v0.6.0: hard network fork; ship multi-persona + CDN restructure

Phases 1-5 of the Identity Architecture rollout are on master; Phase 6
(rotating DM IDs) is deferred. This bumps the protocol-breaking
release: v0.5 and v0.6 cannot interoperate.

Packaging:
- Cargo + tauri.conf: 0.5.3 -> 0.6.0
- deploy.sh: drop -beta filename suffix
- download.html: single v0.6.0 section with fork notice at the top;
  changelog entry summarising the five phases and the schema migration;
  Phase 6's rotating-DM-ID status noted as deferred

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Cargo.lock

@@ -2732,7 +2732,7 @@ checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
 
 [[package]]
 name = "itsgoin-cli"
-version = "0.5.3"
+version = "0.6.0"
 dependencies = [
  "anyhow",
  "hex",
@@ -2744,7 +2744,7 @@ dependencies = [
 
 [[package]]
 name = "itsgoin-core"
-version = "0.5.3"
+version = "0.6.0"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -2767,7 +2767,7 @@ dependencies = [
 
 [[package]]
 name = "itsgoin-desktop"
-version = "0.5.3"
+version = "0.6.0"
 dependencies = [
  "anyhow",
  "base64 0.22.1",

crates/cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsgoin-cli"
-version = "0.5.3"
+version = "0.6.0"
 edition = "2021"
 
 [[bin]]

crates/core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsgoin-core"
-version = "0.5.3"
+version = "0.6.0"
 edition = "2021"
 
 [dependencies]

crates/tauri-app/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsgoin-desktop"
-version = "0.5.3"
+version = "0.6.0"
 edition = "2021"
 
 [lib]

crates/tauri-app/tauri.conf.json

@@ -1,6 +1,6 @@
 {
   "productName": "itsgoin",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "identifier": "com.itsgoin.app",
   "build": {
     "frontendDist": "../../frontend",

deploy.sh

@@ -19,7 +19,7 @@ KEYSTORE="itsgoin.keystore"
 KS_ALIAS="itsgoin"
 
 VERSION=$(grep '"version"' crates/tauri-app/tauri.conf.json | head -1 | sed 's/.*"\([0-9.]*\)".*/\1/')
-echo "=== Deploying v${VERSION}-beta ==="
+echo "=== Deploying v${VERSION} ==="
 
 # Build CLI
 echo "=== Building CLI ==="
@@ -43,7 +43,7 @@ echo "=== APK build complete ==="
 echo "=== Signing APK ==="
 UNSIGNED="crates/tauri-app/gen/android/app/build/outputs/apk/universal/release/app-universal-release-unsigned.apk"
 ALIGNED="itsgoin-aligned.apk"
-SIGNED="itsgoin-${VERSION}-beta.apk"
+SIGNED="itsgoin-${VERSION}.apk"
 ZIPALIGN=$(find ~/Android/Sdk/build-tools -name "zipalign" 2>/dev/null | sort -V | tail -1)
 APKSIGNER=$(find ~/Android/Sdk/build-tools -name "apksigner" 2>/dev/null | sort -V | tail -1)
 "$ZIPALIGN" -f 4 "$UNSIGNED" "$ALIGNED"
@@ -56,7 +56,7 @@ sshpass -p "$SSH_PASS" scp $SSH_OPTS website/*.html website/style.css "$SSH_HOST
 sleep 5
 
 echo "=== Uploading AppImage ==="
-sshpass -p "$SSH_PASS" scp $SSH_OPTS "target/release/bundle/appimage/itsgoin_${VERSION}_amd64.AppImage" "$SSH_HOST:~/public_html/itsgoin_${VERSION}-beta_amd64.AppImage"
+sshpass -p "$SSH_PASS" scp $SSH_OPTS "target/release/bundle/appimage/itsgoin_${VERSION}_amd64.AppImage" "$SSH_HOST:~/public_html/itsgoin_${VERSION}_amd64.AppImage"
 sleep 5
 
 echo "=== Uploading APK ==="
@@ -64,7 +64,7 @@ sshpass -p "$SSH_PASS" scp $SSH_OPTS "$SIGNED" "$SSH_HOST:~/public_html/"
 sleep 5
 
 echo "=== Uploading CLI ==="
-sshpass -p "$SSH_PASS" scp $SSH_OPTS target/release/itsgoin "$SSH_HOST:~/public_html/itsgoin-cli-${VERSION}-beta-linux-amd64"
+sshpass -p "$SSH_PASS" scp $SSH_OPTS target/release/itsgoin "$SSH_HOST:~/public_html/itsgoin-cli-${VERSION}-linux-amd64"
 sleep 5
 
 echo "=== Uploading anchor binary ==="
@@ -78,4 +78,4 @@ sleep 2
 echo "=== Verifying anchor ==="
 sshpass -p "$SSH_PASS" ssh $SSH_OPTS "$SSH_HOST" 'ps aux | grep "[i]tsgoin.*daemon"'
 
