chore: prepare release v1.8.13-alpha

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## v1.8.13-alpha (2026-09-12)
+
+- **GitWorkshop installs reliably on fresh nodes.** The app is classified as a user-facing app while its install placeholder is being created, so it remains visible under My Apps instead of Services.
+- **Fresh GitWorkshop installs build the correct image.** The production orchestrator handles its bundled build context instead of sending the local image reference through the legacy registry-pull path.
+- **Curated app classification is regression-tested.** Every user-facing app remains in My Apps during installation, while headless services stay in Services.
+
 ## v1.8.12-alpha (2026-09-11)
 
 - **Fresh IndeedHub installs no longer share a fleet-wide encryption root.** The API now generates a persistent per-node AES master secret and shares it with the media worker through the platform's protected secret environment. Existing nodes migrate the exact legacy value they are already using before any container can be recreated, preserving access to encrypted data; an unreadable or empty existing root fails safely instead of being silently replaced. The manifest path, retired fallback installer, and container repair script follow the same rule.
@@ -106,7 +112,7 @@
 
 - **Apps open over HTTPS when your node does.** Connect to your node over HTTPS and the apps you open — Vaultwarden in its own tab, BTCPay, Grafana, and the rest, on a remote browser or in the phone's in-app browser — now open on the same secure connection instead of silently dropping to plain HTTP. The node's app gate already served TLS on every app port; the dashboard was handing out `http://` addresses regardless of how you reached it. Ports the gate does not front (plain-HTTP publishes, and the API ports like Cuprate's RPC) deliberately stay on `http` — `https` there would simply fail to connect. Plain-HTTP access (the kiosk, LAN browsing) is unchanged.
 
-- **Every app in the store is now a first-class platform app.** The last stragglers — Nginx Proxy Manager, Tailscale, Ollama, CryptPad, and AdGuard Home — now carry full manifests: the node's app gate fronts their web ports (TLS on the same port, the node login where appropriate, embedding fixes, Tor), installs go through the orchestrator like every other app, and their pins live in the signed catalog. Ollama stays loopback-only — it is the assistant's local model backend, not a web app. The four apps retired earlier (FIPS, Nostr VPN, Routstr, Penpot) are finally dropped from the catalog, and Cuprate's manifest — which carried a duplicated metadata block that strict parsers reject — is fixed.
+- **Every app in the store is now a first-class platform app.** The remaining platform apps carry full manifests: the node's app gate fronts their web ports (TLS on the same port, the node login where appropriate, embedding fixes, Tor), installs go through the orchestrator like every other app, and their pins live in the signed catalog. Ollama stays loopback-only — it is the assistant's local model backend, not a web app. Retired apps are dropped from the catalog, and Cuprate's manifest — which carried a duplicated metadata block that strict parsers reject — is fixed.
 
 - **Newly signed apps appear in the App Store immediately.** The App Store now serves the release-signed catalog the node has already fetched and verified — so publishing a signed app (like Cuprate) makes it appear for every updated node without waiting for a dashboard release. The unsigned community catalog remains only as a fallback for nodes that can't reach the registry. The same signed catalog now also decides which ports serve TLS, so nothing is upgraded to `https` that can't answer it.
 

NOTICE

@@ -72,7 +72,7 @@ is available via Debian (https://snapshot.debian.org) as referenced in each
 release's notes. Container images offered through the app catalog and mirror
 registry remain under their upstream licenses (including GPL/AGPL software
 such as mempool, Nextcloud, Vaultwarden, SearXNG, PhotoPrism, Immich,
-Jellyfin, MariaDB, AdGuard Home, and strfry); source links are provided in
+Jellyfin, MariaDB, and strfry); source links are provided in
 the app catalog. The modified mempool-frontend image is built from
 `docker/mempool-frontend/` in this repository (AGPL-3.0 corresponding source).
 

