What changed,
and what did not.

Linux GTK and macOS AppKit previews now join Windows in replacing validated development revisions inside one native host process.

• The shared mzi-dev-reload/0.1 session and authority policy now drive Win32, GTK4 and AppKit hosts.
• Linux and macOS prepare a replacement Wasmtime runtime and restore host-owned state off the UI thread, then atomically rerender native controls on the platform main thread.
• Package name, publisher identity, state authority, WASI, origin and capabilities remain fixed for the session; revisions that expand authority are rejected.
• Build pipelines exercise an actual CLI-style descriptor, host acknowledgement, archive replacement and semantic rerender instead of relying only on unit tests.
• Linux x64 and ARM64 plus macOS ARM64 advance to Host 0.7 preview 1; macOS remains a CI artifact until production signing and notarization exist.

CLI 0.12 and Windows Host 0.8 keep one native process open while validated development revisions replace its Wasm runtime and semantic UI in place.

• mzi-dev-reload/0.1 uses a package-local session descriptor and host acknowledgement without exposing a network listener.
• CLI opens the host once after acknowledgement; an older host receives the compatible reopen fallback automatically.
• Host reloads only a validated archive at the exact active path and rejects changes to package name, publisher, state authority, WASI, origin or capabilities.
• Persisted host-owned state is restored into the replacement runtime before Win32 controls are rerendered on the UI thread.
• Stale descriptors are rejected when their CLI process is no longer alive, and acknowledgements are scoped to an unpredictable session identifier.
• The Windows 0.8 per-user installer and its exact SHA-256 metadata are published through the independently signed beta update feed.

The CLI now watches an application workspace and produces a validated package after every saved source or contract change.

• mzi dev observes AssemblyScript, WAT, manifest, interface, schema and WIT files while ignoring compiler output and dependency directories.
• Editor write bursts are debounced and overlapping changes are queued instead of starting concurrent compilers.
• Compilation errors are reported without terminating the watcher; the next saved correction triggers a clean retry.
• Each successful revision is packaged, inspected and identified by its deterministic SHA-256 before being reported.
• The optional --launch flag reopens each successful revision through the operating system MZI file association; the default remains a quiet continuous build.

Developers can now author portable MZI behavior in AssemblyScript instead of writing WebAssembly Text by hand.

• mzi init --language assemblyscript creates typed action source, editor configuration, a pinned compiler dependency and reproducible release configuration.
• mzi build and mzi run detect the project language and compile assembly/index.ts into an import-free optimized Wasm module.
• The compiler is installed inside each application workspace, keeping its exact 0.28.20 version explicit and repeatable.
• Tests compile and execute the starter, edit its typed source, rebuild it and prove that the resulting Wasm behavior changed.
• The dependency-free WebAssembly Text starter remains available as the default minimal path; AssemblyScript is accurately presented as TypeScript-like rather than full TypeScript.

The beta CLI now closes the loop from editable project to an application opened by the installed operating-system host.

• mzi run accepts either a workspace or an existing .mzi package.
• Workspace runs recompile app.wat, build the deterministic archive and inspect its structure, runtime profile and signature before launch.
• Windows, macOS and Linux use their normal .mzi file association, keeping application execution inside the independently installed host.
• The --no-launch mode provides the same build and validation path for CI and automation.
• Homepage, downloads and documentation now present one honest three-command path from an empty directory to a running application.

Windows Host update decisions are now authenticated by a dedicated Ed25519 release key whose public identity is embedded in the client.

• mzi-host-update/0.2 signs a domain-separated canonical release payload that binds version, target, installer contract, byte length and SHA-256.
• The API refuses to publish a feed when its signature, trust key, setup bytes or release metadata differ.
• Windows Host 0.7 embeds only the public beta trust root and verifies every Ed25519 signature before reporting an update.
• Host tests generate isolated signing identities and reject tampered signed releases in addition to redirects, foreign origins and contradictory version state.
• The private signing key is excluded from Git and automatic installation remains disabled until the Windows executable itself is code-signed.

