v0.21.0

0.21.0 — Native desktop interfaces, unified activation and Linux ARM64

Signing and hardware validation — important

• Windows: the actual published mcw.exe, mcw-tray.exe and MSI were inspected with Windows Authenticode and are unsigned (NotSigned), with no signer certificate or timestamp. Checksums and provenance do not establish SmartScreen/Defender clearance.
• macOS: DMG applications are ad-hoc sealed, not Developer ID signed and not notarized; the standalone CLI executables in the tar archives have no Mach-O code-signature command. Successful seal verification does not guarantee Gatekeeper acceptance; do not disable OS protections to install.
• Linux ARM64: native hosted build/tests passed, but physical Raspberry Pi/SBC, peripheral and capture-control compatibility has not been validated. These GNU packages retain glibc 2.35+/PipeWire prerequisites; ARMv7, musl and non-USB/CSI camera enforcement are not claimed.

Changes

• Adds redesigned native Win32, GTK3 and AppKit consultation interfaces with Overview, Settings, Diagnostics and localized About information. Current observations, collector health and requested versus effective protection remain distinct; partial/unknown coverage is never an all-clear.
• Unifies mcw tray open, desktop/Finder/Start Menu activation and retained-window behavior: explicit launch reuses the authenticated owner/window for the same installation and data namespace; closing hides the consultation without stopping monitoring, while background/autostart launches stay hidden. Windows retains its CLI and console-free companion as two executables for one application, not two independent desktop applications.
• Adds persistent native profile, notification, sound and local-history preferences, notification pause and explicit autostart controls without granting permissions or enabling protection merely by opening a window. Explicit --config remains authoritative. Refresh preserves native reading/navigation state; full selectable/copyable diagnostics remain separate from compact headlines.
• Fixes preference-refresh ordering and notification/history gating: sound requires enabled, unpaused notifications, enabled sound and a confirmed Active capture start, not Ready/Update/Stop. Linux camera preflight checks the fixed helper/pkexec prerequisites without treating inventory as authorization. Native API acceptance is not guaranteed notification visibility or audible sound.
• Strengthens owned activation and maintenance: Unix sockets are privately prepared before exclusive atomic publication, macOS open delivery no longer waits behind collector polling, and managed Linux launcher/icon receipts retain quoting, rollback, foreign-file refusal and exact MicCamWatch window identity. Windows MSI-owned installations refuse binary self-update before network/staging/frontend stop and direct users to Windows Installer; this is not an automated MSI upgrade. Existing authentication, privilege and restoration boundaries remain enforced.
• Adds miccamwatch-linux-aarch64.tar.gz for native aarch64-unknown-linux-gnu alongside x86_64. Both Linux packages retain the Ubuntu 22.04 / glibc 2.35 and PipeWire/SPA 0.3.48 baseline. User/root helper installers validate both executables' ELF class, byte order, ABI, executable type and machine before probing; checksums, permissions, ownership receipts and restoration safeguards remain enforced. ARMv7/32-bit and musl are unsupported.
• Native hosted ARM qualification records actual host/toolchain/header versions, generated bindings and both ELF identities and exercises native SPA, CLI/PTY, PipeWire, desktop and privilege-boundary scenarios. It is not physical Raspberry Pi/SBC, peripheral, camera-enforcement or capture-transition certification. No historical pre-0.21 public ARM migration or 0.16.1 resource baseline exists; missing comparisons stay unqualified. No global 15 MB resource-budget success is asserted.
• Reorganizes installation, usage/safety, validation, release-history and architecture documentation while retaining historical evidence and screenshot provenance. Read docs/RELEASE_0.21.0.md for the prepared release checklist and docs/VALIDATION.md for source-specific native proofs, simulated GUI observation fixtures and open manual/hardware limits. Earlier platform runs alone are not qualification of a new integrated revision.
• Platform scope remains Windows 10/11 x64, desktop GNU/Linux x64/ARM64 with glibc 2.35+ (GTK3/graphical session for consultation), and macOS 15+ Apple Silicon/Intel. Windows standard-user portable/MSI/Cargo qualification passed in the recorded disposable interactive guest; MSI upgrade/repair, Windows 10/DPI/accessibility, real Wayland and physical ARM/device/OS-authorization validation require separate evidence. macOS camera client/PID remains unknown; SDK mute is not capture-permission denial. Release/restore owned protection explicitly before external replacement/removal.
• The complete approved-Windows set is ten uploaded assets: two Windows packages, two Linux archives, four macOS archives/DMGs, SPDX SBOM and SHA256SUMS. Nine payload/SBOM files are checksummed and provenance-attested; the manifest is not itself attested. Tags-only publication and the approved-Windows stable/latest gate are unchanged; without Windows approval the existing path is Unix-only prerelease, not the complete stable set. Windows signing depends on the configured certificate and otherwise remains unsigned; macOS apps are ad-hoc sealed, not Developer ID signed/notarized. Checksums/provenance are not antivirus, SmartScreen/Gatekeeper clearance or OS authorization. Prior tags/assets remain immutable; public ARM installer proof is opt-in only after an archive is actually published.

Publication provenance and recovery

• Immutable tag v0.21.0 targets 3d74686ace7b04728794765f9eb57c0c0a8bc84c. The five platform jobs and assembly in Release run40331094727 succeeded; that run remains truthfully failed because the publisher received three HTTP500 responses. The complete bundle was reused through the official GitHub Releases REST API, without moving the tag or rebuilding any platform.
• Nine payload/SBOM SHA-256 entries and nine SLSA provenance subjects were independently verified with the tag/source/workflow certificate identity and hosted-runner policy. SHA256SUMS is the tenth upload and is not itself attested. Checksums and provenance are not antivirus approval, publisher signing or OS permission.
• Full comparison: v0.20.0...v0.21.0

v0.20.0

0.20.0 — Native consultation, scoped uninstall and desktop branding

• macOS gains a native consultation window, clearer microphone/camera diagnostics, a simplified menu and localized About. Finder reopening reuses the existing owner and consultation window; closing the window leaves the tray running.
• The macOS menu-bar mark is larger without changing the Finder/About brand. Status badges remain distinct. Windows CLI/tray resources, Start shortcut and installed application metadata use the official logo.
• mcw uninstall identifies the actual installation. Managed Unix and verified portable Windows removal retain preferences/history/restoration records; Cargo, Homebrew, Arch and MSI installations receive their real manager procedure. Standalone apps and unowned layouts receive explicit manual guidance, not a false removal success.
• Portable Windows removal is deferred until the invoking process exits. An accepted request is not completed removal: the retained result file records completion or refusal. Requested protection, foreign/busy ownership, corrupt or pending restoration and unowned payloads refuse safely; nothing implicitly unmutes microphones, allows cameras or terminates another owner.
• Homebrew users with owned autostart intent must retain the old keg during upgrade, run mcw autostart refresh explicitly as the ordinary user, and only then clean up. Homebrew's isolated install hooks cannot perform this migration; refresh preserves loaded, dormant and disabled intent and never enables an absent registration.
• macOS autostart accepts native disabled/enabled and legacy boolean launchctl responses, preserving disabled intent without interpreting an unknown owned state as enabled.
• Unix accepted tray streams explicitly enter blocking mode. This fixes BSD inheritance of listener O_NONBLOCK causing premature command disconnects; existing timeout budgets and cooperative ownership checks remain unchanged.
• TLS dependencies include the targeted fixes rustls-webpki 0.103.16 and webpki-roots/webpki-root-certs 1.0.10 for RUSTSEC-2026-0382/0381/0383, without advisory ignores.
• Windows EXE/MSI artifacts remain unsigned without a configured real signing certificate; macOS apps are ad-hoc sealed, not Developer ID signed/notarized. Native UI and ownership checks do not establish physical capture enforcement or grant OS authorization.
• Tags-only publication, the approved-Windows stable/latest gate, exact package/version/source checks, SHA256SUMS, signed build provenance and SBOM are unchanged. Prior tags and assets are not rewritten.

