From 6e22e60c7badeff6e1b6c8c7c19c3f006cb4cda4 Mon Sep 17 00:00:00 2001
From: Scott Reimers <sologretto@gmail.com>
Date: Thu, 30 Jul 2026 13:04:29 -0400
Subject: [PATCH] chore: bump version to 0.8.0-alpha + v0.8.0-alpha release
 notes

Version bumped in all five places (core/cli/tauri-app Cargo.toml,
tauri.conf.json, Android versionName + versionCode 8000).

download.html carries the v0.8.0-alpha release block: registry + greeting
comments as the headline, the manifest privacy fix and persona-split bug
family, comment ingest verification, and the protocol slimming. States
plainly that v0.8 cannot talk to v0.7.x and the anchor moves with it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LGiPD2cF75mnvneSCjdDC5
---
 crates/cli/Cargo.toml            |  2 +-
 crates/core/Cargo.toml           |  2 +-
 crates/tauri-app/Cargo.toml      |  2 +-
 crates/tauri-app/tauri.conf.json |  2 +-
 website/download.html            | 46 ++++++++++++++++++++++++++++++++
 5 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 2e53c35..41b245a 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "itsgoin-cli"
-version = "0.7.3"
+version = "0.8.0-alpha"
 edition = "2021"
 
 [[bin]]
diff --git a/crates/core/Cargo.toml b/crates/core/Cargo.toml
index 71a4f85..eed04d9 100644
--- a/crates/core/Cargo.toml
+++ b/crates/core/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "itsgoin-core"
-version = "0.7.3"
+version = "0.8.0-alpha"
 edition = "2021"
 
 [dependencies]
diff --git a/crates/tauri-app/Cargo.toml b/crates/tauri-app/Cargo.toml
index 7e9e5a2..d2de386 100644
--- a/crates/tauri-app/Cargo.toml
+++ b/crates/tauri-app/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "itsgoin-desktop"
-version = "0.7.3"
+version = "0.8.0-alpha"
 edition = "2021"
 
 [lib]
diff --git a/crates/tauri-app/tauri.conf.json b/crates/tauri-app/tauri.conf.json
index 8728350..932a95d 100644
--- a/crates/tauri-app/tauri.conf.json
+++ b/crates/tauri-app/tauri.conf.json
@@ -1,6 +1,6 @@
 {
   "productName": "itsgoin",
-  "version": "0.7.3",
+  "version": "0.8.0-alpha",
   "identifier": "com.itsgoin.app",
   "build": {
     "frontendDist": "../../frontend",
diff --git a/website/download.html b/website/download.html
index 023c118..f3df77b 100644
--- a/website/download.html
+++ b/website/download.html
@@ -26,6 +26,52 @@
             <h1 style="font-size: 2rem; font-weight: 800; letter-spacing: -0.03em; margin-bottom: 0.25rem;">Download ItsGoin</h1>
             <p>Available for Android, Linux, and Windows. Free and open source.</p>
 
