Talus changelog

• crates.io: the full agent now builds with cargo install process-monitor — nine ftui-* dependencies moved from path-deps to published crates
• PyPI installer: pip install talus-process-monitor → talus-monitor install fetches the prebuilt binary (~4 MB) from GitHub Releases, no toolchain needed
• CI auto-publish: tagging v* builds and uploads the PyPI package automatically
• Structured data (SoftwareApplication + FAQPage), IndexNow, comparison and field-guide pages

• Storage decoupled from compute: the license worker runs unchanged on native D1 or on Turso (libSQL) over HTTP
• Failover worker on a separate Cloudflare workers.dev domain serving the same shared database — seats and revocations identical on both
• Client failover: activation/deactivation/redemption try the primary, then the failover list (TALUS_LICENSE_SERVER_FAILOVER); connection failures switch, HTTP-level answers are authoritative
• Verified end-to-end; topology and recovery documented in docs/ops.md

Secure licensing backend security

• Key rotation (breaking): the Ed25519 signing key had been committed in git history — a new keypair was generated outside the repository; all previously issued licenses void
• License cache hardening: cached payload re-verified against the signed key on every load; tampering fails closed (CACHE_TAMPERED)
• Trial marker hardening: 30-day trial record carries a SHA-256 integrity tag bound to binary + machine (TRIAL_TAMPERED)
• Activation server: Cloudflare Worker + D1, server-side Ed25519 verification

Enterprise licensing system

• talus-keygen CLI, feature gating, TUI integration, CLI redesign

Enterprise maturity program supply chain

• Level 1: supply-chain security foundation · Level 2: build provenance & signing · Level 3: security hardening & audit · Level 4: testing & quality gates

• Foundations: eBPF file-event pipeline, behavioural scoring, response layer, TUI — full detail in CHANGELOG.md