v0.4.0

Added

• voice streams forward no longer needs ngrok. It defaults to
  localhost.run over ssh — no install, no account, nothing to sign up for —
  and uses ngrok instead when it is already on PATH. --tunnel auto | ngrok | localhost.run forces a choice.

• Release provenance. SHA256SUMS is now signed with cosign keyless, and
  install.sh, install.ps1 and plivo upgrade all verify that signature when
  cosign is available — pinning the signer identity and OIDC issuer, without
  which any Sigstore identity would produce a passing check. Unsigned releases
  and machines without cosign still install; a signature that is present and
  fails is fatal.

• plivo docs — read the documentation from the terminal. docs search <keywords> full-text searches every page (a page must contain all the
  keywords, ranked by frequency), docs list shows the index, and
  docs show <path-or-title> prints one page. Backed by the docs site's own
  llms.txt / llms-full.txt exports, so it needs no credentials and works
  in a bare container. The full text is cached under ~/.plivo/cache for a day;
  --refresh re-fetches, and a stale cache is served if the network is down.

Fixed

• voice streams emitted the wrong audio contract. The <Stream> XML
  carried contentType and sampleRate as two attributes; the rate belongs
  inside contentType (audio/x-mulaw;rate=8000) and there is no sampleRate
  attribute. The l16 MIME type was also wrong — audio/x-l16, not audio/l16.
  Separately, streams test --codec l16 announced 16-bit PCM but generated
  mu-law bytes at half the expected frame size, so the pre-flight passed while
  the endpoint received noise. Both spellings and the audio generator now come
  from one place, and an unsupported codec/rate pair is rejected up front —
  there is no mu-law 16kHz stream.
• An unknown subcommand exited 0. plivo voice streams bogustypo printed
  help and reported success; the same hole existed on 35 command groups. Cobra
  only rejects an unrecognized subcommand for the true root, so every parent
  command that hosts only subcommands silently short-circuited to help. A bare
  group invocation still prints help and exits 0.
• -o json is now honoured by voice streams test, voice streams forward
  and upgrade, which previously always printed prose. Each emits a single
  machine-readable summary of the run, and progress output is suppressed so
  stdout stays parseable.
• make sign-release failed outright against cosign 3.x, which defaults to a
  bundle format requiring --bundle. The signing path had never been executed
  end to end.

---

Verifying this release

cosign verify-blob SHA256SUMS \
  --signature SHA256SUMS.sig --certificate SHA256SUMS.pem \
  --certificate-identity cx-tech@plivo.com \
  --certificate-oidc-issuer https://accounts.google.com