Native OMP integration · release status

Stable v0.7.6

Stable v0.7.6 is published as immutable GitHub Latest. Release v0.7.6. Signed candidate v0.7.6-prealpha.2; source 28fbdf57b1eab8437f2bba0cd1f753960cc3925f; archive SHA-256 96a78778608b1b232fd586abc012199c2cd10d6edb7b38a60f241d09720a89cd. Published v0.7.5 remains the predecessor. Stock OMP v18.8.9 (fa5ff4a3a977a28b93d025f4cf50f046e019f18c), Bun 1.4.0. All thirteen lanes passed; attempt counts and measured evidence are in the release ledger. The separate published-byte smoke passed; it does not expand the candidate matrix.

Lane	Attempts	Exact evidence
artifacts	1	Signed tag, checksums, GitHub attestations 3/3 and Sigstore bundles 3/3; v0.7.5 verified by digest-pinned historical Cosign bundles 3/3 (no GitHub build attestations).
debian	1	Run 38093821367 succeeded (https://github.com/carrythroughsystems/omp-session-gateway/actions/runs/38093821367); OS/kernel versions and migration counts are not exported.
macos	1	VirtualMac2,1, macOS 27.0 arm64; doctor 18/18, rollback 23/23; native addon 76a98a98c7adbe5481e1ac3ede2b7c6c889443dc5edd10929854e1ebde10c1b7.
ompPublication	1	Stock OMP v18.8.9; generation 1; publication, View/Control, new-generation/fork/resume and revocation.
android	1	Pixel 8 Pro, Android 17 build CP3A.261005.005, Chrome 154.0.8037.126; same-page unlock 6991 ms, Airplane 6906 ms, Doze 123 ms; 7/7 detectable; clean.
androidPush	1	Android 17, Chrome 154.0.8037.126, installed WebAPK; force-stop delivered_while_force_stopped, Doze delivered_after_doze_exit; outcomes are observed variants, not delivery guarantees.
androidPushCleanup	1	Device, browser and fixture restored.
deviceCloud	1	TestingBot real devices, tunnel 4.9: iPhone 17 Pro Max (26.6, safari 26.6); iPad (9th generation) (26.6, safari 26.6); Galaxy S26 (16.0.0, chrome 145.0.7632.159). Home Screen alerts do not qualify lock-screen presentation.
deviceCloudCleanup	1	Restored.
relay	1	1800 seconds, 2026-10-10T23:18:36.965Z–2026-10-10T23:48:36.978Z; 2 transitions, final phase live. Eight-hour endurance is not claimed.
cleanup	1	Zero gateway processes, listeners and live OMP hosts.
windows	1	Windows x86-64 build 26100; 4 CPUs, 8186 MiB; Administrator upgrade/rollback from v0.7.5 and fresh standard-account lifecycle; interactive logon, not unattended boot.
windowsCleanup	1	Zero instances and firewalls; tailnet node deleted and access vault removed.

Known limits — part of the claim

The Mac row is a guest, not bare-metal qualification. The guest does not exercise physical firmware, FileVault unlock, Secure Boot, power loss, physical sleep/wake, or physical device drivers (ADR-033); guest reboot and console-login recovery do not qualify a bare-metal Mac or startup before login.
TUN mode is mandatory. With userspace-networking tailscaled every tailnet peer arrives as a loopback peer, and the gateway fails closed rather than believing an identity header.
Never enable Tailscale Funnel. There is no supported public-Internet path.
Android radio transitions can wedge Chrome's process-wide network stack while Android stays healthy; the PWA retries and, after 45 s of visible failure, opens force-stop/reopen help.
Relay assurance is 30 minutes, not eight hours. The founder explicitly replaced the eight-hour gate with this fresh check, as for v0.4.1 and v0.4.0. Eight-hour endurance was not rerun or claimed; residual prolonged-operation risk is accepted. No bounded-memory-growth claim is made.
Attention and lifecycle scope is limited to the recorded retained-Mac new-generation/fork/resume and Pixel triage/stale-tap scenarios, not arbitrary behavior on every platform. New media qualification remains outside this claim. Background Web Push is qualified in full only on the Pixel, with force-stop and Doze as observed variants, never delivery guarantees.
Cloud devices are qualified in the browser. The export does not identify the tunnel host or observed Serve identity. The iPhone receipt proves Home Screen alert delivery and a Control tap, not lock-screen presentation; lock, Airplane, Doze, force-stop and cellular behavior stay Pixel-only.
Windows is qualified at the recorded x86-64 build, started at interactive logon, not at boot. A fresh standard-account install passed, but its upgrade and rollback are not qualified; the lane runs those journeys as Administrator. Other Windows versions remain supported and CI-tested, not qualified by this receipt.
In v0.5.0 and earlier, an update can close a page in use: on the first visit after a gateway upgrade, the new service worker's activation can navigate a pending launch or an open View/Control page back to the directory, because Chromium reports each page's creation URL. The first post-release View/Control smoke failures, including v0.4.0's return to the directory after View, match this navigation. The v0.5.1 fix never navigates from the worker; see the release ledger.
Untrusted local accounts are out of scope: a direct loopback caller can forge non-cryptographic identity headers on a shared shell host.
Portal Tunnel and self-hosted or proxied relays are unsupported; the gateway keeps OMP's existing end-to-end-encrypted relay.

Machine-readable truth: stable release lock · upstream lock · compatibility matrix · release ledger (authoritative where they disagree)

v0.7.6-prealpha.2: 2026-10-10T23:05:18.721Z–2026-10-10T23:52:42.422Z. All thirteen lanes passed. Publication and separate published-byte smoke passed. The approval driver must pass runtime comparison before merging; the campaign receipt alone does not prove that later comparison.

Fork-era release history

v0.3.0 was approved 2026-09-09 against exact patched OMP v18.1.14 observed 2026-09-08, with Bun 1.4.0. Its signed candidate v0.3.0-prealpha.3 was independently qualified and runtime-equivalent. The historical matrix was Debian 13 (trixie) x86-64, macOS 26.6.1 arm64 (Mac14,3), and Chrome 152.0.7977.75 on Android 17 (Pixel 10 Pro). Its rollback predecessor was v0.2.1, with separately activated exact patched OMP v17.4.1.

The source baseline moved to stock mainline OMP v18.1.20 on 2026-09-14 after upstream merged the collaboration registry. Fork-era qualification does not transfer to this architecture.