Accounts and sign-in 0.12.0
- Phone notifications: an account keeps up to 10 devices (Web Push subscriptions at Google's, Mozilla's, Apple's or Microsoft's push service) and Alelyon sends them short notices of a closed list of kinds (a session's question, a task finished or stopped, a change ready for the person's word), encrypted to each device. New routes /identity/native/push/{key,add,list,forget,forget-all,send}; new table hosted_push_devices, deleted with Forget and with the account (ADR-0047).
- Phone notifications' VAPID key is read as PEM in base64 too, the form deploy.sh makes; the VM reads it from the secret alelyon-identity-push-vapid-key. Records the Privacy Notice of 2026-10-21.4 (phone notifications) with each sign-up.
- deploy the identity service at the version's commit, on the owner's word, after a data-disk snapshot and after the Privacy Notice names phone notifications.
- deploy the identity service at the version's commit, with PRIVACY_VERSION 2026-10-21.4, after a data-disk snapshot and after the website release that carries that text.