Changelog

wisp 0.0.5, a box from the release alone

The fifth cut of wisp, on the GitHub release with the same assets as before and on the setup mirror as the server and app sets. Set Up a Box now starts from the release.

• A box is set up from the release alone. The bundle carries ghost-setup, ghost-qr and the operator scripts, so it's download, check the signature, unpack and sudo localghost/tools/install.sh, with no git, Go or make. Setup builds the model engine for the card the driver reports, with no number in a script to change.
• The volume can be a file on a drive that's mounted at boot, allocated in full, instead of a whole empty disk. The seal, the PINs and the wipe work the same.
• English Wikipedia is imported into the box's own database, read once and never at a question, and the file is removed afterwards. The chat, the coin pages and a new WIKIPEDIA page read it, and nothing of a question leaves the box.
• The phone no longer asks Frankfurter for a currency, since the box answers from the ECB table it keeps.
• The check-in and a memory each have a page of their own, a notification opens the thing it's about, and a question can be asked aloud, heard on the box and kept nowhere.
• One memory per person, and a trip of several outings becomes one trip. Box Status says what ghost.synthd did in its last pass.
• SETTINGS names the build the box runs, keeps the last four releases on a shelf to put back on, and finds the release on the mirror again. The widget and the lock screen lead with BTC and ETH.

A box on 0.0.4 can take it from the phone with DEPLOY, the first release a box can take that way, since every earlier bundle carried a file the box's unpacker refused. After the first unlock you still run update.sh yourself, and secd queuing it is next.

Set Up a Box, shorter

Set Up a Box opens with the whole setup in five moves, and each step shows what to run and what it asks, with the reasons and the less common cases folded under it. It also says to leave Wikipedia out with GHOST_WIKI=0 for now: the reader in wisp 0.0.4 can't open the published file, and the fix comes with 0.0.5. A setup from the release alone, with nothing to compile, and the volume as an encrypted file on any drive are on the roadmap for a later wisp.

wisp 0.0.4, Go 1.27.1 and no geocoder

The fourth cut of wisp, most of it answering two outside reviews of 0.0.3, on the GitHub release with the same assets as before and on the setup mirror as the server and app sets.

• The server is built with Go 1.27.1. The earlier cuts used Go 1.25.4, which has had thirty-five standard-library advisories fixed since. Setup and every redeploy install the Go that go.mod names from the mirror, the build never fetches a toolchain by itself, and RELEASE.txt says which Go built the set, so anyone rebuilding the bundle to check its hashes knows which one to use.
• The phone no longer asks its geocoder which country it's in, which on most phones was a network call to Google carrying the fix. The box answers from its own Natural Earth map.
• A "what is" question that the box's own copy of Wikipedia answers no longer goes to the web at all.
• update.sh takes English Wikipedia, about 50 GB, with the other sets whenever the volume has 60 GB free, and GHOST_WIKI=0 leaves it out. Found after the cut: the ZIM reader in 0.0.4 can't open the published file, so leave it out until 0.0.5, where the fix is.
• A coin in CRYPTO50 priced at more than twenty times its month's base is held at its last good price rather than moving the whole index, and ghost-cli ghost.tallyd rates index=1 lays the index out coin by coin.
• With the map open, the dot follows the phone every few seconds.

A box on an earlier wisp takes it from the phone with DEPLOY, and the app installs over the earlier one and keeps the enrolment. The known gaps name the certificate header again: a fresh box trusts the header nginx passes until ghost-ctl edge-passthrough moves the phone's TLS into secd, and a box reached by IP alone can't take that yet. The mirror's go set now carries Go 1.27.1 alone.

Go 1.27.1 on the mirror, and every lookup the phone makes

The mirror's go set gains Go 1.27.1, the newest release, for the next cut of the box. The binaries in wisp 0.0.3 were built with Go 1.25.4, which left support when Go 1.27 came out and lacks the standard library's security fixes since. Go 1.25.4 stays on the mirror only while setup at wisp 0.0.3 asks for it.

The privacy page, Set Up a Box, the About page and llms.txt now name every lookup the phone makes, which a second read of the app's code turned up. A currency question goes to Frankfurter, and a who-is question to Wikipedia's API. To know which country it's in, the phone asks Android's own geocoder about its newest position, at most every 12 hours unless it has moved 20 km, and on phones with Google's services that lookup usually reaches Google. The 0.0.2 entry below no longer says the app's tests run in CI, because they don't pass there yet.

wisp 0.0.3, the weather moves to the box

The third cut of wisp, on the GitHub release with the same assets as 0.0.2 (the server, the signed app with its APP.txt, the source archive and the signed sums) and on the setup mirror as the server and app sets.

• Until now a weather question that named no place sent the phone's position, rounded to two decimal places, to Open-Meteo. The box now pulls the forecast for the world's three thousand larger places once a day, the same list for every box, and answers the weather from that table, so the phone has no weather lookup of its own.
• ghost-cli ghost.tallyd weather shows the table and the forecast where the trail says the phone is, and Box Status gains a Weather section.
• The source archive no longer carries the hardware test that stopped compiling when its helper moved, and the fix to the app's PIN gate on a phone without a screen lock, which the weather change had undone, is back.

