What we shipped.

Embedding and speech candidates remain unavailable for paid customer work until artifact review, promotion, and live qualification pass. Apple system frameworks remain under the central commercial hold. Image-generation and video-generation lanes remain held.

• Reserve pending task admission before asynchronous policy checks, and keep admission closed while an existing dispatch is still unwinding.
• Reject cancelled or incomplete MLX text and vision generation instead of returning partial output as a successful result. Producer interruptions are distinguished from parent-task cancellation.
• Cancel and await the upstream generation task before returning model and worker ownership after completion, an explicit stop, an error, or cancellation.

• Vision results include worker-received prompt and document SHA-256 hashes, model snapshot identity, requested limits, and the generation stop reason. These diagnostics do not include raw prompt or document content.

Embedding and speech candidates remain unavailable for paid customer work until artifact review, promotion, and live qualification pass. Apple system frameworks remain under the central commercial hold. Image-generation and video-generation lanes remain held.

• A model turned off in Models settings is removed from your Mac's advertised model eligibility. Changing that preference refreshes availability without an app restart, avoiding assignments that the model preference would refuse.

Embedding and speech candidates remain unavailable for paid customer work until artifact review, promotion, and live qualification pass. Apple system frameworks remain under the central commercial hold. Image-generation and video-generation lanes remain held.

• Bounded measurements for assignment admission, acknowledgement, dispatch, runner preparation, output upload, cleanup and final availability reporting. These measurements preserve mandatory admission checks and cleanup ordering.

• Text arriving inside the progress reporting interval is retained for the next frame instead of discarded. Liveness frames retain the existing rate limit.

Embedding and speech candidates remain unavailable for paid customer work until artifact review, promotion, and live qualification pass. Apple system frameworks remain under the central commercial hold. Image-generation and video-generation lanes remain held.

• Transcription and subtitle providers now advertise a complete cached MLX Whisper snapshot under its exact model id. The scheduler can prefer Macs that already hold those files instead of starting another model download.
• Cache presence requires the current compiled snapshot tree and all signed inventory files at their expected sizes. Missing, truncated, redirected, or extra files do not count as a complete snapshot. These routing hints leave the host and worker's signed-manifest and content-hash checks in place.
• Both Whisper brokers refresh model capabilities after verified staging so the next request can use the new cache information. Model and workload release holds remain unchanged.

Embedding and speech candidates remain unavailable for paid customer work until artifact review, promotion, and live qualification pass. Apple system frameworks remain under the central commercial hold. Image-generation and video-generation lanes remain held.

• Prepared the native Kokoro speech runner with bounded text, the fixed af_heart voice, WAV validation, character metering, cancellation, and a no-network XPC worker. Its model snapshot and authorization are pinned and verified before execution; this release does not offer the held model.
• Bundled inference runtime license notices, including Kokoro and Misaki notices.
• Added operator-only signed embedding and speech canaries to separately compiled staging builds. These exercise local workers without provider enrollment, customer billing, or production model authorization.

• Narrowed the compiled customer model catalog to the selected Qwen3 text, Qwen3-VL vision-understanding, and Whisper transcription variants. Other registry models and fine-tuning remain held for separate review.
• Provider catalog discovery requires an exact signed speech snapshot before reporting a speech model as resolvable; the compiled release policy remains an independent gate.

Apple system frameworks remain under the central commercial hold. Embedding, image-generation, speech-generation, and video-generation implementations remain unavailable until their separate release requirements and live tests pass.

• Prepared an isolated MLX embedding runner with bounded input batches, signed model delivery, cancellation, response validation, and input-count metering. Embedding models remain unavailable pending model release and live qualification.
• Provider transcription self-tests can compare public speech fixtures against expected words, allowing punctuation and capitalization differences.

• MiniLM sentence pooling now excludes padding and uses masked mean pooling followed by L2 normalization. Padded positions no longer contribute to the sentence vector. Other embedding poolers also receive the attention mask.
• The provider build now runs a numerical MLX pooling regression using cached dependencies and synthetic hidden states; it downloads no model weights.
• Compute workers now use separate process-owned scratch directories and locks, so cleanup of abandoned request data leaves active workers' files alone.

Apple system frameworks remain under the central commercial hold. This release makes chat and vision jobs start sooner and stream as they generate.

• Chat replies now stream to the customer as your Mac generates them, instead of arriving all at once when the job ends.
• After a chat job, your Mac keeps that one model loaded for up to 10 idle minutes, so the next request for it skips reloading and re-checking the weights. Everything from the request is still wiped after every job, any other kind of job unloads the model first, and the model is released at once if macOS reports memory pressure.
• Chat and vision jobs start sooner: a model already on your Mac is checked in full once, inside the isolated worker, instead of also being re-read before every job, and the signed model authorization is reused for up to two minutes instead of being downloaded twice per job.

• Your Mac can run 8-bit versions of popular models (Qwen3, Llama 3.3 70B, GLM-4.5 Air) and, with 192 GB of memory or more, large models: Qwen3 235B, GLM-4.6, Qwen3 Coder 480B and DeepSeek V3.1.
• Each job reports how long each step took on your Mac (model check, load, first token, generation), with no prompt or result content, so slow steps can be found and fixed.
• When few Macs hold a released model, the network may ask an idle Mac that can run it to download it in the background, so the next request for it does not wait on a download. Your Mac does this only while it is idle and ready for work, never for a model you turned off auto-download for on the Models page, one model at a time, and only after the usual disk and memory checks.

Apple system frameworks remain under the central commercial hold. This release fixes transcription and subtitle jobs, which no Mac could receive since 1.7.46.

• Your Mac now offers the Whisper large-v3-turbo model it already runs, so transcription and subtitle jobs can reach it. Since 1.7.46 every Mac reported the Whisper engine but not the model, so those jobs found no Mac and failed before starting.

Apple system frameworks remain under the central commercial hold. This release adds a video generation engine that stays switched off until Common Compute opens video jobs; nothing about the jobs your Mac runs today changes.

• Video generation with Wan 2.2 TI2V-5B: short 24 fps clips from a text prompt, optionally starting from an image. It runs on MLX inside the same isolated, no-network worker as image generation, and only on Macs with at least 32 GB of memory. Your Mac will not advertise it, download its 34 GB of weights, or accept video jobs until the workload is offered.

Apple system frameworks remain under the central commercial hold. This release fixes model downloads and audio input in 1.7.46 and moves the Gemma line to Gemma 4.

• Your Mac can now run the models whose licence text Common Compute hosts: Llama 3.1, 3.2 and 3.3, and Whisper large-v3-turbo for transcription and subtitles. 1.7.46 refused to download those licence files, so every job on those models failed before it started. The licence is still checked byte for byte against its signed hash before the model loads.
• Transcription and subtitles accept WAV, AIFF, CAF and MP3 audio sent with the job. The new MLX Whisper engine read every such upload as M4A and refused the others.

• Your Mac no longer offers Gemma 3 1B, 12B or 27B. Gemma 4 (E2B, E4B, 12B, 26B and 31B) is the Gemma line on Common Compute.

Apple system frameworks remain under the central commercial hold. This release moves transcription onto MLX and lets your Mac serve 18 more open models.

