b65f77e · P2P-Hiverelay

Changed files (12) +67 -29

CHANGELOG.md +3 -3

…	…	@@ -6,10 +6,10 @@ documented here. Dates in YYYY-MM-DD.
6	6
7	7	The packages are versioned in lockstep.
8	8
9		## [Unreleased] — 2026-07-29
	9	## [0.25.0-rc.8] — 2026-07-29
10	10
11		**Post-RC7 release repair. Requires a new prerelease identity before any fleet
12		deployment.**
	11	**Post-RC7 repair prerelease. The signed tag, image evidence, and separate
	12	canary promotion remain required before deployment.**
13	13
14	14	### Fixed — runtime and persistence
15	15

README.md +2 -2

…	…	@@ -14,7 +14,7 @@ and key-material fields at the schema boundary.
14	14	a one-page dashboard, first-run setup, wallet destination, service selection,
15	15	and persistent identity behind each platform's authenticated app proxy.
16	16
17		Open source (Apache 2.0) \| [GitHub](https://github.com/bigdestiny2/P2P-Hiverelay) \| [npm](https://www.npmjs.com/package/p2p-hiverelay) \| Status: v0.25.0-rc.7
	17	Open source (Apache 2.0) \| [GitHub](https://github.com/bigdestiny2/P2P-Hiverelay) \| [npm](https://www.npmjs.com/package/p2p-hiverelay) \| Status: v0.25.0-rc.8
18	18
19	19	The four packages are versioned in lockstep:
20	20
…	…	@@ -34,7 +34,7 @@ and StartOS metadata so the published release surfaces agree.
34	34
35	35	\| Surface \| Current source state \| Publication/evidence boundary \|
36	36	\|---\|---\|---\|
37		\| Core3 packages \| Monorepo and package manifests are at `v0.25.0-rc.7`; the last release with a captured multi-arch GHCR digest is `v0.20.2` \| A tag/release must run `npm run release:prepare` so versions, fleet channels, Umbrel, and StartOS metadata move together \|
	37	\| Core3 packages \| Monorepo and package manifests are prepared for `v0.25.0-rc.8`; its signed tag, multi-arch image, and release evidence are still pending \| The prerelease workflow must build and verify the digest-pinned image before any separate canary promotion \|
38	38	\| Blindspark on Umbrel \| In-repo package uses app proxy, persistent `/data`, review-mode default, and guarded setup/add-wallet/service-manager smoke paths with visible in-flight state \| Official App Store inclusion still needs the upstream `getumbrel/umbrel-apps` PR/review plus real-device `umbrel-runtime-review-evidence.json` \|
39	39	\| StartOS \| Source can build and verify a digest-pinned `.s9pk` from a published GHCR release image and publish to a configured registry \| Current `v0.20.2` package proof is blocked until `ghcr.io/bigdestiny2/p2p-hiverelay:0.20.2` resolves to a multi-arch digest; registry proof requires `startos-registry-evidence.json`; marketplace/community inclusion remains Start9 review-controlled \|
40	40	\| Raw fleet \| Pull updater, channel metadata, health gate, rollback, and rollout verifier are in-repo \| A release is live on the selected fleet only when `fleet-rollout-evidence.json` proves target SHA, package version, `/health.version`, and relay health \|

