gitcommit90 · gitcommit90 · Aug 1, 2026 · Aug 1, 2026
@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.31] - 2026-08-01
+
+### Fixed
+
+- Fixed fresh Linux installation from `1helm.com`: the public installer now
+  downloads and SHA-256-verifies the accepted Linux host artifact instead of
+  pairing its current OCI setup logic with the obsolete source-only v0.0.28
+  tag, which lacked the OCI runtime installer and sealed channel image.
+
 ### Documentation
 
 - Updated the README, standalone website, manual, story, and user guide for the
@@ -899,7 +908,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   notarization, stapled tickets, Gatekeeper verification, persistent
   Application Support, and isolated Apple container machines.
 
-[Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.30...HEAD
+[Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.31...HEAD
+[0.0.31]: https://github.com/gitcommit90/1Helm/compare/v0.0.30...v0.0.31
 [0.0.30]: https://github.com/gitcommit90/1Helm/compare/v0.0.29...v0.0.30
 [0.0.29]: https://github.com/gitcommit90/1Helm/compare/v0.0.28...v0.0.29
 [0.0.28]: https://github.com/gitcommit90/1Helm/compare/v0.0.27...v0.0.28

@@ -139,7 +139,7 @@ Mac, Linux, and Windows use one synchronized desktop release version. A release
 is held in full until the signed/notarized Mac DMG and updater ZIP, verified
 Linux host archive, and Windows Setup/Squirrel feed have all passed native
 install and update acceptance from the same source commit. Windows
-Authenticode status is disclosed in every release; v0.0.30 is `NotSigned`.
+Authenticode status is disclosed in every release; v0.0.31 is `NotSigned`.
 
 ### Connect from a phone or tablet
 
@@ -152,10 +152,10 @@ frontend; the password is never retained and the resulting session is stored
 in the iOS Keychain or encrypted with a key held by Android Keystore.
 
 - The native iOS and Android gateway source is included in this repository,
-  but neither mobile platform has a current v0.0.30 public build. The most
+  but neither mobile platform has a current v0.0.31 public build. The most
   recent signed Android APK is the older v0.0.23 gateway, and 1Helm is not
   currently listed in the public iOS App Store. Use the HTTPS browser interface
-  for the current v0.0.30 experience.
+  for the current v0.0.31 experience.
 - The native clients require HTTPS, do not contain or initialize the 1Helm
   server or a frozen copy of its product frontend, and do not retain host data
   or provider credentials beyond the selected server address and secure
@@ -277,7 +277,7 @@ and an audit trail. A prompt saying “use this service” is not a connector.
   service with health-check rollback.
 - Signed, Apple-notarized, stapled Apple Silicon DMG releases.
 - Browser access from phones and tablets to an already configured HTTPS 1Helm
-  host; native mobile gateway source is present but has no v0.0.30 public build.
+  host; native mobile gateway source is present but has no v0.0.31 public build.
 
 ### Platform truth
 
@@ -286,7 +286,7 @@ and an audit trail. A prompt saying “use this service” is not a connector.
 | **Apple Silicon macOS 26** | Native desktop product and real isolated Linux computer per resident (Apple `container machine`, `home-mount=none`). |
 | **Linux / CI** | Supported headless systemd host with one durable Podman OCI container per resident, runtime-owned storage, and exact ownership checks; CI may select an explicit test backend. |
 | **Windows 11 x64** | Native desktop product with one installation-scoped WSL 2 OCI runtime and one durable container per resident; Windows-drive mounts and interop are disabled. |
-| **iPhone, iPad, and Android** | Use the current HTTPS browser interface. Native gateway source exists, but v0.0.30 has no public mobile artifact and the iOS app is not publicly listed. |
+| **iPhone, iPad, and Android** | Use the current HTTPS browser interface. Native gateway source exists, but v0.0.31 has no public mobile artifact and the iOS app is not publicly listed. |
 
 Not yet shipped: current public mobile builds, a native Linux desktop shell, a
 hosted control plane, rich Photon attachment fidelity, or blind execution of
@@ -313,7 +313,7 @@ A fresh data directory opens first-run setup. The source runtime defaults to
 | `PORT` | `8123` | HTTP/WebSocket control-plane port. |
 | `CTRL_DATA_DIR` | `./data` | Databases, routing state, uploads, and non-OCI development/Apple workspace mirrors. |
 | `HELM_CHANNEL_COMPUTER_BACKEND` | `apple` on macOS, `oci` on Linux and Windows | Host isolation backend; `native` and `mock` are explicit development/test overrides. |
-| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.30` | Versioned channel-machine image contract. |
+| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.31` | Versioned channel-machine image contract. |
 
 ### Agent-first JSON CLI
 

@@ -445,7 +445,7 @@ fallback.
 - Operational history is locally tamper-evident.
 - Mac artifacts are Developer ID signed, notarized, stapled, and Gatekeeper
   verified. Linux assets are digest-verified, and Windows Authenticode status
-  is disclosed for every release (`NotSigned` for v0.0.30).
+  is disclosed for every release (`NotSigned` for v0.0.31).
 