README.md

@@ -11,7 +11,21 @@ Podman containers managed by the Rust backend.
 [![License](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Rust](https://img.shields.io/badge/rust-stable-orange)](https://www.rust-lang.org/)
 [![Vue.js](https://img.shields.io/badge/vue.js-3.5-brightgreen)](https://vuejs.org/)
-[![Version](https://img.shields.io/badge/version-1.8.0--alpha-blue)]()
+[![Version](https://img.shields.io/badge/version-1.8.13--alpha-blue)](https://source.archipelago-foundation.org/lfg2025/archy/releases)
+
+## Current release
+
+The current pre-release is **v1.8.13-alpha**. Release notes and signed OTA
+artifacts are published on [Gitea](https://source.archipelago-foundation.org/lfg2025/archy/releases).
+The same source is mirrored through ngit for Nostr-native cloning and
+contribution:
+
+```
+nostr://npub1w3sqdkrhn0gyuvsex32effzgnfpyde6qrrc4u467flg5e9txh4wsfn5vjg/relay.ngit.dev/archy
+```
+
+Clone with ngit, or use the Gitea mirror when you need a conventional Git
+remote. Contributions should follow [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## What is here
 

app-catalog/catalog.json

@@ -34,18 +34,6 @@
     ]
   },
   "apps": [
-    {
-      "id": "adguardhome",
-      "title": "AdGuard Home",
-      "version": "v0.107.79",
-      "description": "Network-wide ad and tracker blocking: a DNS server that filters every device on your LAN, with a web console for rules and client management.",
-      "icon": "",
-      "author": "AdGuard",
-      "category": "networking",
-      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.79",
-      "repoUrl": "https://github.com/AdguardTeam/AdGuardHome"
-    },
     {
       "id": "alby-hub",
       "title": "Alby Hub",

apps/adguardhome/manifest.yml

@@ -1,91 +0,0 @@
-app:
-  id: adguardhome
-  name: AdGuard Home
-  version: v0.107.79
-  upstream:
-    kind: github
-    repo: AdguardTeam/AdGuardHome
-  description: >-
-    Network-wide ad and tracker blocking: a DNS server that filters every
-    device on your LAN, with a web console for rules and client management.
-
-  container:
-    image: source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.79
-    pull_policy: if-not-present
-    network: pasta
-
-  dependencies:
-    - storage: 1Gi
-
-  resources:
-    memory_limit: 512Mi
-    disk_limit: 1Gi
-
-  security:
-    capabilities: [NET_BIND_SERVICE]
-    readonly_root: false
-    no_new_privileges: true
-    network_policy: isolated
-
-  ports:
-    - host: 3030
-      container: 3000
-      protocol: tcp
-      bind: 127.0.0.1
-      # 3030, not AdGuard Home's conventional 3000: Grafana owns :3000 on a
-      # node, and both being installable means the host ports must not
-      # collide (the orchestrator refuses/loads warn on overlap).
-      # open: the setup wizard and admin console carry AdGuard Home's own
-      # login; the gate fronts the port (TLS, header fixes) without a
-      # second cookie challenge.
-      auth: open
-      auth_rationale: >-
-        AdGuard Home enforces its own admin login on the console, and the
-        first-run wizard must answer before any account exists.
-    - host: 53
-      container: 53
-      protocol: udp
-      # none: plain DNS must answer every unauthenticated query from LAN
-      # devices — a login page in front of :53 breaks every client on the
-      # network by design.
-      auth: none
-      auth_rationale: >-
-        Plain DNS answers unauthenticated by protocol: resolvers and clients
-        send queries directly; a login challenge would make DNS unreachable.
-    - host: 53
-      container: 53
-      protocol: tcp
-      auth: none
-      auth_rationale: >-
-        DNS-over-TCP fallback (truncated responses, zone transfers); same
-        protocol-level requirement as the UDP port.
-
-  volumes:
-    - type: bind
-      source: /var/lib/archipelago/adguardhome
-      target: /opt/adguardhome
-      options: [rw]
-
-  environment: []
-
-  health_check:
-    type: tcp
-    endpoint: localhost:3030
-    interval: 30s
-    timeout: 5s
-    retries: 3
-
-  interfaces:
-    main:
-      name: Admin console
-      description: AdGuard Home web console
-      type: ui
-      port: 3030
-      protocol: http
-      path: /
-
-  metadata:
-    author: AdGuard
-    category: networking
-    repo: https://github.com/AdguardTeam/AdGuardHome
-    tier: optional

core/Cargo.lock

@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.8.12-alpha"
+version = "1.8.13-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.8.12-alpha"
+version = "1.8.13-alpha"
 edition = "2021"
 license.workspace = true
 description = "Archipelago Bitcoin Node OS - Native backend"

core/archipelago/src/api/rpc/package/install.rs

@@ -2743,6 +2743,11 @@ fn uses_orchestrator_install_flow(package_id: &str) -> bool {
             | "gitea"
             | "portainer"
             | "meshtastic"
+            // Build-backed user-facing app. Route it through the production
+            // orchestrator so a fresh node builds its bundled image instead
+            // of treating localhost/archipelago-source:local as a registry
+            // image in the legacy installer.
+            | "archipelago-source"
     )
 }
 
