docs(release): prepare 0.10.8 patch notes

[steipete]

Prepare the Unreleased notes for a proposed 0.10.8 patch release. Lead with the already-landed search fix: Spotify returns plural result containers, while both Web API search paths previously looked for singular keys. Keep the dependency and CI refresh below that user-facing correction and preserve @VACInc's credit.

Only CHANGELOG.md changes, and all published release sections remain untouched. This does not add OAuth support or publish a release.

Validation:

• Full Go test suite and coverage gate: 90.4% total coverage.
• Built CLI imported three synthetic Firefox SQLite cookies through SweetCookie, persisted their exact values with mode 0600, reported the expected auth-status flags, and cleared the cache with empty stderr.
• Dependency/Actions audit: selected application dependencies and Actions are current except libc v1.75.7, deliberately held because modernc.org/sqlite v1.58.0 documents an exact pairing with libc v1.75.6. Other outdated graph modules are unused or dependency test tools.
• Independent autoreview and exact-head CI details are recorded in the proof comment.

Release recommendation: 0.10.8 (patch). OAuth #57 remains a separate product decision; #61 is superseded by #57. Release authorization and the signed, notarized GitHub/Homebrew workflow remain separate steps.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[steipete]

Verified release-note preparation on exact head 235272c366bb1558d02da979d2abe8665be2dece.

Local checks:

• GOTOOLCHAIN=go1.26.8 ./scripts/check-coverage.sh 90: all packages passed, total coverage 90.4%.
• Built the actual CLI with Go 1.26.8. Its embedded VCS revision matches this head and vcs.modified=false; embedded libc remains v1.75.6.
• Exercised auth import --browser firefox --browser-profile <isolated synthetic SQLite database>, auth status, and auth clear with an isolated config. Three synthetic Spotify auth cookies were imported through SweetCookie/SQLite/libc, exact values were persisted, the cookie file had mode 0600, all status flags were true, and clear removed the cache. All commands exited successfully with empty stderr. No real browser profile, Spotify credentials, or account data were used.
• Confirmed every released changelog section is byte-identical to main.
• Independent autoreview, including the committed branch against origin/main, is scoped-clean through P2 with no actionable findings.

Dependency audit: keep SQLite v1.58.0 paired with libc v1.75.6, as upstream explicitly documents. The candidate libc v1.75.7 passed the full suite, race tests, lint, dead-code check, and local cookie workflow, but was withdrawn to retain that documented pairing. No dependency change remains in this PR.

CI: https://github.com/openclaw/spogo/actions/runs/33984664037 — success, including dead-code, lint, and coverage checks.

Proposed release: 0.10.8 patch, covering the already-landed search correction and maintenance refreshes. Publication still requires maintainer authorization and the unified signed/notarized GitHub release plus Homebrew verification.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 5, 2026, 2:39 PM ET / 18:39 UTC.

ClawSweeper review

What this changes

Promote the already-landed search repair to the Unreleased highlights, preserving contributor credit and existing maintenance notes.

Merge readiness

✅ Ready for maintainer review

The release-note edit is accurate, narrowly scoped, and ready for normal review. Its editorial improvement is absent from main, and collaborator-authored work is exempt from automatic closure.

Priority: P3
Reviewed head: 235272c366bb1558d02da979d2abe8665be2dece

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, accurate documentation patch with no actionable defects.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator-authored PR changes only changelog prose, so the contributor runtime-proof gate does not apply; its cookie-import validation is unrelated to the editorial change.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator-authored PR changes only changelog prose, so the contributor runtime-proof gate does not apply; its cookie-import validation is unrelated to the editorial change.
Evidence reviewed	6 items	Verified editorial scope: The pinned base-to-head diff changes only the Unreleased heading and search description: four additions and four deletions. Published sections and runtime files remain unchanged; diff whitespace validation passed. Search wording matches implementation: Both Client.Search and ConnectClient.searchViaWebAPI select response[kind+"s"]. The documented-response regression covers six search types through both paths, supporting the highlighted behavior. Main and release distinction: Fetched main already describes the search correction under Fixed, but does not contain this Highlights edit. Local version tags stop at v0.10.7, consistent with the supplied latest-release snapshot; this PR leaves the notes Unreleased.
Findings	None	None.
Security	None	None.

How this fits together

spogo is a Spotify command-line client. Its changelog summarizes landed changes for users and supplies release notes during the separately authorized publication process.

flowchart LR
  A[Landed search repair] --> C[Unreleased changelog]
  B[Dependency maintenance] --> C
  C --> D[Release preparation]
  D --> E[Published release notes]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep the search correction prominent in Unreleased notes and date the release section when publication is authorized.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR edits release prose; source and regression-test inspection substantiate its search description.

Is this the best way to solve the issue?

Yes. Reordering and clarifying the existing note achieves the stated editorial goal without altering release history or product behavior.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against e89c46fefed8.

Labels

Label changes:

• add P3: This is a small release-note presentation improvement with no runtime change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.

Label justifications:

• P3: This is a small release-note presentation improvement with no runtime change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.

Evidence

What I checked:

• Verified editorial scope: The pinned base-to-head diff changes only the Unreleased heading and search description: four additions and four deletions. Published sections and runtime files remain unchanged; diff whitespace validation passed. (CHANGELOG.md:5, 235272c366bb)
• Search wording matches implementation: Both Client.Search and ConnectClient.searchViaWebAPI select response[kind+"s"]. The documented-response regression covers six search types through both paths, supporting the highlighted behavior. (internal/spotify/search_response_test.go:12, 235272c366bb)
• Main and release distinction: Fetched main already describes the search correction under Fixed, but does not contain this Highlights edit. Local version tags stop at v0.10.7, consistent with the supplied latest-release snapshot; this PR leaves the notes Unreleased. (CHANGELOG.md:3, e89c46fefed8)
• Release preparation boundary: The release guide separates changelog preparation from workflow dispatch and publication verification. This PR explicitly prepares proposed notes without authorizing publication. (docs/RELEASING.md:32, 235272c366bb)
• Historical routing and inspection limit: Available logs connect Peter Steinberger to prior changelog updates and release documentation. Exact blame and older patch inspection failed because required historical objects were unavailable and github.com could not resolve; no source-line introduction attribution is claimed. (docs/RELEASING.md, e89c46fefed8)
• Related work remains separate: The supplied discussion identifies feat(auth): add Spotify OAuth PKCE #57 and feat(auth): add Spotify OAuth PKCE #61 as OAuth proposals. Neither replaces this editorial change, and this patch adds no OAuth release claim.

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.