Release 1.37.0

News · 2026-09-22

A browser can sign in, and an action taken through it records the person. The dashboard validates a provider-issued token, resolves it to an identity, and attaches it to the request; the task-action record then names the actor. Authenticate and the sign-in callback share one resolver, so a browser sign-in cannot be accepted on terms a presented token would be refused on.
archie issues no session. The callback stores the provider’s own token in an HttpOnly cookie and every later request re-verifies it, so nothing archie holds can outlive the provider’s decision and there is no session table to expire, revoke or get wrong.
The event kind describes the actor. A person’s approval records human_approved as that person; an agent’s records agent_approved; an action with no authorising principal records task_approved with the attribution fields empty. Nothing is credited to an identity that did not act, and an unattributed action is recorded as unattributed rather than guessed.
The acting identity is derived from the presented credential and never from a request field: a body carrying actor, actor_id, identity and an X-Archie-Actor header still cannot choose it.

install.sh writes and enables all five host units; previously it seeded only archied.service, so a fresh host ran one service of five and an operator applied the rest by hand from a runbook. The runbook is a description again: it names the units and points at systemctl --user cat.
Every host binary reports its version, and the updater reads all of them before it can report “nothing to install”. A host whose binaries disagree is refused, naming each one: a newer messaging binary beside an older state store crash-loops against a service the older store does not serve, and that install previously looked healthy from the updater’s point of view.
The packaged, installer and updater command lists are pinned by a test, so a service added to one and not the others fails the gate instead of shipping a partial install.

The publish step derives the commit by dereferencing the ref rather than reading github.sha, because every release tag in this repository is annotated and a tag’s object id is not a commit. An immutable sha-<commit> tag is published alongside :latest, and a build with no release tag is stamped dev+<short sha> rather than a bare dev that identified nothing.

Curator definitions may come from configuration or code and run through one engine into the existing registry — no parallel authority and no second config reader. A definition declares its tools, and an unknown tool name fails rather than widening the set silently.