v0.3.0-beta.8

♻️ Refactoring

• Use geist instead of inter (#334)

🎉 Features

• Add secure remote gateway access (#331)

🐛 Bug Fixes

• Judge gate on goal loops
• Restore minimum-age dependencies
• Stabilize release runtime startup
• Start absent SSH daemon

🧪 Testing

• Align nightly runtime fixtures

Release Notes

Features

Bundled Tailscale connectivity extension

Gateway reachability ships with a first-party provider. The tailscale extension runs a Tailscale node inside the Compozy process through tsnet, against the operator's own account — nothing else to install, and Compozy operates no relay, server, or account on anyone's behalf. The private tier serves https://compozy-gateway.<tailnet>.ts.net:8443 on the tailnet; the public tier serves the same hostname over Tailscale Funnel on 443. (#331)

• Bind the auth key once with compozy extension secrets set tailscale --env TS_AUTHKEY (hidden input); the value never appears in output, status, or diagnostics.
• The extension declares required Live network participation for gateway.private and gateway.public, so enabling asks for a one-time digest confirmation — and asks again only when that declaration changes.
• First activation provisions the HTTPS certificate before the Funnel listener opens, verifies public endpoints through authenticated DNS-over-TLS (gateway.verify.public_dns_resolver), and keeps unverified listeners staged with bounded retries instead of tearing them down.
• Third-party providers implement the same connectivity.provider contract from the Go and TypeScript SDKs, gated by install-source trust and control-digest re-confirmation on every enable and boot.

Remote gateway: reach your daemon from anywhere

A fresh install is still reachable only from the machine it runs on — and now that is a choice instead of a limitation. The remote gateway adds three independent, off-by-default switches: a private overlay that serves the full product to devices you pair over your own Tailscale network, a public delivery ingress that accepts only signed webhook and bridge callbacks, and consent-gated public operator access for devices that cannot join the overlay. (#331)

• The daemon never binds a public address. Gateway tier listeners stay on loopback and a connectivity provider publishes a verified route to them: an address is advertised only after the daemon fetches a one-time challenge through it and gets its own nonce back.
• Reaching an address is never authentication. Devices pair with single-use, five-minute artifacts written to private 0600 files, credentials are stored only as hashes, and compozy device revoke cancels live streams before it returns.
• compozy gateway status|audit, compozy pair, compozy device, and compozy connect (HTTPS profiles plus zero-exposure SSH) operate everything, with the same state in Settings → Gateway and the compozy__gateway native tool.
• Public delivery verifies Compozy's timestamped HMAC contract on every request, with replay protection and per-source rate limits. There is no store-and-forward while the daemon is offline — senders own retries.

Setup guides live in the new Gateway docs section: https://compozy.com/docs/gateway.

Highlights

Gateway docs: zero to GitHub webhooks

compozy.com gains a dedicated Gateway section written for first-time operators: a ten-minute quickstart from gateway.enabled to a paired phone, a step-by-step "Receive GitHub webhooks" tutorial verified end to end — including why a native repository webhook cannot sign Compozy's generic trigger contract and the GitHub Actions workflow that can — a Tailscale extension page covering tailnet prerequisites through clean removal, a remote CLI/SSH/public-access guide, a devices-audit-teardown runbook, and a plain-language security page. (#331)

Migration notes: /docs/operations/remote-gateway, /docs/operations/gateway-threat-model, and /docs/configuration/gateway moved into /docs/gateway/* as a hard cut — update saved links.