CHANGELOG · WHAT WE SHIPPED

What we shipped this month.

Customer-driven first. Reviewer-driven second. Nice-to-haves last. Every entry below is something you can find in the product today.

2026.09
September 2026
v.2026.09

Compliance gate, offline verification, error-class rollouts.

  • Compliance gate — the producer evaluates all ten forbidden-change categories over your source and signs the verdict locally. A failure is a refusal at build time, naming the category and the file. The control plane requires the verdict by default.
  • Offline audit verification — ejenix verify export re-derives the chain from an exported packet and checks the head signature, with no network call and no Ejenix service.
  • Error-class rollout gate — the device’s diagnostic ring now reaches the control plane, and a recurring failure class halts the ladder. This catches what the crash-free counter cannot see: a patch that fails verification falls back to the shipped binary and launches successfully.
  • Auto-promotion — the 1 → 5 → 25 → 50 → 100 ladder climbs on fleet telemetry, holds below a minimum sample count rather than promoting on noise, and halts on crash-free, install-failure or install-latency P95.
  • Android parity — the full install / materialize / verify / revert lifecycle now passes on Android arm64 hardware, alongside iOS.
  • New methods on existing classes — proven on device: a method with no counterpart in the shipped binary dispatches and returns.
  • Faster rollback — the SDK checks for updates when the app returns to the foreground, not only on launch.
  • Console — key revocation, and audit chain verify and export wired to real endpoints.
2026.07
July 2026
v.2026.07

Console wired to the live API.

  • Console — feature flags and patches now read and write against the real API rather than fixtures.
2026.05
May 2026
v.2026.05

Engine baseline, hybrid dispatch, reviewer disclosure.

  • Engine baseline — rebased onto Flutter 3.44.0 / Dart 3.12.0, with gen_snapshot built from the ENGENTO SDK fork.
  • HybridPatch v2 — in-place atomic pool swap, end to end.
  • Boot-loop guard — three consecutive crashed launches engage a reboot-surviving lockdown that forces the next launch back to the store binary. It runs before the Dart VM starts, so a crash in native code still counts.
  • Reviewer disclosure — a public, unauthenticated endpoint publishing what the runtime does on the device, including the capabilities it uses and the nine it forbids by design.
  • Transparency witness — Ed25519 signing moved onto ed25519-dalek via the patch tool.
Older entries on the writing page →