0.13.3 — 2026-10-10 App logos now live beside each manifest, and passkeys carry a clearer name. - App logos are served from `<stem>.svg` files beside each `<stem>.yaml` manifest. The image ships no app logos. - Passkey and security-key names read "<instance name> Single Sign-On". The relying-party id is unchanged, so existing passkeys keep working; saved items keep their old label until renamed. - The web app manifest's name follows `OTHALA_INSTANCE_NAME`. - The consent screen shows the monogram only. - Documentation is shorter across the README, architecture, decisions, security and guides. - The `icon_slug` and `icon_fallback` manifest fields are retired: ignored at serve time and rejected by manifest-lint. The bundled icon set is removed. - A logo is served only to a signed-in member who can see that tile, sandboxed (`Content-Security-Policy: sandbox`, `nosniff`, private cache). Every other request gets the same 404. - The cookie-rotation runbook now states the shipped single-slot behavior: rotation signs every member out. The secret-rotation and backup runbooks now say `secrets.system` encrypts Hydra's signing keys and session data, while client secrets are hashed. - Put `<stem>.svg` beside each `<stem>.yaml` in the manifest directory (stem = the manifest filename, the same key as `<stem>.md`). At most 32 KiB, with an `<svg>` root. - Remove `icon_slug` and `icon_fallback` from your manifests. - Copy `*.svg` alongside `*.yaml` and `*.md` into the mounted manifest directory, and do not prune them. - Re-vendor `kratos/kratos.yml`. - No environment changes.