chore[notask]: release @qvac/cli 0.12.0

[simon-iribarren]

🎯 What problem does this PR solve?

• Cuts the @qvac/cli 0.12.0 release. Four unreleased user-facing changes have landed on main since 0.11.0:
  • qvac configure interactive config generator (QVAC-23391 feat: add qvac configure interactive config generator #3953)
  • serve model catalog (QVAC-23390 feat[api]: browse models by capability (serve catalog) #3932)
  • preload: false lazy-load + reversible DELETE, and the flags/config that tune it (QVAC-23389 fix[api]: honor preload:false via lazy-load, keep DELETE reversible #3906)
  • qvac doctor --deep SDK runtime checks (feat[notask]: add deep SDK runtime checks to qvac doctor #3492)
• @qvac/cli still declares @qvac/sdk ^0.17.0, which predates the @qvac/sdk/schemas subpath that qvac configure imports.
• First package in the agent-stack cascade (cli → ai-sdk-provider → opencode-plugin / openclaw-plugin).

📝 How does it solve it?

• packages/cli/package.json — version 0.11.0 → 0.12.0
• packages/cli/package.json — @qvac/sdk ^0.17.0 → ^0.18.1
• packages/cli/changelog/0.12.0/ — CHANGELOG.md, CHANGELOG_LLM.md, api.md
• packages/cli/CHANGELOG.md — aggregate rebuilt (13 versions)

Minor bump per the 0.x policy: outstanding feat and [api] commits, no [bc]. No breaking.md is generated for this release.

Why #3953 and #3492 are in this PR

Both merged into main after release-cli-0.12.0 was cut. The release line is governed by a pull_request ruleset, so it cannot be fast-forwarded to the newer main tip — the only way onto the release line is through this PR. They are picked with -x, and their content is byte-identical to main.

Release order — merge after @qvac/sdk 0.18.1

qvac configure imports @qvac/sdk/schemas:

packages/cli/src/configure/param-schemas.ts:7
import { llamacppCompletionConfigSchema, llamacppEmbeddingConfigSchema } from '@qvac/sdk/schemas'

That subpath is added by #3975 (QVAC-23933) and ships in @qvac/sdk 0.18.1 — see #4000. It is not in @qvac/sdk 0.18.0; the exports map on release-sdk-0.18.0 has no ./schemas entry, while release-sdk-0.18.1 does.

Hence the ^0.18.1 floor rather than ^0.18.0: a caret on 0.18.0 would happily resolve to 0.18.0, which cannot satisfy the import.

Order of operations:

1. Merge QVAC-23933 chore: release @qvac/sdk 0.18.1 #4000 and get @qvac/sdk@0.18.1 onto npm.
2. Then merge this PR and publish @qvac/cli 0.12.0.
3. Then the rest of the cascade: provider chore[notask]: release @qvac/ai-sdk-provider 0.6.1 #3992 → plugins chore[notask]: release @qvac/opencode-plugin 0.3.0 #3994 / chore[notask]: release @qvac/openclaw-plugin 0.2.1 #3996.

Note @qvac/sdk 0.18.0's npm publish run (32474733436) is still waiting on environment approval, so nothing in the 0.18 line is on npm yet.

NOTICE needs regenerating before merge

#3953 adds a genuine third-party dependency — @inquirer/prompts, pinned exact 8.5.2 — and did not update packages/cli/NOTICE. Every other package in this cascade changed only internal @qvac/* ranges, so this is the one stale NOTICE. Regenerating needs GH_TOKEN/HF_TOKEN/NPM_TOKEN, which were not available in the environment that prepared this PR:

source .env
node .cursor/skills/qv-notice-generate/scripts/generate-notice.js cli

🧪 How was it tested?

• The four feature commits carry their own coverage and already passed CI on main (QVAC-23391 feat: add qvac configure interactive config generator #3953: unit 497/497 + e2e 140/140; QVAC-23389 fix[api]: honor preload:false via lazy-load, keep DELETE reversible #3906: unit 472/472 + model-tier e2e 75/75; QVAC-23390 feat[api]: browse models by capability (serve catalog) #3932: catalog unit+e2e 12/12; feat[notask]: add deep SDK runtime checks to qvac doctor #3492: 441 unit + 22 CLI e2e).
• Changelog generated with scripts/sdk/generate-changelog-sdk-pod.cjs --package=cli, based on merge-base(release-cli-0.11.0, main) = c6777063c. Release tags live on release branches and are never ancestors of main, so the generator's tag-ancestor fail-stop needs an explicit base.
• The [skiplog] 0.11.0 release PR (QVAC-23222 chore[skiplog]: backmerge release-cli-0.11.0 — version bump, changelog, NOTICE #3834) was correctly excluded; infra[notask]: revert incident-era macOS runner switches — back to qvac-macos26-arm64-gpu #3859 is CI-only and is kept out of CHANGELOG_LLM.md as having no reader value.
• prettier --check clean on changelog/0.12.0/**/*.md and CHANGELOG.md.
• Only conflict during the picks was packages/cli/package.json — the version/dep edit against QVAC-23391 feat: add qvac configure interactive config generator #3953's new dependency. Resolved by hand to keep all three: version 0.12.0, @qvac/sdk ^0.18.1, @inquirer/prompts 8.5.2.
• Not run here: lint, build, test:unit, test:e2e, check-publish-ready.cjs — this worktree has no node_modules. Worth a full run once @qvac/sdk@0.18.1 is installable, since that is what would catch the @qvac/sdk/schemas import failing against an older SDK.

[github-actions]

License compliance — clean

No new dependency license findings in this PR.

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./.github/actions/release-merge-guard
• ./docs/website
• ./packages/ggml-coload-smoke
• ./packages/fabric/test/integration
• ./packages/inference-addon-cpp/mobile
• ./packages/sdk/e2e
• ./packages/llm-llamacpp/benchmarks/performance
• ./packages/llm-llamacpp/benchmarks/server
• ./packages/vla-ggml/sim/server
• ./packages/embed-llamacpp/benchmarks/performance
• ./packages/embed-llamacpp/benchmarks/server
• ./packages/asr-ggml/benchmarks/server

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​inquirer/​prompts@​8.5.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		System shell access: npm @inquirer/external-editor in module node:child_process Module: node:child_process Location: Package overview From: packages/cli/package.json → npm/@inquirer/prompts@8.5.2 → npm/@inquirer/external-editor@3.0.4 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@inquirer/external-editor@3.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.