Tests never call the API. Commands that need your Cohere key load .env through uv, for example the manual smoke check, which makes a handful of real calls: uv run --env-file .env python scripts/cohere ...

SignTool operates on short private paths; publication copies verified bytes to the target volume before atomic replacement. Final Windows trust, certificate, timestamp and normalized full-file ...