MZI Host can now check a release feed that is generated from the exact downloadable Windows setup.

• The mzi-host-update/0.1 endpoint validates the setup PE header, byte length, SHA-256 and installation contract before publishing a release.
• Windows Host exposes an on-demand native update check with a seven-second deadline and continues running applications when the network is unavailable.
• The client rejects mismatched platform, contradictory version state, foreign artifact origins, malformed hashes and unsigned automatic-install instructions.
• The feed supports cache validation with an SHA-256 ETag and reports whether a client version is current.
• Automatic download and execution remain disabled until the Windows setup is code-signed and the update metadata has an independent production signature.

Windows users can now install MZI Host once and open downloaded .mzi applications by double-clicking them.

• A self-contained x64 setup installs the native host and Wasmtime runner under the current user profile without administrator access.
• The installer registers the .mzi application type, quoted open command and Start menu shortcut, then exposes a standard Windows uninstall entry.
• An isolated test verifies installation, file association and complete removal using disposable files and a dedicated HKCU registry subtree.
• Every build checks the setup PE header and publishes its exact byte size, SHA-256, install scope and signature status beside the portable ZIP.
• The beta setup is intentionally labeled unsigned because Windows code signing and reputation remain a production distribution milestone.

mzi.app now distributes verified application artifacts through a human catalog and a machine-readable host API.

• The new application catalog exposes Field Notes, Capability Clock and Capability HTTP as exact signed .mzi downloads.
• Catalog data is derived from each real archive and rejects mismatched name, version, byte size, SHA-256 identity or signature state.
• The mzi-catalog/0.1 JSON endpoint publishes stable artifact URLs, publisher identity, ABI, capabilities and supported host surfaces with an SHA-256 ETag.
• Catalog links can open a selected same-origin package directly in Browser Host; arbitrary or remote query targets remain rejected.
• The distribution page distinguishes the portable Windows beta from the CI-built but not yet publicly notarized macOS host.

The standalone CLI now turns an empty directory into editable logic and a genuinely runnable MZI application.

• mzi init creates a semantic offline counter with increment, decrement and reset actions instead of an empty WebAssembly module.
• The workspace includes readable WebAssembly Text in app.wat and a compiled app.wasm, so the first package can run immediately.
• mzi build validates and recompiles app.wat automatically before producing the deterministic portable artifact.
• CLI tests instantiate the generated Wasm, exercise every starter action and prove that editing app.wat changes the rebuilt package.
• Homepage, downloads and documentation now lead developers from tool download to a package they can open in Browser Host.

Windows, Linux and macOS now execute the same clock import and bounded HTTP task contract as Browser Host.

• Desktop Host 0.6 selects typed Wasmtime bindings for MZI Application ABI 0.3, 0.4 or 0.5 without translating newer packages through an older contract.
• The signed Capability Clock proof receives wall time from each native host only after the manifest declaration is approved.
• Application 0.5 resolves self against the signed HTTPS distribution origin, performs one credential-free GET with a five-second deadline and 256 KiB response ceiling, then returns the result to the Component.
• Windows, Linux and macOS distributions now include the Field Notes, clock and HTTP proof packages; native tests cover the granted and denied network paths.
• The Windows build falls back to a Linux container test harness when local Application Control refuses an unsigned development runner, and labels that benchmark source explicitly.

Application 0.5 performs useful asynchronous network work without giving portable Components direct browser access.

• The mzi:[email protected] WIT contract adds typed http-get effects and complete-http responses while retaining synchronous, portable Component calls.
• Capability HTTP is a signed 11.1 KB Rust Component proof that requests a same-origin endpoint and renders the host-returned text.
• Browser Host 0.7 authorizes every task against self or exact HTTPS origins from the manifest and strips credentials, redirects and referrers.
• Network work has a five-second deadline and 256 KiB response ceiling; Component completion retains the 750 ms execution limit.
• CLI, SDK, deterministic Component probes and positive and denied E2E paths validate the authority boundary.

