What changed

The split planner now runs your local share of a job at the same time as the peers' shares, so a split no longer waits for the local part first.

tether mail import-kit PATH imports a mail kit in one step, with --dry-run to preview it and --rotate-pepper to rotate the secret.

tether speedup and a dashboard panel say whether a peer made a job faster, slower, or not proven safe.

A peer that measured slower than the local prediction is now refused before a job is sent to it.

The command palette input has a proper accessible name for screen readers.

Local and Fabric image-batch results can be compared side by side, with a verdict of identical, different or incomplete.

When the dashboard is offline, refresh actions wait in a visible queue instead of failing silently, and each one ends as replayed or refused.

tether action routes, show and admission search every action the CLI, dashboard and Mac app can take. It is read-only and never runs anything.

tether receipt redact-preview shows what a receipt looks like after redaction, before you share it.

tether fabric regress shows, per kind of job, whether a peer ever lost to running locally and by how much.

tether test --peers can spread test files over local lanes and trusted peers. Until a peer is qualified for it, the run stays local.

A failed dashboard upload can be retried from the same bytes, with a receipt, and is not offered a retry when the server refused it.

tether receipt timeline and tether fabric diff show how receipts and peer state changed over time, with a matching dashboard panel.

Analyze results now lead with the findings and show upload progress as it happens.

A capability census lists every command and action Tether offers, so gaps are visible.

Security fixes from a scan of our own code: candidate code is no longer executed in-process, the jail denies reads of credential stores, and a peer's result file is read with a size limit.

Image uploads, single or batch, now come with a caption and what the image shows.

Dashboard and changelog got a quality pass, with receipt badges readable in both light and dark.

tether test packs its shards by how long each test took last time, so lanes finish closer together.

tether init only admits peers reachable over a direct Tailscale path, and says why it skipped a relayed or idle one.

tether fabric run --remote refreshes a peer's capacity just before deciding. The first usable peer was qualified, with outputs identical to the local run.

tether --auto now pulls a peer's stale capacity receipt just in time. If that fails the job runs locally.

Dashboard image uploads show real image facts, and the upload still succeeds with a plain reason if the caption is unavailable.

The Mac app's Doctor no longer flashes a red error at every launch while it is still checking.

The landing page has an interactive picture of your Mac and its peers, clearly labelled as an illustration.

tether dashboard keygen and token mint short-lived sign-in tokens. The sign-in page is built but not published yet.

tether-fabric pair create refuses an invite that is too long to import, before it creates a pairing nobody could finish.

On Windows, the pairing key store is limited to your account and SYSTEM, and Tether refuses to use it if that cannot be confirmed.

tether status prints a verified update pin as its own line.

Dashboard totals and peer cards show unknown once the capacity data is stale, instead of printing CPU figures that look live.

Applying an update saves the verified pin next to the install manifest.

First install saves the verified pin next to the install manifest.

When check and apply see the same version, they now break the tie on the signed build.

The release-notes link in a signed feed is checked before Status opens it. Links with an embedded login, query, fragment or empty host are refused.

Publish checks now hash every signed download location, not only the Status app zip.

An update is refused when its pin names a different archive.

The landing and pairing-steps pages are finished, and the placeholder login page is gone.

First install refuses scratch space on the root disk when the install lives elsewhere, and does so before it downloads anything.

Both install wrappers reject an --archive-sha256 value that is not a hex digest.

The installer picks the right platform's checksum from a checksum list that covers several archives, instead of taking the first one.

Each CLI archive is published with its own .sha256 file and a SHA256SUMS list.

tether install finds the checksum files that sit next to a local archive.

The build refuses to ship a CLI archive that has no attestation.

An attestation link must belong to the same archive URL it vouches for.

Release archives are published with an attestation, and the tools verify it.

tether update checks the multi-builder agreement document against the archive it is about to install.

A third independent build machine joined, and all three agreed on the same build.

Release preflight refuses a platform unless a second builder reproduced its archive.

A plan for running the fabric node as a Windows service and tray app exists. Running it is still blocked.

A Linux arm64 fabric node was brought up from a sealed release archive.

tether install can install from a local archive file, tested on Linux arm64.

Web pages and the Mac app now take their colours from one shared token file, with a light theme and an automatic accessibility check.

Archives carry a build-provenance file, and tether update can roll back.

Windows archives include a tether.exe launcher.

The macOS, Linux and Windows install scripts check the release signature and checksum before they unpack anything.