@@ -2822,6 +2827,7 @@ mod tests {
             "gitea",
             "portainer",
             "meshtastic",
+            "archipelago-source",
         ] {
             assert!(uses_orchestrator_install_flow(app));
             assert!(should_try_orchestrator_install(app, true));

core/archipelago/src/container/image_versions.rs

@@ -182,7 +182,6 @@ fn image_var_for_app(app_id: &str) -> Option<&'static str> {
         "immich" | "immich_server" => Some("IMMICH_SERVER_IMAGE"),
 
         // Networking
-        "adguardhome" => Some("ADGUARDHOME_IMAGE"),
         "tor" | "archy-tor" => Some("ALPINE_TOR_IMAGE"),
 
         _ => None,

core/archipelago/src/fips/app_ports.rs

@@ -6,7 +6,7 @@
 //! no listener, so allowing them is inert.
 
 pub const APP_LAUNCH_PORTS: &[u16] = &[
-    2283, 2342, 3000, 3001, 3002, 3030, 4080, 5180, 7778, 8080, 8081, 8082, 8083, 8084, 8085, 8087,
+    2283, 2342, 3000, 3001, 3002, 4080, 5180, 7778, 8080, 8081, 8082, 8083, 8084, 8085, 8087, 8090,
-    8090, 8096, 8123, 8175, 8176, 8187, 8240, 8334, 8336, 8337, 8888, 8999, 9000, 9100, 10380,
+    8096, 8123, 8175, 8176, 8187, 8240, 8334, 8336, 8337, 8888, 8999, 9000, 9100, 10380, 11434,
-    11434, 18081, 18083, 23000, 32838, 50002,
+    18081, 18083, 23000, 32838, 50002,
 ];

core/container/src/manifest.rs

@@ -1746,11 +1746,6 @@ app:
             }
         }
         exempt.sort();
-        // 30 as of 2026-08-31: the 28 below plus adguardhome's two DNS ports
-        // (53 udp + tcp) — plain DNS answers unauthenticated by protocol, the
-        // same reason router's mDNS/SSDP and every p2p port is exempt; each
-        // carries its auth_rationale in the manifest.
-        //
         // 28 as of 2026-08-23: the 26 below plus cuprate's two exemptions —
         // 18183 (Monero p2p gossip, same reasoning as bitcoin's 8333) and
         // 18090 (host mapping for Monero's canonical 18089 restricted RPC,
@@ -1776,7 +1771,7 @@ app:
         // stage timed out that cycle, so the count here lagged at 17.
         assert_eq!(
             exempt.len(),
-            30,
+            28,
             "unauthenticated port set changed — review before updating this count: {exempt:?}"
         );
     }
@@ -1811,13 +1806,11 @@ app:
         // by anonymous payers), and — since the v1.8.7 platform round — the
         // three own-login consoles brought onto the manifest platform:
         // nginx-proxy-manager 8081 (NPM admin accounts), tailscale 8240
-        // (tailnet login on the web console), adguardhome 3000 (AGH admin
+        // (tailnet login on the web console). Both enforce their own login,
-        // accounts + first-run wizard). All enforce their own login, and an
+        // and an operator can re-gate either from Settings → Access control.
-        // operator can re-gate any of them from Settings → Access control.
         assert_eq!(
             open,
             vec![
-                ("adguardhome".to_string(), 3000u16),
                 ("btcpay-server".to_string(), 23000u16),
                 ("gitea".to_string(), 3001u16),
                 ("nginx-proxy-manager".to_string(), 8081u16),

docs/LICENSE-COMPLIANCE-AUDIT.md

@@ -129,7 +129,7 @@ The ISO redistributes a full Debian (trixie) system plus ~29 container image tar
 
