v1.8.4 (2026-09-05)

v1.8.3 was tagged but never published. v1.8.4 supersedes it, carries every v1.8.3 change listed below, and adds one custody fix.

What changed

Fixed

• The machine-local passphrase fallback file now survives a change in the host’s resolved hostname (for example .local versus .localdomain after a reboot); a file written under an earlier derivation keeps opening, and is migrated on the first read by a caller that is allowed to write and whose re-wrap succeeds. Read-only callers read the value and leave the file as it is.

Carried from v1.8.3 (unpublished)

v1.8.2 was tagged but never published. v1.8.3 supersedes it, carries every v1.8.2 change listed below, and adds one release-process fix.

Release process

• Release coverage checks credit each fixture to the assurance row it proves. The fixtures behind the release coverage report now name their correct Assurance Matrix rows, fixture registration refuses two different claims under one row number, and the ordinary test suite checks that every proven row has a passing fixture. Product runtime, fixture bodies and assurance claims are unchanged.

Carried from v1.8.2 (unpublished)

• Local concierge responses use a longer generation window and complete after their outcome is recorded.
• Local-intelligence setup shows signed model-manifest verification before consent and download. The operator can see which manifest was verified before approving the model pull.

Setup and shutdown fixes

• Headless init and Protect stage recovery material outside the fortress and show only its location.
• A failed Castle Wall daemon start no longer implies that an existing wall is unarmed.
• Idle MCP sessions close their own listeners when the harness disconnects or requests shutdown.
• A briefly indeterminate custody-lock owner is checked again within the existing timeout; uncertain ownership still refuses access.

Capability bounds

Ollama is installed by the operator. Light assurance compares the runtime-reported model digest with the signed manifest at the documented checkpoints. Automatic discovery of newer signed manifests is unavailable.