Full Changelog: v0.19.1...v0.20.0

v0.19.1

0.19.1 — Windows CLI-hosted tray update correction

• Windows updates now recognize both supported tray hosts from the exact installation: mcw-tray.exe and mcw.exe tray. The retained owner is stopped cooperatively before either image changes, not left running from the backup after CLI replacement.
• Restart preserves the original raw UTF-16 arguments, working directory and full Unicode environment, including relative --config and language overrides. The executable path is explicit, handles are not inherited, and a different canonical APPDATA/LOCALAPPDATA namespace or unreadable launch context refuses before shutdown.
• Ownership reservations, protected/requested controls, pending/unknown restoration, foreign owners and UAC operations remain safety refusals. There is no implicit unmute, camera Allow, forced termination or adoption of quarantined/renamed executables. Rollback keeps the same ownership and launch-context requirements.
• Earlier invoking clients retain their own updater code. If an older CLI-hosted frontend was already renamed into a retained backup by a previous update, explicitly exit that old frontend once and start the matching installed frontend; never execute or restore the backup. The new matcher does not grant ownership from a backup filename.
• Linux and macOS runtime behavior is unchanged in this coordinated patch. Windows EXE/MSI artifacts remain unsigned without a configured real signing certificate; macOS apps are ad-hoc sealed, not Developer ID signed/notarized. Physical enforcement and Explorer popup automation remain unqualified.
• Tags-only publication, the approved-Windows stable/latest gate, exact package/version/source checks, SHA256SUMS, signed build provenance and SBOM are unchanged. Prior tags and assets are not rewritten.

Full Changelog: v0.19.0...v0.19.1

Known macOS Intel qualification incident

The first native release attempt reached a ready, live macOS Intel tray but its isolated mcw tray stop returned Invalid argument (os error 22). The failed log and resource report are retained in release run 39397946877, attempt 1, and tracked as P1-MAC-TRAY-STOP in ROADMAP. Only failed jobs were rerun on the same immutable tag/source with unchanged criteria; attempt 2 completed successfully. The cause remains open; this retry does not prove the incident fixed. Windows EXE/MSI files are NotSigned.

v0.19.0

0.19.0 — Direct tray profiles and Windows lifecycle fixes

• Windows and Linux now join macOS with four direct, checked tray profiles: Balanced, Private, Meeting and Development. Selection persists across restart; explicit --config remains authoritative and disables profile changes. The Windows parent caption shows the selected localized profile or the config override. Profile selection never grants capture permission or implicitly releases protection.
• Windows uses the first known session state as a passive startup baseline, not a new lock event. Stored requested protections and pending restoration are not reset. A requested camera Block whose guard is unavailable offers Restart camera protection (UAC)… without an intermediary Allow; restart revalidates current intent and preserves restoration ownership.
• Native Windows IPC waits at most three seconds for connection admission to a busy pipe. Peer authentication is unchanged; command bytes are sent once, and no possibly applied command is replayed. Microphone broker retirement now coordinates preparing/queued requests with a fresh reconciliation before shutdown, without increasing request deadlines.
• Windows tray restart uses CreateProcessW with handle inheritance disabled, fixing captured-stream EOF for the 0.19.0 invoking updater. Already-running legacy clients retain their own EOF defect even after replacing their files; this is not a retrospective fix for old published updaters.
• Healthy active trays with inactive protection passed native replacement and mixed-pair repair without manual Exit. Real active/requested protection, automatic ownership, foreign owners and pending/unknown restoration still refuse before tray stop or file replacement. There is no implicit unmute, camera Allow or guard takeover. Before changing protected binaries, explicitly release through the matching version and complete owned restoration; killing the guard or closing its frontend is not a workaround. External MSI/manual replacement retains the same precautions.
• Microphone failures retain the original IPC error. An occupied lease alone proves neither a different namespace nor missing administrator rights; an incompatible guard version is also possible. Version, source and ownership checks remain enforced.
• The tray begins with a neutral identity and exposes its current bounded headline, with complete diagnostics in Status details. Native product qualification passed functional scenarios on all four platforms; Windows still failed the strict Explorer popup observation. Windows UIA/Explorer popup automation remains unqualified despite positive Windows user feedback. Pre-publication packaging passed Windows, Linux and both macOS architectures; those runs did not publish 0.19.0 or qualify its public acquisition path.
• Publication is tags-only. WINDOWS_RELEASE_APPROVED=true and a successful Windows build remain required for coordinated stable/latest publication; without approval this is an explicitly selected Unix prerelease, not a stable/latest replacement. The Unix installer follows stable without --version; use --version v0.19.0 to pin this release.
• Windows EXE/MSI artifacts are unsigned unless a real configured certificate signs and verifies them; the qualified pre-publication artifacts are unsigned. macOS apps are ad-hoc sealed, not Developer ID signed or notarized. No antivirus clearance, Gatekeeper/quarantine bypass or physical microphone/camera enforcement certification is claimed. SHA256SUMS, build provenance and the SBOM remain provided; source/version/attestation checks and earlier immutable tags/assets are unchanged.