 - [ ] **GPL source offer for the ISO** — kernel, GRUB, busybox/live-boot, coreutils, nftables, cryptsetup, wireguard-tools, SYSLINUX `isohdpfx.bin`, etc. Easiest compliance: keep `/usr/share/doc/*/copyright` (the build already does ✓) **and** publish, per release, either a mirror of the exact Debian source packages (`apt-get source` snapshot / snapshot.debian.org pointer) or a written offer in the docs. Add this to the release checklist.
 - [ ] **AGPLv3 images redistributed** (mempool, Grafana, Vaultwarden, SearXNG, PhotoPrism, Nextcloud, Immich, CryptPad, MinIO): AGPL compliance = make corresponding source available. You ship a **modified** mempool-frontend (`docker/mempool-frontend` entrypoint patch) — the patch is in-repo, so compliance is met once the repo is public; state this in docs. For unmodified images, link upstream sources in the app catalog.
-- [ ] **GPLv2/GPLv3 images** (MariaDB, Jellyfin, AdGuard Home, strfry): unmodified redistribution → provide license text + upstream source links (a `license` + `sourceUrl` field per `app-catalog/catalog.json` entry solves this catalog-wide).
+- [ ] **GPLv2/GPLv3 images** (MariaDB, Jellyfin, strfry): unmodified redistribution → provide license text + upstream source links (a `license` + `sourceUrl` field per `app-catalog/catalog.json` entry solves this catalog-wide).
 - [ ] **Non-free firmware** (firmware-realtek/iwlwifi/misc/linux-nonfree, intel/amd microcode): redistributable but proprietary — disclose in docs ("includes non-free firmware for hardware support"), like Debian's own non-free-firmware ISOs do.
 - [ ] The ISO build's live-server image capture (`podman save` of whatever matches on the dev server) is a compliance hazard — bundle only from the audited image list.
 - [ ] FIPS daemon (jmcorgan/fips v0.4.1, MIT ✓) and nostr-rs-relay binary (MIT ✓): include their license texts in the notices bundle.

image-recipe/_archived/build-auto-installer-iso.sh

@@ -1601,7 +1601,7 @@ IMAGES_CAPTURED_FROM_SERVER=0
 if [ -n "$DEV_SERVER" ] && [ "$DEV_SERVER" != "localhost" ] && [ "$DEV_SERVER" != "127.0.0.1" ]; then
     echo "   Capturing container images from live server ($DEV_SERVER)..."
     # Patterns match against `podman images` repository names (not container names)
-    CAPTURE_PATTERNS="bitcoin-ui bitcoinknots lnd lnd-ui electrs-ui filebrowser mempool backend frontend electrs tailscale homeassistant home-assistant btcpayserver nbxplorer postgres alpine-tor nostr-rs-relay strfry fedimintd gatewayd dwn-server vaultwarden searxng mariadb valkey nginx-alpine portainer nginx-proxy-manager adguard"
+    CAPTURE_PATTERNS="bitcoin-ui bitcoinknots lnd lnd-ui electrs-ui filebrowser mempool backend frontend electrs tailscale homeassistant home-assistant btcpayserver nbxplorer postgres alpine-tor nostr-rs-relay strfry fedimintd gatewayd dwn-server vaultwarden searxng mariadb valkey nginx-alpine portainer nginx-proxy-manager"
     REMOTE_TMP="/tmp/archipelago-image-capture-$$"
     SAVED_LIST=$(ssh "$DEV_SERVER" "mkdir -p $REMOTE_TMP && for p in $CAPTURE_PATTERNS; do img=\$(podman images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep -i \"\$p\" | head -1); [ -n \"\$img\" ] && podman save -o \"$REMOTE_TMP/\$p.tar\" \"\$img\" 2>/dev/null && echo \"\$p\"; done" 2>/dev/null) || true
     for p in $SAVED_LIST; do
@@ -1648,7 +1648,6 @@ ${PHOTOPRISM_IMAGE} photoprism.tar
 ${NEXTCLOUD_IMAGE} nextcloud.tar
 ${NPM_IMAGE} nginx-proxy-manager.tar
 ${ONLYOFFICE_IMAGE} onlyoffice.tar
-${ADGUARDHOME_IMAGE} adguardhome.tar
 "
 
