Chutes Build 1.0.1

Fixed (the TUI wore upstream's identity)

• The splash showed Grok's wordmark. assets/logo/logo07.txt and
  logo05.txt were byte-identical to upstream's: the re-base overwrote the Chutes
  wordmark and 1.0.0 shipped it, so every start drew the wrong brand. Restored. A
  sweep of every asset in the tree says these two were the only ones taken.
• A Chutes user was offered a subscription to another company's product.
  Hitting a usage limit produced "Upgrade to SuperGrok" and "Upgrade to SuperGrok
  Heavy"; a restricted command said it "requires SuperGrok". The buttons already
  pointed at chutes.ai/pricing — the fork had rebranded where they go and left
  what they say. This one predates the re-base; v0.4.3 carries the same strings.
• The screen-mode settings described opening "plain grok", the welcome gate read
  "SuperGrok subscription required", and the feedback prompt opened with "You've
  been using Grok Code productively!".

Rust identifiers, crate names, telemetry event types and model ids such as
grok-4.5 are deliberately untouched: AGENTS.md keeps them so upstream diffs
stay readable, and a model name is data rather than branding.

The wordmark's hash is now pinned by a test, so a merge that takes upstream's
side there fails instead of shipping. The loss was silent by nature: nothing
compiles differently, no test read the bytes, and the only symptom was on screen.

Security

• The agent serve token comparison no longer rests on a function that
  disclaims the property it was chosen for. It used
  ring::constant_time::verify_slices_are_equal, which ring now deprecates as an
  "internal function not intended for external use with no promises regarding side
  channels" — while the reason for calling it at all is that == on &str returns
  at the first differing byte, and over a socket with no rate limit that leaks the
  token one byte at a time. It now uses subtle::ConstantTimeEq, which is
  maintained for this and also resists the compiler folding the comparison back
  into an early return. No new code enters the build: subtle was already in the
  graph through rustls, so the lock file moves by one line.

Fixed

• --help had upstream's branding back in it. The re-base took upstream's
  wording over the fork's in five places a user reads, three of them flag names:
  --grok-ws-origin and --grok-ws-url, which 0.4.3 spelled --chutes-ws-* and
  kept hidden, so the re-base both renamed them and put internal plumbing into the
  top-level help; --xai-api-base-url, described as "the public xAI API base URL"
  when it overrides the Chutes inference base URL; the positional-prompt example,
  which read grok "fix the bug" beside a chutes-build example on the same
  line; and the screen_mode help, which said "To default plain grok to
  minimal". Found by installing the published 1.0.0 the way a user gets it and
  reading every help surface — the step the release procedure asks for and which
  had not been done. leader/mod.rs passes those flags to the child process, so
  the rename covers it too.

Repository and CI

• xai-grok-shell --lib auth:: runs on Windows. It failed 24 there, and the
  CI step had never executed at all, because the pager step above it always failed
  first. A provider command goes through cmd /C off Unix — deliberately, for
  exit-code propagation — while the fixtures were POSIX one-liners. They now drive
  auth-provider-fixture, a real helper invoked with args, so no shell
  interprets them. Two lock tests read the lock file through a second handle while
  holding it, which Windows refuses; they read through the holding handle now, as
  the product does.
• The Linux job reaches its end. It had not passed in the last twenty runs, so
  four steps below the failure — auth and session integration, agent construction
  and bundled skills, Chutes-native tools, and clippy — had not run either. Behind
  them were a banned tokio::process::Command::spawn in a test the ban does not
  describe, and a doc comment separated from the function it documents.
• That job's 60-minute limit was sized for the broken state. The first run to
  reach the end spent 59.7 minutes on work that passed and was killed during the
  cache save — which left the next run cold, slower, and killed in the same
  place. Raised to 90, matching Windows. Measured twice since at 65 and 67 minutes:
  the cost is roughly 45 minutes of tests plus 11 of clippy, not compilation, so a
  warm cache moves it very little and the headroom is about a quarter.
• All five CI jobs pass. Windows had been red since 1.0.0 landed and Linux had
  not finished in over twenty runs; this is the first complete green run.
• RUSTSEC-2026-0249 is recorded in deny.toml: smartstring is unmaintained —
  archived, not vulnerable — and reaches this tree only as a non-optional
  dependency of rhai, whose latest stable we already use, so no bump closes it.
  It turned the dependency job red on a documentation-only commit, an hour after
  the same check passed, because that job reads the live advisory database.
• A flaky history-delivery test asked for a repaint and a result in one condition;
  it fails when the daemon is fast enough to answer before the eager snapshot,
  which is why widening its deadline had not helped.