• Your Mac can now take transcription and subtitle jobs (preview) with Whisper large-v3-turbo. It runs on the GPU through MLX instead of Core ML. The 8-bit model is an 864 MB download that the app checks byte for byte before use.
• Your Mac can now serve 18 more open models when it has the memory for them: Llama 3.2 1B and 3B, Llama 3.1 8B and Llama 3.3 70B; Gemma 3 1B, 12B and 27B, and Gemma 4 E2B and E4B; GLM-4.5 Air and GLM-4.7 Flash; Qwen 2.5 Coder 32B; MagenticBrain 8B; and, for images and documents, GLM-OCR (4-bit and 8-bit), LFM2-VL 1.6B, Fara 7B and Fara 1.5 9B. Each model downloads only when a job needs it, with its licence, and is checked byte for byte before it loads.

• Your Mac no longer offers olmOCR-2 7B. Its published configuration cannot load in the app's MLX runtime, so every job on it would have failed.

Version 1.7.44 was signed, notarized and passed a smoke install but was not published: the full release gate caught a stale test pin after its metadata merged, and a provider release may differ from its binary's source commit only by release metadata. 1.7.45 contains the same app changes, rebuilt after the fix.

Apple system frameworks remain under the central commercial hold. This release enables one new lane, image upscaling, which runs on MLX (no Core ML), and does not enable any held speech, video, music or computer-vision offering.

• Your Mac can now take image-upscaling jobs (preview). Real-ESRGAN enlarges an image to four times its width and height on the GPU through MLX. The model is a single 33 MB file that the app downloads once and checks byte for byte before it is used.

• Earnings explains when a payout is on hold because the Provider Agreement has not been accepted, and payout history now names every status in plain words ("Accept agreement", "On the way", "Needs attention") instead of raw codes.

Apple system frameworks remain under the central commercial hold. This release does not enable held speech, image, video, music or computer-vision offerings, and does not change model-license or signed-supply requirements.

• The app now tells you when the Provider Agreement needs your acceptance. A banner appears above the dashboard, a short prompt opens with a link to the full agreement on commoncompute.ai, and you can accept it right in the app. Accepting releases any of your Macs that were held for the agreement, with no restart or update needed. A reminder notification appears at most once a day until you accept.

Versions 1.7.40 and 1.7.41 were signed, notarized and tested but not published. Server-only changes merged before their artifacts went out (a provider release may differ from its binary's source commit only by release metadata), and the full release gate then caught a lint error in that server change. 1.7.42 contains the same app changes, rebuilt after the fix.

Apple system frameworks remain under the central commercial hold. This release does not enable held speech, image, video, music or computer-vision offerings, and does not change model-license or signed-supply requirements.

• Model files already on this Mac are reused instead of downloaded again. When a model's signed file list changes (for example, the packaged licence added on 2026-09-17), the weights from the earlier download or the legacy Hugging Face cache are cloned into the new snapshot and re-hashed against the signed manifest; only files that are missing or do not match are downloaded.
• Each job's private model copy in the no-network worker is now an APFS clone of the verified file rather than a full rewrite, and it is still fully hashed before the model loads. Jobs spend less time on disk work before inference starts.
• The dock icon, menu bar and app menu now open the same single dashboard window instead of a second copy that could not be closed until the app quit.

Apple system frameworks remain under the central commercial hold. This release does not enable held speech, image, video, music or computer-vision offerings, and does not change model-license or signed-supply requirements.

• Model downloads now check the actual GPU core count, the model's memory floor, weights, KV-cache budget, runtime workspace and macOS reserve. Manual downloads and job-triggered snapshot downloads use the same guard.
• The Models screen explains incompatible hardware and includes the KV budget for a 4K combined context. Longer inference requests are checked against the actual tokenized context before generation; oversized contexts fail explicitly.
• Free-space checks use the cache and temporary volumes, reserve room for staging and execution copies, and coordinate concurrent downloads. Existing cached models remain removable, including ones no longer compatible or offered.
• GPU capability reporting reads the physical core count instead of assuming the largest GPU variant of a chip family.
• Manual preloads acquire the same signed execution snapshots as jobs, without loading model weights into the networked app's GPU memory just to download them.

This release retains the model-cache fixes from the unpublished 1.7.37 candidate and adds cancellation handling across the app and control plane. Server-side delivery requires the matching control-plane rollout; an app update alone does not enable that behavior.

• Customer cancellation is delivered as a signed request on the provider heartbeat, including after reconnect. The control plane retries until acknowledgement within a bounded offline delivery window; cancelled work does not keep renewing its lease or count as a provider failure.
• The Mac forwards cancellation to the actual assignment runner, including fresh LLM and VLM instances, and keeps its active slot while dispatch unwinds. Cancellation during model preparation is checked again before starting an MLX worker. An acknowledgement confirms request handling, not immediate erasure or proof that all physical computation has stopped.
• Release QA includes a real-runner cancellation probe alongside the existing strict-answer inference, cache removal/re-download, recovery and update tests.

• Apple system frameworks remain under the central commercial hold. Those workloads are not customer-orderable, and retained implementation code is not an offer. Existing model-license/supply gates remain unchanged. This release does not enable held speech, image, video, music, or computer vision offerings, or expand access to provider-host data.

Version 1.7.36 passed the automated release gate and signed execution smoke tests but was not published. Physical UI testing confirmed that its model controls still omitted the separate execution-snapshot cache.

• Models now counts and removes this build's pinned LLM/VLM execution snapshot together with the legacy Hugging Face copy. Both stores use the existing exclusive removal lock; downloads, active jobs, and auto-download preferences retain their existing protections.
• Retirement cleanup, reset, cached-model routing hints, and the don't-auto-download check reuse the same cache view. Generated snapshot ownership is not execution authorization; signed manifests and per-file verification remain required. Unrecognized historical snapshot trees are not silently attributed to a model or deleted.
• The signed-app LLM smoke test now checks the built-in public answer fixture, model identity, engine, and finish reason instead of accepting metering alone.

• Apple system frameworks remain under the central commercial hold. Those workloads are not customer-orderable, and retained implementation code is not an offer. Portable replacement workloads remain held until separately reviewed, tested, and promoted server-side.

Version 1.7.33 was signed and notarized but never published. The complete release gate caught that its generated appcast no longer carried the exact commercial-hold disclosure enforced by the legal-remediation tests. No 1.7.33 artifact, tag, appcast, or provider-version floor was deployed to production.

• Apple system frameworks remain under the central commercial hold. Those workloads are not customer-orderable, and retained implementation code is not an offer. Portable embeddings also remain held until separately reviewed and promoted server-side.
• Rebuilt the bounded MLX text-embedding worker and regenerated provider model policy from the corrected, fail-closed release source. The worker remains in the signed no-network XPC service and accepts only signed immutable model inventory.

• Replaced the unpublished 1.7.33 candidate with an otherwise equivalent 1.7.34 build whose appcast, release notes, tests, and provider policy all use the same commercial-hold disclosure.

• Added a bounded MLX text-embedding worker inside the signed, no-network XPC compute service. It accepts only a signed immutable model inventory, caps batch size and input/result bytes, privately materializes and re-hashes the model, and exposes no downloader, callback, or result-upload authority to the worker.
• Regenerated the provider's model architecture and offering policy from the reviewed catalog. Signed served-catalog state can narrow or retire compiled entries but cannot add an unreviewed model or repoint an immutable snapshot.
• Apple system frameworks remain under the central commercial hold. Those workloads are not customer-orderable, and retained implementation code is not an offer. The portable embedding runtime also remains held until its own reviewed server-side promotion.