-echo "=== Deploy complete: v${VERSION}-beta ==="
+echo "=== Deploy complete: v${VERSION} ==="

website/download.html

@@ -24,42 +24,38 @@
     <div class="container">
         <section>
             <h1 style="font-size: 2rem; font-weight: 800; letter-spacing: -0.03em; margin-bottom: 0.25rem;">Download ItsGoin</h1>
-            <p>Available for Android and Linux. Free and open source.</p>
+            <p>Available for Android, Linux, and Windows. Free and open source.</p>
 
-            <h2 style="margin-top: 2rem;">Stable Release</h2>
+            <div class="note" style="margin-top: 1rem; border-left: 3px solid var(--accent); padding-left: 0.9rem;">
-            <p style="color: var(--text-muted); font-size: 0.85rem;">Version 0.5.3 &mdash; April 19, 2026</p>
+                <strong>Network fork:</strong> v0.6 is a hard fork from v0.5. Older versions cannot connect to the v0.6 network. If you were on v0.5.3, upgrade to stay reachable. Export your identity from v0.5.3 (Settings &rarr; Export) and import it on first launch of v0.6.
-            <p style="color: var(--text-muted); font-size: 0.85rem;">Multi-identity, export/import, fast startup, pagination, SAF support, AppImage video, and more. Recommended for daily use.</p>
+            </div>
+
+            <h2 style="margin-top: 2rem;">v0.6.0 &mdash; April 21, 2026</h2>
+            <p style="color: var(--text-muted); font-size: 0.85rem;">The privacy architecture overhaul. Network identity is decoupled from posting identity &mdash; peers cannot correlate network traffic to a posting identity, and users can hold multiple simultaneous posting identities (personas) on one device.</p>
 
             <div class="downloads">
-                <a href="itsgoin-0.5.3.apk" class="download-btn btn-android">
+                <a href="itsgoin-0.6.0.apk" class="download-btn btn-android">
                     Android APK
-                    <span class="sub">v0.5.3 stable</span>
+                    <span class="sub">v0.6.0</span>
                 </a>
-                <a href="itsgoin_0.5.3_amd64.AppImage" class="download-btn btn-linux">
+                <a href="itsgoin_0.6.0_amd64.AppImage" class="download-btn btn-linux">
                     Linux AppImage
-                    <span class="sub">v0.5.3 stable</span>
+                    <span class="sub">v0.6.0</span>
                 </a>
-                <a href="itsgoin-cli-0.5.3-linux-amd64" class="download-btn btn-linux">
+                <a href="itsgoin-cli-0.6.0-linux-amd64" class="download-btn btn-linux">
                     Linux CLI / Anchor
-                    <span class="sub">v0.5.3 stable</span>
+                    <span class="sub">v0.6.0</span>
-                </a>
-                <a href="itsgoin-0.5.3-windows-x64-setup.exe" class="download-btn btn-linux">
-                    Windows Installer
-                    <span class="sub">v0.5.3 stable</span>
                 </a>
             </div>
 
