v0.10.0-rc.4

Native signing status: Windows: unsigned transition artifact. SmartScreen publisher identity is not established. macOS: unsigned transition artifact. Developer ID and notarization are not established. Checksums and GitHub build provenance remain required. Do not bypass SmartScreen or Gatekeeper.

Changed

• Updated the optional LiteLLM proxy integration to 1.92.2 with aiohttp
  3.14.3 and cryptography 50.0.0. Updated the TypeScript MCP client examples
  to SDK 1.30.0 with patched fast-uri, Hono, and ip-address versions,
  removing the known vulnerable transitives from both reproducible locks. The
  Python MCP example guide now pins the current maintained v1 release while
  identifying v2 as the stable breaking line.
• Replaced the exportable-PFX Windows release contract with a protected
  release-signing environment, short-lived GitHub OIDC authentication, and
  the pinned Azure Artifact Signing action. The signer receives an exact
  full-tree-validated file catalog, SHA-256 file and RFC 3161 timestamp digests,
  and no private-key material. Credential-free build and publication jobs
  exchange immutable candidates with the isolated signing jobs, so dependency
  resolution, compilation, packaging, attestation, and upload cannot obtain the
  Azure signing identity.
• Windows signature verification now binds platform trust to the Artifact
  Signing Public Trust marker and the owner's durable subscriber identity EKU,
  while recording but not pinning the service's daily rotating leaf subject and
  thumbprint. Exact downloaded draft assets are reverified before publication.
• Added explicit release signing modes and a mandatory release-note disclosure.
  The transition unsigned mode preserves checksums and provenance without
  claiming platform identity; signed mode fails closed without the protected
  Azure profile configuration. Published v0.9.9 artifacts remain unsigned.

Fixed

• Made fresh-download verification, exact asset audit, and publication use
  explicit always() conditions with exact-success requirements for every
  direct prerequisite. GitHub's implicit status condition propagated the
  intentionally skipped unsigned signer through successful Windows packaging,
  so the v0.10.0-rc.3 workflow skipped verification after uploading 12 draft
  assets. The incomplete draft and partial assets were removed; its immutable
  tag and workflow logs remain.
• Checked out the tagged source before extracting curated release notes from
  CHANGELOG.md. The v0.10.0-rc.2 release quality gate passed, but draft
  creation correctly stopped before any asset build because the release job had
  no workspace checkout. Its immutable tag has no GitHub release.
• Added the two fully pinned Azure signing action repositories to the GitHub
  Actions allowlist. GitHub validates every referenced action before evaluating
  job conditions, so the missing allowlist entries prevented even an unsigned
  release workflow from starting. The rejected v0.10.0-rc.1 tag remains
  immutable and has no GitHub release.
• Cursor 3.x now passively detects a recognized current local plan only when its
  bounded membership owner matches the subject of the existing Cursor access
  token. The plan remains unroutable diagnostic evidence because Cursor does
  not persist current Cursor Models and Other Models quota balances in the
  supported local state, and credentials and owner identifiers are never
  exposed.
• quotabot login claude now sends a 32-byte, 43-character OAuth state value
  accepted by Anthropic's authorize POST and encodes the scope separator as an
  unambiguous %20. The prior 22-character state could show a valid-looking
  consent page and then fail with "Invalid request format" after authorization.
• Logout now removes every exact account grant slot, including malformed and
  legacy records that cannot be discovered by their embedded account marker,
  without following symbolic links or touching similarly prefixed files.
• OAuth login now rejects successful HTTP responses that omit a nonempty access
  token. Background refresh remains fail-soft and preserves the stored grant
  when Google, xAI, Anthropic, or OpenAI returns an unusable token response.
• Healthy subscriptions with a known reset time now keep the fail-soft
  passthrough fallback instead of also telling callers to wait for the selected
  provider. Only an unavailable subscription can produce a wait-for-reset
  fallback in CLI, MCP, HTTP, receipt, and desktop output.
• Cache-only routing now skips an individual snapshot whose metadata or contents
  cannot be read and continues loading healthy sibling providers, rather than
  silently stopping at the first filesystem error.
• Windows source setup and the new one-command contributor gate now share the
  space-safe Dart invocation for collector and Flutter native-asset commands,
  including Flutter installs located under a user profile containing spaces.
• Windows release signing now passes the RFC 3161 timestamp URL before the
  SHA-256 timestamp digest option, as required by SignTool, and refuses to sign
  when any file in the candidate tree differs from its unsigned inventory.
• Tagged Windows release jobs now download the exact draft CLI and desktop
  archives, re-inventory and independently verify every embedded signature,
  and retain bounded verification receipts before publication can continue.
• quotabot login claude now uses Anthropic's current platform OAuth callback
  and token hosts (platform.claude.com). The retired
  console.anthropic.com generation rejected the public Claude Code client
  with "Invalid request format", so an idle machine could not mint a
  refreshable usage-metadata grant.
• quotabot login claude now POSTs the token exchange as JSON, matching
  Claude Code's current platform.claude.com/v1/oauth/token contract.
  Form-urlencoded bodies on that host can fail with no grant written. A
  rejected exchange now prints the HTTP status and Anthropic's bounded error
  text instead of a generic "token exchange failed".
• Linux desktop release verify now downloads, checksums, and attests the
  draft archive before installing GTK and xvfb. CI and release share a
  time-bounded apt helper, and the verify job budget is 45 minutes, so a
  stalled hosted Ubuntu mirror fails that step instead of cancelling the
  whole job.

Documentation

• Recorded the immutable v0.9.9 14-asset lock and three-OS install smoke,
  including upgrade from v0.9.8.