• Bundled the current MLX model metadata needed to validate the expanded signed catalog. Actual availability still requires an offered model/workload pair, compatible signed weights, sufficient device memory, and live capacity.
• Established a current signed provider build that can be qualified for an organization-scoped Private Fleet. The production Private Fleet workload allowlist remains closed; installing this build does not enable that lane.

This is the release previously numbered 1.7.31. That build was signed and notarized but never published: a later fix to the release pipeline itself (regenerating the derived web changelog during prepare) changed five non-metadata files after the binary's source commit, and verify_source_to_release_diff correctly refuses to publish a binary whose source predates unrelated changes. Rebuilding required a version the appcast did not already carry. No 1.7.31 artifact was ever distributed, and the appcast is single-item, so nothing references it.

• The provider's compiled fallback now advertises only mlx_llm, mlx_finetune, and mlx_vlm, and only the reviewed qwen3-4b and qwen2-vl-2b models. Legacy and specialized workload or model identifiers cannot reappear when served-catalog metadata is unavailable.
• Signed served-catalog state can retire or narrow compiled entries but cannot add a model, repoint an immutable model revision, or widen the provider's commercial allowlist. A model is advertised only with matching signed snapshot inventory for its offered workload.
• Capability refreshes filter cached-model claims to released, resolvable models and apply signed snapshot and retirement narrowing before the first provider advertisement.
• Workloads implemented with Apple system frameworks remain under the central commercial hold: they are omitted from discovery and cannot be quoted, accepted, or dispatched. Retained implementation code is not an offer.

• MLX text inference and the provider self-test now default to qwen3-4b; legacy aliases no longer select Llama by default.
• MLX sampling accepts a bounded top_k value in addition to the existing temperature, top-p, penalty, and seed controls.

• Snapshot-backed model workloads now obtain a fresh Common Compute-signed authorization after model download and verification, immediately before the no-network XPC service starts. The new authorization must describe the exact same framework, repository, immutable revision, file inventory, and tree digest that the host staged; a catalog change fails closed.
• The isolated worker's five-minute signature freshness and replay defense is unchanged. Cold downloads no longer require a weaker, hour-long acceptance window.

• Cold model preparation that takes longer than five minutes no longer leaves currently offered MLX LLM/VLM, image-generation, or fine-tuning work with an expired pre-download model authorization.
• The provider catalog now includes the pinned Qwen3.8 27B Vision Q8 checkpoint for 64 GB and larger Macs. Server-side signed inventory and live capacity checks still decide whether it is available for customer jobs.
• Model discovery now offers a ten-model set sized across 48, 64, 96, 128, and 512 GB Macs. New architecture targets remain unavailable until their native runtime and signed model inventory are complete.
• Chat, image, vision-language, fine-tuning, batch, generic-job, workload, and v2 submission paths now use the same live-capacity check. An unavailable model fails closed before submission, while legacy model links and compatible automatic selection keep working.
• Workloads implemented with Apple system frameworks remain under the central commercial hold: they are omitted from discovery and cannot be quoted, accepted, or dispatched. Retained implementation code is not an offer.
• Long-running chat jobs now recover the completed result after the stream wait expires instead of asking the customer to submit the same prompt twice.

• Privacy-safe timing audit spans now cover API rate limiting, authentication, organization and policy checks, billing, input handling, persistence, dispatch, outbox delivery, provider acknowledgement, first progress, and completion. Request IDs and Server-Timing headers make slow stages traceable without recording prompts, inputs, or result bodies.
• The operations console now reports queue, dispatch, and end-to-end latency so fleet testing can separate control-plane delay from provider execution time.

• Every task artifact acquisition now receives a separate, host-generated file inside the task's protected scratch directory. Reusing one signed artifact capability for multiple workload inputs no longer creates a filename collision, while exclusive creation and no-follow protections remain intact.
• Long-running immutable model download, migration, and verification stages now send bounded, content-free liveness pulses. The pulses identify only the public model framework, repository, revision, and verified tree digest; they never contain customer prompts, media, results, URLs, or filenames.

• Multi-input audio and video composition no longer fails when the same signed source artifact is intentionally used more than once.
• Cold model preparation no longer looks like an unresponsive provider while the host is downloading or verifying a large model snapshot for offline XPC execution.

• Speech transcription, diarization, MLX language and vision inference, fine-tuning, image generation, depth, and upscaling now advertise the same signed no-network XPC execution boundary as the rest of the marketplace.
• Model weights are downloaded only by the networked host from immutable, signed manifests, verified by size and SHA-256, and staged for offline use by the Compute Service. Customer prompts, media, and results are never sent to model hosts.
• Every completed job reports bounded, content-free execution evidence for its XPC boundary, denied worker network access, host egress policy, scratch cleanup, engine, resource state, and immutable model revision. This is audit evidence, not a claim of hardware attestation on a provider-owned Mac.

• FluidAudio speech work now enforces host and worker deadlines, cancels stalled XPC requests, cleans model state on failure, and preserves model-stage telemetry through the asynchronous runner boundary.
• A job that lands exactly while the bounded-lifetime Compute Service is retiring now reconnects once to a fresh service. Other errors are never retried, and completed assignments are cleared from host runner memory.
• Exact Common Compute artifact-capability URLs continue to work on provider VPNs that map public destinations into the RFC 2544 benchmark range, while private, loopback, link-local, metadata, arbitrary reserved, and unapproved destinations remain blocked.

• Downloaded task inputs remain behind opaque, task-bound Common Compute artifact capabilities. The provider app now restores only a small, validated file-type suffix from the platform response Content-Type; source URLs and customer filenames still never cross the provider boundary.
• Restoring a media type is confined to the existing per-task internal-storage scratch directory and fails closed instead of overwriting another file.

• Audio classification, video trajectory, optical flow, and scene detection now receive runner-compatible local media names after secure artifact retrieval. Previously the opaque capability token became an extensionless filename, causing valid audio and video fixtures to be rejected before XPC execution.

• The no-network Compute Service now admits exactly one signed-host claim at a time. New claims cannot overlap scratch preparation, request decoding, execution, response delivery, or cleanup, preventing state and files from one customer request from being reused by another.
• Every Compute Service claim uses a private internal-storage scratch directory that is scrubbed and verified empty before and after use. Replay state, image-filter context, sealed artifacts, model materialization, and workload temporaries are reset or removed at the claim boundary.
• Cleanup, acknowledgement, cancellation, and connection failures retire the Compute Service instead of allowing an uncertain process to accept another claim. Unsupported generic RPC requests continue to fail closed.

• The Compute Service can remain warm for a short, bounded sequence of claims without allowing concurrent customers or carrying request-owned files and state across the boundary. This preserves sandbox protection while avoiding a fresh process launch for every short workload.

