For the current release, see PSF Guard 0.9. This post covers the earlier 0.7 series.

0.6 changed what PSF Guard is — it stopped needing a N.I.N.A. Target Scheduler database and learned to build its own catalog. 0.7 is about what happens after grading: the stacks, and how long you wait for them.

One thing to read first, though.

A server on the network now needs a login

If you run PSF Guard in server mode on anything other than loopback, it now answers 401 to every API request until you add a user, and refuses to start if you also configure it to manage databases.

That is a change in behaviour, and it closes a hole rather than adding a feature. Before, a server with no accounts treated every caller as a full editor — and the default bind is 0.0.0.0. Anyone who could reach the port could grade, edit, or delete. There is a browser login page and role management now, documented under server authentication.

Remote sync and image upload are unaffected: they already authenticate with bearer keys. If the machine really is on a network you trust, --allow-anonymous-access restores the old behaviour and logs the access it grants.

Stacking became a queue

Build buttons used to lock while a build ran. Now each click queues a channel behind the one working, every card shows whether it is queued or running, and the status line counts the queue. The colour panel no longer sits frozen while mono channels build.

Queued or running work has a Stop button, which becomes Stop all once a queue forms. PSF Guard stops between frames, between channels, and between calibration masters, so it never publishes partial results, and channels that already finished keep their previews.

The better part is what happens when you build again. A rebuild that only added frames resumes from where the last one finished instead of integrating the whole night a second time, and the card counts the work it restored. PSF Guard reuses a checkpoint only when the previous source fingerprints, calibration, policy and pipeline still match. Otherwise, the card shows what changed before starting over.

A Stacking indicator sits in the header for as long as anything is queued or running, in every view and across databases, and stack panels re-attach to a running job when they mount. Leaving the grid or reloading the page no longer hides work in flight.

While that was going in, a quieter bug turned up: every rebuild wrote a new artifact directory but left the old ones behind. PSF Guard now removes those old artifacts from the cache.

Previews that agree with the sky

A stack preview keeps the rotation of its reference frame. PSF Guard rotates it half a turn when that frame faces the wrong way across a meridian flip.

Working out which way is right takes three fallbacks: the reference frame’s cached solve or embedded WCS first, then its PIERSIDE header read through what a solved channel in the same build has already taught, then the stack’s own exposure. The point is that every channel of a target agrees with every other, rather than each following its own frames and arriving somewhere slightly different. A mosaic still wants the shared north-up, east-left grid, which an API caller can ask for with north_up: true.

Dropping the required plate solve made a three-frame build roughly twenty times faster.

PSF Guard now crops colour composites before normalizing them, so it scales every channel from the same patch of sky. The result keeps the reference plate solution. Each colour card also gained an Edges picker: keep the blank edges registration leaves, trim to the box the covered pixels span, or trim to the largest rectangle every channel covers in full. The default is unchanged, and a finished card reports the size it kept — identifying the channel that bounded the crop when one of them did.

Stack previews also get automatic gradient correction.

Which frames made that mark

Select a region of a stack and PSF Guard will show you the frames that contributed it, with the shape classified and localized quality findings highlighted. It answers the question you actually have when something ugly survives into an integration: not is this bad, but which subs did this.

Grading got more careful elsewhere too. A satellite trail warning now needs pixel evidence rather than merely a predicted pass. Background grading uses the solved nebulosity of a field. And Sequence quality scores renormalize when evidence is missing, so a session is not punished for a scan that has not run yet, and scores stay comparable across sessions and projects.

Signed Windows builds

0.7.1 is a packaging release. The Windows installer, the MSI, the standalone CLI, and the executables inside the installer are now Authenticode signed as StackFoundry LLC through Azure Artifact Signing. Until now they shipped unsigned, so Windows called it an unknown publisher and Defender ran each download in a sandbox to inspect it.

The interesting part is where the signature has to happen. Signing the executable beforehand does not survive: the bundler rewrites the main binary while packaging it, leaving a signature whose digest no longer matches — an installer that verified perfectly containing a program that did not. Signing runs through Tauri’s signCommand instead, as each artifact is packaged.

SmartScreen may still warn on a first download. Reputation is scored per file hash and starts at zero for every build, so signing buys a publisher identity rather than an instant clean pass.

The release also included two features despite its signing-only notes: named processing setups you can save, apply, import and export, and XISF frames read anywhere PSF Guard reads FITS.

Getting it

PSF Guard 0.7.1 is on GitHub releases: Windows setup or MSI, macOS DMG, Linux deb, AppImage or RPM, a stand-alone CLI for each platform, and a Docker image for server mode. Docs and screening deep dives are at psf-guard.com.

Under it all, this build moves onto the published Seiza 0.15 crates for plate solving and star catalogs.