Tome v0.2.0

Tome v0.2.0 — first Tauri release

The Rust + Tauri rewrite of Tome. AI coding agents run in sandboxed terminal panes behind a network air gap — macOS seatbelt (sandbox-exec) and Linux bubblewrap network namespaces — with only an allowlisted loopback proxy between the agent and model-provider APIs. Pane grid with real popout OS windows, editors, documents, the conductor assistant, and flow DAGs.

These builds are unsigned (Apple Developer ID credentials are not configured yet). Gatekeeper will block first launch on macOS — right-click → Open, or remove the quarantine attribute:

xattr -dr com.apple.quarantine /Applications/Tome.app

Verifying your download

1. Checksums — download SHA256SUMS-macos-latest / SHA256SUMS-ubuntu-22.04 from the assets and compare:

   shasum -a 256 -c SHA256SUMS-macos-latest

2. Build provenance — the release workflow attested both checksum manifests with a Sigstore certificate whose identity is this exact workflow at this exact tag:

   • Rekor transparency log entry: https://search.sigstore.dev/?logIndex=2466844666
   • Signer identity: https://github.com/zwaneldmz/tome/.github/workflows/release-tauri.yml@refs/tags/v0.2.0
   • Workflow run: https://github.com/zwaneldmz/tome/actions/runs/31811496478

   You can inspect the certificate yourself:

   curl -s "https://rekor.sigstore.dev/api/v1/log/entries?logIndex=2466844666" |
     python3 -c "import json,sys,base64; e=json.load(sys.stdin); k=list(e)[0]; \
       b=json.loads(base64.b64decode(e[k]['body'])); \
       print(base64.b64decode(b['spec']['signatures'][0]['verifier']).decode())" |
     openssl x509 -noout -ext subjectAltName

Platform notes

• macOS: universal binary (Apple Silicon + Intel). Touch ID unlock works out of the box.
• Linux: x86_64 .deb / .rpm / .AppImage. Sandboxing needs bubblewrap (sudo apt install bubblewrap); on distros that restrict unprivileged user namespaces, see docs/THREATMODEL.md. Without bwrap, panes fall back to network-only containment.