• Customer inputs, derived outputs, task scratch files, Compute Service temporaries, and writable Tool VM clones now fail closed unless their storage resolves to the FileVault-protected startup Data volume. Public, signature-verified model weights and immutable Tool VM archives may remain on provider-selected storage because they do not contain customer data.
• Downloaded and inline task inputs are created through validated directory descriptors with no-follow and exclusive-create semantics. Network inputs now stream directly into that file through an ephemeral URL session instead of first landing in an opaque operating-system download location.
• The host, Router availability mirror, no-network Compute Service, and Tool clone lifecycle all enforce the same internal-storage rule before admitting or executing work.

• Early HTTP rejection can no longer race download continuation setup and leave a provider job waiting until its outer workload timeout.
• Tool VM settings now explain that an external immutable base may be retained as an archive, but execution requires the base and disposable clones on the same internal APFS volume.

• Verified model downloads now follow Hugging Face's immutable same-origin cache redirects and its bounded regional Xet CDN destinations. Mutable model refs, non-model APIs, arbitrary subdomains, malformed paths, and lookalike hosts remain blocked; every downloaded file still has to match the signed size and SHA-256 inventory before no-network XPC execution.
• The sealed-file tamper regression test now always changes a ciphertext byte, removing a rare false failure when the random original byte was already the test's fixed replacement value.

• FileVault is now verified from inside the signed App Sandbox before a Mac accepts an assignment and again immediately before customer input can become plaintext. Unknown, transitioning, paused, malformed, or disabled states all fail closed.
• Sandboxed FileVault detection now uses the narrow Apple APFS status interface carried by the Developer ID provisioning profile, fixing the false "FileVault unknown" result on encrypted provider Macs.
• Provider trust evaluation now interprets persisted FileVault signals consistently, so only an explicit enabled signal satisfies the disk- encryption gate.

• The on-device LLM release smoke test can select a pinned catalog model while retaining the production download, digest verification, App Group staging, and no-network XPC inference path.

• Added sealed marketplace execution for 35 reviewed workloads. Customer input and results travel through the provider host as ciphertext, while signed, bounded work runs inside the separately sandboxed no-network XPC service.
• Added per-device recipient-key enrollment, task-bound key wrapping, signed execution manifests, encrypted artifact framing, and fail-closed workload and device rollout gates.
• Added a verified public-model store. The host may download only signed, hash-pinned model files; customer prompts, images, audio, and results are not sent to model hosts.

• Marketplace workloads now advertise their concrete XPC execution boundary. A workload is withheld when the installed provider build cannot prove the exact reviewed runner capability.
• Provider vetting and completion evidence now distinguish application-level containment from provider-owned-host or confidential-computing guarantees.

• Preserved known-length task bodies when staging ordinary input in R2, avoiding a submission failure introduced by the centralized sealed-input coordinator.

• In-app updates work again. Sandboxed builds were missing the two Mach-service permissions Sparkle's installer requires, so the updater launched, waited 20 seconds for installation data it could never receive, and ended with the generic “Update Error” dialog. Release builds now also sign Sparkle's helpers in the framework's supported order and fail before notarization if either permission is absent.
• Model downloads now report real byte progress instead of sitting at zero until the transfer finished. A lost connection, timeout, DNS interruption, or Wi-Fi transition retries up to three times across direct artifacts, MLX models, Whisper, speech, diarization, TTS, depth, and image-generation paths.
• The Downloads page no longer offers buttons for model cases that have no downloadable artifact or whose bytes are owned by a different framework. This removes the guaranteed “no entry in the model manifest” failure for Embedding Gemma and prevents a single representative Whisper file from being mistaken for a complete model.

• Translation languages now live alongside models in Downloads. The list is populated from every English language pair macOS reports as supported rather than a hard-coded subset, shows installed and per-language failure state, and includes a bounded “Download all missing” action.
• Removed the nonfunctional Shared Web Credentials capability. Developer-ID builds had no provisioning profile for Associated Domains and released apps did not carry the entitlement, even though the login view attempted the API. Standard username/password AutoFill content types remain in place.
• Builds through 1.7.19 need one manual replacement from the download page because the entitlement missing from the currently running app is also what prevents that app from installing its own repair. Updates after 1.7.20 return to the normal in-app flow.

• A slow first model download no longer counts against a provider's Mac. A cold-cache pull is now reported as *warming* rather than as a device failure, so a large first download that outran the job's time limit no longer decays the provider's reliability score for something that was only an empty cache.
• Image upscaling now actually runs. The lane shipped with its inference step unimplemented and threw on every job; it now performs real 4x super-resolution as an MLX/Metal graph (Real-ESRGAN RRDBNet). There is no Core ML conversion of Real-ESRGAN published anywhere, which is why the lane sat stubbed.
• Depth estimation failed on every image: Apple's Core ML conversion returns a CVPixelBuffer and the runner only read MLMultiArray.
• Model artifacts that are a single file rather than a Core ML bundle can now be cached. The cache path hardcoded a .mlpackage suffix for every model, which the MLX weight loader rejected.

• Three workload types are built in and ready, switched off until enabled server-side: 4x image upscaling, depth estimation, and neural text-to-speech (Kokoro-82M on the Neural Engine).

• The Models page no longer offers a download your Mac cannot run. A model whose unified-memory floor exceeds this machine stays visible but greyed out, with the reason and your installed memory shown — previously the floor was calculated and used only for a warning badge, so a 16 GB Mac could start a 43 GB download for a model the scheduler would never send it work for.
• Model sizes on that page are now accurate. Un-downloaded models showed "Zero KB" instead of their download size, and downloaded Core ML models reported a hand-written estimate rather than their real footprint — which also skewed the disk-usage total, the storage-budget warning, and how much "Free up space" believed it had reclaimed.

• The model catalog can now be updated from the server, so new models become available without waiting for an app release. Every entry is still checked against this build's own list of runnable architectures and must carry an immutable commit pin, so the server can widen what is offered but never what this build can actually run.
• Models that have been retired are now removed from disk automatically, freeing the space they occupied. This happens by comparing your cache against the published catalog whenever the app refreshes it, so a Mac that was asleep or offline cleans up when it next runs.

• Made 1.7.17 the required provider version. Macs on older builds finish any active work but accept no new assignments until the signed Sparkle update is installed and the app relaunches.
• Enforced the same 1.7.17 floor in the router, so a stale or modified client cannot bypass the update requirement.

• Added a mandatory-update policy that pauses new earnings work on obsolete builds, drains active jobs, downloads the signed Sparkle update, and keeps visible retry and direct-download recovery actions when the feed is down.
• Added assignment acknowledgements, immediate reconnect heartbeats, and structured failure codes so transport, policy, capacity, input, and runner failures are handled independently.

• Scheduling now prioritizes measured per-runtime throughput and current capacity, with a bounded hardware cold-start prior and exploration for new devices.
• Provider failures now open runtime-specific circuits instead of taking an otherwise healthy Mac out of every workload lane.

• Required updates can no longer be disabled by optional-update preferences or bypassed by accepting work through a stale client once server enforcement is activated.
• Reconnects no longer wait for the next periodic heartbeat before becoming dispatchable, and unacknowledged assignments no longer consume attempts or damage provider reliability.

