[PinableAgents]

Completed: merged and downloadable from main

Merged as 2eb057869ca11301edf1768e6ff68d8f95521e10. Main's code tree exactly matches validated PR head 2ade69507108d76e93359083aac1061aaedf3bb0.

Main runtime version: 20260922102929-2eb057869ca1.

Main complete download (all six platforms, 15 files, about 130 MB):
https://github.com/PinableAgents/CLIProxyAPI/actions/runs/35716265457/artifacts/10689356410

Main six-platform packaging and validation: SUCCESS
https://github.com/PinableAgents/CLIProxyAPI/actions/runs/35716265457

Main existing regression/build checks: SUCCESS
https://github.com/PinableAgents/CLIProxyAPI/actions/runs/35716265484

The main artifact was downloaded and independently checked: GitHub artifact SHA256 0a3974fd5acfb5982ae29c4f676eba4d8f4d1928de5649a3865420cfe3786165, all six archives/binaries/manifests, index, validation reports and SHA256SUMS match. The main Linux amd64 packaged executable also passed independent smoke validation outside Actions.

Implementation

Dedicated Pinable desktop runtime pipeline: native Windows/macOS/Linux, both amd64 and arm64; exact go.mod toolchain; CGO=0 portable profile; baseline CPU settings; full source SHA/version/source timestamp metadata; real PE/Mach-O/ELF checks; deterministic archive metadata and canonical license text. Downloads contain separate binary/archive SHA256 and sizes, embedded runtime.json, runtime-index.json, SHA256SUMS and validation.json.

macOS is ad-hoc signed before hashing, not Developer ID signed/notarized. Windows binaries are unsigned. CGO=0 removes the Unix dynamic-library loader; Windows retains the existing DLL loader. Third-party plugin execution is explicitly untested and no plugins are bundled.

Every main push, including an upstream-sync merge, generates Actions downloads. Single-platform retention is 30 days and complete-set retention is 90 days. Only explicit manual main-only publish_release=true can publish an immutable dedicated prerelease without replacing latest. No Release, tag or deployment has been performed. The optional publish job was correctly skipped on both PR and main push.

Desktop handoff boundary

Uses the attached Desktop build document's absolute CLIPROXYAPI_COMPONENT_ASSET override and preserves source/hash lock enforcement. Desktop source and lock schema were not retrieved: runtime-index.json is not component-lock.json, no Desktop lock is modified, CodeGraph is unchanged, and Wails end-to-end packaging is not claimed. A reviewed Desktop lock alignment is still required before consuming a different source/hash. See docs/pinable/desktop-runtime.md.

Native finding and production fix

Initial Windows/Linux smoke exposed loss of config-file notifications after atomic replacement. The only production change is eight lines additionally watching the config directory, preserving the original file watch and existing filters. New real-filesystem regressions require two consecutive replacements and a subsequent in-place write; unrelated siblings must remain ignored. Actual packaged binaries now pass atomic key rotation on all six platforms. No authentication/reload assertions were removed or weakened.

Verified before and after merge

• 28 packaging/publication-policy Python cases, eight existing sync-script cases and shell syntax: passed.
• Full normal-profile go test ./...: passed.
• Existing Codex bootstrap ordering regressions, 20 repetitions: passed.
• Six native portable-profile host test/build/package/smoke jobs: passed.
• Both version probes without config/file creation, both discovery JSON paths, exact authenticated runtime metadata, API/management credential separation, ephemeral-key survival across proven config rotation without persistence, authenticated loopback shutdown and parent-death shutdown: passed on every target.
• macOS signatures verified after extraction on both architectures.
• Complete-set assembly and independent downloaded-file verification: passed.

Earlier PR packaging: https://github.com/PinableAgents/CLIProxyAPI/actions/runs/35715593205
PR regression: https://github.com/PinableAgents/CLIProxyAPI/actions/runs/35715593236
PR build: https://github.com/PinableAgents/CLIProxyAPI/actions/runs/35715593217

Candidate Linux runtime independently passed smoke plus three repetitions; the distinct main runtime was separately downloaded and passed smoke again. No live provider accounts or historical API keys were used. Optional publication-policy tests use mocks, not an actual Release. Upstream release workflows, dependencies, model catalogs, credentials and Desktop locks remain unchanged.

[PinableAgents]

Runtime now published as Latest

Following the user's explicit request to publish a latest version on the Releases page, the already-verified main artifact is now a full, non-draft, non-prerelease Release:

https://github.com/PinableAgents/CLIProxyAPI/releases/tag/pinable-runtime-20260922102929-2eb057869ca1

The releases/latest API confirms release ID 393647097. Its tag points to original verified main SHA 2eb057869ca11301edf1768e6ff68d8f95521e10.

All 15 release attachments (six platform archives, six matching manifests, runtime-index.json, SHA256SUMS and validation.json) were validated from the original pinned Actions artifact. Publication checked both original main CI runs, all six native jobs, the artifact ZIP digest, archive/executable hashes and native reports. Every uploaded attachment's server-side SHA256 and size matched before the draft was published as Latest.

Publication run: https://github.com/PinableAgents/CLIProxyAPI/actions/runs/35717908936

No binaries were rebuilt, source changes were not merged into main, and Desktop locks were not modified. The one-time publication entry was removed from its separate publication branch after success. Ordinary main builds retain their existing non-publishing default; this explicitly requested full release does not silently enable future automatic stable releases. Existing signing and plugin limitations remain as documented.