+            <h2 style="margin-top: 2rem;">v0.8.0-alpha &mdash; July 30, 2026</h2>
+            <p style="color: var(--text-muted); font-size: 0.85rem;"><strong>Clean protocol break.</strong> ALPN moves to <code>itsgoin/4</code> &mdash; v0.8 nodes and v0.7.x nodes refuse each other at the QUIC handshake rather than half-interoperating. Alpha: testers only. See <a href="design.html">design.html</a> for the full v0.8 architecture.</p>
+
+            <div class="downloads">
+                <a href="itsgoin-0.8.0-alpha.apk" class="download-btn btn-android">
+                    Android APK
+                    <span class="sub">v0.8.0-alpha</span>
+                </a>
+                <a href="itsgoin_0.8.0-alpha_amd64.AppImage" class="download-btn btn-linux">
+                    Linux AppImage
+                    <span class="sub">v0.8.0-alpha</span>
+                </a>
+                <a href="itsgoin-cli-0.8.0-alpha-linux-amd64" class="download-btn btn-linux">
+                    Linux CLI / Anchor
+                    <span class="sub">v0.8.0-alpha</span>
+                </a>
+                <a href="itsgoin-0.8.0-alpha-windows-x64-setup.exe" class="download-btn btn-windows">
+                    Windows Installer
+                    <span class="sub">v0.8.0-alpha</span>
+                </a>
+            </div>
+
+            <h3 style="margin-top: 1.25rem; font-size: 1rem;">Finding people &mdash; the headline feature</h3>
+            <ul style="color: var(--text-muted); font-size: 0.85rem; line-height: 1.6; margin-top: 0.5rem;">
+                <li><strong>Registry &mdash; opt-in discoverability.</strong> A well-known "registrations here" post whose comment chain <em>is</em> the directory. Registering publishes a signed comment carrying your display name, keywords, and public author ID &mdash; self-certifying, so any holder can verify it against the key it names, with no authority involved. Entries carry a fixed 30-day expiry and auto-renew while you stay listed, so the chain self-cleans and is never more than a month stale. Unlisting sends a signed delete every holder honors. Your author ID stays location-anonymous: it maps to content through ordinary CDN holder search, never to an address.</li>
+                <li><strong>Greeting comments &mdash; talking to strangers.</strong> Messaging with no prior key relationship. A greeting is an opaque comment on a bio post, signed with a published open-slot key so it passes the CDN's comment-verification gate, with its body sealed to the recipient's posting key. Inside: who you really are and a return path. Outside: ciphertext authored by a throwaway ID. Replies carry a fresh key and the next rendezvous, so a conversation hops temporary identities and no two messages share an outer identity. Since encrypted comment blobs are already commonplace on public posts, greetings blend into ordinary traffic &mdash; if everyone's anonymous, anonymity doesn't stand out.</li>
+                <li><strong>Vouching is deliberately separate.</strong> No vouch control exists on any messaging surface. Talking to someone never grants them anything; vouching is a considered relationship act that lives in the People tab.</li>
+                <li><strong>Comment expiry.</strong> Ordinary comments now carry a randomized 30&ndash;365 day lifetime fixed at creation and covered by the signature, so every holder expires them at the same moment. Throwaway conversation identities eventually vanish from the network entirely.</li>
+                <li><strong>No proof-of-work.</strong> Considered and rejected: its cost lands inverted &mdash; a phone registrant pays seconds of battery while a botnet rig pays effectively nothing. Flood limits are holder-side size and count caps; the durable answer is vouch-gated registration once the graph supports it.</li>
+            </ul>
+
+            <h3 style="margin-top: 1.25rem; font-size: 1rem;">Privacy &amp; correctness fixes</h3>
+            <ul style="color: var(--text-muted); font-size: 0.85rem; line-height: 1.6; margin-top: 0.5rem;">
+                <li><strong>Manifests no longer carry device addresses.</strong> <code>AuthorManifest</code> shipped your device's network addresses under a posting-identity author &mdash; a direct link between a persona and the machine hosting it. The field is gone from the struct <em>and</em> the signature digest, with startup migrations that re-sign your own stored manifests and purge unverifiable foreign copies. This is what makes a registered author ID safe to publish.</li>
+                <li><strong>Persona-split bug family fixed.</strong> The v0.6.1 network-key/posting-key split left roughly fourteen places comparing a network NodeId where posting identities now live. Consequences included: <em>visibility revocation silently failed on every post</em>, group-key distribution to later-added circle members never worked, encrypted attachments wouldn't decrypt, the replication cycle never found under-replicated content, and your own blobs missed their eviction protection tier. Every "is this mine?" check now tests membership across all of your posting personas.</li>
+                <li><strong>Comment ingest is verified everywhere.</strong> Two pull paths stored incoming comments with no signature verification at all. All three ingest sites now share one acceptance gate. Also fixed during review: forged tombstones could delete comments through the ingest path, a delete path trusted the sender rather than a signature, a forged policy message could poison a post's comment intake remotely, and the frontend's HTML escaper didn't escape quotes (an attribute-breakout XSS reachable through registry names, which also affected seven pre-existing sites).</li>
+            </ul>
+
+            <h3 style="margin-top: 1.25rem; font-size: 1rem;">Protocol slimming</h3>
+            <ul style="color: var(--text-muted); font-size: 0.85rem; line-height: 1.6; margin-top: 0.5rem;">
+                <li><strong>Message types 46 &rarr; 40, about 1,400 lines of Rust removed.</strong> Deleted: <code>DeleteRecord</code> (0x51) and <code>VisibilityUpdate</code> (0x52), both superseded by signed control posts; <code>SocialDisconnectNotice</code> (0x71) and <code>MeshPrefer</code> (0xB3), which nothing had sent in generations; <code>GroupKeyRequest</code>/<code>Response</code> (0xA1/0xA2), an orphaned pair that could never have granted a key after the persona split; and the legacy half of the dual pull-matching path.</li>
+                <li><strong>Preferred peers eliminated.</strong> The preferred tier existed to serve direct N+10 push/pull that the CDN's holder model replaced. Gone: the slot tier, the <code>preferred_peers</code> table, preferred-tree routing semantics, the rebalance priority pass, the relay candidate tiers, and the 7-day and 30-day watchers.</li>
+            </ul>
+
+            <p style="color: var(--text-muted); font-size: 0.85rem;"><strong>Upgrade note:</strong> v0.8.0-alpha cannot talk to v0.7.x at all &mdash; that is intentional, and the anchor moves with this release. Existing data directories migrate in place on first run (manifest re-signing, legacy profile cleanup, registry materialization).</p>
+
             <h2 style="margin-top: 2rem;">v0.7.3 &mdash; May 15, 2026</h2>
             <p style="color: var(--text-muted); font-size: 0.85rem;">Bandwidth + bootstrap hardening on top of v0.7.2. Wire-compatible with v0.7.0/v0.7.1/v0.7.2.</p>