Releases 1

Sealed alerts (flow_core::alert, oxygenhub-android#16): what a phone is told about a job is encrypted to an X25519 key the phone made (a fresh key per alert, HKDF-SHA256, ChaCha20-Poly1305), so the push service carrying it sees only ciphertext. seal for the hub, open and new_secret/public_key for the phone, from crates already in the tree (curve25519-dalek, ring).

flow runner register --ca keeps the CA in the Flow home (issue #98): it wrote the path as given, so --ca hub-ca.pem left ca = "hub-ca.pem" in runner.toml and a service started elsewhere could not find it. Register now copies the file to the home's hub-ca.pem and records that copy's absolute path, and a relative ca already in runner.toml is read against the home.

The cheap checks run as WASM (issue #96): layout, todos, size and summary are one WASI module, crates/flow-checks, built by scripts/checks-wasm.sh and committed as .flow/checks.wasm, so they need no image or microVM and any runner with the WASM tier takes them (the phone, plex, windows-1); each runs in under 100 ms. The fmt job fails unless the committed module is what the source builds, and the build image has the wasm32-wasip1 target for that.