Full Changelog: v0.18.1...v0.19.0

v0.18.1

ZIP dependency security maintenance and native macOS app

• Windows updater dependencies now use self_update 1.3.1 and ZIP 9, removing versions affected by RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369 (issued 2026-10-17). No advisory is ignored. The upstream full/stream extraction issues concern Unix permissions/symlinks; MCW selects two named Windows executables, so no MCW exploit is demonstrated. Privacy behavior and permissions are unchanged; earlier tags/assets remain immutable.
• Windows ZIP/MSI publication requires the explicit repository gate WINDOWS_RELEASE_APPROVED=true and a successful Windows build. This gate is independent of signing: a configured certificate signs and verifies both EXEs and MSI; absent a certificate they are unsigned. Neither signing, tests nor provenance is antivirus clearance. Quarantined executables are not restored or automatically reinstalled.
• With approved Windows artifacts, this coordinated release is stable/latest for Windows, Linux and both macOS architectures. Otherwise it remains an explicitly selected Unix prerelease and does not replace stable latest. Use the public Unix installer without --version to follow stable, or --version v0.18.1 to pin this release.
• Partial Windows camera/client attribution no longer hides known microphone/camera activity behind a generic grey error cross. An amber exclamation distinguishes incomplete coverage from camera-ready pause and real collection/control failures. Complete details retain Active/Ready accesses, known or unknown PID identities, collector reasons, observation gaps and protection/notification errors; a healthy refresh recovers without clearing unrelated manual failures.
• Sensor client PID/report-time API errors and raw metadata explain attribution failures. A successful zero/missing report timestamp remains unavailable, not a fabricated current time; process-instance and report-freshness checks remain enforced, and raw PID evidence is never kill authorization. Native SDK/Zoom qualification confirmed a valid client PID but zero report time; this release does not invent the camera client or promise physical enforcement.
• Windows tray menus show a compact single-line status, not concatenated protection diagnostics; full details remain available separately. Camera protection with a stopped approved owner remains a visible warning, never a fake healthy state.
• Completed privacy operations clear only their own applicable error state. A successful microphone operation does not erase a camera failure, and automatic policy cannot acknowledge a failed explicit request. Successful native notification API calls clear current unavailability while retaining failure history; API acceptance does not prove a visible notification.
• macOS owned autostart refresh preserves dormant/disabled intent instead of implicitly activating it. Physical Homebrew Cellar targets are validated and refreshed before old-keg cleanup; absent or externally modified registrations are not adopted or enabled. Package recipes and external acceptance are qualified separately.
• The Unix installer prints platform, destination, download/checksum/install progress and the exact next command, with optional terminal colors and plain redirected output. The short HTTPS curl pipeline uses the same reviewed installer; PATH remains consent-based and no tray, autostart or privacy control is enabled implicitly. Windows retains native MSI/ZIP installation.
• Native SPA bindings follow complete C declarations with bindgen 0.72.1, fixing opaque pod builders generated by Clang 22+ without inventing a C ABI. A real C/Rust nested POD and buffer-growth roundtrip qualifies legacy Ubuntu and current Arch headers separately.
• Windows manual microphone protection now has a separate native background owner until explicit mcw unmute/deactivation; closing top/tray does not release it and does not install login autostart. Requested protection, effective SDK endpoint mute and observed capture are distinct. Native callbacks reinforce external endpoint-unmute changes, but software mute is not capture permission: exclusive/ASIO, hardware and unsupported paths remain explicit limits.
• Windows camera intent is global Allow/Block, independent of camera count. A temporary elevated Block helper covers new arrivals until Allow, without an installed service. Restoration changes only MCW-owned camera disables; absent cameras are not an expected inventory or an invented unplugged error. Protected receipts, native identity/generation checks and explicit target-bound UAC legacy recovery preserve external administrator state. A brief PnP-arrival window and partial/restart/unknown outcomes remain visible.
• Windows portable replacement now reserves native protection ownership and refuses active/requested, automatic or pending/unknown restoration before stopping the tray or swapping files. It never releases protection implicitly; external MSI/manual replacements still require explicit release and completed restoration. Background microphone startup inherits no caller handles, preventing completed CLI commands from retaining output pipes.
• Linux PipeWire decoding, child output/time, retained graph data, UI delivery and caches are bounded; limit/outage errors remain unavailable with observation gaps rather than fabricated STOP. Resource reports compare the checksum-verified previous release and the candidate, count the product tree including helpers/shared RSS and disclose sampling gaps. The 15 MB soft target is not claimed as achieved; approximately 30 MB is a reference, not a hard cutoff.
• Resource qualification gates every candidate profile explicitly. Immutable-reference functional failures remain failed rows and CI warnings; a successful candidate gate alone is not a qualified baseline comparison. Composed Windows proof measures both real guards with top/tray, verifies protection survives frontend exit, and reports the total rather than adding separate-profile medians. Latest pre-publication proof is linked in Architecture; the complete protection-plus-interface scenario exceeds the 15 MB target and 30 MB reference.
• All six mcw top controls stay in one horizontal row with compact narrow-terminal representations on Windows, Linux and macOS. Native keyboard, resize and hitbox behavior is exercised. Linux/macOS microphone controls retain their scoped one-shot behavior; Windows persistent protection is not silently promised on Unix.
• Unix tray stop retires shared native readiness only after the main loop accepts shutdown, preventing a control-thread race from presenting a valid AppKit stop as a disconnection. Real Linux/macOS stop controls, process exits and cleanup are exercised; genuine helper/transport failures remain errors.
• Unix observation warnings preserve known accesses and name the actual collector/scope cause without presenting an unknown camera-profile read as a failed action. macOS camera inspect is passive by default; --admin explicitly offers a read-only, fixed and bounded global profile query without elevating MCW, granting TCC or adopting profile ownership. Cancellation/denial remains unknown. CoreMediaIO client/frame-flow and public lock limitations are not missing-admin-rights claims.
• macOS profiles are four direct checked choices, with explicit --config taking priority. Details precedes Exit; menu/Finder artwork shares the authorized MCW mark. Desktop IPC v2 requires the frontend and embedded helper from the same build; no v1 compatibility path remains.
• Older macOS archives retain their embedded updater. Quit their tray/watcher and follow the reviewed standalone bootstrap migration in README when needed; the installer verifies the caller-supplied old SHA-256 and selected release checksum, preserves permissions/quarantine, refuses running/changed/unsafe targets and leaves PATH/preferences/history untouched. Managed bin layouts still require receipts; Linux standalone archives are unchanged.
• macOS DMGs include MicCamWatch.app and an Applications link for Apple Silicon and Intel, macOS 15+. The native exec-only app launcher opens the existing tray without Terminal, implicit autostart or privacy control. Native vector icons reuse the authorized site mark. The existing three-file CLI tar.gz archives remain available. Binary-only mcw update refuses inside any .app before download or replacement: quit and replace the whole app from the matching DMG.
• macOS apps are ad-hoc sealed for bundle integrity only, not Apple Developer ID signed or notarized. No Gatekeeper/quarantine bypass is included. Native DMG smoke records mount/copy/version/icon/seal/update-refusal checks and, when a logged-in Aqua desktop and preexisting Accessibility are available, real .app open/menu readiness/duplicate-owner/native Exit. Missing GUI authorization is recorded as unavailable, never a successful lifecycle or physical capture test.
• Linux x64: PipeWire graph capture with authenticated client PID and /proc identity, conservative V4L2 readiness, session-only PipeWire source mute, real StatusNotifier tray, native desktop notifications/sound/journal delivery, managed desktop autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Optional USB uvcvideo camera controls require a separately reviewed root-helper installation and explicit Polkit authorization. Supported cameras have one complete USB configuration and stable video interface roles; ambiguous/partial bindings, non-USB cameras and automatic camera-on-lock are refused. Status/startup never elevate. Restore and explicitly remove the root helper before a user upgrade/removal; install the new matching root helper separately afterward.
• macOS 15+ Apple Silicon and Intel: CoreAudio input activity, writable INPUT mute only, native AppKit menu bar, notifications/sound/unified log, managed LaunchAgent autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Camera blocking is a ...

