v0.1.44-beta.10

v0.1.44-beta.10

Fixed

• Sign and verify the final macOS executable after compilation, before creating
  release archives.

• Let updated CLI and desktop clients attach to a healthy shared backend while
  existing clients own its previous runtime, without starting another database
  writer or failing update readiness solely on the backend version.

• Require harness authorization before custom, plugin, and MCP tool hooks or
  execution, with runtime-only grants bound to the exact tool and canonical
  arguments.

• Ignore legacy persisted always grants after restart and prevent DWS from
  preapproving tools unless an explicit allow rule matches.

• Update ChatGPT OAuth's Codex compatibility header to 0.154.0 so GPT-6 Astra
  satisfies the current backend client-version requirement.

Tests

• Add regressions for custom-tool authorization metadata, canonical invocation
  identities, argument-isolated grants, restart isolation, and Astra headers.

Experimental prerelease from 5d80dbe. Concurrency remains opt-in.

Verify

Built from 5d80dbe242b9be8aa03c9e6fc9019c7ed2452504.

gh release download v0.1.44-beta.10 --repo MendCode/MendCode
shasum -a 256 -c SHA256SUMS
for file in mendcode-*.zip mendcode-*.tar.gz SHA256SUMS RELEASE-MANIFEST.txt release-index.json mendcode.spdx.json; do
  gh attestation verify --repo MendCode/MendCode "$file"
done