credential's (#19)

Maintenance run in step with anchor d8142295 (synced from and to the same commit) and the live traveller API.

maintenance: in step with anchor 7b9ae67 and the live API (#18)

Maintenance run of 2026-10-04: anchor synced at 7b9ae67, binaries rebuilt from its pinned make release, live API at api.veilnet.com.au compared and exercised.

enrol: install a credential that does not renew (#17)

conflux enrol now installs a credential that carries no renewal fields at all (no renewalUrl, no renewalAuth), and the rest of conflux stops trying to renew one.

Maintenance 2026-09-29: anchor's exit, export and uplink rules; CI cache; redaction (#16)

Maintenance run against anchor 4965e6e (unchanged since the last sync) and the live API at api.veilnet.com.au, with the embedded pair rebuilt from anchor's pinned make release.

Maintenance 2026-09-28: thirty-day window, supervisor hang, faster builds and fetch (#15)

Maintenance pass against anchor 0e68ba25 (no new anchor commits since the last sync) and the live API at api.veilnet.com.au.

Maintenance: realign with anchor and the live API; fixes, speed-ups, leaner CI (#14)

A maintenance pass over the whole repo: realigned with anchor 80a2ee8 and the live API at api.veilnet.com.au, with fixes, speed-ups, CI restructuring and docs. Each commit is one area and explains itself.

Every merge to version3 releases; the gate stopped deciding whether to (#13)

The release workflow's only question was whether the string in VERSION was already a published tag. VERSION has read 1.0.0-pre since 13 September and that release exists, so every merge to version3 since then has shipped nothing:

Anchor-native enrolment: honour renewalAuth, import a guardian manifest, persist the export block (#12)

Conflux's side of the guardian exchange. The other half is veilnet-admin/guardian, and the two were written against one contract document that lives in that repository: docs/contracts/guardian-node.md.

A Mac brought the anchor up twice, and Windows waited ten seconds for a signal it never sent (#11)

Three separate reasons conflux up took so much longer off Linux, and one reason an uninstalled Mac could never be installed again.

Shipping an anchor fix should not cost a version number (#10)

anchor cut four fixes since 1.0.0-pre was published — #25 through #28, the newest of them three defects found under the mobile binding — and its shelf now serves a pair built from e37605e. None of them can reach a conflux user, and this tree is the reason.

FETCH=1 is a fallback, and a stale local release was answering instead (#9)

Re-syncing conflux against anchor 844c805 needed the shelf build, and make anchor-bins FETCH=1 quietly did not fetch it — ../anchor/release was older than the commit under test and wins outright. The three-source precedence was already documented; that FETCH=1 is the last of the three rather than a source to prefer was not, and the only thing separating a good run from a stale one is one word in one line of output.

Pushed to version3 directly

• skill: utility checks local before every push, code testing in CI only (1ca903d)
• skill: run nothing locally that CI runs (eb7cd7c)
• skill: verify through the PR's CI, then merge (3ca37a7)
• Add the conflux-maintenance skill [skip ci] (00901a5)
• Updated readme (2f531ae)
• Refactor release workflow to remove overwrite input and clarify republish conditions (80de3dc)

Full diff: 1.0.0-pre...1.0.0

Install

curl -fsSL https://raw.githubusercontent.com/veil-net/conflux/HEAD/install.sh | sh

On Windows, in PowerShell as Administrator:

irm https://raw.githubusercontent.com/veil-net/conflux/HEAD/install.ps1 | iex

Then sudo conflux up. Already installed? sudo conflux update.

What is inside

Each binary carries the anchor pair for its own platform. Verify what you have with conflux version:

conflux 1.0.0 (cd4a1fb963b55e4048440d706e9ab6dc71cfd9b3) linux/amd64
anchor set 7db4e87f963e942b
  anchord    dd6fe5af331392d46e7fe3bf071c36d76411f3bb3a74689c1e8352447d3cd464
  anchorctl  105ab85c6ea12199f2314bcae9e054a3a98d0f50261167cf7e56c797fe772a4c

Windows TUN mode additionally needs wintun.dll, which conflux downloads and verifies when it is first needed:
Version = "0.14.1"
ZipSHA256 = "07c256185d6ee3652e09fa55c0b673e2624b565e02c4b9091c79ca7d2f24ef51"