v2026.4.13 — Tenancy + Hardening Day
Major release covering 7 backlog items shipped today:
S1 — Generic credential sanitizer
S3 — Security-critical audit log
S5 — Hybrid self-service cert rotation
U1 — Tighter zombie-peer lifecycle (10s heartbeat / 25s stale)
U2 — bun cli.ts init <URL> one-command device setup
U3 — bun cli.ts doctor (11 health checks)
S2 — Hard multi-tenancy via UUID namespaces and cert bindings,
plus cert revocation, receiver-scoped message ack, and a
poll fallback for non-channel-mode operation
Plus: README rewrite, automated CHANGELOG via git-cliff, CalVer
image tags, auto-update on MCP startup.
73 tests across 7 files. Migration is irreversible: drops legacy
namespace string columns after backfill into UUID-based namespace_id.