v0.18.0

Native macOS app, scoped diagnostics and direct profiles

• Windows ZIP/MSI publication requires the explicit repository gate WINDOWS_RELEASE_APPROVED=true and a successful Windows build. This gate is independent of signing: a configured certificate signs and verifies both EXEs and MSI; absent a certificate they are unsigned. Neither signing, tests nor provenance is antivirus clearance. Quarantined executables are not restored or automatically reinstalled.
• With approved Windows artifacts, this coordinated release is stable/latest for Windows, Linux and both macOS architectures. Otherwise it remains an explicitly selected Unix prerelease and does not replace stable latest. Use the public Unix installer without --version to follow stable, or --version v0.18.0 to pin this release.
• Partial Windows camera/client attribution no longer hides known microphone/camera activity behind a generic grey error cross. An amber exclamation distinguishes incomplete coverage from camera-ready pause and real collection/control failures. Complete details retain Active/Ready accesses, known or unknown PID identities, collector reasons, observation gaps and protection/notification errors; a healthy refresh recovers without clearing unrelated manual failures.
• Sensor client PID/report-time API errors and raw metadata explain attribution failures. A successful zero/missing report timestamp remains unavailable, not a fabricated current time; process-instance and report-freshness checks remain enforced, and raw PID evidence is never kill authorization. Native SDK/Zoom qualification confirmed a valid client PID but zero report time; this release does not invent the camera client or promise physical enforcement.
• Windows tray menus show a compact single-line status, not concatenated protection diagnostics; full details remain available separately. Camera protection with a stopped approved owner remains a visible warning, never a fake healthy state.
• Completed privacy operations clear only their own applicable error state. A successful microphone operation does not erase a camera failure, and automatic policy cannot acknowledge a failed explicit request. Successful native notification API calls clear current unavailability while retaining failure history; API acceptance does not prove a visible notification.
• macOS owned autostart refresh preserves dormant/disabled intent instead of implicitly activating it. Physical Homebrew Cellar targets are validated and refreshed before old-keg cleanup; absent or externally modified registrations are not adopted or enabled. Package recipes and external acceptance are qualified separately.
• The Unix installer prints platform, destination, download/checksum/install progress and the exact next command, with optional terminal colors and plain redirected output. The short HTTPS curl pipeline uses the same reviewed installer; PATH remains consent-based and no tray, autostart or privacy control is enabled implicitly. Windows retains native MSI/ZIP installation.
• Native SPA bindings follow complete C declarations with bindgen 0.72.1, fixing opaque pod builders generated by Clang 22+ without inventing a C ABI. A real C/Rust nested POD and buffer-growth roundtrip qualifies legacy Ubuntu and current Arch headers separately.
• Windows manual microphone protection now has a separate native background owner until explicit mcw unmute/deactivation; closing top/tray does not release it and does not install login autostart. Requested protection, effective SDK endpoint mute and observed capture are distinct. Native callbacks reinforce external endpoint-unmute changes, but software mute is not capture permission: exclusive/ASIO, hardware and unsupported paths remain explicit limits.
• Windows camera intent is global Allow/Block, independent of camera count. A temporary elevated Block helper covers new arrivals until Allow, without an installed service. Restoration changes only MCW-owned camera disables; absent cameras are not an expected inventory or an invented unplugged error. Protected receipts, native identity/generation checks and explicit target-bound UAC legacy recovery preserve external administrator state. A brief PnP-arrival window and partial/restart/unknown outcomes remain visible.
• Windows portable replacement now reserves native protection ownership and refuses active/requested, automatic or pending/unknown restoration before stopping the tray or swapping files. It never releases protection implicitly; external MSI/manual replacements still require explicit release and completed restoration. Background microphone startup inherits no caller handles, preventing completed CLI commands from retaining output pipes.
• Linux PipeWire decoding, child output/time, retained graph data, UI delivery and caches are bounded; limit/outage errors remain unavailable with observation gaps rather than fabricated STOP. Resource reports compare the checksum-verified previous release and the candidate, count the product tree including helpers/shared RSS and disclose sampling gaps. The 15 MB soft target is not claimed as achieved; approximately 30 MB is a reference, not a hard cutoff.
• Resource qualification gates every candidate profile explicitly. Immutable-reference functional failures remain failed rows and CI warnings; a successful candidate gate alone is not a qualified baseline comparison. Composed Windows proof measures both real guards with top/tray, verifies protection survives frontend exit, and reports the total rather than adding separate-profile medians. Latest pre-publication proof is linked in Architecture; the complete protection-plus-interface scenario exceeds the 15 MB target and 30 MB reference.
• All six mcw top controls stay in one horizontal row with compact narrow-terminal representations on Windows, Linux and macOS. Native keyboard, resize and hitbox behavior is exercised. Linux/macOS microphone controls retain their scoped one-shot behavior; Windows persistent protection is not silently promised on Unix.
• Unix tray stop retires shared native readiness only after the main loop accepts shutdown, preventing a control-thread race from presenting a valid AppKit stop as a disconnection. Real Linux/macOS stop controls, process exits and cleanup are exercised; genuine helper/transport failures remain errors.
• Unix observation warnings preserve known accesses and name the actual collector/scope cause without presenting an unknown camera-profile read as a failed action. macOS camera inspect is passive by default; --admin explicitly offers a read-only, fixed and bounded global profile query without elevating MCW, granting TCC or adopting profile ownership. Cancellation/denial remains unknown. CoreMediaIO client/frame-flow and public lock limitations are not missing-admin-rights claims.
• macOS profiles are four direct checked choices, with explicit --config taking priority. Details precedes Exit; menu/Finder artwork shares the authorized MCW mark. Desktop IPC v2 requires the frontend and embedded helper from the same build; no v1 compatibility path remains.
• Older macOS archives retain their embedded updater. Quit their tray/watcher and follow the reviewed standalone bootstrap migration in README when needed; the installer verifies the caller-supplied old SHA-256 and selected release checksum, preserves permissions/quarantine, refuses running/changed/unsafe targets and leaves PATH/preferences/history untouched. Managed bin layouts still require receipts; Linux standalone archives are unchanged.
• macOS DMGs include MicCamWatch.app and an Applications link for Apple Silicon and Intel, macOS 15+. The native exec-only app launcher opens the existing tray without Terminal, implicit autostart or privacy control. Native vector icons reuse the authorized site mark. The existing three-file CLI tar.gz archives remain available. Binary-only mcw update refuses inside any .app before download or replacement: quit and replace the whole app from the matching DMG.
• macOS apps are ad-hoc sealed for bundle integrity only, not Apple Developer ID signed or notarized. No Gatekeeper/quarantine bypass is included. Native DMG smoke records mount/copy/version/icon/seal/update-refusal checks and, when a logged-in Aqua desktop and preexisting Accessibility are available, real .app open/menu readiness/duplicate-owner/native Exit. Missing GUI authorization is recorded as unavailable, never a successful lifecycle or physical capture test.
• Linux x64: PipeWire graph capture with authenticated client PID and /proc identity, conservative V4L2 readiness, session-only PipeWire source mute, real StatusNotifier tray, native desktop notifications/sound/journal delivery, managed desktop autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Optional USB uvcvideo camera controls require a separately reviewed root-helper installation and explicit Polkit authorization. Supported cameras have one complete USB configuration and stable video interface roles; ambiguous/partial bindings, non-USB cameras and automatic camera-on-lock are refused. Status/startup never elevate. Restore and explicitly remove the root helper before a user upgrade/removal; install the new matching root helper separately afterward.
• macOS 15+ Apple Silicon and Intel: CoreAudio input activity, writable INPUT mute only, native AppKit menu bar, notifications/sound/unified log, managed LaunchAgent autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Camera blocking is a manually reviewed/approved Restrictions profile, not a silent camera or TCC switch. Public screen-lock state remains Unknown; no automatic macOS lock enforcement is claimed.
• macOS camera discovery remains passive AVFoundation inventory; activity uses public CoreMediaIO device running-state. Client PID stays null, application is unknown, enforcement is Unknown and coverage is degraded: running-state is not proof of frame flow or app attrib...

