API changelog and support policy

• Released MCP contract aune_mcp_v4 and Agent Skill 2.1.0 with self-contained JSON Schemas, explicit per-tool noauth/OAuth security schemes, and OAuth challenge metadata that clients can use to start account linking.
• Added aune.requests.read for caller-owned provider-follow-up status. Existing delegated clients must request the new scope and reauthorize before calling get_request_status.
• Removed session IDs, persistence backends, internal workflow states, timestamps, provider candidate records, and other nonessential diagnostics from MCP request-create and request-status responses.
• Corrected action annotations: anonymous option search is read-only and does not change open-world state; request creation is a consequential provider-follow-up write and is marked destructive for client approval.
• MCP v3 is superseded immediately for get_request_status because anonymous customer-specific status lookup was a security and privacy defect. Other v3 tool names and booking semantics remain source-compatible, but connectors must rescan v4 metadata.

• Added one versioned client-installation and diagnostics contract for ChatGPT, Claude, Codex, Cursor, VS Code, and generic MCP clients, exposed in human docs, machine Markdown, and a read-only MCP tool.
• Removed static bearer-token installation recipes from Claude and Codex distribution guidance; public clients now use OAuth 2.1 Authorization Code with PKCE and browser authorization.
• Added private, principal-scoped booking history to connected-app controls so users can inspect which delegated client created each booking and revoke access immediately.
• Added client-specific contract tests, retrieval eval coverage, and desktop/mobile browser evidence for the new documentation surface.
• Added an aggregate-only model regression dashboard by release, model, client, tool, vertical, and condition, with explicit 1,000-run safety-threshold status and protected raw traces.
• Added shared deployment markers to status and OpenTelemetry, candidate/canonical source-SHA verification, retained marker evidence, and post-rollback readiness verification.
• Hardened docs telemetry so zero-result searches are hashed, quickstart abandonment is emitted once, and telemetry delivery failures cannot masquerade as example failures.

• Added canonical `/v1` REST aliases and RFC problem responses.
• Added OAuth 2.1 discovery, dynamic registration, PKCE S256, narrow scopes, rotating refresh tokens, introspection, revocation, and connected-app control.
• Added atomic booking truth, cancellation, rescheduling, transactional outbox, signed webhooks, deterministic sandbox, docs search, TypeScript SDK, Python SDK, and CLI previews.
• Expanded MCP with docs search and booking lifecycle tools; moving follows the same confirmed-booking path as other supported verticals.

• Legacy `/api/public/*` routes return `Deprecation: true` and a successor link to `/v1`.
• A sunset date is announced only after equivalent production migration paths and telemetry exist.
• Security fixes may narrow unsafe behavior immediately, with a public incident or security note.
• Every public contract change updates OpenAPI, MCP schemas, Agent Card, SDK tests, examples, docs index, evals, and changelog in the same release.

Existing confirmed booking IDs, issued option verification windows, idempotency records, webhook event IDs, and consent evidence remain interpretable during rollback and version migration.