Releases: winnowwallet/winnow
Release list
v0.6.0
Winnow v0.6.0 adds People and shared savings and brings the app and its Bitcoin modules into one release.
TestFlight 0.6.0 (26) is available to internal testers. As of September 7, 2026, Apple is blocking external submission while the earlier 0.6.0 build 25 is awaiting beta review. Build 26 has not yet been submitted for external review.
- Share a public People card, pay a saved person to a fresh address each time, and create shared Taproot savings with approval requests.
- Use the four-tab everyday wallet; Advanced mode exposes network, peer, explorer and vault controls.
- Improve interrupted reorg recovery, wallet persistence, in-flight coin reservations, descriptor and PSBT handling, header difficulty checks and filter-header agreement.
- Share one package, dependency lockfile and validation pipeline across the app, Bitcoin modules, CLI and development tools. Remove unused Silent Payments hooks.
- Expand regression and fuzz coverage, reject silently skipped tests, and publish reproducible source counts and build provenance.
This remains an early-access TestFlight release. The P2WSH Safe is planned for 0.7; it is not included here.
The 29 commits since v0.5.5 are condensed into one release commit, a4b3ea. Application source matches d391989, and existing release tags are unchanged. The tagged repository contains 44,129 lines of code under its CI counting policy: 18,428 app/library/CLI, 17,590 tests, 3,161 webpages and 4,950 tooling. The attached loc.md, loc.json and loc.csv provide the breakdown and counting method.
Pre-release validation passed: package tests on both architectures, story tests, complexity and skip gates, production builds, CLI checks, deterministic fuzzing, 142 app tests, Bitcoin Core differential tests and simulator UI journeys.
Build 26 publication succeeded from the unchanged v0.6.0 tag. The attached SPDX SBOM and build provenance identify that source commit and the signed app archive.
v0.5.5
v0.5.5 — the explorer gets a picker, the wallet gets a spine
The one visible change: the warned external explorer is a picker now —
blockstream.info by default, mempool.space, or a custom Esplora site —
persisted per network, with the honest wrinkle that blockstream has no
signet explorer, so that preset opens mempool.space while on signet
and the Settings line says so before any tap.
The invisible change is the larger one: the Bitcoin implementation
lives in its own repository, btc-swift, and this app pins an exact
revision of it. Every function in both repositories now sits at seven
decision paths or under, with CI refusing anything past eight. This
release is also the first through the peer-freshness gate that
replaced release-time regeneration when the peer list moved out with
the library.
Supply-chain note: the post-upload SBOM step failed on this release (fixed in the next commit), so the app-archive-subject attestation is absent for this build. Attached instead: the deterministic source-tree SBOM and provenance regenerated from the tagged commit, which is what they cover; archive attestation resumes with the next release.
v0.5.4
v0.5.3
v0.5.2
v0.5.1
v0.5.0
v0.5.0 — evidence over inspection
The release that turned "reviewed by reading" into observation, and found
five defects doing it — none reachable by reading code.
A serialized script larger than MAX_SCRIPT_SIZE is consensus-legal, and
refusing to parse one froze a live scan permanently at the first real block
carrying one: found by a sustained signet soak within its first hour, fixed,
and verified in the field by the frontier moving again. The privacy cover
leaked a window per background cycle. An error message echoed imported
descriptors — which can carry private keys — back onto the screen. The secret
detector caught an xprv in prose but missed a recovery phrase with any text
around it. And the differential harness deadlocked on any reply over 64KB,
which had silently capped what it could ever check.
Silent payments moved out of the shipped app to the alpha branch, behind a
fail-closed refusal: a wallet holding a silent-payment coin will not open in
a build that cannot spend it, and says where it can. Bitcoin Core now
co-signs a 2-of-3 vault script-path spend on chain — the mixed-implementation
evidence the gate asked for — and the bundled fallback peers are generated at
release time by the wallet's own handshake instead of curated by hand.
The reorg edge case closes: a spend whose confirming block is disconnected is
re-pended, its inputs stay reserved, and the broadcaster re-announces it. The
review screen says when a locktime will lag the tip. The cfheaders cross-check
pair spans peer source classes, so one acquisition channel can no longer agree
with itself. The story runner moved to its own repository.
v0.4.0
v0.4.0 — reorg safety and the relay's rough edges
The wallet now survives its chain being rewritten. Spent coins are marked
rather than deleted, so a rollback has something to restore; a reorg rolls
the wallet back through a crash-safe marker that fails closed in both
directions; a pending tombstone gains its height when the spend confirms.
Relay grows up: a damaged relay store is quarantined instead of silently
stopping sync, transactions are copyable (raw bytes withdrawn once
confirmed), every send stamps an anti-fee-sniping locktime matching Core's
distribution, and a disproportionate fee warns before signing. Slow peers
cool off exponentially instead of being banned for the session — the fix for
"peers are lagging me out" — and header persistence appends instead of
rewriting the whole file, which had made every sync slower than the last.
The cfcheckpt majority rule runs for the first time on a fixture tall enough
to reach it, and what it caught is recorded: evict-and-continue rather than
halt, and no trust for a peer that replaced an evicted liar. Signer
independence is proven structurally instead of sampled. CI stops asserting on
wall-clock time, and fork code stays off the persistent runner.
v0.3.0
v0.3.0 — the security epic
Fifty-odd commits of adversarial hardening across every invariant the wallet
claims, produced under a standing rule: every guard observed failing before
it was believed, mutations run against every new test.
The money path: the pre-broadcast gate authorizes the payment outputs
themselves — not just fee and inputs — send and bump reviews bind to exactly
what gets signed, stale or mutated reviews fail closed, spending operations
are mutually exclusive, and vault economics are validated inside core
signing. Vaults: signers must be distinct keys (relabelling included), every
2-of-3 signing pair proven end to end, MuSig2 nonces one-use and
interruption-safe, taproot tree depth bounded at parse.
The read side: damaged wallet, vault, header, and relay storage each fail
closed and distinctly; disagreeing peers cannot advance the scan; reorgs
become visible to their consumers; hostile PSBT and import-bundle parsing is
bounded and linear; a deterministic fuzz runner covers nine surfaces.
The app: wallet secrets require authentication to create, import, sign, and
export; the app switcher sees a cover, not a balance; clipboard copies carry
stated policies; the E2E journal is inspected by value, so a seed filed under
any field name is refused; release archives are gated against E2E controls.
The paper trail ships with the code: the limited-mainnet gate report, the
invariant matrix, and the findings register — verdict NO-GO, on evidence,
with the reasoning public. MIT licensed.
v0.2.0
v0.2.0 — a mainnet sync that finishes
The performance release. A fresh mainnet wallet reaches the tip in around
eight and a half minutes: header sync starts from a shipped checkpoint whose
provenance is derived rather than asserted — generated by syncing from
genesis with this code, reproducible by anyone via the same path — with
verify-from-genesis kept as a setting. The header chain learns to start
somewhere other than genesis, and a first real mainnet test taught two
lessons that landed as fixes, including wallet deletion.
Correctness alongside: coinbase outputs wait their hundred confirmations,
P2PKH scriptSig windows index correctly, and silent-payment UTXOs are watched
so compact filters see their spends.
The site becomes source-of-truth pages — the build that regenerated them is
deleted — the custody ladder is published, and the talk becomes a live
walkthrough with a measured nineteen seconds per transaction.