NurRouterOS 0.4.0-rc.4

Label: controlled-pilot candidate (QEMU). Not production-ready. Not bare-metal qualified.

Why rc.4 exists

Public 0.4.0-rc.3 remains available. rc.4 rebuilds the appliance overlay after post-ISO management fixes that were not in the published rc.3 ISO:

• nur-mgmt passwd home/shell repair (/etc/nurrouter/mgmt, /bin/ash) so Dropbear pubkey auth works
• nur-mgmt-ssh apply allowlist hardened (full apply argv; ash-safe character class)
• WinControl ApplianceSshOperation no longer shell-quotes validated overlay paths (matches appliance allowlist)

Final installer ISO

Honest gaps carried forward

• Bare-metal not qualified; QEMU/KVM evidence only
• OTA update tooling without automatic A/B rollback
• Bridge/VLAN and SNAT/DNAT UCI export present; dedicated live acceptance incomplete on fresh ISO
• Public source publication still requires a verified project-owned remote