Rivet 0.5.0

• Give Windows installers a per-product identity and desktop presence. The WiX installer now derives each project's UpgradeCode from its identifier under a fixed Rivet namespace — the previous shared hardcoded code made two Rivet applications treat each other as upgrades and silently replace one another — and authors start-menu (in a per-app folder) and desktop shortcuts pointing at RivetHost.exe, removing the start-menu folder on uninstall. Shortcut components carry machine-scoped registry key paths, display names and identifiers stay XML-escaped, and tests/windows-installer.rkt covers code derivation, shortcut authoring, escaping, and a real wix build where WiX is installed. Applications installed from a release built before this change will side-by-side with the next version instead of upgrading in place; uninstall the old entry once after upgrading.
• Add the first-party Linux system adapter in platform/linux/system, mirroring the Windows and macOS surfaces: an abstract-socket single-instance lease with activation forwarding (peer-credential checked, so activations from other local users are rejected), desktop notifications over org.freedesktop.Notifications with tagged replacement ids, XDG autostart entries, Secret Service binary secrets through libsecret (compiled when present, reported as a runtime capability), POSIX fatal-signal crash hooks, and a Capabilities() probe that reflects what the running session actually provides. The tray contract stays deliberately absent because StatusNotifierItem hosting is compositor-dependent. The Linux integration binary self-checks the adapter (RivetIntegration --system), CI runs it, and the Linux host packaging no longer embeds build-machine rpaths.
• Add clean-runner desktop architecture gates. Windows ARM64 builds now force the x64-hosted MSVC toolchain (PreferredToolArchitecture=x64), avoiding the 32-bit HostX86 cross compiler whose address space cannot hold the WinUI precompiled header. A dedicated workflow now proves the full doctor/new/build/package/verify path on Windows ARM64 (windows-11-arm, checksum-pinned Racket 9.3 arm64 installer), macOS Intel (macos-15-intel), and Linux ARM64 (ubuntu-24.04-arm, Racket CS built from the pinned source tarball), completing build/package/verify evidence for every advertised desktop architecture; production release artifacts remain tag-driven.
• Add Kotlin typed-client generation. raco rivet build and raco rivet generate now emit a coroutine-native typed client at .rivet/generated/kotlin/dev/rivet/generated/GeneratedBackend.kt alongside the Swift/C++ clients: RPCs become suspend functions, Records become data classes, Enums become enum class values carrying their stable wire name, Events become a sealed RivetEvent hierarchy with typed decoding, and shared State becomes typed get/set accessors over the runtime extension functions. Identifier normalization and collision checks cover the Kotlin surface, inspect --json exposes generated-clients for every language, and CI compiles the generated client from the shared schema-matrix backend with the pinned Gradle/Kotlin toolchain.
• Add an agent-readable capability-sourcing contract. Generated projects now teach humans and coding agents how to choose among Racket packages, first-party native host APIs, safe FFI wrappers, argv-based CLI integrations, isolated sidecars, and owned implementations; inspect --json exposes the same decision order and release/security checklist as structured data.
• Complete the Linux release path. raco rivet release now runs on Linux: the verified self-contained package is packed into a deterministic ustar/gzip archive and signed with a detached Ed25519 signature (<installer>.tar.gz.sig, base64), configured through RIVET_LINUX_SIGN_PRIVATE_KEY and RIVET_LINUX_SIGN_KEY_ID. raco rivet verify --production re-derives the archive from the packaged directory, requires a byte-identical match with the released installer, and validates the signature against RIVET_LINUX_SIGN_PUBLIC_KEY; update manifests record the artifact as platform linux, installer kind targz. raco rivet package --production on Linux now points to raco rivet release, which owns the installer-level signing flow.