v1.12.7

What's Changed

• catalogue: add io.pilot.primitive v1.0.0 (Primitive — email for AI agents) by @Alexgodoroja in #385
• appstore install: render the product demo at the last step by @Alexgodoroja in #395
• catalogue: backfill product demos into all 19 apps (signed) by @Alexgodoroja in #398
• pilotctl: render next-steps after every appstore call by @Alexgodoroja in #396

Full Changelog: v1.12.6...v1.12.7

v1.12.6

What's Changed

• ci: add zone-2 cascade receiver (daily-coalesced bump PRs) by @TeoSlayer in #370
• chore: update legacy TeoSlayer references to pilot-protocol org by @TeoSlayer in #371
• cascade: secrets inherit (App-token bump PRs) by @TeoSlayer in #372
• Fix pilotctl help drift: recv defaults, broadcast flags, quickstart banner by @TeoSlayer in #373
• fix(envelope): authenticate before committing replay state (remote-DoS) by @TeoSlayer in #374
• updater: correct --skip-attestation help (verification is now gh-free) by @TeoSlayer in #375
• catalogue: io.pilot.insforge v1.0.0 by @Alexgodoroja in #376
• catalogue: io.pilot.orthogonal v0.1.1 by @Alexgodoroja in #377
• catalogue: io.pilot.mysql v9.7.1 by @Alexgodoroja in #378
• catalogue: io.pilot.didit v1.0.0 by @Alexgodoroja in #379
• catalogue: io.pilot.tldr v1.13.1 by @Alexgodoroja in #380
• fix(nightly): repair WSS compat-auth skew + stale enterprise-gate test assertions by @TeoSlayer in #381
• nightly: serialize integration jobs to end runner starvation by @TeoSlayer in #382
• nightly: env-gate real-network integration tests off hosted runners by @TeoSlayer in #383
• nightly: gate 8 more load-dependent network tests (round 2) by @TeoSlayer in #384
• daemon: rx-watchdog also detects the partial (outbound-dial) wedge by @TeoSlayer in #387

Full Changelog: v1.12.5...v1.12.6

v1.12.5

What's Changed

• chore(deps): bump github.com/pilot-protocol/common from 0.5.5 to 0.5.6 by @dependabot[bot] in #337
• chore(deps): bump github.com/pilot-protocol/trustedagents from 0.2.3 to 0.2.4 by @dependabot[bot] in #338
• chore(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #336
• fix(gosec): handle resp.Body.Close in catalogue httpGet (G104) by @Alexgodoroja in #325
• catalogue: io.pilot.postgres v17.5.0 (PostgreSQL 17.5.0 — native CLI) by @Alexgodoroja in #340
• catalogue: io.pilot.agentphone v0.1.0 by @Alexgodoroja in #334
• catalogue: io.pilot.duckdb v1.5.4 (DuckDB — in-process analytical SQL) by @Alexgodoroja in #341
• catalogue: remove io.pilot.agentphone (non-functional — broker unregistered) by @TeoSlayer in #344
• catalogue: io.pilot.docker v29.6.1 (Docker — Engine + CLI, Linux) by @Alexgodoroja in #343
• catalogue: io.pilot.redis v8.6.2 (Redis — local in-memory data store) by @Alexgodoroja in #342
• catalogue: io.pilot.slipstream — add linux/amd64 bundle by @TeoSlayer in #345
• catalogue: io.pilot.aegis v0.1.3 (AEGIS — runtime firewall) by @Alexgodoroja in #346
• catalogue: io.pilot.smol 1.2.0 (Smol Machines — local + cloud microVMs) by @Alexgodoroja in #347
• Add envelope sign/verify IPC commands and pilotctl front-ends by @TeoSlayer in #350
• catalogue: add io.pilot.bowmark v0.1.0 by @Alexgodoroja in #351
• fix(install): support PILOT_TRANSPORT env var for compat mode (PILOT-222) by @matthew-pilot in #349
• fix(install): capture tar extraction diagnostic output on darwin-arm64 (PILOT-221) by @matthew-pilot in #348
• catalogue: add io.pilot.sqlite 3.45.2 (native SQLite CLI) by @Alexgodoroja in #354
• catalogue: add io.pilot.orthogonal v0.1.0 by @Alexgodoroja in #353
• catalogue: io.pilot.agentphone v0.3.0 by @Alexgodoroja in #352
• fix(pilotctl,install): stop claiming pilot-gateway ships with the install by @TeoSlayer in #355
• daemon: inbound-path watchdog — auto-recover the long-uptime NAT wedge by @TeoSlayer in #369

