Skip to main content

Release Notes and Changelog

This document tracks the technical evolution of the TkushPatch software suite (ota-server, ota-web-console, tk-ota-push CLI, tk_ota_push SDK, and the native Rust updater engine).

Version 1.2.0 (Current Release - Production)​

Release Date: November 2026

🛡️ Security & Banking Regulatory Compliance​

  • Maker-Checker Governance (Four-Eyes Principle): Complete separation of duties enforcement. All production patches enter STAGED quarantine and mandate independent cryptographic sign-off by a secondary officer (ROLE_SECURITY_OFFICER).
  • Dynamic Solo Tenant Transition: Automated detection for single-member organizations (totalMembers == 1) granting explicit self-approval derogation tracked in the audit trail (PATCH_APPROVED_SOLO_OVERRIDE).
  • Inviolable Production Guard (OtpHardProductionGuard): Bytecode-level barrier neutralizing any dev or mock test bypasses whenever a production environment is detected.
  • Hardened Multi-Factor Auth (2FA OTP): Cryptographic CSPRNG generation (SecureRandom), secret organizational salting, and SHA-256 constant-time verification.
  • Append-Only Regulatory Audit Log: Write-once protection on audit_logs backed by SHA-256 seal chaining, with certified CSV and official PDF regulatory package exports.

🚀 Fleet Distribution & High-Availability​

  • Native Multi-ABI Consolidation: Unified declaration of Store releases supporting 64-bit (arm64-v8a) and 32-bit (armeabi-v7a) CPU targets concurrently.
  • ISO Country Geo-Targeting: Granular regional distribution whitelisting by country code (e.g. CM, CI, SN).
  • Data Plane Anti-DDoS Protection: Edge Token Bucket filter bounding client device requests to 120 req/min across /api/v1/patches/**.
  • 1-Click Emergency Kill-Switch: Immediate revocation of active production patches with client-side invalidation directives.

💻 Developer Experience & Web Console​

  • Integrated Dart Deobfuscator (/symbols): Live stack trace translation mapping production hexadecimal crash dumps to exact Dart filenames and line numbers.
  • Dark Mode & Bilingual Localization: Instant client-side switching between French (fr) and English (en), with dark/light visual themes.
  • Web CLI Consent Gateway (/cli/login): Frictionless browser-based OAuth/PKCE authorization for tk-ota-push login.

Version 1.1.0​

Release Date: August 2026

⚙️ Differential Engine & Cryptography​

  • compressed binary diff Differential Engine: Reduced average patch payload size below 35 KB (65% improvement over standard binary diff tools).
  • secure signing service Engine Adapter: Delegated asymmetric digital signature/4096 code signing to a secure HSM with environment key isolation (prod vs nonprod).
  • Rust Updater Compatibility (signing.rs): Strict alignment with public signing key (Base64) public keys and 64-character lowercase ASCII digest signatures.

🌐 Tracks & Promotion​

  • Zero-Recompile Inter-Channel Promotion: 1-click promotion workflow migrating exact QA-certified binary artifacts into production without recompilation drift.
  • Tier-3 Device Diagnostics Console (/support): Granular client troubleshooting by client_id, targeted rollbacks, and QA hardware whitelisting.

Version 1.0.0 (Initial Sovereign Release)​

Release Date: May 2026

  • Hexagonal Control Plane: TkushPatch Server 3 (Java 21) backend with relational database persistence.
  • Next.js Management Console: Modern graphical cockpit for managing Store versions and patches.
  • Flutter Client SDK tk_ota_push: Autonomous client runtime for Android and iOS devices.
  • Air-Gapped Offline Distribution: Support for direct .vmcode differential file side-loading in disconnected environments.
  • JWT Authentication & RBAC Matrix: Core definition of the 5 institutional platform roles.

Technical Engineering Roadmap​

TkushPatch Evolution Roadmap
  • v1.2: Enterprise four-eyes governance, ISO country targeting, and full multi-ABI support.
  • v1.3: Automated cohort rollouts and enriched fleet telemetry analytics.
  • v1.4: Extended support for Web and desktop targets.