 For the detailed boundary, see [SECURITY.md](../SECURITY.md). For product intent,
 see [VISION.md](VISION.md).
@@ -91,7 +91,7 @@ verification.
   synchronized public desktop-host product. Every named desktop release must
   publish all three from one version and exact source commit.
 - 1Helm is self-hosted and open source. Native mobile gateway source is present,
-  but v0.0.30 has no public Android/iOS build and 1Helm is not listed in the
+  but v0.0.31 has no public Android/iOS build and 1Helm is not listed in the
   public iOS App Store. A hosted control plane, blind community-skill execution,
   and a native Linux desktop shell are not shipped.
 

@@ -1,7 +1,7 @@
 {
   "name": "1helm",
   "productName": "1Helm",
-  "version": "0.0.30",
+  "version": "0.0.31",
   "private": true,
   "type": "module",
   "license": "AGPL-3.0-only",

@@ -80,9 +80,16 @@ ensure_roots() {
   # Prefer netavark on a fresh dedicated store. CNI writes IPAM state beneath
   # /var/lib/cni, which is intentionally read-only to the hardened service;
   # netavark keeps its runtime state under the explicit Podman runroot.
-  if [[ ! -e "$STORAGE_ROOT/defaultNetworkBackend" ]] \
+  if [[ -f "$STORAGE_ROOT/defaultNetworkBackend" ]] \
+      && [[ "$(cat "$STORAGE_ROOT/defaultNetworkBackend")" == netavark ]]; then
+    # Repair selectors written by v0.0.30 as well as creating new ones below.
+    printf '%s' netavark >"$STORAGE_ROOT/defaultNetworkBackend"
+    chmod 0600 "$STORAGE_ROOT/defaultNetworkBackend"
+  elif [[ ! -e "$STORAGE_ROOT/defaultNetworkBackend" ]] \
       && { command -v netavark >/dev/null 2>&1 || [[ -x /usr/lib/podman/netavark || -x /usr/libexec/podman/netavark ]]; }; then
-    printf 'netavark\n' >"$STORAGE_ROOT/defaultNetworkBackend"
+    # Podman reads this as an exact token. Ubuntu 24.04's Podman rejects the
+    # newline that ordinary text-file conventions would otherwise add.
+    printf '%s' netavark >"$STORAGE_ROOT/defaultNetworkBackend"
     chmod 0600 "$STORAGE_ROOT/defaultNetworkBackend"
   fi
 }

@@ -13,7 +13,7 @@ const doc = (path, title, description, content) => ({ title, description, kind:
 
 const security = doc("/manual/security-model", "Security model", "How 1Helm isolates residents, brokers credentials, audits actions, validates skills, and defines the human boundary.", `<p class="intro">Autonomy without architecture is just ambient authority. 1Helm makes routine action cheap inside a narrow world and makes boundary crossings explicit, attributable, and recoverable.</p><h2>Resident isolation</h2><p>Each ordinary channel receives a separate persistent Linux world: an Apple container machine with no Mac home mount, or a durable OCI container. Linux runs OCI natively. Windows hosts containers inside one managed WSL 2 runtime whose Windows-drive mounts and interop are disabled. Exact labels, storage mounts, and owner markers gate lifecycle operations. Other residents and the host home are not exposed.</p><h2>Authoritative files</h2><p>OCI workspace storage belongs to the runtime and is authoritative. Files and Cowork receive narrow direct access to that channel's storage; command and terminal paths do not copy the whole workspace. Apple's backend retains its bounded, symlink-contained mirror.</p><h2>Skipper boundary</h2><p>Skipper owns native host operations, fleet lifecycle, credential brokering, and cross-channel work. A resident calls Skipper directly with the invoking thread; a Captain-authored request is required for host-authorized operations. Skipper returns the result to the resident automatically.</p><h2>Credentials and connections</h2><p>Provider, Gmail, and Photon credentials stay in host-owned storage. Residents receive task-scoped tools and permission records, not raw access tokens or the native Messages database. Photon accepts only the configured Captain phone and keeps that direct Skipper conversation in the Captain's private <code>#main</code>.</p><h2>Skill supply chain</h2><p>The external catalog is discovery metadata, not executable trust. 1Helm shows the open registry's results without applying its own browse-time allowlist. A selected GitHub source is resolved to an immutable commit, bounded to 256 KiB, scanned for instruction override, exfiltration, remote-pipe execution, broad destructive commands, security disabling, private-host access, and prompt extraction, then hashed and wrapped beneath runtime authority.</p><h2>Audit and limits</h2><p>New activity, tool starts/results, and skill installation decisions enter an append-only SHA-256 chain. The chain is tamper-evident, not a remote transparency log: an administrator with database access can still delete or replace the entire database. Historical rows predating the chain are not backfilled.</p><h2>Known dependency debt</h2><p>The pinned Photon SDK currently carries moderate OpenTelemetry advisories upstream. It runs in a supervised loopback-only child process with telemetry disabled. 1Helm tracks the exact pin and will upgrade when the required Photon API remains compatible; this is not represented as a clean dependency audit.</p><h2>Report a vulnerability</h2><p>Use GitHub's private vulnerability reporting for the 1Helm repository. Do not open a public issue containing credentials, tokens, or an unpatched exploit.</p>`);
 