Full Changelog: v1.12.4...v1.12.5

v1.12.4

What's Changed

• catalogue: io.telepat.ideon-free v0.3.1 by @Alexgodoroja in #326
• catalogue: pin io.telepat.ideon-free publisher (v1.12.3 anchor fix) by @Alexgodoroja in #327
• ci: use native temp dir to fix macOS TempDir flake by @TeoSlayer in #329
• catalogue: add io.pilot.slipstream v1.0.0 by @TeoSlayer in #330
• catalogue: refresh pins on a miss (newly-pinned apps spawn without a daemon restart) by @Alexgodoroja in #328
• catalogue: add io.pilot.miren v0.1.0 by @Alexgodoroja in #331
• fix(pilotctl): surface app store + missing commands in help and context by @Alexgodoroja in #332
• fix(catalogue): metadata consistency fixes by @TeoSlayer in #302
• catalogue: add io.pilot.otto v0.20.0 by @Alexgodoroja in #333
• catalogue: add io.pilot.plainweb v1.0.0 by @Alexgodoroja in #335
• pilotctl: appstore outdated + upgrade (client-side app updates) by @Alexgodoroja in #339

Full Changelog: v1.12.3...v1.12.4

v1.12.3

What's Changed

• Fix gitleaks license gate and macOS test TMPDIR in CI by @TeoSlayer in #312
• Harden daemon IPC/transport correctness and DoS sizing by @TeoSlayer in #314
• Use writable /tmp TMPDIR for tests on both CI runners by @TeoSlayer in #316
• Fix config and CLI correctness/safety bugs in pilotctl by @TeoSlayer in #313
• Harden app-store install path and cap-state reads by @TeoSlayer in #315
• catalogue: publish Smol Machines (io.pilot.smolmachines v1.2.0) [needs re-sign] by @Alexgodoroja in #319
• appstore: carry install.json/install.sh on install + wire trust anchor by @Alexgodoroja in #318
• daemon: drop PILOT_TRUSTED_PUBLISHERS wiring (catalogue is the trust anchor) by @Alexgodoroja in #320
• chore(release): CHANGELOG for v1.12.0 by @TeoSlayer in #300
• docs: staged TLS+pinning rollout for registry transport (H1) by @TeoSlayer in #310
• Update README.md by @TeoSlayer in #299
• go.mod: bump app-store to the proc.exec version by @Alexgodoroja in #317
• Pin app-store to v1.0.1 release tag by @TeoSlayer in #321
• Fan out release to PyPI, npm, and Homebrew by @TeoSlayer in #322
• Drop push-based downstream fan-out in favor of self-polling by @TeoSlayer in #323
• daemon: anchor catalogue apps to the catalogue publisher pin (companion to app-store#25) by @Alexgodoroja in #324

Full Changelog: v1.12.2...v1.12.3

v1.12.2

Round-2 security audit fixes + CI/supply-chain hardening.

Client/daemon fixes:

• Fix daemon rotate-key data race: old Ed25519 private key was zeroed while a concurrent signer could still read it (use-after-zero on signing material).
• pilotctl recovery now backs up identity.json before overwriting it.
• Auto-updater: fail closed when gh is absent (SLSA attestation can no longer be silently skipped); bump updater to v0.2.3; add --skip-attestation / PILOT_UPDATER_SKIP_ATTESTATION opt-out.
• Repoint dead changelog/MOTD feed URLs to the pilot-protocol org.

Security CI + evals:

• Add CodeQL, gosec, govulncheck, gitleaks, dependency-review gating and adversarial fuzz/eval suites (badge IPC, keyexchange frames, node-binding).
• Bump toolchain to go 1.25.11 (stdlib advisory fixes).