Application 0.4 lets portable Component logic call a host-owned clock only after declared authority is approved.

• The new mzi:[email protected] WIT world imports clock.now-ms while retaining typed actions and migrations.
• Capability Clock is a signed 9.8 KB proof package containing a real Rust Component with no direct browser or operating-system access.
• Browser Host 0.6 inspects generated Component imports, rejects unsupported or undeclared authority and injects only the approved wall-clock function.
• CLI and SDK validate the clock capability boundary; deterministic component tests use a fixed host clock.
• Desktop and mobile browser tests open the 0.4 package, approve its request and verify a live 13-digit timestamp returned through the import.

The native iOS Host now compiles for the real iPhoneOS ARM64 target in addition to executing in Simulator.

• GitHub Actions produces separate Simulator and unsigned iPhoneOS device artifacts from the same tested source.
• The device Mach-O is required to contain only ARM64 and declare the IOS build platform with a minimum iOS 17.0 target.
• CI verifies bundle identity, the embedded signed Field Notes package and the absence of linked WebKit or JavaScriptCore frameworks before publishing.
• The Simulator suite still proves signature verification, Component actions, migration, instruction-budget interruption and the native UI path.
• The unsigned device artifact is not installable as shipped; Apple signing, physical-device execution and App Store policy validation remain explicit open milestones.

iOS Host preview 2 interrupts runaway WebAssembly instead of relying on an unenforceable wall-clock timeout.

• Every exported Wasm call receives an independent 10 million VM-instruction budget in the token-threaded WasmKit interpreter.
• Budget exhaustion throws through the interpreter, and the host permanently locks that Component or core-Wasm instance after the trap.
• A malicious core module with an infinite backward branch proves termination at a 1,000-instruction test budget on the iOS Simulator.
• The dependency preparation step verifies the exact WasmKit 0.2.2 commit before applying the reviewed two-file metering patch and refuses unknown revisions.
• Normal signed Field Notes actions, schema migration, SwiftUI execution proof and Simulator artifact remain green.

The unchanged signed Field Notes Component now executes through a native SwiftUI host and no-JIT Swift interpreter in an iPhone Simulator.

• iOS Host preview 1 opens .mzi documents, verifies the canonical Ed25519 publisher signature with CryptoKit and renders semantic nodes as native SwiftUI controls.
• WasmKit executes the import-free embedded core module through the focused mzi:[email protected] Canonical ABI without JIT or a browser engine.
• Component actions and the schema 1 to 2 migration pass on an Apple-hosted iOS Simulator; a UI test adds and toggles Pump test and captures the running host.
• Host-owned state is bound to the publisher key, with 25 MB package, 5 MB call, 4 MB state and 16 MiB linear-memory limits.
• The artifact is Simulator-only: physical signing, instruction fuel and an App Store-compatible distribution model remain open boundaries.

The unchanged signed Field Notes Component now executes typed actions and state migration inside the native Android Host.

• Android extracts the single embedded core module directly from the signed Component artifact and applies the mzi:[email protected] Canonical ABI.
• Field Notes add, toggle and allow actions execute through Chicory on the Android JVM; the schema 1 to 2 migration is covered by the same runtime tests.
• Component and core-Wasm calls have a 10 million instruction budget, 16 MiB memory ceiling and trap lockdown.
• The native Compose proof adds a note, toggles it and restores the completed record after an Android process restart.
• No WebView, JNI runtime, network permission or Android-specific application package was added.

A native Compose host opens MZI packages, verifies their publisher boundary and executes core WebAssembly without a WebView or JNI runtime.

• Android Host preview 1 opens .mzi documents through the system picker and ACTION_VIEW.
• Canonical Ed25519 signatures, archive paths, duplicate entries and 25 MB compressed/expanded limits are verified before activation.
• Semantic controls are rendered with Jetpack Compose and host-owned state survives Android process restarts.
• The pure-JVM Chicory interpreter executes the bundled core-Wasm proof; signed Component Model actions remain the next Android runtime milestone.
• The APK requests no network permission and CI checks tests, Android lint and 16 KB ZIP alignment.