v0.17.2

Partial capture coverage and actionable Windows tray details

• Windows ZIP/MSI publication requires the explicit repository gate WINDOWS_RELEASE_APPROVED=true and a successful Windows build. This gate is independent of signing: a configured certificate signs and verifies both EXEs and MSI; absent a certificate they are unsigned. Neither signing, tests nor provenance is antivirus clearance. Quarantined executables are not restored or automatically reinstalled.
• With approved Windows artifacts, this coordinated release is stable/latest for Windows, Linux and both macOS architectures. Otherwise it remains an explicitly selected Unix prerelease and does not replace stable latest. Use the public Unix installer without --version to follow stable, or --version v0.17.2 to pin this release.
• Partial Windows camera/client attribution no longer hides known microphone/camera activity behind a generic grey error cross. An amber exclamation distinguishes incomplete coverage from camera-ready pause and real collection/control failures. Complete details retain Active/Ready accesses, known or unknown PID identities, collector reasons, observation gaps and protection/notification errors; a healthy refresh recovers without clearing unrelated manual failures.
• Sensor client PID/report-time API errors and raw metadata explain attribution failures. A successful zero/missing report timestamp remains unavailable, not a fabricated current time; process-instance and report-freshness checks remain enforced, and raw PID evidence is never kill authorization. Native SDK/Zoom qualification confirmed a valid client PID but zero report time; this release does not invent the camera client or promise physical enforcement.
• Windows tray menus show a compact single-line status, not concatenated protection diagnostics; full details remain available separately. Camera protection with a stopped approved owner remains a visible warning, never a fake healthy state.
• Completed privacy operations clear only their own applicable error state. A successful microphone operation does not erase a camera failure, and automatic policy cannot acknowledge a failed explicit request. Successful native notification API calls clear current unavailability while retaining failure history; API acceptance does not prove a visible notification.
• macOS owned autostart refresh preserves dormant/disabled intent instead of implicitly activating it. Physical Homebrew Cellar targets are validated and refreshed before old-keg cleanup; absent or externally modified registrations are not adopted or enabled. Package recipes and external acceptance are qualified separately.
• The Unix installer prints platform, destination, download/checksum/install progress and the exact next command, with optional terminal colors and plain redirected output. The short HTTPS curl pipeline uses the same reviewed installer; PATH remains consent-based and no tray, autostart or privacy control is enabled implicitly. Windows retains native MSI/ZIP installation.
• Native SPA bindings follow complete C declarations with bindgen 0.72.1, fixing opaque pod builders generated by Clang 22+ without inventing a C ABI. A real C/Rust nested POD and buffer-growth roundtrip qualifies legacy Ubuntu and current Arch headers separately.
• Windows manual microphone protection now has a separate native background owner until explicit mcw unmute/deactivation; closing top/tray does not release it and does not install login autostart. Requested protection, effective SDK endpoint mute and observed capture are distinct. Native callbacks reinforce external endpoint-unmute changes, but software mute is not capture permission: exclusive/ASIO, hardware and unsupported paths remain explicit limits.
• Windows camera intent is global Allow/Block, independent of camera count. A temporary elevated Block helper covers new arrivals until Allow, without an installed service. Restoration changes only MCW-owned camera disables; absent cameras are not an expected inventory or an invented unplugged error. Protected receipts, native identity/generation checks and explicit target-bound UAC legacy recovery preserve external administrator state. A brief PnP-arrival window and partial/restart/unknown outcomes remain visible.
• Windows portable replacement now reserves native protection ownership and refuses active/requested, automatic or pending/unknown restoration before stopping the tray or swapping files. It never releases protection implicitly; external MSI/manual replacements still require explicit release and completed restoration. Background microphone startup inherits no caller handles, preventing completed CLI commands from retaining output pipes.
• Linux PipeWire decoding, child output/time, retained graph data, UI delivery and caches are bounded; limit/outage errors remain unavailable with observation gaps rather than fabricated STOP. Resource reports compare the checksum-verified previous release and the candidate, count the product tree including helpers/shared RSS and disclose sampling gaps. The 15 MB soft target is not claimed as achieved; approximately 30 MB is a reference, not a hard cutoff.
• Resource qualification gates every candidate profile explicitly. Immutable-reference functional failures remain failed rows and CI warnings; a successful candidate gate alone is not a qualified baseline comparison. Composed Windows proof measures both real guards with top/tray, verifies protection survives frontend exit, and reports the total rather than adding separate-profile medians. Latest pre-publication proof is linked in Architecture; the complete protection-plus-interface scenario exceeds the 15 MB target and 30 MB reference.
• All six mcw top controls stay in one horizontal row with compact narrow-terminal representations on Windows, Linux and macOS. Native keyboard, resize and hitbox behavior is exercised. Linux/macOS microphone controls retain their scoped one-shot behavior; Windows persistent protection is not silently promised on Unix.
• Unix tray stop retires shared native readiness only after the main loop accepts shutdown, preventing a control-thread race from presenting a valid AppKit stop as a disconnection. Real Linux/macOS stop controls, process exits and cleanup are exercised; genuine helper/transport failures remain errors.
• Older macOS archives retain their embedded updater. Quit their tray/watcher and follow the reviewed standalone bootstrap migration in README when needed; the installer verifies the caller-supplied old SHA-256 and selected release checksum, preserves permissions/quarantine, refuses running/changed/unsafe targets and leaves PATH/preferences/history untouched. Managed bin layouts still require receipts; Linux standalone archives are unchanged.
• Linux x64: PipeWire graph capture with authenticated client PID and /proc identity, conservative V4L2 readiness, session-only PipeWire source mute, real StatusNotifier tray, native desktop notifications/sound/journal delivery, managed desktop autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Optional USB uvcvideo camera controls require a separately reviewed root-helper installation and explicit Polkit authorization. Supported cameras have one complete USB configuration and stable video interface roles; ambiguous/partial bindings, non-USB cameras and automatic camera-on-lock are refused. Status/startup never elevate. Restore and explicitly remove the root helper before a user upgrade/removal; install the new matching root helper separately afterward.
• macOS 15+ Apple Silicon and Intel: CoreAudio input activity, writable INPUT mute only, native AppKit menu bar, notifications/sound/unified log, managed LaunchAgent autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Camera blocking is a manually reviewed/approved Restrictions profile, not a silent camera or TCC switch. Public screen-lock state remains Unknown; no automatic macOS lock enforcement is claimed.
• macOS camera discovery remains passive AVFoundation inventory; activity uses public CoreMediaIO device running-state. Client PID stays null, application is unknown, enforcement is Unknown and coverage is degraded: running-state is not proof of frame flow or app attribution. Unknown/error states never become fabricated idle or STOP events. No capture session or camera/microphone permission request is made.
• Linux is built on Ubuntu 22.04 (glibc 2.35 baseline; PipeWire 0.3.48 supported). Runtime needs libpipewire-0.3/libspa-0.2, pw-dump and an accessible user PipeWire socket; desktop features additionally need session D-Bus, a real StatusNotifier host/panel and notification daemon. Sound needs canberra-gtk-play. Build prerequisites are installed only on ephemeral CI runners.
• macOS needs macOS 15+ and a logged-in Aqua/WindowServer session for the menu bar; native notifications and screenshot evidence may require user authorization. No Apple Developer ID, notarization, permission grant or physical-device compatibility is asserted.
• All three Unix architectures run format/clippy/test/build and extracted-package native smoke. Linux smoke uses a real XFCE panel under Xvfb, notification daemon, session D-Bus, isolated virtual PipeWire capture, actual PTY uppercase/cancel/quit, and a real service outage with no fabricated START/STOP. macOS attempts native menu-bar lifecycle and captures native output; absent Aqua/Screen Recording prerequisites are explicit evidence, not a silently passed GUI test. Screenshots/native-proof artifacts require review and are not physical capture proof.
• Physical microphone/camera capture, physical mute, real lock/unlock transitions, manually installed macOS Restrictions-profile effectiveness and native notification authorization remain unverified by hosted CI. SHA256SUMS and build provenance cover distributables; the SBOM describes dependencies. Existing v0.14.0 tag/assets are left untouched and exclud...