 # Pull and save each image (force target arch) only if not already present

neode-ui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.8.12-alpha",
+  "version": "1.8.13-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.8.12-alpha",
+      "version": "1.8.13-alpha",
       "dependencies": {
         "@scure/bip39": "^2.2.0",
         "@types/dompurify": "^3.0.5",

neode-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neode-ui",
   "private": true,
-  "version": "1.8.12-alpha",
+  "version": "1.8.13-alpha",
   "type": "module",
   "scripts": {
     "start": "./start-dev.sh",

neode-ui/public/catalog.json

@@ -34,18 +34,6 @@
     ]
   },
   "apps": [
-    {
-      "id": "adguardhome",
-      "title": "AdGuard Home",
-      "version": "v0.107.79",
-      "description": "Network-wide ad and tracker blocking: a DNS server that filters every device on your LAN, with a web console for rules and client management.",
-      "icon": "",
-      "author": "AdGuard",
-      "category": "networking",
-      "tier": "optional",
-      "dockerImage": "source.archipelago-foundation.org/lfg2025/adguardhome:v0.107.79",
-      "repoUrl": "https://github.com/AdguardTeam/AdGuardHome"
-    },
     {
       "id": "alby-hub",
       "title": "Alby Hub",

neode-ui/src/views/appSession/generatedAppSessionConfig.ts

@@ -1,7 +1,6 @@
 /** Generated by scripts/generate-app-catalog.py. Do not edit manually. */
 
 export const GENERATED_APP_PORTS: Record<string, number> = {
-  "adguardhome": 3030,
   "aiui": 5180,
   "alby-hub": 8187,
   "archipelago-source": 8337,
@@ -40,7 +39,6 @@ export const GENERATED_APP_PORTS: Record<string, number> = {
 }
 
 export const GENERATED_APP_TITLES: Record<string, string> = {
-  "adguardhome": "AdGuard Home",
   "aiui": "AI Assistant",
   "alby-hub": "Alby Hub",
   "archipelago-source": "GitWorkshop",

neode-ui/src/views/apps/__tests__/appsConfig.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { ref } from 'vue'
 import { PackageState, type PackageDataEntry } from '@/types/api'
-import { canLaunch, filterEntriesForTab, hasFrontendUi, isServiceContainer, isServicePackage, isWebsitePackage, launchBlockedReason, resolveAppIcon, useCategoriesWithApps, DEFAULT_APP_ICON } from '../appsConfig'
+import { APP_CATEGORY_MAP, canLaunch, filterEntriesForTab, hasFrontendUi, isServiceContainer, isServicePackage, isWebsitePackage, launchBlockedReason, resolveAppIcon, useCategoriesWithApps, DEFAULT_APP_ICON } from '../appsConfig'
 
 function makePkg(id: string, title: string, category: string): PackageDataEntry {
   return {
@@ -105,6 +105,25 @@ describe('appsConfig service filtering', () => {
     expect(isWebsitePackage('some-ui-app', uiApp)).toBe(false)
   })
 
+  it('keeps GitWorkshop in My Apps while installing metadata is minimal', () => {
+    const installing = makePkg('archipelago-source', 'GitWorkshop', 'development')
+    installing.state = PackageState.Installing
+    expect(isWebsitePackage('archipelago-source', installing)).toBe(false)
+    expect(filterEntriesForTab([['archipelago-source', installing]], 'apps', 'all'))
+      .toEqual([['archipelago-source', installing]])
+    expect(filterEntriesForTab([['archipelago-source', installing]], 'services', 'all'))
+      .toEqual([])
+  })
+
+  it('keeps every curated app placeholder out of Services during install', () => {
+    for (const id of Object.keys(APP_CATEGORY_MAP)) {
+      if (isServiceContainer(id)) continue
+      const placeholder = makePkg(id, id, APP_CATEGORY_MAP[id] ?? 'other')
+      placeholder.state = PackageState.Installing
+      expect(isWebsitePackage(id, placeholder), id).toBe(false)
+    }
+  })
+
   it('never offers Launch for an unknown container with a bare exposed port', () => {
     // A self-deployed compose stack (e.g. podsteadr) publishes a port, so it
     // has a runtime lan-address — but no manifest-declared or probed UI. It

neode-ui/src/views/apps/appsConfig.ts

@@ -48,6 +48,9 @@ export const APP_CATEGORY_MAP: Record<string, string> = {
   'tailscale': 'networking', 'netbird': 'networking', 'nginx-proxy-manager': 'networking', 'portainer': 'networking',
   'uptime-kuma': 'networking',
   'botfights': 'community',
+  // User-facing app: keep the install placeholder in My Apps while its
+  // manifest (including interfaces.main.ui) is not available yet.
+  'archipelago-source': 'development',
 }
 
 export function getAppCategory(id: string, pkg: PackageDataEntry): string {

neode-ui/src/views/marketplace/marketplaceData.ts

@@ -140,7 +140,7 @@ export function categorizeCommunityApp(app: MarketplaceApp): string {
 
