meta-proxy v0.3.0 — signed cross-platform binaries

meta-proxy v0.3.0

Signed public binaries for Cognitum's local Rust routing proxy. meta-proxy gives
Claude Code and OpenAI-compatible clients one authenticated loopback endpoint
with explicit, fail-closed routing across Passthrough, Cloud, Local, and
Sponsored data planes.

What is included

• Anthropic-compatible POST /v1/messages, including SSE streaming and Claude
  Code's subscription OAuth semantics.
• OpenAI-compatible chat and sponsored endpoints.
• Cognitum Cloud authentication through browser OAuth, headless OAuth, a pasted
  API key, or a short-lived token injected by a resident Ruflo supervisor.
• Per-installation bearer authentication, loopback binding by default, explicit
  consent gates, and a local Sponsored spend circuit breaker.
• Five native archives for Windows x64, Linux x64/ARM64, and macOS x64/Apple
  Silicon.

New in v0.3.0

• Forwards an explicit allowlist of Anthropic response headers, including
  anthropic-ratelimit-unified-*, so Claude Code can display native usage and
  reset information through the proxy.
• Persists authoritative Passthrough-only utilization state to
  ~/.ruflo/usage-status.json and bounded, write-on-change history to
  ~/.ruflo/usage-history.ndjsonl.
• Rejects lookalike telemetry from Cloud, Local, and Sponsored routes; snapshot
  errors remain fail-open and cannot interrupt inference.
• Hardens concurrent snapshot writes, private temporary files, history
  rotation, and Windows replacement behavior. Set RUFLO_PROXY_USAGE_TAP=0 to
  disable local snapshot writes without disabling header forwarding.

Verification

• 143 Rust tests, clean Clippy with warnings denied, and a locked release build.
• Every archive is listed in SHA256SUMS; the exact manifest bytes are signed
  with raw Ed25519 in the base64-encoded SHA256SUMS.sig.
• All five archives were executed on their native architectures across
  Passthrough, Cloud, Local, and Sponsored: 20/20 target-plane combinations
  passed authenticated status, buffered and SSE inference, applicable
  OpenAI-compatible routes, routing/auth, telemetry-boundary, permission, and
  teardown checks.
• The exact public Windows x64 archive was acceptance-tested in an isolated
  Passthrough environment: HTTP 200, upstream utilization 0.42 forwarded,
  provenance-labelled snapshot written, and duplicate history suppressed.
• The Cognitum OAuth Cloud route was also verified end-to-end against the
  production GCP gateway.

Downloads

Platform	Asset
Windows x64	meta-proxy-0.3.0-x86_64-pc-windows-msvc.zip
Linux x64	meta-proxy-0.3.0-x86_64-unknown-linux-gnu.tar.gz
Linux ARM64	meta-proxy-0.3.0-aarch64-unknown-linux-gnu.tar.gz
macOS Intel	meta-proxy-0.3.0-x86_64-apple-darwin.tar.gz
macOS Apple Silicon	meta-proxy-0.3.0-aarch64-apple-darwin.tar.gz

Download the archive for your platform together with SHA256SUMS,
SHA256SUMS.sig, and signing-key.pub.pem. Verify the archive digest and the
manifest signature before installation. The signer public-key SHA-256
fingerprint (PEM bytes) is
39c0b53dae0f84df5062d6e6d2b39ba31f0b73875f5fb5f6d205cec4599d2432.

This public repository distributes signed binaries only. The implementation,
security tests, and architecture decision records are maintained in Cognitum's
private meta-proxy repository.