Client versions - A new Client versions screen in Admin: root sets the minimum version of the OSH desktop app and the osh command line, with a deadline. Until the deadline older builds keep working and are told to update; after it they cannot get a certificate or enroll. Needs gateway 0.26.0 or newer. - Require the latest version: one tap sets both minimums to the newest release, enforced in 7, 14 or 30 days. Needs gateway 0.27.0 or newer. - Each machine now shows which osh build it runs, so you can see who is behind before you set a minimum. Needs gateway 0.25.0 or newer. Device keys - An approval request, and every screen that describes a machine, now says what holds its device key: a TPM, a Secure Enclave, or a file. Needs gateway 0.24.0 or newer. Fixes - The app no longer crashes on Connect when the gateway address has a stray space or a mistyped port. Before, it crashed again on every launch until it was deleted. - A phone promoted to admin now shows pending approvals right away, without reopening the app. - A rule stays on screen when its machine has a long name. On an older gateway the new screens say so; everything else works as before.

Notifications - One Notifications screen in Admin: how approvers' phones ring, and where your team hears about requests. - Team channels: add Slack, webhook or Telegram channels from the phone, test them, and sign each change with Face ID. - Tapping a link in a Slack or Telegram message opens the right screen in the app. Phone alerts (root) - Turn on phone alerts through Open Layer's push relay right from the app, without access to the server. - The status now says whether the gateway is waiting for approval, paused, or removed, and root can withdraw or stop and apply again under another name. Security - Every request the app sends to the gateway is signed with a key held on this device. Fixes - Fixed crashes when swiping list rows and when editing a notification channel.

Approvals - The Approvals tab now shows only what still needs your decision. - Approval history is behind the log button. Each entry opens the full request: who asked, which server and user, who approved each step, and why a request was refused. - Tapping a notification opens the right screen, including from the lock screen. - Notification details are encrypted so only your phone can read them. Admin - Access Rules lead with the server name, flag rules that any enrolled device can use, and are grouped by server group. - A rule can now name up to five devices. - The Devices and Servers lists keep their order instead of reshuffling while you look at them. - The Gateway screen shows which version your gateway runs and when an update is available. Fixes - The Admin tab no longer freezes when going back on iOS 27.

• Open network access from your phone. A super admin can now let a single IP address reach the gateway for a limited time — type the address, read exactly what the gateway will do, and approve with Face ID. The access expires on its own. • Your device's Approval tab shows who approved this device and when, instead of an empty screen. • Rules no longer offer signers that cannot approve, so a rule you create will not be rejected later. • An approval row now shows both the machine asking and the destination it wants to reach. Previously the machine name appeared twice and the destination was cut short. • The gateway address placeholder is no longer styled as if it were a real saved value.

• The approval screen now shows the whole approval chain — who has already signed, who is next, and how far a request has got. • Approve and Deny are offered only when the chain is waiting on your device. When it is not your turn, the screen says what you already decided and who it is waiting on. • Create and Edit Rule now state which role a rule grants when a server offers only one, instead of a control that looked unpressed. • Editing a rule onto a server that does not offer its role no longer leaves the role unset. • You can paste an enrollment link when scanning the QR code is not possible. • Server records no longer carry an unused IP field.

• Scan a web-admin login QR right inside the app — no need to switch to the Camera app. • The Signers list now updates in real time, shows each device's specific model, and lets you remove expired registrations. • New admin approval history to review promote and revoke actions. • Clearer messages when an access request is denied. • Support for SSH servers on custom ports. • Stability and interface improvements.

• New app icon. • Approvals now appear in real time — no need to reopen the app. • Pending requests show a live countdown instead of a frozen timestamp. • Role changes take effect immediately after a promotion — no relaunch. • Admins can remove pending devices, and the Admin badge no longer sticks. • Clearer step-by-step guidance on the approval waiting screen. • Fixed entering "." in the IP Address field.