chore: prepare genmeta v0.8.0-beta.4

CHANGELOG.md

@@ -7,6 +7,81 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0-beta.4] - 2026-07-16
+
+### Added
+
+- `genmeta id` is a visible alias for `genmeta identity`.
+- `genmeta identity default -v` shows the default identity's full details.
+- Successful identity apply, replacement, and renewal append a post-commit
+  certificate audit record to the selected profile's `cert.log`; audit-write
+  failures do not roll back installed identity material.
+
+### Changed
+
+- `genmeta ssh` now discovers all online primary sequences, preserves server ranking, and connects through the first online sequence unless an explicit selector is supplied.
+- `genmeta identity apply [name]` is now the single create-or-update flow;
+  the former `identity create` command has been removed.
+- Existing identities, new root identities, and new direct sub-identities now
+  share the same `identity apply` lifecycle. Names entered by an interactive
+  prompt receive an early local and certserver availability check.
+- Bare `genmeta identity renew` targets the configured default identity, and
+  renew no longer accepts `--default`.
+- Identity authentication selects the first usable proof from the target,
+  direct parent, and email sequence. It skips expired, incomplete, and invalid
+  local certificates with an actionable warning, while transport and server
+  failures remain terminal instead of changing proof.
+- Verification-code recovery keeps attempt limits at the code prompt without
+  resending automatically, and treats blocked accounts as terminal.
+- `apply`, `renew`, and `default` now give `--force` command-specific meanings:
+  local replacement approval, recoverable renewal preflight, and non-ready
+  default selection respectively. Force never bypasses authentication,
+  certificate validation, payment confirmation, or a missing local target.
+- Removed legacy public identity flow switches, including `--auth`,
+  `--register-if-missing`, `--replace-local`, `--send-code`, and
+  `--allow-nonready`.
+- Compact identity output uses `(default)` and retains abnormal states. The
+  shared detail renderer reports usage, sequence, profile directory, validity,
+  reason, and warning fields; `default -v`, `info`, and `list -v` use the same
+  format.
+- Renewal preserves the original certificate-chain kind and sequence, performs
+  strict local preflight, installs validated material transactionally, and
+  prints a visible success result.
+
+### Fixed
+
+- Identity authentication now degrades only after unusable local material or
+  explicit authorization rejection; transport, parsing, quota, and unknown
+  failures remain terminal.
+- Generated private keys stay in memory until a validated certificate can be
+  installed, and local certificate/key replacement rolls back on commit
+  failure without deleting service files.
+
+### Fixed
+
+- Identity fallback errors compile cleanly with the release workflow nightly toolchain.
+
+### Dependencies
+
+- Release manifests now target `dhttp` v0.6.0-beta.4, including
+  `dhttp-access` v0.4.0-beta.2, `dhttp-home` v0.5.0-beta.1, and
+  `dhttp-log` v0.1.0-beta.1 through the facade; discovery and transport
+  dependencies target `dyns` v0.7.0-beta.2, `h3x` v0.6.0-beta.4,
+  `dquic` v0.7.0-beta.4, and `dshell` v0.6.0-beta.3.
+
+### Components
+
+- `genmeta` v0.8.0-beta.4
+- `genmeta-curl` v0.7.0-beta.4
+- `genmeta-ssh` v0.7.0-beta.4
+- `genmeta-access` v0.4.0-beta.3
+- `genmeta-identity` v0.4.0-beta.4
+- `genmeta-proxy` v0.4.0-beta.3
+- `genmeta-discover` v0.4.0-beta.3
+- `genmeta-doctor` v0.4.0-beta.3
+- `genmeta-nat` v0.5.0-beta.3
+- `genmeta-nslookup` v0.5.0-beta.3
+
 ## [0.8.0-beta.3] - 2026-07-09
 
 ### Added