-            <h2 style="margin-top: 2rem;">Coming in Beta (0.6.x)</h2>
+            <ul style="color: var(--text-muted); font-size: 0.85rem; line-height: 1.6; margin-top: 1rem;">
-            <p style="color: var(--text-muted); font-size: 0.85rem;">The next beta introduces a major privacy architecture overhaul:</p>
+                <li><strong>Multiple personas</strong> on one device &mdash; Public, Private, Work, whatever you want. No switching; all active at once. Filter the merged feed per persona; compose as any persona.</li>
-            <ul style="color: var(--text-muted); font-size: 0.85rem; line-height: 1.6;">
+                <li><strong>Network-ID / Posting-ID split</strong> &mdash; content is signed by a posting key, not the network endpoint. Peers cannot link network connections to posting identities.</li>
-                <li><strong>Multiple personas</strong> on one device &mdash; Public, Private, Work, per-conversation. No switching; all active at once.</li>
+                <li><strong>CDN-only DM propagation</strong> &mdash; encrypted posts no longer have a sender&rarr;recipient traffic signal. They travel through the same CDN path as any other content.</li>
-                <li><strong>Network-ID / Posting-ID split</strong> &mdash; peers can no longer correlate network traffic to a posting identity.</li>
+                <li><strong>Merged pull with recipient-match</strong> &mdash; DMs from strangers reach you without requiring a mutual follow. No distinguishable &ldquo;searching for DMs&rdquo; traffic pattern.</li>
-                <li><strong>Ephemeral rotating DM identities</strong> &mdash; observers cannot link successive messages in a thread.</li>
+                <li><strong>File-holder CDN</strong> &mdash; replaces the upstream/downstream tree with flat lateral holder sets (max 5 per file, LRU-capped). Delete-notice and manifest fan-out are now uniform.</li>
-                <li><strong>CDN-only DM propagation</strong> &mdash; removes the sender&rarr;recipient traffic signal entirely.</li>
-                <li><strong>Multi-device support</strong> &mdash; phone + desktop share a persona without exposing the relationship.</li>
-                <li><strong>File-holder CDN</strong> &mdash; replaces the upstream/downstream tree with flat lateral replication.</li>
             </ul>
-            <p style="color: var(--text-muted); font-size: 0.85rem;">See the <a href="design.html#identity-architecture">Identity Architecture section of the design doc</a> for the full plan. Beta releases will appear here as each phase ships.</p>
+            <p style="color: var(--text-muted); font-size: 0.85rem;">See the <a href="design.html#identity-architecture">Identity Architecture section of the design doc</a> for details. Rotating DM identities (from the original plan) are deferred &mdash; they need more work on the connection model.</p>
         </section>
 
         <section>
@@ -116,6 +112,18 @@
         <section>
             <h2>Changelog</h2>
             <div class="changelog">
+                <div class="changelog-date">v0.6.0 &mdash; April 21, 2026</div>
+                <ul>
+                    <li><strong>Network fork from v0.5.</strong> The network protocol has changed enough that v0.5 and v0.6 cannot interoperate. Upgrade if you want to stay reachable.</li>
+                    <li><strong>CDN-only encrypted-post propagation.</strong> Direct <code>PostPush</code> for encrypted posts is removed; encrypted DMs look identical on the wire to any other encrypted post.</li>
+                    <li><strong>Flat per-file holder sets replace upstream/downstream trees.</strong> Each file tracks up to 5 most-recent peers it was exchanged with. Engagement diffs, manifest pushes, and delete notices all route through this holder set uniformly.</li>
+                    <li><strong>Merged pull with recipient-match.</strong> Pull queries contain a uniform list of NodeIds (follows + your own); server matches on post author OR wrapped-key recipient. Non-follower DMs now reach you via a normal pull cycle &mdash; no sender&rarr;recipient traffic signal.</li>
+                    <li><strong>Posting-key / network-key split.</strong> Content is signed with a dedicated posting key; the network endpoint uses a separate network key. Peers can no longer correlate posting identity to network traffic.</li>
+                    <li><strong>Multi-persona support.</strong> Hold multiple posting keys on one device; each peer sees distinct authors. Settings &rarr; Personas to create/manage; compose box picks which persona posts each item; feed has filter pills per persona.</li>
+                    <li><strong>pkarr default lookup suppressed.</strong> <code>clear_address_lookup()</code> + mDNS only; no implicit DNS publishing.</li>
+                    <li><strong>Schema: four legacy tables dropped</strong> (<code>post_upstream</code>, <code>post_downstream</code>, <code>blob_upstream</code>, <code>blob_downstream</code>); replaced with <code>file_holders</code>. One-way migration seeds the new table from the old ones on first launch. Also adds <code>post_recipients</code> index for merged pull, and <code>posting_identities</code> table for multi-persona.</li>
+                </ul>
+
                 <div class="changelog-date">v0.5.3-beta &mdash; April 19, 2026</div>
                 <ul>
                     <li><strong>Feed pagination</strong> &mdash; Cursor-based pagination (20 posts/page) with pre-fetch and infinite scroll. Batched engagement queries (3 SQL queries instead of 4 per post). Media loads only for visible posts via IntersectionObserver.</li>