Skip to main content
← Changelog

v1.1.2

2026-05-15

v1.1.2 is a patch on the v1.1.x line. P101 nClaw groundwork plus security hardening, doc-truth corrections, and CI fixes.

Added:

  • nself-sync server fully implemented: push, subscribe, ack, and snapshot handlers wired end-to-end.
  • nself-vault KEK envelope encryption with documented rotation procedure.
  • LlamaCpp real backend wiring: GPU offload, sampling, streaming, and memory guards.
  • sqlite-vec cross-compile CI matrix across 5 targets.
  • Throttle retries with full jitter and Retry-After honoring.
  • nself-audit baseline scan rules (10) and nself doctor --deep integration.
  • @nself/config workspace package scaffold.
  • F09 ENV-VAR-INVENTORY (992 lines) covering v1.2.0 forward-looking vars.
  • ADR-003 records the admin Next.js permanent exception.

Fixed:

  • Cross-language signing material is now byte-identical between Rust and Go. 119-byte golden test locked.
  • nself-vault REVOKE actually invalidates. JWT aud claim “nself-vault” enforced. 404 (not 403) on cross-ownership reads.
  • Plugin signing now uses canonical SHA-256 of tarball bytes. Worker and CLI aligned.
  • License HMAC key is randomized. No longer derived from an observable value.
  • Argon2id KAT test mismatch resolved. Production derive_key was always correct; the test had the bug.
  • Tauri 2 updater chain complete: plugin in Cargo.toml, Ed25519 minisign signing, real public key, downgrade_guard.
  • nclaw/desktop Tauri 2 API drift fixed (7 compile errors cleared).
  • 16 nclaw/core lib test compile errors plus 15 surfaced runtime failures fixed.
  • WebSocket goroutine leak fix prevents fd exhaustion under aggressive context cancellation.
  • All TODO, stub, and unimplemented! markers removed from production paths.

Security:

  • All TLS, WAF, and hardening rules ship free at install, update, deploy, and on the daily scan (Security-Always-Free).
  • AGPL and SSPL license gate runs in fail mode across cli, admin, plugins, plugins-pro, and web.
  • nself doctor --deep runs without a license. Critical findings exit 1.

Changed:

  • SPORT F01, F02, F04, and F09 regenerated against code reality.
  • PPI corrections: 87 → 112 paid plugins. 25 → 29 free plugins. AGPL gate documented as already-live fail mode.
  • web/org marketing copy updated to 29 free / 112 paid plugin counts.
  • ɳ branding enforced across product, bundle, and pricing user-visible prose.

Docs:

  • 11 CLI wiki cmd-*.md pages promoted from v1.0.9 PREVIEW to v1.1.1 SHIPPED.
  • README versions bumped in cli, admin, and clawde.
  • Tauri updater signing procedure documented.
  • KEK rotation procedure documented.
  • Mobile platform encryption matrix published (iOS, Android, macOS encrypted; Linux, Windows, web unsupported).

Known limitations carried to v1.1.3:

  • Integration test API drift (httpmock 0.7 → 0.8, nclaw_core → libnclaw rename). Separate sprint.
  • 22 CLI commands still need dedicated wiki pages.
  • Throttle retry orchestrator integration deferred to S17.T07.

Upgrade:

brew update && brew upgrade nself

No breaking changes from v1.1.1.