joinweave 0.1.3
The published compact-receipt repair, fresh registry acceptance and preserved-data recovery.
Published and verified
joinweave 0.1.3 was published on October 12, 2026. The exact npm archive and its provenance signature were verified at 12:10 CT, and npm latest points to 0.1.3. A separate fresh Linux registry install passed actual service and MCP acceptance at 12:14 CT.
npx joinweave@0.1.3joinweave 0.1.2 is deprecated and withdrawn from recommended installs. Its embedded MCP dependency-tree census exceeded the native ownership reader's unchanged 64 KiB limit, blocking service ownership checks. Use 0.1.3 for installation or repair while retaining identity and data.
The 0.1.1 release remains historical evidence for its own archive and tested flows. Version 0.1.3 has its own qualification and postpublication acceptance; the earlier evidence is not relabeled as a test of this patch.
Compact receipt, separate private census
The installer keeps ~/.weave/.joinweave-install.json within the native 64 KiB limit. Detailed MCP file records live in ~/.weave/tools/mcp-0.1.0.census.json, a private 0600 file referenced by exact path and SHA-256 from the compact receipt. The installer verifies the census and installed tree before reusing or removing them.
Recognized 0.1.2 embedded censuses migrate before native service commands. Journaled staging and persisted removal intent support interrupted recovery. Modified trees, changed metadata, symbolic links and foreign census destinations are preserved and reported instead of overwritten. A missing census beside a surviving runtime is not treated as permission to delete it.
Native CLI, MCP and all four platform packages remain 0.1.0. The native ownership-receipt protocol also remains 0.1.0; installerVersion records 0.1.3 separately. No native binary was rebuilt for this patch.
Install or recover
Use the same workspace and retain the existing identity and data:
npx joinweave@0.1.3 --yes --jsonDo not purge ~/.weave or hand-edit the ownership receipt to work around the 0.1.2 failure. If the installer reports changed files or conflicting metadata, preserve those files and resolve the reported conflict. PATH and agent-client edits still require explicit flags or interactive consent.
For a retained-data uninstall:
npx joinweave@0.1.3 uninstall --yes --json~/Weave remains separate from the private runtime workspace and is preserved. --purge deletes the dedicated private workspace, including identity and stored data; it is not a routine repair step.
Release evidence
The archive SHA-256 is:
35628d03da4dd0e49e8b40b4adab5d0706f62631eab558d5faccbb1cf71dffd2The GitHub release includes the exact archive, package manifest, Depot qualification, candidate service acceptance, test log and provenance receipt. The published npm metadata and attestation bind the same archive.
| Check | Actual result |
|---|---|
| Exact-source Depot qualification, run 38281000021 | 60 checks passed; zero failures or skips, including the full managed MCP tree |
| Prepublication managed Linux flow | Exact candidate archive, live doctor, persistent MCP calls, restart/crash recovery, safe rerun and retained-data uninstall passed; ownership receipt 854 bytes |
| GitHub-hosted attestation, run 38281608819 | Verified signature for the exact Depot archive, without rebuilding it |
| Postpublication registry acceptance, run 38282815523 | A fresh Ubuntu 24.04 x64 user and empty npm cache installed joinweave@0.1.3 through actual registry npx, with no local installer fallback |
| Postpublication native ownership receipt | 858 bytes with the actual persistent MCP dependency tree installed |
| Postpublication MCP access | Initialized the installed server, listed all ten tools, called weave_status, and matched its running PID to direct native status and systemd's MainPID |
| Postpublication recovery and removal | Real stop/start and crash recovery passed, rerun preserved identity/data, and uninstall removed owned binary/service/MCP/census while retaining identity and fixture data without warnings |
The new fresh registry acceptance covers Linux x64, Node 22.23.3 and npm 11.21.0. The unchanged 0.1.0 native packages retain their existing macOS/Linux support and earlier evidence. This patch's tests do not claim a new macOS registry run, cross-machine sparse transfer or Desktop acceptance. Doctor's provider round trip can use local DHT cache; it alone does not prove remote propagation or requested payload delivery.
Persistent tools and terminal experience
The release retains the woven terminal renderer and the locally installed @useweave/mcp 0.1.0 server at ~/.weave/tools/mcp-0.1.0/node_modules/@useweave/mcp/bin/weave-mcp.js. Client configurations use the recorded absolute Node path. npm lifecycle scripts stay disabled during managed MCP installation, and the package's published integrity remains pinned.
The website's 72-frame illustration was exported from the qualified 0.1.2 renderer. That historical visual evidence is preserved; it is neither live network telemetry nor proof of installation in your browser. JSON and non-TTY output do not animate. --no-animation, NO_COLOR, prompt pauses and cursor restoration remain available.
| Component | Version / status |
|---|---|
| Installer | 0.1.3, published and verified |
| 0.1.2 installer | Historical publication; deprecated and withdrawn from recommended installs |
| Native CLI and platform binaries | 0.1.0, unchanged |
| Runtime MCP | 0.1.0, ten published tools |
| Expanded MCP and Weave Desktop | Development candidates; not included in this release |
Installation and support, operations and runtime MCP explain the platform, consent and recovery boundaries. This npm release does not install Weave Desktop, a browser, Loom or a public Rust SDK. Local identity creation does not register an OpenAgentID account.
