ChannelGate 0.5.1

ChannelGate 0.5.1 — the first update after the 0.5.0 public release.

Highlights

• Qwen (Claude Code) harness (optional): the Claude Code CLI driven against QwenCloud's Anthropic-compatible endpoint, with its own key, base URL and live model list. Off until an admin enables it; no Anthropic credential ever reaches a Qwen run; outside automatic failover; tokens recorded with no invented cost.
• Admin-only /sudo threads: an organization admin can switch one Slack thread to direct host execution; everyone else is rejected before anything runs.
• Interactive Slack question cards for Claude and Codex, durable across restarts.
• Channel VPNs on OpenVPN 3 with chat, web and Slack controls, plus bounded read-only channel database queries.
• Unusable Cloud MCP selections are dropped from a run (with the reason shown) instead of failing the turn.
• Personal quiet-thread reminders, native Slack image attachments and previews, host rclone provisioning, Codex capacity and pricing fixes, and more. Full list in CHANGELOG.md.

Upgrade: npm run update (or scripts/update.sh). Adds one database migration (v26, a new table); no dependency or runtime-image changes.

Evidence: full regression suite, static analysis, secret scan, security coverage, dependency audit and DCO passed on the exact candidate; CI green. Signed build evidence (runtime image archive, SPDX inventory, model hashes, checksums, GitHub attestations) is in the release workflow run. Verify with sha256sum -c SHA256SUMS and gh attestation verify <artifact> --repo makeitfutureDev/channelgate. Live acceptance covered Claude and Qwen; Codex live acceptance and the full live campaign were not run for this release (see docs/RELEASE-ACCEPTANCE.md).