diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 2e53c35..41b245a 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -1,6 +1,6 @@
[package]
name = "itsgoin-cli"
-version = "0.7.3"
+version = "0.8.0-alpha"
edition = "2021"
[[bin]]
diff --git a/crates/core/Cargo.toml b/crates/core/Cargo.toml
index 71a4f85..eed04d9 100644
--- a/crates/core/Cargo.toml
+++ b/crates/core/Cargo.toml
@@ -1,6 +1,6 @@
[package]
name = "itsgoin-core"
-version = "0.7.3"
+version = "0.8.0-alpha"
edition = "2021"
[dependencies]
diff --git a/crates/tauri-app/Cargo.toml b/crates/tauri-app/Cargo.toml
index 7e9e5a2..d2de386 100644
--- a/crates/tauri-app/Cargo.toml
+++ b/crates/tauri-app/Cargo.toml
@@ -1,6 +1,6 @@
[package]
name = "itsgoin-desktop"
-version = "0.7.3"
+version = "0.8.0-alpha"
edition = "2021"
[lib]
diff --git a/crates/tauri-app/tauri.conf.json b/crates/tauri-app/tauri.conf.json
index 8728350..932a95d 100644
--- a/crates/tauri-app/tauri.conf.json
+++ b/crates/tauri-app/tauri.conf.json
@@ -1,6 +1,6 @@
{
"productName": "itsgoin",
- "version": "0.7.3",
+ "version": "0.8.0-alpha",
"identifier": "com.itsgoin.app",
"build": {
"frontendDist": "../../frontend",
diff --git a/website/download.html b/website/download.html
index 023c118..f3df77b 100644
--- a/website/download.html
+++ b/website/download.html
@@ -26,6 +26,52 @@
Download ItsGoin
Available for Android, Linux, and Windows. Free and open source.
+ v0.8.0-alpha — July 30, 2026
+ Clean protocol break. ALPN moves to itsgoin/4 — v0.8 nodes and v0.7.x nodes refuse each other at the QUIC handshake rather than half-interoperating. Alpha: testers only. See design.html for the full v0.8 architecture.
+
+
+
+ Finding people — the headline feature
+
+ - Registry — opt-in discoverability. A well-known "registrations here" post whose comment chain is the directory. Registering publishes a signed comment carrying your display name, keywords, and public author ID — self-certifying, so any holder can verify it against the key it names, with no authority involved. Entries carry a fixed 30-day expiry and auto-renew while you stay listed, so the chain self-cleans and is never more than a month stale. Unlisting sends a signed delete every holder honors. Your author ID stays location-anonymous: it maps to content through ordinary CDN holder search, never to an address.
+ - Greeting comments — talking to strangers. Messaging with no prior key relationship. A greeting is an opaque comment on a bio post, signed with a published open-slot key so it passes the CDN's comment-verification gate, with its body sealed to the recipient's posting key. Inside: who you really are and a return path. Outside: ciphertext authored by a throwaway ID. Replies carry a fresh key and the next rendezvous, so a conversation hops temporary identities and no two messages share an outer identity. Since encrypted comment blobs are already commonplace on public posts, greetings blend into ordinary traffic — if everyone's anonymous, anonymity doesn't stand out.
+ - Vouching is deliberately separate. No vouch control exists on any messaging surface. Talking to someone never grants them anything; vouching is a considered relationship act that lives in the People tab.
+ - Comment expiry. Ordinary comments now carry a randomized 30–365 day lifetime fixed at creation and covered by the signature, so every holder expires them at the same moment. Throwaway conversation identities eventually vanish from the network entirely.
+ - No proof-of-work. Considered and rejected: its cost lands inverted — a phone registrant pays seconds of battery while a botnet rig pays effectively nothing. Flood limits are holder-side size and count caps; the durable answer is vouch-gated registration once the graph supports it.
+
+
+ Privacy & correctness fixes
+
+ - Manifests no longer carry device addresses.
AuthorManifest shipped your device's network addresses under a posting-identity author — a direct link between a persona and the machine hosting it. The field is gone from the struct and the signature digest, with startup migrations that re-sign your own stored manifests and purge unverifiable foreign copies. This is what makes a registered author ID safe to publish.
+ - Persona-split bug family fixed. The v0.6.1 network-key/posting-key split left roughly fourteen places comparing a network NodeId where posting identities now live. Consequences included: visibility revocation silently failed on every post, group-key distribution to later-added circle members never worked, encrypted attachments wouldn't decrypt, the replication cycle never found under-replicated content, and your own blobs missed their eviction protection tier. Every "is this mine?" check now tests membership across all of your posting personas.
+ - Comment ingest is verified everywhere. Two pull paths stored incoming comments with no signature verification at all. All three ingest sites now share one acceptance gate. Also fixed during review: forged tombstones could delete comments through the ingest path, a delete path trusted the sender rather than a signature, a forged policy message could poison a post's comment intake remotely, and the frontend's HTML escaper didn't escape quotes (an attribute-breakout XSS reachable through registry names, which also affected seven pre-existing sites).
+
+
+ Protocol slimming
+
+ - Message types 46 → 40, about 1,400 lines of Rust removed. Deleted:
DeleteRecord (0x51) and VisibilityUpdate (0x52), both superseded by signed control posts; SocialDisconnectNotice (0x71) and MeshPrefer (0xB3), which nothing had sent in generations; GroupKeyRequest/Response (0xA1/0xA2), an orphaned pair that could never have granted a key after the persona split; and the legacy half of the dual pull-matching path.
+ - Preferred peers eliminated. The preferred tier existed to serve direct N+10 push/pull that the CDN's holder model replaced. Gone: the slot tier, the
preferred_peers table, preferred-tree routing semantics, the rebalance priority pass, the relay candidate tiers, and the 7-day and 30-day watchers.
+
+
+ Upgrade note: v0.8.0-alpha cannot talk to v0.7.x at all — that is intentional, and the anchor moves with this release. Existing data directories migrate in place on first run (manifest re-signing, legacy profile cleanup, registry materialization).
+
v0.7.3 — May 15, 2026
Bandwidth + bootstrap hardening on top of v0.7.2. Wire-compatible with v0.7.0/v0.7.1/v0.7.2.