{
  "product": "Peelr",
  "version": "0.3.6",
  "channel": "alpha",
  "released": "2026-09-20",
  "notes": "A security release. Two ways a page could reach past the boundary Peelr draws for it are closed, and both were found by testing the main process itself rather than the modules around it. FIRST: only one document is ever handed the mesh bridge \u2014 the Text-O shell at rs://texto/ \u2014 but that document loads its code as a SUBRESOURCE, and a subresource runs in the document's origin without passing any URL rule. When the vendored bundle was missing, that fetch fell through to the mesh; nobody vouches for the name \"texto\", so a peer's bytes could have run in the origin holding your carrier and the resolver's own traffic. Unproven content is now refused outright for that origin. Delivery of the app's code over the mesh still works when it comes with a proof \u2014 what is refused is delivery without one. SECOND: a holon page could point its own window at any address it liked, including file:// and ordinary websites, inside chrome that said rs://. The trusted shell already handed those to the system browser; a sandboxed window did not. Both windows now answer the same way, and the rule lives in one tested place instead of two Electron callbacks. Also: the page shown when an address cannot be resolved now escapes the address it echoes back, and the windows that hold your key run inside the Chromium sandbox, which they did not before. RELIABILITY: a duplicate WebRTC answer \u2014 which the blind relay can deliver, and which a re-offering peer sends \u2014 was applied unconditionally and threw, so every ordinary run logged \"Failed to set remote answer sdp: Called in wrong state\" as though a pairing had broken. A stray answer is now ignored and reported as what it is. The record of what Peelr served for each address was an unbounded map that grew for every response, subresources included; it is bounded now, and losing an entry costs a glyph in a window title, never a decision. UNDER THE HOOD: the vendored rspace-online modules are 837 commits newer, and the bundles got 134 KiB SMALLER \u2014 the morpheus forge engine and planner were inlined into everything that touched the SDK and are now decoupled upstream. The Reticulum client gains demand and announce support. UNCHANGED: still alpha, still unsigned by any certificate your computer recognises \u2014 the macOS builds are ad-hoc signed only, which is what lets Apple Silicon run them at all, and Gatekeeper still quarantines them on download. NomadNet fetching still needs a Reticulum transport this binary does not carry (librns), and two peers behind symmetric NAT still cannot open a channel, because no TURN relay is deployed.",
  "signed": false,
  "artifacts": [
    {
      "os": "linux",
      "arch": "x86_64",
      "format": "AppImage",
      "file": "/dl/Peelr-0.3.6-linux-x86_64.AppImage",
      "sha256": "7b4b65b180b98d875d6c5068a7523f25900e68a1a2ca022d403436a2cf528095",
      "bytes": 117055043,
      "signing": "none"
    },
    {
      "os": "linux",
      "arch": "x86_64",
      "format": "tar.gz",
      "file": "/dl/Peelr-0.3.6-linux-x64.tar.gz",
      "sha256": "6863b4248f62cb126aaa370fa7a93e91333655227434800602f1e57075c959c8",
      "bytes": 110710742,
      "signing": "none"
    },
    {
      "os": "linux",
      "arch": "arm64",
      "format": "AppImage",
      "file": "/dl/Peelr-0.3.6-linux-arm64.AppImage",
      "sha256": "423bcd360030ba29d1ee4948e0bc0d8b0b87fc0202748d142373abf068513a56",
      "bytes": 117375939,
      "signing": "none"
    },
    {
      "os": "linux",
      "arch": "arm64",
      "format": "tar.gz",
      "file": "/dl/Peelr-0.3.6-linux-arm64.tar.gz",
      "sha256": "6b9e9ed7d174f4e1e850c54806794dd2aff1a92bff29091866c431a00ce6822c",
      "bytes": 110718676,
      "signing": "none"
    },
    {
      "os": "macos",
      "arch": "arm64",
      "format": "zip",
      "file": "/dl/Peelr-0.3.6-mac-arm64.zip",
      "sha256": "1884b914d0118b1f990e5337bae05d560d1a9bdddbc666cf4776d1e78abe60e7",
      "bytes": 105046766,
      "signing": "ad-hoc"
    },
    {
      "os": "macos",
      "arch": "x86_64",
      "format": "zip",
      "file": "/dl/Peelr-0.3.6-mac-x64.zip",
      "sha256": "8f372dfb37eb99ebbf484acc9d459b60ef8d57a23cd8f5826e8cb46070010b4a",
      "bytes": 112672718,
      "signing": "ad-hoc"
    },
    {
      "os": "windows",
      "arch": "x86_64",
      "format": "nsis",
      "file": "/dl/Peelr-0.3.6-win-x64.exe",
      "sha256": "9aa97b25a63edc9acd6a5d035bf6fc48b1b79409bc76c1eebfeaf4499cac1e40",
      "bytes": 84708133,
      "signing": "none"
    },
    {
      "os": "windows",
      "arch": "x86_64",
      "format": "zip",
      "file": "/dl/Peelr-0.3.6-win-x64.zip",
      "sha256": "6adbf4b4f6bb1d0fb17a4f557af5bd70976ae483438e61dbfa49b02ae9aade60",
      "bytes": 116172540,
      "signing": "none"
    }
  ],
  "pending": [
    {
      "os": "all",
      "reason": "NO ARTIFACT IS SIGNED BY A RECOGNISED CERTIFICATE. The checksums here are the substitute: verify them before you run anything. Real signing needs an Apple Developer ID (~$99/yr, and notarization requires a Mac) and an Authenticode certificate (~$200/yr); neither exists for this project yet."
    }
  ],
  "signing": {
    "linux": "none \u2014 Linux does not require a signature to run a downloaded binary",
    "macos": "ad-hoc \u2014 the bundle is sealed and identified as lol.peelr.browser so Apple Silicon will execute it, but there is no Apple Developer ID, so Gatekeeper still quarantines it on first download",
    "windows": "none \u2014 SmartScreen will warn until an Authenticode certificate exists"
  }
}