v0.17.1

Windows tray recovery and compact status; package-owned macOS autostart

• Windows ZIP/MSI publication requires the explicit repository gate WINDOWS_RELEASE_APPROVED=true and a successful Windows build. This gate is independent of signing: a configured certificate signs and verifies both EXEs and MSI; absent a certificate they are unsigned. Neither signing, tests nor provenance is antivirus clearance. Quarantined executables are not restored or automatically reinstalled.
• With approved Windows artifacts, this coordinated release is stable/latest for Windows, Linux and both macOS architectures. Otherwise it remains an explicitly selected Unix prerelease and does not replace stable latest. Use the public Unix installer without --version to follow stable, or --version v0.17.1 to pin this release.
• Windows tray menus show a compact single-line status, not concatenated protection diagnostics; full details remain available separately. Camera protection with a stopped approved owner remains a visible warning, never a fake healthy state.
• Completed privacy operations clear only their own applicable error state. A successful microphone operation does not erase a camera failure, and automatic policy cannot acknowledge a failed explicit request. Successful native notification API calls clear current unavailability while retaining failure history; API acceptance does not prove a visible notification.
• macOS owned autostart refresh preserves dormant/disabled intent instead of implicitly activating it. Physical Homebrew Cellar targets are validated and refreshed before old-keg cleanup; absent or externally modified registrations are not adopted or enabled. Package recipes and external acceptance are qualified separately.
• The Unix installer prints platform, destination, download/checksum/install progress and the exact next command, with optional terminal colors and plain redirected output. The short HTTPS curl pipeline uses the same reviewed installer; PATH remains consent-based and no tray, autostart or privacy control is enabled implicitly. Windows retains native MSI/ZIP installation.
• Native SPA bindings follow complete C declarations with bindgen 0.72.1, fixing opaque pod builders generated by Clang 22+ without inventing a C ABI. A real C/Rust nested POD and buffer-growth roundtrip qualifies legacy Ubuntu and current Arch headers separately.
• Windows manual microphone protection now has a separate native background owner until explicit mcw unmute/deactivation; closing top/tray does not release it and does not install login autostart. Requested protection, effective SDK endpoint mute and observed capture are distinct. Native callbacks reinforce external endpoint-unmute changes, but software mute is not capture permission: exclusive/ASIO, hardware and unsupported paths remain explicit limits.
• Windows camera intent is global Allow/Block, independent of camera count. A temporary elevated Block helper covers new arrivals until Allow, without an installed service. Restoration changes only MCW-owned camera disables; absent cameras are not an expected inventory or an invented unplugged error. Protected receipts, native identity/generation checks and explicit target-bound UAC legacy recovery preserve external administrator state. A brief PnP-arrival window and partial/restart/unknown outcomes remain visible.
• Windows portable replacement now reserves native protection ownership and refuses active/requested, automatic or pending/unknown restoration before stopping the tray or swapping files. It never releases protection implicitly; external MSI/manual replacements still require explicit release and completed restoration. Background microphone startup inherits no caller handles, preventing completed CLI commands from retaining output pipes.
• Linux PipeWire decoding, child output/time, retained graph data, UI delivery and caches are bounded; limit/outage errors remain unavailable with observation gaps rather than fabricated STOP. Resource reports compare the checksum-verified previous release and the candidate, count the product tree including helpers/shared RSS and disclose sampling gaps. The 15 MB soft target is not claimed as achieved; approximately 30 MB is a reference, not a hard cutoff.
• Resource qualification gates every candidate profile explicitly. Immutable-reference functional failures remain failed rows and CI warnings; a successful candidate gate alone is not a qualified baseline comparison. Composed Windows proof measures both real guards with top/tray, verifies protection survives frontend exit, and reports the total rather than adding separate-profile medians. Latest pre-publication proof is linked in Architecture; the complete protection-plus-interface scenario exceeds the 15 MB target and 30 MB reference.
• All six mcw top controls stay in one horizontal row with compact narrow-terminal representations on Windows, Linux and macOS. Native keyboard, resize and hitbox behavior is exercised. Linux/macOS microphone controls retain their scoped one-shot behavior; Windows persistent protection is not silently promised on Unix.
• Unix tray stop retires shared native readiness only after the main loop accepts shutdown, preventing a control-thread race from presenting a valid AppKit stop as a disconnection. Real Linux/macOS stop controls, process exits and cleanup are exercised; genuine helper/transport failures remain errors.
• Older macOS archives retain their embedded updater. Quit their tray/watcher and follow the reviewed standalone bootstrap migration in README when needed; the installer verifies the caller-supplied old SHA-256 and selected release checksum, preserves permissions/quarantine, refuses running/changed/unsafe targets and leaves PATH/preferences/history untouched. Managed bin layouts still require receipts; Linux standalone archives are unchanged.
• Linux x64: PipeWire graph capture with authenticated client PID and /proc identity, conservative V4L2 readiness, session-only PipeWire source mute, real StatusNotifier tray, native desktop notifications/sound/journal delivery, managed desktop autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Optional USB uvcvideo camera controls require a separately reviewed root-helper installation and explicit Polkit authorization. Supported cameras have one complete USB configuration and stable video interface roles; ambiguous/partial bindings, non-USB cameras and automatic camera-on-lock are refused. Status/startup never elevate. Restore and explicitly remove the root helper before a user upgrade/removal; install the new matching root helper separately afterward.
• macOS 15+ Apple Silicon and Intel: CoreAudio input activity, writable INPUT mute only, native AppKit menu bar, notifications/sound/unified log, managed LaunchAgent autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Camera blocking is a manually reviewed/approved Restrictions profile, not a silent camera or TCC switch. Public screen-lock state remains Unknown; no automatic macOS lock enforcement is claimed.
• macOS camera discovery remains passive AVFoundation inventory; activity uses public CoreMediaIO device running-state. Client PID stays null, application is unknown, enforcement is Unknown and coverage is degraded: running-state is not proof of frame flow or app attribution. Unknown/error states never become fabricated idle or STOP events. No capture session or camera/microphone permission request is made.
• Linux is built on Ubuntu 22.04 (glibc 2.35 baseline; PipeWire 0.3.48 supported). Runtime needs libpipewire-0.3/libspa-0.2, pw-dump and an accessible user PipeWire socket; desktop features additionally need session D-Bus, a real StatusNotifier host/panel and notification daemon. Sound needs canberra-gtk-play. Build prerequisites are installed only on ephemeral CI runners.
• macOS needs macOS 15+ and a logged-in Aqua/WindowServer session for the menu bar; native notifications and screenshot evidence may require user authorization. No Apple Developer ID, notarization, permission grant or physical-device compatibility is asserted.
• All three Unix architectures run format/clippy/test/build and extracted-package native smoke. Linux smoke uses a real XFCE panel under Xvfb, notification daemon, session D-Bus, isolated virtual PipeWire capture, actual PTY uppercase/cancel/quit, and a real service outage with no fabricated START/STOP. macOS attempts native menu-bar lifecycle and captures native output; absent Aqua/Screen Recording prerequisites are explicit evidence, not a silently passed GUI test. Screenshots/native-proof artifacts require review and are not physical capture proof.
• Physical microphone/camera capture, physical mute, real lock/unlock transitions, manually installed macOS Restrictions-profile effectiveness and native notification authorization remain unverified by hosted CI. SHA256SUMS and build provenance cover distributables; the SBOM describes dependencies. Existing v0.14.0 tag/assets are left untouched and excluded from publication by this workflow.