   if (id.includes('vpn') || id.includes('wireguard') || id.includes('tailscale') || id.includes('netbird') ||
       id.includes('proxy') || id.includes('dns') || id.includes('pihole') ||
-      id.includes('adguard') || id.includes('nginx') || id.includes('tor') ||
+      id.includes('nginx') || id.includes('tor') ||
       combined.includes('network') || combined.includes('firewall')) {
     return 'networking'
   }

neode-ui/src/views/settings/AccountInfoSection.vue

@@ -362,6 +362,16 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.8.13-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.8.13-alpha</span>
+                  <span class="text-xs text-white/40">September 12, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>GitWorkshop installs reliably on fresh nodes.</strong> The app is classified as a user-facing app while its install placeholder is being created, so it remains visible under My Apps instead of Services. Fresh installs now use the production orchestrator to build the bundled GitWorkshop image rather than sending its local image reference through the legacy registry-pull path. Regression coverage now protects all curated app classifications.</p>
+                </div>
+              </div>
               <!-- v1.8.12-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">
@@ -369,6 +379,7 @@ init()
                   <span class="text-xs text-white/40">September 11, 2026</span>
                 </div>
                 <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p><strong>Fresh IndeedHub installs no longer share a fleet-wide encryption root.</strong> The API now generates a persistent per-node AES master secret and shares it with the media worker through the platform's protected secret environment. Existing nodes migrate the exact legacy value they are already using before any container can be recreated, preserving access to encrypted data; an unreadable or empty existing root fails safely instead of being silently replaced. The manifest path, retired fallback installer, and container repair script follow the same rule.</p>
                   <p><strong>The Companion download advertises and re-announces the APK it actually serves.</strong> The Discover banner and its install prompt now share the no-cache APK metadata, visibly report Companion 0.5.32 build 52, and remember dismissal per Android build rather than forever, so an existing browser gets one useful update prompt when the APK changes. The ISO gate reads the expected version from the Android build itself instead of accepting the stale 0.5.28 payload.</p>
                   <p><strong>GitWorkshop's dependency audit is clean.</strong> The pinned upstream client keeps its separately reviewable Archipelago integration patch and now applies a deterministic dependency patch: safe lock refreshes plus targeted fflate, React Router, and Vitest upgrades remove all ten production advisories and all eight development advisories. A clean install reports zero vulnerabilities; type-check, all 152 upstream unit tests, and the exact Archipelago subpath build pass.</p>
                   <p><strong>Every completed payment now gets the full Lightning-style receipt screen.</strong> Cashu and Fedimint sends no longer leave the payment form open behind a token; wallet, QR-scan, Web5, and app-requested sends all replace their forms with the animated success state. Payment hashes, transaction IDs, ecash tokens/notes, mint details, and other useful references remain copyable in the receipt, and receive completions open the same distinct payment-success modal. Minibits claims retain a short-lived durable receipt so the visible modal still reports success when another dashboard or Companion context wins the claim-poll race, while concurrent watchers now share one bounded relay fetch instead of queueing several long polls.</p>
@@ -459,7 +470,7 @@ init()
                   <p><strong>The installer carries the same corrected release and Companion 0.5.28.</strong> Its artifact gate now checks the companion APK version and the v1.8.0 What's New floor inside the finished ISO, so a stale frontend or phone app cannot be published under the current release label.</p>
                   <p><strong>Crash dumps work on fresh installs as well as upgraded nodes.</strong> The installer gate checks every kdump package inside the finished ISO, and makedumpfile is installed explicitly rather than accidentally relying on a recommended dependency that the minimal image deliberately omits.</p>
                   <p><strong>Apps open over HTTPS when your node does.</strong> Connect to your node over HTTPS and the apps you open — Vaultwarden in its own tab, BTCPay, Grafana, and the rest, on a remote browser or in the phone's in-app browser — now open on the same secure connection instead of silently dropping to plain HTTP. The node's app gate already served TLS on every app port; the dashboard was handing out http:// addresses regardless of how you reached it. Ports the gate does not front (plain-HTTP publishes, and the API ports like Cuprate's RPC) deliberately stay on http — https there would simply fail to connect. Plain-HTTP access (the kiosk, LAN browsing) is unchanged.</p>
-                  <p><strong>Every app in the store is now a first-class platform app.</strong> The last stragglers — Nginx Proxy Manager, Tailscale, Ollama, CryptPad, and AdGuard Home — now carry full manifests: the node's app gate fronts their web ports (TLS on the same port, the node login where appropriate, embedding fixes, Tor), installs go through the orchestrator like every other app, and their pins live in the signed catalog. Ollama stays loopback-only — it is the assistant's local model backend, not a web app. The four apps retired earlier (FIPS, Nostr VPN, Routstr, Penpot) are finally dropped from the catalog, and Cuprate's manifest — which carried a duplicated metadata block that strict parsers reject — is fixed.</p>
+                  <p><strong>Every app in the store is now a first-class platform app.</strong> The remaining platform apps carry full manifests: the node's app gate fronts their web ports (TLS on the same port, the node login where appropriate, embedding fixes, Tor), installs go through the orchestrator like every other app, and their pins live in the signed catalog. Ollama stays loopback-only — it is the assistant's local model backend, not a web app. Retired apps are dropped from the catalog, and Cuprate's manifest — which carried a duplicated metadata block that strict parsers reject — is fixed.</p>
                   <p><strong>Newly signed apps appear in the App Store immediately.</strong> The App Store now serves the release-signed catalog the node has already fetched and verified — so publishing a signed app (like Cuprate) makes it appear for every updated node without waiting for a dashboard release. The unsigned community catalog remains only as a fallback for nodes that can't reach the registry. The same signed catalog now also decides which ports serve TLS, so nothing is upgraded to https that can't answer it.</p>
                 </div>
               </div>

