NarrowsLink v0.2.0

NarrowsLink v0.2.0

NarrowsLink v0.2.0 moves the full protocol-portable investigation and handoff workflow into the packaged operator release, then makes field setup repeatable before evidence recording begins.

What changed

• Save bounded local capture profiles containing transport settings and the exact decoder pack. Profiles exclude bridge credentials, browser device permission, session names, and telemetry payloads.
• Run live UDP or Web Serial preflight before recording. Preflight reports source state, traffic and byte rate, last-input age, valid and malformed frames, checksum failures, message families, and UDP endpoints.
• Establish an explicit evidence boundary after preflight. UDP stops and discards the probe before opening a new owned capture ID; serial keeps the selected port open, resets framing, and routes only future reads to the recorder.
• Diagnose traffic-without-decoder-fit before capture while preserving an operator escape hatch to record malformed or unexpected evidence with a visible warning.
• Package the decoder-pack architecture, NMEA 0183 support, in-application evidence receiver, bounded comparative replay, cancellable worker processing, and 200,000-record replay envelope introduced since v0.1.0.
• Preserve v0.1 session, library, workspace, and evidence compatibility. Existing browser data remains tied to the same loopback origin and browser profile.

Release assets

• narrowslink-0.2.0.tgz
• narrowslink-0.2.0.release.json
• narrowslink-0.2.0.cdx.json
• SHA256SUMS

Verify the checksum set before installation:

shasum -a 256 -c SHA256SUMS

On GNU/Linux, use sha256sum -c SHA256SUMS.

Install without lifecycle scripts:

npm install --global ./narrowslink-0.2.0.tgz --ignore-scripts
narrowslink version --json
narrowslink serve

Compare the reported version and commit with narrowslink-0.2.0.release.json. Keep the default http://127.0.0.1:47890 origin and the same browser profile to retain access to the existing local session library and operator workspace.

Verification boundary

The release workflow builds the package twice from the annotated tag, requires byte-identical assets, runs the complete source gate, and exercises the unpacked package through live UDP preflight, capture, replay, evidence export, receiver verification, comparison, persistence, recovery, and removal in Chromium, Firefox, and WebKit.

Automated Web Serial coverage uses the public browser API with an injected device. Physical USB adapters, drivers, native permission prompts, operating-system disconnect behavior, manual screen-reader combinations, and actual multicast network infrastructure remain separate manual acceptance boundaries.

Checksums and canonical identities establish internal consistency. NarrowsLink v0.2.0 artifacts, decoder packs, sessions, bundles, and comparison findings remain unsigned and do not independently establish publisher, operator, source-channel, or build-environment authenticity.

NarrowsLink v0.1.0

NarrowsLink v0.1.0

NarrowsLink v0.1.0 is the first maintainer-authorized local operator release. It packages the production mission-timeline workspace, authenticated UDP bridge, deterministic Harbor relay fixture, and offline evidence receiver into one dependency-free distribution.

Install

Download all four release assets into one directory:

• narrowslink-0.1.0.tgz
• narrowslink-0.1.0.release.json
• narrowslink-0.1.0.cdx.json
• SHA256SUMS

Verify and install the exact published bytes:

shasum -a 256 -c SHA256SUMS
npm install --global ./narrowslink-0.1.0.tgz --ignore-scripts
narrowslink version --json
narrowslink serve

Node.js 20.19 or newer and a local browser are required. A repository checkout, Vite, and project dependencies are not.

Release evidence

The release gate builds the package twice from separate staging directories and requires byte-identical archives. It then installs and unpacks the archive outside the repository and exercises a real loopback UDP capture through replay, an operator-authored incident, .nlb export, and verification by the receiver CLI shipped in those same release bytes. The external manifest records the exact version, commit, source tree, build epoch, toolchain, lockfile, and packaged payload hashes. The package, external manifest, and normalized CycloneDX SBOM are covered by SHA256SUMS.

The v0.1 tag, release assets, and same-channel checksum file are unsigned. Checksum verification establishes internal byte consistency, not publisher or build-environment authenticity; confirm the expected tag and commit through a separately trusted channel when that distinction matters.

Compatibility and data

The v0.1 release accepts unchanged session format v1 and v2 files and verifies evidence bundle format v3. Saved sessions, markers, notes, and authored ranges remain in browser storage at the stable http://127.0.0.1:47890 origin when the package is upgraded or uninstalled. Exported .nlsession and .nlb files are never removed by package operations.

Evidence bundles remain unsigned. A passing receiver report establishes internal consistency and describes available capture and provenance evidence; it does not establish author or source-channel authenticity.

See the tagged CHANGELOG for the complete v0.1.0 change record and README for operation, upgrade, removal, formats, and current limits.