[valicm]

For users

• First screen: New vault, New account (vault and sync account in one go) and Sign in. A team invite opened before setup shows there with the address filled in; an invite opened while sync is off opens once sync is on.
• Sync offer: a new vault no longer asks right away; if sync is still off a week later, MorphGate asks once.
• Suggested master passwords: five random words, wherever you set one.
• Hosts as home: with saved hosts, MorphGate opens on Hosts, with Quick connect beside New host.
• Lists redesigned: hosts, groups, keys, snippets, tunnels and VPNs are searchable, filterable tables; groups show what they give their hosts; the sidebar lists open sessions first; Keys, identities and host CAs are tabs of Keys; session logs can be searched and filtered.
• Team pages: what needs you first (members to confirm, devices to approve, keys to rotate), then tabs for members, vaults, SSH keys, settings and activity; invite several people at once.
• Two-step verification: when a team requires it and your account lacks it, MorphGate says so and takes you to set it up.
• Feeds: hosts and snippets from a JSON document your team publishes at a URL, read with a token, refreshed every 15 minutes. Host keys it lists are trusted for their hosts, others refused; its snippets are read-only, and a changed one shows the new commands before it runs.
• Item history: every change carries a version inside its signed envelope and deletions are signed, so a sync server can't serve an older copy of an item than one the device has seen. 0.2.0 apps keep syncing alongside.
• Fixes: Install and restart waits for an update check still running; two devices refreshing the same cloud source no longer make duplicates or "(conflict)" copies; copy buttons fall back to another way of copying and say "Couldn't copy" when nothing works.
• About links to the documentation and the source code.

Under the hood

• mg-store / reference server: item_version and signed deletions. The server keeps a deletion's envelope (up to 1 KiB, features.signed_tombstones), vault-conform checks it, and the sync crypto spec is updated. Strict item history is built but off.
• mg-inventory: feed source (feed.rs, document version 1); cloud items get derived ids; sync makes no conflict copies where only source-decided fields differ; offboarding lists feed tokens.
• Sync notes a team waiting for two-step verification (Hold::Totp, from 403 totp_setup_required or the team's policy).
• The workspace keeps a page opened while the vault is still loading (it used to switch to Hosts over it).

CI and release

• Release: Windows signing retries Microsoft's timestamp server (4 tries, 20 s apart); notarizing the macOS DMG is its own job ("macOS nota rebuild.
• New "Android monkey" job (not required): a debug build in an API 35 emulator, 3 rounds of 500 random events. It fails on a crash, a Rust panic, a page error or an app that stops drawing; ANRs are noted (with the main thread's stack), since the emulator draws in software. Run workflow takes a seed to
  repeat a run.
• need-packages.sh puts a time limit on apt (a stalled mirror once held a job for an hour).

Tests

• E2E: feeds (host-feed.mjs), a desktop monkey (E2E_ONLY=monkey), the README demo (E2E_ONLY=demo, drawn by tools/readme-demo), thekey.mjs`); appimage, teams and layout updated for the new screens.
• The last CI run on Sync offered a week after setup; Android monkey in CI #12 passed every job: lint/test/live SSH and VPN, end to end (Linux), Android build, Desktop, Android monkey.

Docs

Feature docs, the e2e README, docs/development.md and the ROADMAP are updated (cloud sources and feeds, item history done; strict item history and signed checkpoints still open). The README shows the app.