Full Changelog: v0.17.0...v0.17.1

v0.17.0

Persistent Windows privacy controls, bounded collectors and single-row top controls

Thank you @repentandliveholy for diagnosing and fixing missed Telegram camera activity on macOS 27.

• Windows ZIP/MSI publication requires the explicit repository gate WINDOWS_RELEASE_APPROVED=true and a successful Windows build. This gate is independent of signing: a configured certificate signs and verifies both EXEs and MSI; absent a certificate they are unsigned. Neither signing, tests nor provenance is antivirus clearance. Quarantined executables are not restored or automatically reinstalled.
• With approved Windows artifacts, this coordinated release is stable/latest for Windows, Linux and both macOS architectures. Otherwise it remains an explicitly selected Unix prerelease and does not replace stable latest. Use the public Unix installer without --version to follow stable, or --version v0.17.0 to pin this release.
• Windows manual microphone protection now has a separate native background owner until explicit mcw unmute/deactivation; closing top/tray does not release it and does not install login autostart. Requested protection, effective SDK endpoint mute and observed capture are distinct. Native callbacks reinforce external endpoint-unmute changes, but software mute is not capture permission: exclusive/ASIO, hardware and unsupported paths remain explicit limits.
• Windows camera intent is global Allow/Block, independent of camera count. A temporary elevated Block helper covers new arrivals until Allow, without an installed service. Restoration changes only MCW-owned camera disables; absent cameras are not an expected inventory or an invented unplugged error. Protected receipts, native identity/generation checks and explicit target-bound UAC legacy recovery preserve external administrator state. A brief PnP-arrival window and partial/restart/unknown outcomes remain visible.
• Windows portable replacement now reserves native protection ownership and refuses active/requested, automatic or pending/unknown restoration before stopping the tray or swapping files. It never releases protection implicitly; external MSI/manual replacements still require explicit release and completed restoration. Background microphone startup inherits no caller handles, preventing completed CLI commands from retaining output pipes.
• Linux PipeWire decoding, child output/time, retained graph data, UI delivery and caches are bounded; limit/outage errors remain unavailable with observation gaps rather than fabricated STOP. Resource reports compare the checksum-verified previous release and the candidate, count the product tree including helpers/shared RSS and disclose sampling gaps. The 15 MB soft target is not claimed as achieved; approximately 30 MB is a reference, not a hard cutoff.
• Resource qualification gates every candidate profile explicitly. Immutable-reference functional failures remain failed rows and CI warnings; a successful candidate gate alone is not a qualified baseline comparison. Composed Windows proof measures both real guards with top/tray, verifies protection survives frontend exit, and reports the total rather than adding separate-profile medians. Latest pre-publication proof is linked in Architecture; the complete protection-plus-interface scenario exceeds the 15 MB target and 30 MB reference.
• All six mcw top controls stay in one horizontal row with compact narrow-terminal representations on Windows, Linux and macOS. Native keyboard, resize and hitbox behavior is exercised. Linux/macOS microphone controls retain their scoped one-shot behavior; Windows persistent protection is not silently promised on Unix.
• Unix tray stop retires shared native readiness only after the main loop accepts shutdown, preventing a control-thread race from presenting a valid AppKit stop as a disconnection. Real Linux/macOS stop controls, process exits and cleanup are exercised; genuine helper/transport failures remain errors.
• Older macOS archives retain their embedded updater. Quit their tray/watcher and follow the reviewed standalone bootstrap migration in README when needed; the installer verifies the caller-supplied old SHA-256 and selected release checksum, preserves permissions/quarantine, refuses running/changed/unsafe targets and leaves PATH/preferences/history untouched. Managed bin layouts still require receipts; Linux standalone archives are unchanged.
• Linux x64: PipeWire graph capture with authenticated client PID and /proc identity, conservative V4L2 readiness, session-only PipeWire source mute, real StatusNotifier tray, native desktop notifications/sound/journal delivery, managed desktop autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Optional USB uvcvideo camera controls require a separately reviewed root-helper installation and explicit Polkit authorization. Supported cameras have one complete USB configuration and stable video interface roles; ambiguous/partial bindings, non-USB cameras and automatic camera-on-lock are refused. Status/startup never elevate. Restore and explicitly remove the root helper before a user upgrade/removal; install the new matching root helper separately afterward.
• macOS 15+ Apple Silicon and Intel: CoreAudio input activity, writable INPUT mute only, native AppKit menu bar, notifications/sound/unified log, managed LaunchAgent autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Camera blocking is a manually reviewed/approved Restrictions profile, not a silent camera or TCC switch. Public screen-lock state remains Unknown; no automatic macOS lock enforcement is claimed.
• macOS camera discovery remains passive AVFoundation inventory; activity now uses CoreMediaIO device running-state, correcting the missed Telegram transitions reported by @repentandliveholy on macOS 27. Client PID stays null, application is unknown, enforcement is Unknown and coverage is degraded: running-state is not proof of frame flow or app attribution. Unknown/error states never become fabricated idle or STOP events. No capture session or camera/microphone permission request is made.
• Linux is built on Ubuntu 22.04 (glibc 2.35 baseline; PipeWire 0.3.48 supported). Runtime needs libpipewire-0.3/libspa-0.2, pw-dump and an accessible user PipeWire socket; desktop features additionally need session D-Bus, a real StatusNotifier host/panel and notification daemon. Sound needs canberra-gtk-play. Build prerequisites are installed only on ephemeral CI runners.
• macOS needs macOS 15+ and a logged-in Aqua/WindowServer session for the menu bar; native notifications and screenshot evidence may require user authorization. No Apple Developer ID, notarization, permission grant or physical-device compatibility is asserted.
• All three Unix architectures run format/clippy/test/build and extracted-package native smoke. Linux smoke uses a real XFCE panel under Xvfb, notification daemon, session D-Bus, isolated virtual PipeWire capture, actual PTY uppercase/cancel/quit, and a real service outage with no fabricated START/STOP. macOS attempts native menu-bar lifecycle and captures native output; absent Aqua/Screen Recording prerequisites are explicit evidence, not a silently passed GUI test. Screenshots/native-proof artifacts require review and are not physical capture proof.
• Physical microphone/camera capture, physical mute, real lock/unlock transitions, manually installed macOS Restrictions-profile effectiveness and native notification authorization remain unverified by hosted CI. SHA256SUMS and build provenance cover distributables; the SBOM describes dependencies. Existing v0.14.0 tag/assets are left untouched and excluded from publication by this workflow.