What's Changed

• Add pilotctl auto-update control surface (off by default) by @TeoSlayer in #304
• catalogue: sixtyfour v2 bundles map (fix macOS + Linux install) by @Alexgodoroja in #306
• Security hardening batch: updater attestation opt-out, recovery backup, feed repoint, trust-pin TODO by @TeoSlayer in #307
• Fix data race between key rotation and registry signer by @TeoSlayer in #308
• Bump updater to v0.2.3 for fail-closed attestation by @TeoSlayer in #309
• Add supply-chain CI gates and adversarial fuzz evals by @TeoSlayer in #311

Full Changelog: v1.12.1...v1.12.2

v1.12.1

What's Changed

• Fix NAT keepalive dropped by src-binding; flow poll retry; recover test by @TeoSlayer in #303

Full Changelog: v1.12.0...v1.12.1

v1.12.0

What's Changed

• test(daemon): isolate HOME to fix flaky ~/.pilot test contention by @TeoSlayer in #252
• test(registry): reconcile stale WAL torn-tail test with current contract by @TeoSlayer in #251
• feat(pilotctl): agent-first CLI overhaul — bounded output, filters, styling by @TeoSlayer in #247
• Signed app-store catalogue + Pages catalogue site by @TeoSlayer in #249
• ci: validate app-store catalogue entries on PR by @Alexgodoroja in #259
• fix(pilotctl): reject non-all skill ids in disable/enable (PILOT-394) by @matthew-pilot in #260
• chore: remove app-store catalogue CI from platform repo by @Alexgodoroja in #272
• feat(appstore): catalogue list shows name+headline only with view pointer (PILOT-404, PILOT-405) by @TeoSlayer in #275
• feat(pilotctl): add review command with subject+rating validation (PILOT-410) by @TeoSlayer in #276
• fix(install): add consent disclosure section (PILOT-393) by @matthew-pilot in #271
• feat(pilotctl): add pilotctl update command (PILOT-396) by @matthew-pilot in #262
• feat(telemetry): consent-gated telemetry client with Ed25519 signing (PILOT-400) by @matthew-pilot in #263
• fix(appstore): random output interception for review prompts (PILOT-409) by @matthew-pilot in #268
• feat(telemetry): emit install, catalogue-view, and detail-view events (PILOT-401, 402, 406, 407) by @TeoSlayer in #277
• fix(telemetry): add missing consent gates to appstore telemetry events by @TeoSlayer in #278
• feat(consent+sandbox): broadcasts gate, review consent, skillinject modes, sandbox flag, install disclaimers by @TeoSlayer in #279
• docs: update README — fix errors, add app store, messaging, consent, env vars by @TeoSlayer in #280
• fix: inject nodeID into telemetry events and add catalogue_viewed payload by @TeoSlayer in #281
• fix: populate nodeID in telemetry events; add broadcast consent test by @TeoSlayer in #282
• fix(security): replace math/rand with crypto/rand in 3 daemon files (PILOT-417) by @matthew-pilot in #283
• chore: update module path TeoSlayer/pilotprotocol → pilot-protocol/pilotprotocol by @TeoSlayer in #287
• feat(motd): source banners from pilot-changelog feed-motd.json by @Alexgodoroja in #285
• fix(security): add decompression bomb protection to untarUnder (PILOT-418) by @matthew-pilot in #288
• Bind inner packet Src to authenticated peerNodeID by @TeoSlayer in #294
• Add verified-badge client layer: daemon, IPC, pilotctl by @TeoSlayer in #295
• fix(telemetry): default daemon to production endpoint; emit app_usage on pilotctl call by @TeoSlayer in #293
• chore(deps): bump github.com/pilot-protocol/rendezvous from 0.2.5-0.20260615154750-f09cf1a708b0 to 0.2.5 by @dependabot[bot] in #291
• Add pilotctl verify status with offline check and how-to by @TeoSlayer in #297
• Bump common to v0.5.3 (pinned badge issuer key) by @TeoSlayer in #298
• catalogue: io.pilot.sixtyfour v0.1.0 by @Alexgodoroja in #289
• appstore: per-platform bundles (v3 catalogue) by @Alexgodoroja in #296
• chore(deps): bump github.com/coder/websocket from 1.8.14 to 1.8.15 by @dependabot[bot] in #290
• chore(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #286
• Add self-service verify device-flow via the verifier by @TeoSlayer in #301

Full Changelog: v1.11.2...v1.12.0

v1.11.2

What's Changed

• feat(motd): message-of-the-day banner on every pilotctl command by @Alexgodoroja in #253
• release: v1.11.2 — message of the day by @Alexgodoroja in #258

Full Changelog: v1.11.1...v1.11.2

v1.11.1

What's Changed

• docs: add skill-injection transparency disclaimers by @Alexgodoroja in #248
• fix(deps): bump rendezvous to fix accept rate-limiter data race by @TeoSlayer in #250
• feat(appstore): view detail command + catalogue v2 metadata by @Alexgodoroja in #255
• docs(changelog): release 1.11.1 by @Alexgodoroja in #257

Full Changelog: v1.11.0...v1.11.1