• Added deny-by-default Trust Fabric eligibility for confidential workloads, including expiring vetting grants, provider agreement acceptance, build and integrity gates, and active heartbeats.
• Replaced shared-secret internal service authentication with signed, versioned RPC envelopes and replay protection, with bounded legacy migration flags.
• Added admin JWT MFA step-up, one-time break-glass controls, fail-closed revocation checks, hashed password-reset tokens, and organization-scoped job visibility.
• Bound artifact credentials to task and device identities, made server-owned usage authoritative for billing, and added structured warming controls.
• Added signed model supply-policy checks, immutable digest validation, secure archive extraction, and a sandboxed XPC service boundary for the provider.
• Added deployment provenance, migration, health, security-header, and pinned Wrangler release gates.

The public provider trust model remains explicit: ordinary provider Macs can read plaintext workloads. Cryptographic confidentiality requires customer- controlled or attested confidential-compute infrastructure.

• The app no longer crashes when its window is reopened. Closing the main window and bringing it back — or just waking the Mac after it slept — could crash the app outright. The window was being released twice while its open/close animation was still running, so the animation finished by reaching for something that no longer existed. Crash reports on 1.6.6 and 1.7.13 are identical down to the instruction. If your Mac has been dropping offline for no apparent reason, especially after sleeping, this is the likely reason.
• Updates install again on Macs that are left running. The app asks before quitting while you are earning, which was right for you pressing ⌘Q but wrong for the updater: the update process asks the app to quit exactly the same way, so it was being met with a confirmation box and quietly cancelled. On a Mac nobody is sitting at, the update then never installed at all. The updater is now recognised and lets itself out; the confirmation you see when you quit is unchanged.
• Only one main window opens. A sign-in handoff from the browser, or opening the app from the dock at the wrong moment, could leave you with two identical windows.

• Answers now appear as they are written. mlx_llm already generated text incrementally, but the words were dropped on the way out and the customer sat in silence until the whole answer was finished. This build reports the partial text as it goes, so a streamed request shows tokens arriving instead of one block at the end. Nothing about how a job is paid or measured changes.
• Two more kinds of work can land on your Mac. fluid_asr (speech transcription) and coreml_vision (image captioning) are now live. Both runners already shipped in earlier builds — only the catalog was holding them back — so this widens what your machine can be sent, not what it can do.

• Neural Engine work now stays on the Neural Engine. Every lane is classified by how well it fits the ANE, and the ones that fit natively are pinned to it rather than being allowed to drift onto the GPU. Your GPU stays free for a second job, so a Mac can run vision work and a model at the same time instead of the two contending.
• Sentiment scoring no longer reads plain facts as complaints. "The package arrived on Tuesday" was being labelled negative. The threshold was recalibrated against hand-labelled text — 21 of 26 correct, up from 15 — and the raw score is still returned, so anything reading it directly is unaffected.
• Short reranking jobs stop waiting behind long ones. Reranking was queued in the GPU pool even though it never touches the GPU, so a one-second job could sit behind a model generation holding that slot for up to 45 minutes. It now queues in the pool it actually uses. Your Mac runs no more work at once than before — the short jobs just stop being blocked by the long ones.

• You are no longer penalised when a job's input is the problem. If an image has no subject to cut out, no Mac on the network can do that work — but every Mac that tried was taking a reliability hit for it, and reliability decides what you get sent. One prod job failed on three Macs in three seconds and docked all three. Unprocessable input is now its own outcome: it settles once, reports honestly to the customer, and never touches your score.
• Group photos no longer come back with zero faces. The face detector silently discarded faces it could not fit landmarks to and reported that as an empty photo — a 13-person team photo returned none. It now runs both detectors and merges the results: never worse than before, better on 9 of 26 test images.

• Image generation on your Mac. Four diffusion models (SD-Turbo, Vega, SSD-1B, SDXL-Turbo) now run through one shared runner, so mlx_image work can land on your machine. Weights are pinned to exact versions and verified before they load.
• Tool calling for local LLMs. mlx_llm can now run tool-calling requests, along with five sampling controls that were being sent and silently dropped: top_p, stop, presence_penalty, frequency_penalty and seed.

• Someone else's sign-in link can no longer move your Mac to their account. Opening a commoncompute:// link used to sign this Mac in to whatever account the link named, with no prompt — so a link from anywhere, opened by anything, could quietly redirect your earnings. The app now only accepts a sign-in it started itself, and if you're already signed in as someone else it asks first and names both accounts.
• A malformed job input can no longer delete other jobs' files. A crafted download URL could escape the per-task scratch folder and wipe the working files of every other job running on your Mac at that moment — failing work you were part-way through and denting the reliability score that gates your payouts. The name is now sanitised through the same routine the rest of the app uses, and the destination is re-checked before anything is written or removed.

Both fixes above came out of a full platform security review. Neither was ever seen in the wild, and neither needed anything from you — but until this build they were reachable, and a provider running an older version stays exposed to them. Updating is worth doing.

• A dedicated Models page. Every model your Mac can run — including the MLX models, which never had a way to see or manage them before this — now lives in one place: what's downloaded, how much disk it's using, and a Download or Remove button for each one.
• Auto-download, per model. If you'd rather a specific model never download on its own, turn it off — the app will decline work that needs it instead of pulling it silently. Everything still downloads lazily by default, same as always; this just gives you a say in which ones.
• A storage budget. Set a soft cap on how much disk models are allowed to use, and free up space back down to it in one click when you're over.

• "Reset app data" now actually clears every downloaded model. It was only clearing part of what it claimed to.

• Text recognition got a lot better at its job. The OCR your Mac runs was using almost none of what Apple's Vision framework can actually do. It now reads the language the customer asked for instead of assuming English, reads photos the right way up instead of sideways, and returns the text in reading order instead of whatever order the detector happened to find it in. If OCR work on your Mac has been coming back looking wrong, this is why — the recognition was fine, everything around it wasn't.

• PDFs that already contain text are no longer re-read from pixels. A PDF exported from Word or an invoicing system carries its text inside the file. Your Mac was rendering it to an image and recognising it back, which is slower and less accurate than just reading what was already there. Now it reads it directly. Scanned PDFs are unaffected — those still go through full recognition, and the app tells the difference by checking whether there's enough real text to trust.

• The recognition version is pinned. Results no longer shift when your Mac updates macOS. That matters for you specifically: verification compares your output against a known-good answer, and until now two Macs on different macOS versions could disagree about the same page.

• A second OCR engine, for the work the first one can't do. Apple Vision is excellent on printed text and weak on handwriting — on a real test set it read printed text near-perfectly and only managed 7 of 45 handwritten fields. Customers can now ask for a vision-language model instead, which runs on the GPU rather than the Neural Engine and needs a Mac with 16 GB or more. It takes longer per page and returns text without the position boxes Apple Vision gives, so it's offered as a separate choice rather than a silent substitution — nobody should pay for one engine and receive the other.

• Work for Macs with 32 GB or more. Large models were listed but not actually orderable — the lane they sat on was switched off and its code was a stub, so a 64 GB Mac had nothing to run that a 16 GB Mac couldn't. There are now 21 models that need 32 GB or more, and they route to the machines that can hold them.

• Every model is pinned to an exact version. The app used to resolve models through a general-purpose list that tracked whatever was current upstream. It now carries its own catalog, and each entry names a specific commit, so the weights that land on your Mac are the ones we checked and not whatever replaced them since.

• Jobs prefer the Mac that already has the model. If a customer asks for a model your Mac has already downloaded, you now get a large scheduling advantage for that job over a Mac that would have to fetch it first. Your Mac tells the scheduler which models it has on disk; nothing about your files or your jobs is shared.