docs/LADDER-SHIP-MAP.md +8 -8

…	…	@@ -1,6 +1,6 @@
1	1	# Ladder ship map (chronological)
2	2
3		Date: 2026-07-29 · Status: living operator/product plan · Baseline: fleet canary `v0.25.0-rc.7` · stable `v0.24.3` · post-RC7 repair candidate in `codex/hiverelay-release-fleet-20260729`
	3	Date: 2026-07-29 · Status: living operator/product plan · Baseline: fleet canary `v0.25.0-rc.7` · stable `v0.24.3` · `v0.25.0-rc.8` repair candidate prepared in `codex/hiverelay-release-fleet-20260729`
4	4
5	5	> Two parallel tracks, one honesty ladder. Version tags and claim badges stay separate until a deliberate merge. Do not call the blind public-test pilot “fleet v0.25.0,” and do not claim rungs the current ship has not evidenced.
6	6
…	…	@@ -55,8 +55,8 @@ Marketing one-liner when both are live: **“Fleet v0.25.0 + Blind public-test o
55	55	\| Item \| State \|
56	56	\|------\|--------\|
57	57	\| Fleet channel \| canary `v0.25.0-rc.7` · stable `v0.24.3` · held `v0.24.3` \|
58		\| Repair candidate \| Post-RC7 tree: full Node unit 3559/3559, integration 107/107, lint, workspace audit, public-artifact audit, and npm package dry-runs green; requires a new prerelease identity before deployment \|
59		\| Scoped live health (2026-07-29) \| 9/10 permitted relays reachable; eight are healthy at their assigned target; `utah-8gb` is healthy but drifted at RC4 with its stable updater disabled; Bern is unreachable \|
	58	\| Repair candidate \| `v0.25.0-rc.8` package identity prepared: full Node unit 3561/3561, integration 107/107, lint, public-artifact audit, release mailbox benchmark, and npm package dry-runs green; signed tag and CI image evidence remain pending \|
	59	\| Scoped live health (2026-07-29) \| 9/10 permitted relays reachable; eight are healthy at their assigned target; `utah-8gb` is healthy on its signed RC4 hold with `CHANNEL=stable`, exact `PINNED_TAG=v0.25.0-rc.4`, and updater timer enabled/active; Bern is unreachable \|
60	60	\| Wake runtime \| `notify` loaded 9/9 reachable, but signed live egress 0/9 and exact-lane wake 0/9; seven stable relays still carry the old false `notify-v1` feature claim \|
61	61	\| Agent mailbox \| `outboxlog` loaded and signed-advertised on 7/9 reachable permitted relays; absent on canary Utah and drifted Utah-8GB \|
62	62	\| Privacy runtime \| two signed Tor endpoints, both restricted without a negative proof on their deployed versions; post-RC7 code suppresses that claim until the anonymous rejection probe succeeds \|
…	…	@@ -440,11 +440,11 @@ You can call the product ladder complete for honest marketing when:
440	440
441	441	## 9. Immediate next three moves (in order)
442	442
443		1. Name and ship the repair candidate: finish release gates, cut a new signed
444		post-RC7 prerelease, and deploy it to the permitted canary only. Correct
445		Utah-8GB's disabled stable updater separately: install the repaired updater,
446		set `CHANNEL=stable` plus `PINNED_TAG=v0.25.0-rc.4`, prove a no-op dry run,
447		then arm its timer. Do not fold a downgrade into a canary promotion.
	443	1. Sign and ship the prepared RC8 candidate: unlock the existing release
	444	signer, cut and push the signed `v0.25.0-rc.8` tag, and let CI build and prove
	445	the digest-pinned image. Promote only the permitted canary in a separate
	446	health-gated change. Utah-8GB's exact RC4 updater pin and timer repair is
	447	complete; do not fold a downgrade into the canary promotion.
448	448	2. Prove the claims on live canary: configure operator-owned push egress if
449	449	wake is a release claim; verify exact-lane wake, outboxlog persistence,
450	450	restricted-Tor negative probe, and the 100 MB onion transfer. Observe for