-const gettingStarted = doc("/manual/getting-started", "Getting started", "Install 1Helm, connect providers, create the workspace, and give the first resident a real outcome.", `<p class="intro">The normal setup is three product decisions. 1Helm handles the infrastructure around them.</p><h2>1. Install or connect</h2><p>On Apple Silicon, download the signed, notarized, and stapled DMG. On Windows 11 x64, download the Setup executable; its Authenticode status is disclosed in the release notes and v0.0.30 is <code>NotSigned</code>. Ubuntu/Debian hosts use the digest-verified Linux systemd installer. A new desktop installation can host its own workspace or connect to an existing HTTPS 1Helm host. Native mobile apps connect only to an existing configured host. Starting a new host may request one administrator approval for its isolated Linux runtime.</p><h2>2. Captain</h2><p>Create the first account. This is the Captain: owner, final authority, and administrator. Public registration closes after the Captain exists.</p><h2>3. Providers</h2><p>Connect one or more subscription accounts or API keys. You can add more later, pool accounts, select exact models, and build fallback or round-robin routes. There is no required single “AI brain.”</p><h2>4. Workspace</h2><p>Name the workspace. Terminals default on. 1Helm creates <code>#main</code> with the one Skipper, then you create ordinary channels with plain-language purposes. Every ordinary channel gets a private Linux computer.</p><h2>5. Give an outcome</h2><p>Try: <em>“Audit this launch folder, turn the notes into a decision brief, resolve obvious gaps yourself, and give me the finished PDF with evidence.”</em> The resident should inspect, execute, create the artifact, and call Skipper itself if it crosses the channel boundary.</p>`);
+const gettingStarted = doc("/manual/getting-started", "Getting started", "Install 1Helm, connect providers, create the workspace, and give the first resident a real outcome.", `<p class="intro">The normal setup is three product decisions. 1Helm handles the infrastructure around them.</p><h2>1. Install or connect</h2><p>On Apple Silicon, download the signed, notarized, and stapled DMG. On Windows 11 x64, download the Setup executable; its Authenticode status is disclosed in the release notes and v0.0.31 is <code>NotSigned</code>. Ubuntu/Debian hosts use the digest-verified Linux systemd installer. A new desktop installation can host its own workspace or connect to an existing HTTPS 1Helm host. Native mobile apps connect only to an existing configured host. Starting a new host may request one administrator approval for its isolated Linux runtime.</p><h2>2. Captain</h2><p>Create the first account. This is the Captain: owner, final authority, and administrator. Public registration closes after the Captain exists.</p><h2>3. Providers</h2><p>Connect one or more subscription accounts or API keys. You can add more later, pool accounts, select exact models, and build fallback or round-robin routes. There is no required single “AI brain.”</p><h2>4. Workspace</h2><p>Name the workspace. Terminals default on. 1Helm creates <code>#main</code> with the one Skipper, then you create ordinary channels with plain-language purposes. Every ordinary channel gets a private Linux computer.</p><h2>5. Give an outcome</h2><p>Try: <em>“Audit this launch folder, turn the notes into a decision brief, resolve obvious gaps yourself, and give me the finished PDF with evidence.”</em> The resident should inspect, execute, create the artifact, and call Skipper itself if it crosses the channel boundary.</p>`);
 const architecture = doc("/manual/architecture", "Architecture", "The 1Helm control plane, resident computers, Skipper, model fabric, memory, obligations, connections, and audit chain.", `<p class="intro">1Helm is a compact local control plane around many persistent employee worlds.</p><pre class="diagram">Captain
   └─ #main / Skipper ── host · credentials · fleet · cross-channel
        ├─ #product / resident ── private Linux computer ── /workspace