• A job you decline because an engine is busy no longer counts against you. Your Mac says no when its ANE or GPU is already occupied — that is the app working correctly, not a fault. It was being recorded the same way as a crash or a timeout, so a busy Mac was quietly losing reliability for doing the right thing, and reliability is what decides which work you get offered.

• New installs need Apple Silicon. An Intel Mac has no Neural Engine, and most of the work on this marketplace requires one, so an Intel Mac sits in the queue being passed over rather than earning. The two currently enrolled have between them completed no jobs and earned nothing. Enrolling a new Intel Mac is now refused up front, with the reason, instead of leaving you to work that out from an empty earnings page. If you already had one enrolled, it keeps working — the app just shows a notice explaining the requirement.

• Two jobs of the same kind running at once could get each other's files. If your Mac was working on two jobs of the same type simultaneously, the second one could overwrite the first one's inputs partway through, so one customer's job ran on another customer's data and returned the wrong result. Both customers were billed. Only ever possible on engines that run more than one job at a time, and never on the ANE, which runs one at a time — but it was possible, and it is now structurally prevented rather than avoided by timing.

• Uploading a finished result could be rejected. A security check meant for browser form posts was being applied to your Mac's result uploads, failing them for the wrong reason.

• Transcription now uses the model the customer actually asked for. A request for Whisper Large v3 was being served by Whisper base — the customer paid for the larger model and your Mac ran the smaller one. Both sides now agree on which model runs.

• Images stopped being shrunk before the model reads them. Every image was being squashed to 448×448 first, which is fine for "what is in this picture" and useless for reading text off a page. Document work coming back as nonsense was this, not the model.

• See what your compute actually costs you in electricity. Settings ▸ Electricity looks up your local utility's published rates from your postal code — including time-of-use plans, where the price changes by hour — and reads this Mac's real power draw from its own sensors where it can, rather than guessing from the chip model (it says which one it's doing). Only the extra power drawn while jobs were running counts, above what your Mac uses sitting idle, since it was going to be on anyway. Your Earnings page then shows what you net after power. If the lookup doesn't cover your utility, or you'd rather not share a location, you can type your own rate in instead — that always wins.

• Cheapest-hours scheduling. If your utility charges less overnight, the app can say so and offer to run only during your cheapest hours. It states the trade honestly: fewer hours available means less earned overall, in exchange for a lower power cost per job.

• A heads-up if FileVault is off. Customer files sit on your Mac while a job runs, so we're moving toward sending work only to Macs with an encrypted disk. Nothing changes for you in this version — it only warns, and points you at the right settings pane. If FileVault is already on, or your Mac can't report either way, you'll never see it.

• Your reliability score now measures one thing instead of two. It used to mix "does this Mac finish work" with "does this Mac return honest results", and the first drowned out the second — Macs with spotless verification records were sitting below the payout line purely on crashes and dropped jobs. Those are now separate, and payouts read the honesty number. If you have been passing verification checks, this can only help you.

• Signing in now enforces two-factor if you have it switched on. Previously it was possible to enable two-factor on your account and still get in with just a password.

• Customer files are now deleted from your Mac as soon as a job finishes, instead of accumulating in the app's cache indefinitely.
• The app now respects your system text size. Every label was a fixed size before, so turning text up in Accessibility settings did nothing here — which mattered, because a lot of this app's labels are small. VoiceOver also now reads earnings figures, job rows, and settings switches as whole facts rather than disconnected fragments, and the dimmest text colour has been brightened to a legible contrast.
• "Offline" is no longer the faintest thing on screen. The status dot for a Mac that isn't connected was the palest colour in the app — the one state you'd most want to notice.
• Settings no longer quietly undoes a change made elsewhere in the same window.
• ⌘, now opens the Settings you already know, rather than a second window showing the same settings with its own scrollbar.
• Escape closes the job details, email verification, and setup windows. Previously they could only be dismissed with the mouse.

• Speech transcription is no longer offered by Macs that have Dictation turned off. 1.7.6 stopped un-granted Macs from taking speech work, but a Mac can pass every permission check and still fail the job if Dictation itself is switched off in System Settings — nothing the app could see up front. Now the first job that hits it takes the lane off your advertised list, so the work goes to a Mac that can do it instead of costing you an attempt and dinging your reliability every time. Turn Dictation on (System Settings ▸ Keyboard ▸ Dictation) and the lane starts earning again on its own within a few hours — no reinstall, nothing to click.

• Long audio and video jobs can now be split across several Macs. The split step was failing to read the source file's duration, so every attempt gave up before any work was shared out. Your Mac can now take a slice of a long recording instead of only whole files.
• Speech transcription is no longer offered by Macs that haven't been granted speech-recognition permission. Previously an un-granted Mac would accept the job and then sit on it until it timed out — which cost you the attempt and dinged your reliability score for a permission you were never actually asked for.
• The permission request for speech recognition comes back if it was never answered. Dismissing the window used to count as answering it, which left some Macs quietly unable to take speech work. Declining it still sticks — this only returns for people who never saw the ask.
• Transcription jobs that produce no words now fail honestly instead of reporting a full-length result, so a customer is never billed for silence and you are never credited for work that didn't happen.

• Earnings wording now matches the published rate: you keep 80–100% of the customer price depending on your agreement, with a flat 20% platform take. Providers who joined before October 1, 2026 keep 100%, permanently.

• The app now offers to pre-download common translation language packs up front — during first-run setup for new installs, or once for existing installs — instead of only discovering the download step when a translation job fails until you find Settings ▸ Languages yourself.

• LoRA fine-tuning (mlx_finetune) is now a real workload — trains a small on-device model against your own examples and hands back the adapter weights, instead of failing with "not enabled yet."
• Image captioning (coreml_vision) is now a real workload.

• Stable Diffusion (sd_mlx) jobs no longer time out on a Mac's first use, when the model still needs to download.

• The app now asks for Speech Recognition permission up front — during first-run setup for new installs, or once for existing installs — instead of only discovering it's missing when a speech-to-text job actually needs it. Fully on-device; your audio never leaves your Mac.
• Settings now has a Languages section where you can pre-download translation language packs before a translation job needs them, instead of a job simply failing until you find the right System Settings screen yourself.

• Clearer error message when a translation job needs a language pack that isn't downloaded yet, pointing you at the new Settings ▸ Languages panel.

• Fixed a bug where several workloads that fetch a real audio or video file (rather than receiving it inline) — transcode, scene detection, audio classification, loudness normalization, denoise, thumbnails, trajectory and optical-flow detection, and video composition — could hang and eventually fail instead of completing, because the app never actually registered its download handler with the network session it created. All of these now complete normally.

• The app can now show you a quick in-app or system notification directly from us — for example when an update's ready — instead of only reaching you by email.

• The app no longer repeatedly asks for your Mac login password after a fresh install. A broken Keychain entitlement shipped in every notarized release to date (it wasn't fully resolving to this app's identity), so macOS couldn't durably remember that you'd allowed it access — now fixed, so you're only asked once, if at all.

