# v2.0.2 release qualification Status: [v2.0.2](https://github.com/hashimkarim/usagestat/releases/tag/v2.0.2) was published as a stable release on 2026-10-04 at 21:21:50 UTC from `f70ad758064dea4a8581814dfea8cd3e841c7dff` on `main`. GitHub, npm, AUR, Homebrew, COPR and the Ubuntu PPA are verified. The complete tagged release workflow passed. Existing releases remain unchanged. ## Scope Stable publication retains Linux x64/ARM64 with glibc 2.39+. Windows/macOS candidates run native release checks but remain excluded from stable downloads and npm. The release updates provider compatibility, native Codex accounting, OpenCode 2 storage and dashboard setup hints, and adds three disabled-by-default providers. See [release notes](v2.0.2.md). Native `/v1` readback, optional `agenticdriver.usage.v2` ingestion and the shared provider-icons `0.1.0-alpha.1` pin remain compatible. No model calls, production credential changes, new identity grants or installed-service rollout are part of this release. TypeSafe Cloudflare access and new provider live sessions retain their explicit qualification limits. ## Evidence - At version 2.0.2, 178 Rust workspace tests passed, with one existing systemd-session test ignored. The locked CLI/daemon build passed, as did the workspace check using the qualified Rust 1.89.0 toolchain. - Publishing tests passed 58 cases with two Windows-only skips on Linux; service/RPM update tests passed 22 cases, and both npm launcher tests passed. All 390 provider/dashboard JavaScript checks passed. The actual pinned Bar contract passed seven checks and native synthetic local-history acceptance passed six checks using the 2.0.2 debug binaries. All 100 provider manifests and modes, 20 vendored source hashes/licenses and 62 shared icon mappings passed their checks. - Read-only readiness verified AUR/Homebrew authentication and repository permissions, COPR build access for all four configured Fedora chroots, and PPA signing/upload permission. The single-destination doctor flags this README's intentional separate alpha links; manual review confirms they match the existing stable/alpha workflow and are not destination drift. - Preflight verified the earlier 2.0.1-1ppa1 in the direct Noble amd64 APT index. Final 2.0.2 package publication is verified separately below. The source desktop/mobile browser checks used a private isolated dashboard with every collector paused. Setup guidance and blank-field/save behavior passed, with no horizontal overflow or console errors. Synthetic/native fixtures do not establish authenticated access to a new provider account. - [Tagged release CI](https://github.com/hashimkarim/usagestat/actions/runs/37234674963) passed workspace tests, all five native builds, aggregate input verification, npm install rehearsals on five hosts, both Homebrew rehearsals and the Windows per-user installer. GitHub, npm, AUR, Homebrew, COPR and Ubuntu publication jobs passed, with an overall success conclusion. The separate [native foundation run](https://github.com/hashimkarim/usagestat/actions/runs/37234673616) also passed all five targets and complete same-source fixture verification. Windows/macOS desktop-session and minimum-system qualification remain pending; these checks do not promote their separate alpha downloads to stable. - All 14 downloaded GitHub assets matched public sizes/digests and SHA-256 sidecars. The live tag resolves to the source above. The public Linux x64 archive matches the CI candidate byte for byte. Its native archive checks passed all 16 checks, including all 100 bundled manifests, install layouts, QuickJS, SQLite, local fixture HTTP/filesystem access, private isolated data, daemon polling and readback. A separate public extraction passed all four dashboard collection/client checks. - Public npm metadata and every tarball file matched the three staged packages. A public registry install passed seven isolated checks for versions/resources, daemon health and graceful stop, local/one-off commands, missing optional dependency diagnostics, and retained data after stopped reinstall/uninstall. All