A box on 0.0.1 or 0.0.2 takes it from the phone with DEPLOY, and the app installs over the earlier one and keeps the enrolment. An app older than 0.0.3 still asks Open-Meteo itself until it's updated. The known gaps are the same as 0.0.2's, and the weather on home and the lock screen is still to come.

Every planned piece gets a release line

The roadmap gains a table of what each release line brings, and every page that mentions something not built names the earliest line it's planned for, in place of the old phase numbers. The two FIDO2 hardware keys, and the recovery path they give, come in shade (1.x) at the earliest, along with as many duress PINs as you want, ghost.tallyd's import parsers, memory episodes and the rest of ghost.shadowd's detectors. The box we sell is specter, mail, the browser extension and always-on listening are phantom, and The Mist is poltergeist. The decoy volume, shorter device certificates, an offline release key and a retire button on the phone stay with the later wisps, as the repository's README has them.

The privacy page, Set Up a Box and the About page say that since wisp 0.0.3 the box pulls the weather for the world's three thousand larger places once a day and the phone no longer sends its position for it. What the Box Does Now no longer describes the hardware keys as built, and the Build page's link to the security policy points at SECURITY.md, where it lives now.

wisp 0.0.2, the second cut

Still a wisp, since the name is the release line and the number is the cut. Every 0.x release is a wisp, 1.x will be shade, and specter, phantom and poltergeist come after. This is 0.0.1 with the day's fixes, and the first cut whose GitHub release holds everything its notes promise, the server, the signed app with its APP.txt, the source archive and a SHA256SUMS signed by the site key. The mirror's server and app sets carry it.

• Photos a phone saved as HEIC with an unfamiliar brand were archived as videos. The box now reads every brand in the file, and at its first start on 0.0.2 it re-reads the archive once and puts each one right.
• A lost phone can be retired by its key, with ghost-cli ghost.secd retire on the box or from another phone, and every call it makes after that is answered as if the box were down.
• The release cut stops before tagging when the app can't be built or signed, and the upload no longer stops on a name collision, which is what left three files off 0.0.1's page.
• The repository's README, CONTRIBUTING.md and SECURITY.md describe what is built, CI runs the Go tests (the app's tests don't pass in CI yet), and the tree builds on a Mac.

The app installs over 0.0.1 and keeps the enrolment. Known gaps at 0.0.2 are the certificate authority's key on the system disk (by choice, so a phone can be enrolled or retired while the vault is locked), ten-year device certificates, releases signed by the site key alone, an APK that isn't byte-reproducible yet, and no Mist, mail or decoy volume.

wisp 0.0.1, the first release

The server for linux-amd64, built reproducibly from the tag, and the Android app, signed with the app's own key (certificate SHA-256 3dcc5e35…f0cdf4, in full on Set Up a Box). Both went on the GitHub release and on the setup mirror as the server and app sets, which carry the newest release. From this release on, a box takes new releases from the phone (DEPLOY), checks them against the mirror's signed manifest and rolls back by itself if the new build fails its first unlock.

Eleven daemons ship in it, ten doing their whole job and ghost.shadowd with its first detector. The known gaps at release are the certificate authority's key on the system disk, a trusted header on secd's loopback port, releases signed by the site key alone, no per-device revocation, no recovery path, and no Mist, mail or decoy volume yet.

Set Up a Box, and the mirror's release sets

Set Up a Box goes up, the whole setup in the order the server repo's scripts expect, from a bare Debian install to a phone that unlocks the box. The mirror gains the server and app sets, fifteen sets in all.

The site says what is built, and names the weather lookup

The home page's answers now say where something isn't built yet, the two hardware keys and The Mist among them. The privacy page and Set Up a Box name the weather lookup, a question that names no place, which sends the position rounded to about a kilometre to Open-Meteo. The setup page explains how the enrolment QR's key is retired at the first unlock.

Status, privacy, terms and security.txt

The site gains a status page with an incident history, privacy and terms pages naming LocalGhost.ai Ltd (company number 17213100), and an RFC 9116 security.txt. The About page now keeps what wisp 0.0.1 does apart from what's planned for v1.0.

Time zones, heights and Wikipedia on the mirror

The mirror adds the world's time zone boundaries and IANA's rules (tz), the Copernicus DEM at 90 metres (elevation) and English Wikipedia as a Kiwix ZIM (wikipedia). The last two are refreshed by hand because of their size. Upstream is now checked at most once a month.

Speech on the mirror

whisper.cpp v1.9.4 (whisper), pinned like llama.cpp, and Whisper large-v3-turbo (speech), for transcribing the voice notes of the daily check-in on the box.

The setup mirror

The setup mirror goes up with a SHA-256 manifest signed by the site key, starting with GeoNames and Natural Earth (geo), OpenStreetMap's land polygons, the Go toolchain and the Gemma 4 12B weights. Over the following days it adds llama.cpp v0.5.0, EmbeddingGemma, the phone's model and Geofabrik's road extracts, and boxes stop falling back to upstream sources.