Full Changelog: v0.16.1...v0.17.0

v0.16.1

macOS updater/menu corrections and responsive cross-platform top controls

Thank you @repentandliveholy for diagnosing and fixing missed Telegram camera activity on macOS 27.

• Windows ZIP/MSI publication requires the explicit repository gate WINDOWS_RELEASE_APPROVED=true and a successful Windows build. This gate is independent of signing: a configured certificate signs and verifies both EXEs and MSI; absent a certificate they are unsigned. Neither signing, tests nor provenance is antivirus clearance. Quarantined executables are not restored or automatically reinstalled.
• With approved Windows artifacts, this coordinated release is stable/latest for Windows, Linux and both macOS architectures. Otherwise it remains an explicitly selected Unix prerelease and does not replace stable latest. Use the public Unix installer without --version to follow stable, or --version v0.16.1 to pin this release.
• macOS v0.16.1 fixes ./mcw update for an owned standalone executable outside bin. The explicit bootstrap installer mode updates an older archive in-place after verifying the caller-supplied current SHA-256 and selected release checksum; it preserves permissions/quarantine, refuses running/changed/unsafe targets, and leaves PATH/preferences/history untouched. Older binaries embed their old updater: quit their tray/watcher, download and inspect the current installer and follow the README standalone migration once. Managed bin layouts still require receipts; Linux standalone archives are unchanged.
• Diagnostic tray menu rows on Windows, Linux and macOS stay compact with full details separately accessible; Unknown/degraded remains visible. Windows/macOS offer native wrapping/copyable text; Linux uses existing native status notifications, whose visible height depends on the desktop daemon. Shared mcw top action buttons have clearer boundaries, shortcuts and responsive layouts on all three OS; platform control capabilities and permission requirements do not change.
• Linux x64: PipeWire graph capture with authenticated client PID and /proc identity, conservative V4L2 readiness, session-only PipeWire source mute, real StatusNotifier tray, native desktop notifications/sound/journal delivery, managed desktop autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Optional USB uvcvideo camera controls require a separately reviewed root-helper installation and explicit Polkit authorization. Supported cameras have one complete USB configuration and stable video interface roles; ambiguous/partial bindings, non-USB cameras and automatic camera-on-lock are refused. Status/startup never elevate. Restore and explicitly remove the root helper before a user upgrade/removal; install the new matching root helper separately afterward.
• macOS 15+ Apple Silicon and Intel: CoreAudio input activity, writable INPUT mute only, native AppKit menu bar, notifications/sound/unified log, managed LaunchAgent autostart, profiles/history, shared TUI, and ownership-checked user-prefix updates. Camera blocking is a manually reviewed/approved Restrictions profile, not a silent camera or TCC switch. Public screen-lock state remains Unknown; no automatic macOS lock enforcement is claimed.
• macOS camera discovery remains passive AVFoundation inventory; activity now uses CoreMediaIO device running-state, correcting the missed Telegram transitions reported by @repentandliveholy on macOS 27. Client PID stays null, application is unknown, enforcement is Unknown and coverage is degraded: running-state is not proof of frame flow or app attribution. Unknown/error states never become fabricated idle or STOP events. No capture session or camera/microphone permission request is made.
• Linux is built on Ubuntu 22.04 (glibc 2.35 baseline; PipeWire 0.3.48 supported). Runtime needs libpipewire-0.3/libspa-0.2, pw-dump and an accessible user PipeWire socket; desktop features additionally need session D-Bus, a real StatusNotifier host/panel and notification daemon. Sound needs canberra-gtk-play. Build prerequisites are installed only on ephemeral CI runners.
• macOS needs macOS 15+ and a logged-in Aqua/WindowServer session for the menu bar; native notifications and screenshot evidence may require user authorization. No Apple Developer ID, notarization, permission grant or physical-device compatibility is asserted.
• All three Unix architectures run format/clippy/test/build and extracted-package native smoke. Linux smoke uses a real XFCE panel under Xvfb, notification daemon, session D-Bus, isolated virtual PipeWire capture, actual PTY uppercase/cancel/quit, and a real service outage with no fabricated START/STOP. macOS attempts native menu-bar lifecycle and captures native output; absent Aqua/Screen Recording prerequisites are explicit evidence, not a silently passed GUI test. Screenshots/native-proof artifacts require review and are not physical capture proof.
• Physical microphone/camera capture, physical mute, real lock/unlock transitions, manually installed macOS Restrictions-profile effectiveness and native notification authorization remain unverified by hosted CI. SHA256SUMS and build provenance cover distributables; the SBOM describes dependencies. Existing v0.14.0 tag/assets are left untouched and excluded from publication by this workflow.

Full Changelog: v0.16.0...v0.16.1