package-lock.json +8 -8

…	…	@@ -1,12 +1,12 @@
1	1	{
2	2	"name": "p2p-hiverelay-monorepo",
3		"version": "0.25.0-rc.7",
	3	"version": "0.25.0-rc.8",
4	4	"lockfileVersion": 3,
5	5	"requires": true,
6	6	"packages": {
7	7	"": {
8	8	"name": "p2p-hiverelay-monorepo",
9		"version": "0.25.0-rc.7",
	9	"version": "0.25.0-rc.8",
10	10	"hasInstallScript": true,
11	11	"license": "Apache-2.0",
12	12	"workspaces": [
…	…	@@ -8152,7 +8152,7 @@
8152	8152	},
8153	8153	"packages/client": {
8154	8154	"name": "p2p-hiverelay-client",
8155		"version": "0.25.0-rc.7",
	8155	"version": "0.25.0-rc.8",
8156	8156	"license": "Apache-2.0",
8157	8157	"dependencies": {
8158	8158	"@noble/hashes": "^2.2.0",
…	…	@@ -8166,7 +8166,7 @@
8166	8166	"corestore": "^7.11.0",
8167	8167	"hyperdrive": "^13.3.2",
8168	8168	"hyperswarm": "^4.17.0",
8169		"p2p-hiverelay": "^0.25.0-rc.7",
	8169	"p2p-hiverelay": "^0.25.0-rc.8",
8170	8170	"sodium-universal": "^5.0.1"
8171	8171	},
8172	8172	"engines": {
…	…	@@ -8206,7 +8206,7 @@
8206	8206	},
8207	8207	"packages/core": {
8208	8208	"name": "p2p-hiverelay",
8209		"version": "0.25.0-rc.7",
	8209	"version": "0.25.0-rc.8",
8210	8210	"license": "Apache-2.0",
8211	8211	"dependencies": {
8212	8212	"@grpc/grpc-js": "^1.14.4",
…	…	@@ -8282,14 +8282,14 @@
8282	8282	},
8283	8283	"packages/services": {
8284	8284	"name": "p2p-hiveservices",
8285		"version": "0.25.0-rc.7",
	8285	"version": "0.25.0-rc.8",
8286	8286	"license": "Apache-2.0",
8287	8287	"dependencies": {
8288	8288	"@noble/curves": "^2.2.0",
8289	8289	"@noble/hashes": "^2.2.0",
8290	8290	"@noble/secp256k1": "^3.1.0",
8291	8291	"b4a": "^1.8.1",
8292		"p2p-hiverelay": "^0.25.0-rc.7",
	8292	"p2p-hiverelay": "^0.25.0-rc.8",
8293	8293	"sodium-universal": "^5.0.1"
8294	8294	},
8295	8295	"engines": {
…	…	@@ -8329,7 +8329,7 @@
8329	8329	},
8330	8330	"packages/verifier": {
8331	8331	"name": "p2p-hiverelay-verifier",
8332		"version": "0.25.0-rc.7",
	8332	"version": "0.25.0-rc.8",
8333	8333	"license": "Apache-2.0",
8334	8334	"dependencies": {
8335	8335	"b4a": "^1.8.1"

package.json +1 -1

…	…	@@ -1,6 +1,6 @@
1	1	{
2	2	"name": "p2p-hiverelay-monorepo",
3		"version": "0.25.0-rc.7",
	3	"version": "0.25.0-rc.8",
4	4	"description": "Monorepo root for HiveRelay (Core + Services + Client)",
5	5	"private": true,
6	6	"type": "module",

packages/client/package.json +2 -2

…	…	@@ -1,6 +1,6 @@
1	1	{
2	2	"name": "p2p-hiverelay-client",
3		"version": "0.25.0-rc.7",
	3	"version": "0.25.0-rc.8",
4	4	"description": "Unified client SDK for HiveRelay (Core + Services). Talks to either via capability flags advertised by relay nodes.",
5	5	"type": "module",
6	6	"main": "index.js",
…	…	@@ -61,7 +61,7 @@
61	61	"corestore": "^7.11.0",
62	62	"hyperdrive": "^13.3.2",
63	63	"hyperswarm": "^4.17.0",
64		"p2p-hiverelay": "^0.25.0-rc.7",
	64	"p2p-hiverelay": "^0.25.0-rc.8",
65	65	"sodium-universal": "^5.0.1"
66	66	},
67	67	"engines": {

packages/core/package.json +1 -1

…	…	@@ -1,6 +1,6 @@
1	1	{
2	2	"name": "p2p-hiverelay",
3		"version": "0.25.0-rc.7",
	3	"version": "0.25.0-rc.8",
4	4	"description": "HiveRelay Core — minimal always-on P2P availability infrastructure (seeding, circuit relay, proof-of-relay, gateway)",
5	5	"type": "module",
6	6	"main": "core/index.js",