three provenance predicates identify the immutable source and tagged release workflow. A fresh Linux x64 installation independently passed `npm audit signatures`: two packages verified registry signatures and two verified attestations. Publication used the existing trusted publisher. - The public Fedora 44 RPM passed signature verification using an isolated RPM database and the owned COPR key, repository checksum verification, update-unit/feed/hook payload checks and `%config(noreplace)` verification. Its separately compiled daemon reports 2.0.2 and passed all four native dashboard collection/client checks in an isolated profile. The RPM was extracted for checks, not installed on this machine. - Launchpad's completed Noble amd64 `.deb` matched its build's changes-file SHA-256 and size. Its extracted daemon reports 2.0.2 and passed the same four dashboard collection/client checks. The independent public APT download is byte-identical to that tested build. The archive's InRelease signature, the signed compressed Packages index checksum, and the advertised DEB digest and size all passed verification using an isolated public-key profile. - The ingestion schema, store and regression source are unchanged from v2.0.0. Prior real-record and AgenticDriver RC.2 qualification remains historical evidence; this release adds no app execution or provider-session qualification. Missing pricing and failed usage remain unknown. - The public tags, bodies and assets of v2.0.1, v2.0.0 and v2.0.0-alpha.4, and the corresponding three npm versions' integrity, were verified unchanged. [Machine-readable public verification](v2.0.2-verification.json) records the asset/package hashes and channel outcomes without credentials or account data. ## Immutable coordinates - Source: `f70ad758064dea4a8581814dfea8cd3e841c7dff`; tag: `v2.0.2`. - Linux x64 archive SHA-256: `0b7b2de373bca09f50465384e59f49faf8a84606e975341008fa0be7db8bef88`. - Linux ARM64 archive SHA-256: `7119ae6d4ad1afecbae3752d203478b51c009e2d53fa2da04c3b45c975595984`. - Public Linux x64 archive daemon SHA-256: `9cd4bd800981e8a73d1ed920885bdd797c65986e54193a9f4ed3c43cc17cec29`. - Fedora 44 RPM SHA-256: `23816712bc934814961f2e5741d8d64eaf70229a7739b406da5885425e463b70`. - Fedora 44 daemon SHA-256: `795ae20c08b688ab51e964d5603cd6c062decf2bb1f22dfab7bdda76cc412490`. - Noble amd64 DEB SHA-256: `0e598584f6d2eeaf9ebdf4d9c161ece84bd22ae0955f22587d5259687f77de2a`. ## Package channels - GitHub: stable Linux x64/ARM64 downloads and matching sidecars verified. - npm: `@hashimkarim/usagestat@2.0.2` and exact-version Linux x64/ARM64 native dependencies verified with `latest=2.0.2`; `alpha=2.0.0-alpha.4` is unchanged. - AUR: live `usagestat-bin` recipe and `.SRCINFO` are 2.0.2-1 at `01e46b87b39ba8d555603bb679453da9f2ef7fa0`, with the public archive digest. - Homebrew: live Linux formula is 2.0.2, with both public archive digests. - COPR: [build 11074458](https://copr.fedorainfracloud.org/coprs/hashimkarim/usagestat/build/11074458/) succeeded for Fedora 43, 44, 45 and Rawhide x86-64. Fedora 44 repository metadata advertises the verified 2.0.2-1.fc44 binary RPM. - Ubuntu PPA: [build 33813130](https://launchpad.net/~hashimkarim/+archive/ubuntu/usagestat/+build/33813130) succeeded at 21:39:52 UTC for Noble amd64, version 2.0.2-1ppa1. Launchpad published the binary at 22:06:13 UTC. The signed APT index and its matching public DEB were verified at 22:08:18 UTC. The existing upload was awaited; no duplicate submission was made. ## Installed-service boundary The normal RPM-owned readback installation and its loopback health still report 2.0.1. Its daily update timer is disabled/inactive. Publication did not replace system binaries or alter production configuration, credentials, autostart or SDK-owned services. To install the new dashboard and enable daily downloads: ```sh sudo dnf upgrade usagestat sudo systemctl enable --now usagestat-rpm-update.timer ``` The packaged transaction hook refreshes an already-running RPM-owned daemon after its binary is replaced. Refresh the dashboard after the upgrade.