joinweave 0.2.1 — Verified GitHub updates

Published installer patch, signed release discovery, explicit updates and exact verification boundaries.

Published release

joinweave 0.2.1 on npm was published and its exact archive, provenance and latest tag verified on October 13, 2026 at 5:32 AM CT. The GitHub v0.2.1 release followed at 5:34 AM CT, with all 18 assets verified by anonymous download: seven package archives, seven provenance bundles, the release manifest, signed update catalog, Sigstore bundle and checksum list.

Only joinweave changes to 0.2.1. The CLI launcher, four native packages and @useweave/mcp remain 0.2.0. MCP still exposes 46 tools across core operations and six persistent model families. The native executable and service receipt protocol remain 0.1.0; the runtime API remains 2. See the 0.2.0 release for that runtime's qualification.

Install, check and explicitly update

Use Node.js 20.17+ in the 20.x series, or 22.9+ (^20.17.0 || >=22.9.0); Node 21 is unsupported. The platform matrix still applies.

# New workspace, or a managed reinstall:
npx joinweave@0.2.1

# Existing owned workspace; no mutation:
npx joinweave@0.2.1 update --check --json

# Apply only with explicit authorization:
npx joinweave@0.2.1 update --yes --json

Use the existing WEAVE_HOME consistently. The updater authenticates the catalog against the pinned GitHub release workflow with Sigstore, verifies expiry, source bindings, component versions and exact archive checksums, then invokes the selected release's installer. No GitHub CLI or GitHub login is required. Missing catalogs, signature failures, expiry, component downgrades and unsupported store migrations stop the operation.

Identity, signed data, service/MCP enablement and agent-client settings are retained. The update command does not grant new client consent or silently reconnect clients. Installing the current release again is a separate managed reinstall; an update check uses the completed installer version in the owned receipt and reports current without reapplying.

Verified acceptance

Check	Result and scope
Exact installer candidate	Depot `j08rw5z0n2`: 96 passing tests, two explicitly skipped checks
Managed upgrade, rollback and retry	Real Linux x64 systemd workspace with identity/data/client retention and cleanup; qualified before publication
Catalog and package provenance	Tokenless signing run 38378720409; actual positive and negative Sigstore verification on Depot `jft703fbvg`
npm publication	Official npm CLI, Depot `b3sz0ntw43`, exact archive/provenance/latest verified at 05:32:07 CT
GitHub publication	Depot `k813fj3dk3`, all 18 assets, latest release and peeled tag commit verified at 05:34:23 CT
Actual public update	Depot `lhh6pl78vz`, six acceptance checks passed at 05:35:17 CT, with owned cleanup successful

The public update acceptance fetched genuine npm archives through an unseeded cache, created a real 0.2.0 workspace, authenticated the canonical GitHub latest release, and applied its signed archive with 0.2.1. It retained the original identity, read the original signed Strand, kept the MCP tree and all 46 tools, and preserved consented client files. A repeat check reported current without reapplying. Owned uninstall retained identity and data. This public-path check used Linux x64 detached mode; it is separate from the managed systemd qualification and is not a new four-platform update claim.

Recovery and limits

The updater preserves prior executable, receipt and service bytes privately under ~/.weave/updates/. These are recovery material, not automatic health rollback. A failed install retains the last completed installer version and its interrupted-install recovery path; resolve the reported error and retry the same verified release. Do not copy a stale ownership receipt over a running workspace. Read the update and recovery guide.

Scheduled automatic application, native CLI/TUI integration and signed Desktop updates are follow-ons. No background updater or timer is installed. Weave Desktop is separate development software, and public Apple distribution remains on hold. Desktop selected-file grants are separate from the local authority of the runtime MCP. Cores persistence remains a separate pilot; this release does not purchase hosted storage or prove funded hosted ciphertext/offline recovery. No public npm SDK or automatic OpenAgentID/LifeID account linking is included.

Exact release bindings

Installer package source: f81b59b102a3b50bb89d81c2b4a50ef87f31b586.
Public release/signing commit: 275904395ae6dcacc0180b7bd3ea045d3655f728.
Installer archive: joinweave-0.2.1.tgz, 37,772 bytes.
Installer archive SHA-256: a4c858e3257cb79cbbf15ae076c7d4d18b8e1593d11839a7da1565b3282a5141.
Actual public update receipt SHA-256: cba6006bcd53c0984b2d5b44c5fc3f9ca13107672a606a1f920f644952d959ce.

The six unchanged archives retain their original provenance and checksums in the GitHub release. The public distribution repository contains JavaScript tooling and prebuilt native executables; native Rust source remains private.