packages/services/package.json +2 -2

…	…	@@ -1,6 +1,6 @@
1	1	{
2	2	"name": "p2p-hiveservices",
3		"version": "0.25.0-rc.7",
	3	"version": "0.25.0-rc.8",
4	4	"description": "HiveRelay Services — application-layer services (AI inference, identity, schemas, SLAs, storage CRUD) that ride on top of HiveRelay Core",
5	5	"type": "module",
6	6	"exports": {
…	…	@@ -20,7 +20,7 @@
20	20	"@noble/hashes": "^2.2.0",
21	21	"@noble/secp256k1": "^3.1.0",
22	22	"b4a": "^1.8.1",
23		"p2p-hiverelay": "^0.25.0-rc.7",
	23	"p2p-hiverelay": "^0.25.0-rc.8",
24	24	"sodium-universal": "^5.0.1"
25	25	},
26	26	"engines": {

packages/verifier/package.json +1 -1

…	…	@@ -1,6 +1,6 @@
1	1	{
2	2	"name": "p2p-hiverelay-verifier",
3		"version": "0.25.0-rc.7",
	3	"version": "0.25.0-rc.8",
4	4	"description": "Independent reference verifier for HiveRelay — reads raw hypercores from multiple relays and reports divergence. Ships separately from the main client SDK so cross-client verification is meaningful (see docs/THREAT-MODEL.md action item #3).",
5	5	"type": "module",
6	6	"main": "index.js",

scripts/lib/audit-owned-diff.mjs +17 -0

…	…	@@ -82,6 +82,23 @@ export const AUDIT_OWNED_DIFF_SLICES = Object.freeze([
82	82	'test/unit/audit-owned-diff.test.js'
83	83	]
84	84	},
	85	{
	86	id: 'prerelease-version-identity',
	87	title: 'Lockstep prerelease package version identity',
	88	files: [
	89	'CHANGELOG.md',
	90	'README.md',
	91	'package.json',
	92	'package-lock.json',
	93	'packages/client/package.json',
	94	'packages/core/package.json',
	95	'packages/services/package.json',
	96	'packages/verifier/package.json',
	97	'scripts/lib/audit-owned-diff.mjs',
	98	'startos/README.md',
	99	'test/unit/audit-owned-diff.test.js'
	100	]
	101	},
85	102	{
86	103	id: 'hyperdrive-release-lifecycle',
87	104	title: 'Bounded Hyperdrive release rotation and scoped reclamation',

startos/README.md +1 -1

…	…	@@ -167,7 +167,7 @@ Three paths, smallest to widest reach:
167	167	## Status
168	168
169	169	Package source targets multi-arch image tarballs (x86_64 + aarch64),
170		v0.25.0-rc.7, one-page dashboard via `HIVERELAY_UI_SIMPLE`, review-mode first boot,
	170	v0.25.0-rc.8, one-page dashboard via `HIVERELAY_UI_SIMPLE`, review-mode first boot,
171	171	and a first-boot-only 10 GB storage cap. Current `v0.20.2` package verification
172	172	is externally gated on the published GHCR image/tag and digest; once that image
173	173	exists, `make verify IMAGE_DIGEST=sha256:<multi-arch-digest>` is the release

test/unit/audit-owned-diff.test.js +21 -0

…	…	@@ -222,6 +222,27 @@ test('audit-owned diff assigns the Hyperdrive release lifecycle surface', (t) =>
222	222	}
223	223	})
224	224
	225	test('audit-owned diff assigns lockstep prerelease version surfaces', (t) => {
	226	const paths = [
	227	'CHANGELOG.md',
	228	'README.md',
	229	'package.json',
	230	'package-lock.json',
	231	'packages/client/package.json',
	232	'packages/core/package.json',
	233	'packages/services/package.json',
	234	'packages/verifier/package.json',
	235	'startos/README.md'
	236	]
	237	const report = buildOwnedDiffReport(paths.map(file => ` M ${file}`).join('\n'))
	238
	239	t.is(report.status, 'pass')
	240	t.is(report.totals.unknown, 0)
	241	for (const entry of report.entries) {
	242	t.ok(entry.owners.some(owner => owner.id === 'prerelease-version-identity'), entry.path)
	243	}
	244	})
	245
225	246	test('audit-owned diff blocks unknown development paths', async (t) => {
226	247	const fixture = await tempFile(t, '?? stray-release-note.txt\n')
227	248	const res = await runAudit(['--json', '--status-file', fixture])

P2P-Hiverelay commits / b65f77e

Changed files (12) +67 -29