Linux and macOS prove that a native MZI host can open and replace signed applications without rebuilding for the operating system.

• Linux Host preview 5 accepts .mzi files through GTK drag-and-drop, reviews the replacement package and swaps runtimes only after approval succeeds.
• The Linux x64 AppImage registers the MZI package MIME type and is verified by a clean-system two-package render smoke test.
• Native AppKit Host preview 5 opens .mzi documents from Finder and drag-and-drop on a GitHub-hosted Apple Silicon runner.
• Both desktop workflows publish screenshots and verified seven-day beta artifacts.

Three independent hosts verify publisher continuity and execute the byte-identical signed application package.

• mzi-signature/1 signs a domain-separated canonical payload with Ed25519.
• The CLI generates publisher keys, signs packages and rejects tampered signed artifacts.
• Browser, Windows and Linux hosts verify the publisher key before binding it to storage_key.
• Linux ships self-contained native GTK4 AppImages for x64 and ARM64, with static terminal hosts and Wasmtime runners.
• Both exact AppImages are smoke-tested without system GTK through approval, control creation, a Wasm action and semantic rerender; ARM64 currently uses AArch64 emulation.

Offline records survive a package and schema upgrade through the same isolated migration in Browser and Windows hosts.

• A stable storage_key separates application data from changing package SHA-256 identities.
• The mzi:[email protected] contract adds a typed migrate function with explicit source and target schema versions.
• Both hosts adopt the previous Field Notes identity, preserve a versioned backup and commit only valid schema-2 state.
• The CLI and TypeScript SDK validate versioned storage declarations and migration edges.
• Field Notes demonstrates schema 1 to 2 migration without losing existing records.

Field Notes becomes a real WebAssembly Component executed through the same typed WIT interface in browser and Windows hosts.

• Field Notes is rebuilt in Rust as a 17.5 KB component and packaged in a deterministic 9.3 KB artifact.
• Browser Host 0.3 lowers and invokes import-free MZI components with Jco inside its Worker.
• Windows Host 0.3 uses a persistent Wasmtime runner with typed generated bindings and fuel limits.
• The CLI now rejects mismatches between component-model declarations and WebAssembly binary kinds.
• The component source, Docker cross-build and execution probes are reproducible from the repository.

MZI moves from a scalar counter to a persistent offline record application shared by two hosts.

• Field Notes adds semantic forms, statistics, record collections, item templates and contextual actions.
• The package embeds the versioned mzi:[email protected] WIT contract.
• TypeScript SDK 0.1 defines and validates the Application 0.2 authoring model.
• Browser and native Windows hosts render and persist the same 2.12 KB package.
• The CLI creates deterministic Application 0.2 workspaces with an embedded WIT contract.

The unchanged proof package now runs in a second, independent host outside the browser.

• Native Win32 Desktop Host validates and opens the exact Field Counter .mzi artifact.
• Wasm executes through an independent pure-Go runtime with no operating-system imports.
• Semantic nodes map to native controls and state persists under the package identity.
• Reproducible Windows build, downloadable archive and raw size, startup, action and memory measurements.

MZI moves from package documentation to a working protocol demonstration.

• First Browser Host opens an unchanged .mzi artifact.
• WebAssembly logic executes in a time-limited isolated worker.
• Semantic UI is rendered by the host rather than shipped as a platform rendering engine.
• Application state is owned and persisted locally by the host.

The project center becomes an operational developer beta rather than a static project page.

• Persistent developer beta registry backed by PostgreSQL.
• Manifest Lab validation, deterministic package identity and development bundle export.
• Keyboard-accessible command search across the project center.
• Database-aware health checks and hardened production response headers.

The first public statement of the MZI package and host model.

• Initial draft specification for packages, hosts and capabilities.
• Documentation and public implementation roadmap.
• First browser-based manifest inspector.