releases/pending/v1.8.13-alpha/manifest.json

@@ -0,0 +1,29 @@
+{
+  "changelog": [
+    "**GitWorkshop installs reliably on fresh nodes.** The app is classified as a user-facing app while its install placeholder is being created, so it remains visible under My Apps instead of Services.",
+    "**Fresh GitWorkshop installs build the correct image.** The production orchestrator handles its bundled build context instead of sending the local image reference through the legacy registry-pull path.",
+    "**Curated app classification is regression-tested.** Every user-facing app remains in My Apps during installation, while headless services stay in Services."
+  ],
+  "components": [
+    {
+      "current_version": "1.8.13-alpha",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.13-alpha/archipelago",
+      "name": "archipelago",
+      "new_version": "1.8.13-alpha",
+      "sha256": "832c7e75b395f94f919a21d1ad7d32d367e1ef84a0e0995b4e8fe87268aa21a4",
+      "size_bytes": 64585424
+    },
+    {
+      "current_version": "1.8.13-alpha",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.13-alpha/archipelago-frontend-1.8.13-alpha.tar.gz",
+      "name": "archipelago-frontend-1.8.13-alpha.tar.gz",
+      "new_version": "1.8.13-alpha",
+      "sha256": "d0159b61f84eb30013634a97177801474376dddb1189024b94f16236ce7ff538",
+      "size_bytes": 97915796
+    }
+  ],
+  "release_date": "2026-09-12",
+  "signature": "45a322e793a2fc7565cc148f14efbbcf03e0c934183590375368091368ffe49ed2a7e9962692caf54b3432c71976a6c1b0f06a48cf8c4634c7b2e573e5782a0f",
+  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
+  "version": "1.8.13-alpha"
+}

scripts/generate-app-catalog.sh

@@ -81,7 +81,6 @@ SINGLE = {
     "fedimint": "FEDIMINT_IMAGE",
     "fedimint-gateway": "FEDIMINT_GATEWAY_IMAGE",
     "nostr-rs-relay": "NOSTR_RS_RELAY_IMAGE",
-    "adguardhome": "ADGUARDHOME_IMAGE",
 }
 
 # Stack apps: app_id -> {container_name: image variable}. The FIRST entry is the

scripts/image-versions.sh

@@ -70,7 +70,6 @@ NETBIRD_DASHBOARD_IMAGE="docker.io/netbirdio/dashboard:v2.38.0"
 NETBIRD_SERVER_IMAGE="docker.io/netbirdio/netbird-server:0.71.2"
 NETBIRD_PROXY_IMAGE="docker.io/library/nginx:1.27-alpine"
 ALPINE_TOR_IMAGE="$ARCHY_REGISTRY/alpine-tor:0.4.8.13"
-ADGUARDHOME_IMAGE="$ARCHY_REGISTRY/adguardhome:v0.107.79"
 
 # Fedimint
 FEDIMINT_IMAGE="$ARCHY_REGISTRY/fedimintd:v0.10.1"