[samgbafa]

🤖 New release

• tinycloud-node: 0.0.1 -> 1.20.7

Changelog

1.20.7 - 2026-10-18

Added

• (TC-1274) maintain epoch_head so writes stop scanning epoch history (#343)
• (TC-887) TCE1 segmented AES-256-GCM envelope (#322)

Fixed

• (TC-1277) saturate SpaceSizes decrement instead of wrapping (#345)
• (TC-1354) size S3 block deletes with HeadObject (#337)
• Require revoke action for revocation requests (#314)
• tighten revocation scope checks (#311)

Other

• cap /invoke upload bodies at 95 MiB with 413 (#317)

• disable epoch_head backfill in the production compose (#349)

• (TC-887) base32 runs end at their own alphabet; name 3+ salt pieces as out of scope (#344)

• (TC-887) harness follow-ups 3: secrets in blocks, blocks tied to their DEK, ARK sanity cap (#340)

• (TC-887) harness follow-ups: derived keys in mirrors, escrow-none, bounded generations, required mirrors (#338)

• prewarm PostgreSQL round-trip budget fixture (#339)

• (TC-887) keep the at-rest key mirror out of KV pairing; check it for raw keys (#335)

• (TC-887) at-rest interfaces in the repo, one generation ceiling, harness follow-ups (#331)

• Add request correlation and per-request database telemetry (#305)

• (TC-887) native at-rest harness with RED plaintext-at-rest checks (#324)

• Normalize delegation identifiers (#291)

• Harden DuckDB statement and settings policy (#312)

• Test a personal-node installation guide (#308)

• hash report data before GetQuote (#295)

• Recheck hook ticket delegation revocation when event streams open and use
  literal segment-prefix matching for hook subscriptions.

---

This PR was generated with release-plz.

[samgbafa]

Superseded by #351 (chore(release): 1.21.0); release-plz cannot compute bumps here (TC-342), versions are manual.