Updates

Principal keys, without scanning the ledger

The identity detail route used to swallow /api/identity/<name>/keys, treating <name>/keys as an identity. A real identity could therefore appear unknown. The route now reaches the key handler, and the SDK provides getIdentityKeys(name) for one direct lookup. Pi tools and identity recovery use it instead of downloading and filtering the complete keys ledger.

A missing principal returns an explicit not-found result. An existing group returns an empty key list. Transport failures, unexpected response shapes and the old shadowed-route response are errors, so an unavailable node cannot quietly masquerade as a missing identity.

One vocabulary for names, with distinct policies

Creating a new identity still requires 1–50 ASCII letters or digits. Group names still use dot-separated alphanumeric segments, up to 128 characters. Reading an already registered principal must also handle names such as the genesis identity devnet1-node0 and dotted groups. The public key lookup now accepts the registered-name policy rather than applying the narrower creation policy.

Scala and TypeScript each have a shared validator, checked against the same name vectors. Group admission and application agree; explorer forms and dependent applications reuse the SDK policy. Applications can retain stricter admission rules: Forge still requires its restricted lowercase account names. Mobile signer admission retains its existing restrictions, including rejection of names that could alias a stored signer filename.

Reachability is an explicit deployment decision

The plain node API continues to bind to 127.0.0.1 by default. Applications in other containers need an explicit http.bind-host = "0.0.0.0" and a private network boundary. A wildcard bind listens on every interface; it does not authenticate a caller or make a published port private.

gRPC now exposes evolver.grpc.bind-host. Setting its port to zero disables the gRPC socket while leaving HTTP identity creation available. Public devnet identity sponsorship remains a deliberate temporary onboarding exception: reachable callers can request narrowly constructed, node-sponsored identity creation. It does not grant arbitrary signing or access to hosted identities. A future onboarding gate is planned.

TEE configurations now explicitly admit their intended container/VPC clients and embed the current four-entry devnet genesis. The loopback host mappings and GCP firewall remain the access boundaries. A healthy in-container probe alone cannot prove another container can reach the API. Existing TEE data from the old genesis requires the documented migration before rejoining, with identity keys preserved.

Upgrade the complete dependency tree

The release set is node v0.24.2, client 0.19.1, pi-evolver 0.9.1, pi-meerkat 0.4.3, Meerkat v0.7.13, scheduler v0.11.30, Forge v0.2.15, LLM proxy v0.2.1 and TEE v0.1.2. Both Pi and Claude MCP bundles lock one shared SDK copy. The installer carries the matching npm manifest and lockfile, so newly built agents receive the same versions.

Upgrade the queried node before using the new tool bundle. Rebuild applications to change their embedded SDK; changing a manifest or Compose default cannot update a running image. App deployment artifacts must be rebuilt too, because they pin the node image by digest.

Deployment update, 9 October 2026: all eleven active managed nodes now run v0.24.2. Meerkat, scheduler, Forge, the LLM proxy and agent tool bundles have been upgraded and their running SDK versions verified as 0.19.1. Identities, keys, channels and data volumes were preserved. Optional stacks that were stopped remain stopped.

Verification and remaining work

The full Scala suite passed 3,198 tests before the final mobile admission correction; 95 focused tests then passed with a real-handler filename-alias regression. SDK and Pi checks, scheduler checks, Forge tests and pi-meerkat tests passed. The LLM proxy typecheck and 125 tests passed; three optional Ollama integration tests were skipped. The new browser group membership case passes; three existing explorer submit failures were reproduced against the original forms. TEE tests were deliberately not run for these configuration changes.

The review also identified a request-buffer ownership leak, now tracked separately in issue 155. It is not fixed by this release. The separate mobile deletion authorization issue also remains open; keep the plain API inside its intended private boundary.