OnionGate v0.2.1 (superseded)

Caution

Superseded — do not install this build.
Plain 0.2.x releases are no longer recommended. Install only the current
alpha (x.y.z-alpha.N) from the
Releases page.
GitHub Latest is not the alpha channel; in-app Check for updates
follows Latest only and stays off until a stable 1.0.0 exists.

Warning

This is an unsigned 0.x alpha. GitHub Actions could not build the four-platform draft (billing). This release was published from a local Apple Silicon Mac.

• Attached: macOS Apple Silicon DMG only. No Intel Mac, Linux, or Windows installers in this drop.
• Not signed or notarized. Gatekeeper will refuse the first launch — right-click the app → Open. Verify the file against SHA256SUMS before you run it.
• Not an updater channel. In-app Check for updates will not see this build (latest.json was not produced).
• Do not treat this as a sole control for high-risk work.

Added

• macOS NIC default-deny lock (Maximum Isolation) with a local deny journal and
  destination-exception consent (LEAK).
• Verify Kill stops an .app bundle (quit GUI, launchctl bootout, leftover
  pids), not a single pid.
• make dev builds and starts oniongate-helper. CLI: oniongate helper status|start|stop.
• Docs changelog page and commit-subject release audit trail, enforced by
  make changelog-check on every PR.

Security

• CLI start no longer reports Protected; managed Tor only leaves the session
  Degraded.
• Disconnect aborts if the transition lock cannot arm, instead of dropping
  TUN/proxy onto clearnet.
• Tray Protected label matches the window (live NIC lock and no destination
  exceptions).
• Signed macOS helper requires a matching peer code signature; unsigned debug
  builds stay UID-only.
• Preset copy no longer claims a NIC lock on Linux/Windows.
• Product and docs label this line as alpha.

Known limitations

• This is an unsigned 0.x alpha. The NIC default-deny is macOS-only. CLI start
  does not apply TUN, kill switch, or proxy. Helper crate split and Windows
  pipe identity remain open.