• Whisper transcription is real. Speech-to-text now runs on WhisperKit's ANE-optimized Core ML pipeline (openai_whisper-base by default, large-v3-turbo on request); the model downloads itself on first use. Subtitle generation produces real timed SRT/VTT cues from the same pipeline.
• On-device LLM chat and vision Q&A. MLX-backed language models (Llama 3.2 3B / Llama 3.1 8B, 4-bit) and vision-language answering (Qwen2-VL 2B) with real token accounting — only registry-listed models can load; arbitrary model repos are refused.
• Image generation. Stable Diffusion via MLX (SDXL-Turbo default, SD 2.1-base selectable), seeded and reproducible.
• Speaker diarization. Who-spoke-when segmentation via FluidAudio's pyannote-lineage Core ML models.
• All model weights download from their official model repositories on first use and are cached locally; nothing runs without a verified source.

• Requires macOS 14 Sonoma or newer (the model frameworks' floor). Macs on macOS 11–13 stay on 1.6.17 — the update feed marks this release accordingly.
• The app's downloads moved to dedicated hosting; the update feed location is unchanged.
• Model bundles fetched by the app's own model manager are now strictly manifest-verified (checksum required, no fallback URLs) and support archive extraction.

• The long-context 70B lane no longer silently delegates to a small model — it declines honestly until a genuinely 70B-class path ships.

• Nine more capabilities now run for real on Apple frameworks: motion-path tracking and optical flow in video (Vision), video concatenation and trimming (AVFoundation), PDF merge / split / extract / watermark (PDFKit), tabular model training (Create ML), loudness normalization to a target LUFS and a real spectral-gate noise reducer (Accelerate vDSP), fast on-device speech-to-text (Apple Speech, never leaves the Mac), and the built-in Apple Foundation language model on macOS 26. All report billable usage correctly.
• The menu bar shows "Update ready — Restart now" when a new version is staged, so you can update on your schedule.

• Updates now install themselves. The app used to stage downloaded updates and wait for a relaunch that, for an always-on provider, never came — Macs silently stayed on old versions. Staged updates now install automatically the next time the device is idle (no workload running), with a hard 6-hour cap so busy devices still update the same day.
• Video transcode honors the requested codec and bitrate (it silently produced H.264 before), keeps the audio track (it silently dropped it before), preserves rotation, no longer stalls forever on 10-bit / HDR sources, and fails legibly instead of hanging when an encode goes wrong.
• Translation no longer hangs when running headless; unavailable or not-downloaded language pairs fail immediately with a clear message.

• The self-test mode (--selftest-runners) now exercises audio, video, PDF, and tabular-training workloads too (--audio / --video / --pdf fixture flags), covering the full real catalog on-device.

• Two more Apple-framework capabilities now run for real: image similarity / dedup (Vision feature-prints with a pairwise distance matrix) and Core Image filter pipelines (grayscale, sepia, blur, sharpen, brightness, contrast, saturation, invert, auto-enhance). Both report billable usage correctly.

• The self-test mode (--selftest-runners) now covers text workloads and accepts any usage metric, so more of the catalog can be validated on the device before it goes live.

• Eight new Apple Vision capabilities, ready for the upcoming catalog lanes: whole-image classification, animal recognition, saliency detection, hand pose, animal body pose (macOS 14+), document segmentation, rectangle detection, and person segmentation. All report billable usage correctly.
• A headless self-test mode (--selftest-runners) that validates this Mac's workload runners directly — used before new capabilities go live, and handy for support diagnostics.

• Task-envelope replay protection is stricter: the anti-replay window now fully covers the clock-skew tolerance, and an invalid envelope can no longer consume a nonce that a legitimate envelope needed.
• Placeholder runners for not-yet-enabled workloads (LLM chat, image generation, vision Q&A stubs) now fail honestly instead of returning fabricated "completed" results.

• Jobs now report their billable usage correctly. Transcription reports the audio duration it processed, image and document workloads report the items they handled, transcodes report output minutes, and speech/translation report characters — so completed work is billed and earnings accrue as intended. Previously only embeddings reported usage; every other workload completed successfully but recorded no billable usage at all.
• Workloads that aren't fully implemented yet no longer risk recording billable usage for placeholder responses.

• Large jobs now transfer end-to-end through a presigned artifact bridge: inputs and results that exceed the 256KB inline-envelope cap (long audio/ video, big document batches, large embedding outputs) move over a short-lived signed https URL instead of failing. Backend: api-v2 /v1/artifacts GET/PUT + router-minted tokens. Provider: result-PUT for oversized outputs and https fetch for oversized inputs.

• Defaults now favor uptime and earnings: the app launches at login by default, and keeps the Mac awake while it's plugged in and available to earn (so an idle-but-powered Mac doesn't sleep and stop earning overnight). Both are AC-only — never active on battery — and toggleable in Settings.

• Longer-running workloads (audio transcription, video transcoding, builds) now get a per-workload runtime budget instead of being cut off at the lease deadline, so genuinely long jobs can finish.

• A workload that stalls (for example while loading a model) no longer blocks other jobs on the same engine. Your Mac keeps taking work even if one task gets stuck.

• Four new on-device Apple Vision workloads: face detection with landmarks, object detection and classification, human body pose estimation, and barcode / QR scanning. All run on the Neural Engine.

• Earnings, Help, Onboarding, and Settings now describe the weekly payout schedule (earnings accrue per completed job and pay out weekly via Stripe Connect) instead of the old real-time-settlement wording.

• Jobs submitted with inline input now dispatch to your Mac correctly for every workload, not just embeddings.

• Provider signup now completes the Mac app handoff automatically. Signup still happens on the website for Turnstile bot protection, then the browser opens commoncompute://auth/handoff so the Mac app can redeem a short-lived, single-use sign-in code and land on the dashboard.

• The Mac app signup CTA now says "Sign up on the website" and directly opens https://commoncompute.ai/signup?role=provider&source=mac-app. There is no native registration path behind the button.

• Login now shows the email/password sign-in form first, with web signup as a secondary action that opens the Turnstile-protected signup page.
• Account and sign-out controls are now visible from the sidebar footer, menu bar popover, and native macOS app menu instead of only at the bottom of Settings.
• Sparkle updates now default to automatic checking and background install, and the appcast publishes new signed releases to eligible installs immediately instead of phasing rollout over a day.

• Provider Macs now accept every valid router assignment signature. Swift's JSON encoder escaped / inside router nonces as \/, while the router signs with JSON.stringify semantics. Any assignment whose nonce contained a slash could be rejected as quarantine.envelope_bad_sig; the verifier now canonicalizes strings to match the router exactly.
• CPU health-check jobs now return real inline JSON results that the router can persist to R2, instead of unusable local-only result URIs.
• ANE/Core ML bench jobs now use the same inline input path as normal embeddings, so /v1/bench/ane exercises the live coreml_embed runner end to end.

• Provider connection handling is more tolerant of heartbeat ack timing and stale WebSocket sessions, reducing false offline states while the Mac is connected and waiting for work.

• Menu bar icon now tints to white in the macOS menu bar (or to the system tint colour in custom appearances), matching every other system menu bar item. v1.6.5 set isTemplate = true on the output NSImage only — but the source SVG carried its blue fill through the drawing-handler composite, so AppKit saw a coloured bitmap and rendered it as-is. v1.6.6 marks the source as template *before* drawing, so the composite is alpha-only and AppKit applies the proper menu bar tint.
• Bumped the visual glyph size from 13pt → 16pt inside the same 18pt NSImage slot. Now fills the menu bar height the same way Wi-Fi / Battery / Control Center do.

