TOOLBOXLAP Gateway — GMI Edition v0.2.9

TOOLBOXLAP Gateway — GMI Edition v0.2.9

v0.2.9 is the hardened public release of the Windows local
Anthropic-compatible gateway for GMI Cloud. It retains the default loopback
gateway at 127.0.0.1:8787, the claude-opus-5 compatibility alias, and the
tested MiniMaxAI/MiniMax-M3 target.

Security hardening

• Non-loopback startup now fails unless an explicit Local Gateway Token of at
  least 24 characters is configured.
• The public toolboxlap convenience token is rejected for non-loopback binds.
• Every route requires bearer authentication while bound beyond loopback.
• Localhost development behavior remains unchanged.
• New unit and integration tests cover loopback detection, token validation,
  rejected unsafe startup, and authenticated non-loopback routes.

Public-source preparation

• Added the GNU General Public License v3.0.
• Expanded .gitignore coverage for secrets, runtime credential files, logs,
  caches, dependencies, build products, and executable release artifacts.
• Added build, contribution, security, CI, issue, and pull request guidance.
• Aligned current package, UI, build, and documentation metadata at v0.2.9.

Release artifact

• Filename: TOOLBOXLAP-Gateway-GMI-0.2.9.exe
• Size: 99,616,546 bytes
• SHA-256:
  757D49182E805ED07B0AFC706D00C79C9424822D8F3D8011319AEEC68F2E5CEB

The Windows portable executable was built locally, its version metadata was
verified as 0.2.9, and it passed an isolated launch check. Verify the downloaded
asset against the SHA-256 value above before running it.

Historical release

The previously published v0.2.8 executable and its verified checksum remain
documented in v0.2.8 release notes. The v0.2.9 hardening must not
be assumed to be present in that historical binary.