• Menu bar icon now renders the real brand monogram from the SVG asset, not the simplified two-arc approximation introduced in 1.6.3. The SVG is composited at 13×13 into the 18×18 NSImage with isTemplate = true, so macOS auto-tints the brand silhouette to the menu bar's appearance (light/dark/accent/vibrancy) while still being a real, design-faithful CC monogram up close.

• Menu bar icon glyph shrunk ~25% — fills 13pt inside the 18pt slot instead of 17pt edge-to-edge. Matches the visual weight of system icons (Wi-Fi, Control Center, Battery) so it sits next to them without looking oversized.

• Menu bar icon rendered massive in the macOS menu bar. The v1.6.1 fix used a SwiftUI-drawn glyph that worked, but the v1.6.2 brand-mark vectorisation silently regressed the call site to the NetworkLogo image asset — and SwiftUI's MenuBarExtra label is a hostile environment for any image-backed view, regardless of .frame() and .fixedSize() modifiers. Replaced with a programmatically-drawn 18×18 NSImage with isTemplate = true — the route the platform was designed for. macOS now sizes and tints the icon natively, like every other system menu bar item. Locked behind a comment in CommonCommuteApp.swift warning future commits not to revert.

• Brand mark rendered oversized in some windows (sidebar brand chip, menu-bar popover header, others). Same SwiftUI intrinsic-size bug that affected the menu bar icon in 1.6.1 — the SVG's vector representation reported its viewBox (256) as the natural size and some layouts honoured that before .frame(...) clamped it. Fixed by adding explicit .aspectRatio(1, contentMode: .fit) and .fixedSize() to NetworkLogo and AnimatedNetworkLogo so the requested frame is now the ideal size, not a soft suggestion.

A polish-and-fix release. No functional changes to the network — same catalog, same pricing, same security envelope. The Mac app gained a batch of native polish, and the brand pipeline became fully vector.

• In-app feedback (Help → Send Feedback…, ⌘K → Send feedback). Replaces the bare mailto: link with a sheet that auto-attaches app version, chip, memory, connection status, optional 5-minute telemetry, and an optional recent-logs excerpt — every future support email now arrives with a complete repro.
• Diagnostics toggle in Settings → Advanced. Gates Apple MetricKit collection. Default-on, live-toggleable without an app restart.
• Security link in the About sheet (→ commoncompute.ai/security).
• VoiceOver labels on the dashboard utilization gauges, sidebar nav rows, menu-bar icon, status footer, and login fields.

• Menu bar icon now renders the real brand monogram from a true vector source, sized predictably regardless of display scale. The side status dot is gone — status reads as opacity on the glyph itself (earning = full, paused = 45%, offline = 35%).
• Brand mark is fully vector everywhere — apps/web/public/brand/*.svg and the Mac app's asset catalog now share a single 6 KB SVG traced from the canonical raster. The wordmark is also outlined-to-paths so it renders identically on machines without Inter Tight.
• Error copy for payouts, runner failures, rate-limits, and Stripe-shaped errors. No more "stripe: account_invalid" or "HTTP 429" in the UI.
• APIClient now stamps X-App-Version on every request, so the backend can attribute heartbeat traffic to the build that produced it.

• Menu bar icon rendered "massive" on some display configurations because the Mac asset was a 1254×1254 1x PNG. Switched to a vector asset with preserves-vector-representation: true; size is now consistent at any scale.

• New scripts/release.sh — local-Mac orchestrator that wraps build-dmg.sh, publish-appcast.sh, optional gh release create, and an optional Cloudflare deploy. No GitHub Actions required.
• New scripts/changelog-extract.mjs — single extractor that feeds both the local release flow and the GH workflow's release-notes body, sourced from this CHANGELOG.
• New scripts/trace-brand-mark.sh + scripts/outline-wordmark.py — reproducible vectorisation of the brand mark and wordmark from raster + bundled-font sources.

• New app icon — the interlocking-C monogram on a dark navy squircle, visible in the Dock and Finder.
• Wordmark refreshed to Inter Tight ExtraLight throughout the app — airier, more modern.
• Electric-blue accent rolled through the menu-bar UI, login flow, earnings panel, and toasts.
• First-launch animation now fades the new mark in instead of the old network-node reveal.
• commoncompute.ai redesigned to match.

Functional behavior is identical to 1.5.0 — same security hardening, same earnings, same workloads. Visual update only.

Security hardening release. Closes a class of attacks that could have let a malicious customer poke at your home network or run untrusted code on your Mac. None of these were ever exploited — we found and fixed them ourselves.

• Strict URL policy on every job input. Audio, image, and video downloads now flow through a single chokepoint that refuses anything except HTTPS to public hosts. Loopback, RFC1918 home networks, AWS metadata addresses, and link-local IPs are all rejected — even via redirect. Magic-byte checks confirm what arrived actually is the media type the runner asked for.
• Cryptographic proof of every task. The router now signs each task assignment with Ed25519. Your Mac refuses anything that doesn't verify against the pinned public key, with a 5-minute clock-skew window and replay protection.
• Hash-pinned model downloads. Models fetched via ModelManager go through a signed manifest. The Mac SHA-256s every byte and refuses any model that doesn't match what we published.
• Ownership check on the WebSocket connect. Your Mac can no longer be impersonated by another logged-in user — the device id is bound to the authenticated account at the gateway.
• Tighter Keychain protection. Your session token now requires the screen to be unlocked and never syncs via iCloud Keychain. Existing entries are upgraded automatically on first launch.
• App Transport Security defaults restored. The blanket "allow plaintext" exception is gone. All outbound traffic is TLS 1.2+.

• Sign-in and signup views now fill the whole window with the brand background — no more grey bezel around a floating card.
• Email and password fields advertise the right content types so Edit → AutoFill Passwords… and the right-click menu surface the Passwords app directly. Return signs you in; Tab moves between fields.

• Associated Domains entitlement and the apple-app-site-association file at commoncompute.ai. Once the app is Developer-ID signed, the Passwords app will automatically suggest credentials stored for commoncompute.ai web login.

• Command palette (⌘K). Jump to any page, open docs, check for updates, or sign out — from anywhere in the app, without reaching for the mouse.
• Keyboard shortcuts reference (⌘/). A tidy sheet lists every binding, grouped by category.
• About sheet. Version, build number, release notes, terms, and privacy — all one click away.
• Toast notifications and skeleton loaders — small touches that make actions feel finished and first loads feel faster.

• Duplicate "View" menu in the menubar; page-jump shortcuts now live where you'd expect them.

• Design system tightening — new spacing, radius, and motion scales brought the Mac app pixel-for-pixel in sync with the web dashboard.

• The app now identifies itself with a stable hardware fingerprint, so restarting no longer creates duplicate "devices" on your dashboard.

• Auto-updates. New versions install in the background via Sparkle. No more DMG downloads after this one.
• Email verification in the app and web dashboard — resend the code without restarting.
• Settings → Updates. Manual "Check Now" and toggles for automatic download and install.
• Payout estimator on commoncompute.ai/providers — chip, RAM, idle hours → expected earnings.

• Updates are signed with an EdDSA key we hold. Anything that isn't signed by us will be rejected.