docs: record verified updater PR handoff

Author: cixiangtao

TASK_PROGRESS.md

@@ -1,5 +1,46 @@
 # Task Progress
 
+## Verified in-app update handoff PR (2026-08-11)
+
+- [goal] Replace the current macOS release-page-only update action with an explicit,
+  verified DMG handoff. The client may download the exact newer GitHub Release
+  artifact only after the user confirms; it must
+  validate the canonical repository/tag/asset identity, bounded byte count,
+  GitHub asset SHA-256 digest, and `SHA256SUMS.txt` before opening the DMG.
+- [scope] Feature branch `codex/verified-auto-update` from clean `main` at
+  `6f789be4570b1d5c9e7e60545f22173195968720` (`v1.5.12`). No matching upstream
+  auto-update Issue or PR was found. Preserve the existing background check and
+  notification behavior; do not silently replace the running application, skip
+  system install UI, remove quarantine, weaken execution policy, or trust an
+  arbitrary release/download URL. Windows is intentionally excluded: open Issue
+  #276 already owns bounded update-response parsing, and its PowerShell 5.1/
+  Setup handoff should be reviewed in a separate PR rather than coupled here.
+- [implemented] The macOS menu now asks before downloading, then re-reads the
+  exact stable tag, requires unique canonical DMG/checksum assets, enforces
+  bounded sizes and approved HTTPS redirects, verifies both GitHub asset
+  digests and `SHA256SUMS.txt`, mounts the DMG read-only, and checks the unique
+  App bundle ID, App/engine version, and code-signature integrity. Only the
+  verified DMG is moved into a private cache and opened; the running App is
+  never replaced automatically. Background checks still do not download.
+- [verified] Live v1.5.12 metadata check, shell syntax, `git diff --check`, Swift
+  frontend parse, shared-runtime sync check, 93 portable Node tests, and the
+  macOS suite all pass. The macOS suite covers the valid handoff plus checksum,
+  identity, URL, duplicate asset, draft Release, cache symlink, oversized
+  version component, and conflicting-mode rejection. Signed-runtime, Doctor,
+  and real ChatGPT integration were intentionally skipped; this machine lacks
+  the full matching Xcode platform, so SwiftPM/XCTest and the DMG build remain
+  CI requirements.
+- [submitted] Feature commit `e98b12c` was pushed to
+  `cixiangtao:codex/verified-auto-update`; Draft PR #355 targets
+  `Fei-Away/Codex-Dream-Skin:main`:
+  https://github.com/Fei-Away/Codex-Dream-Skin/pull/355
+- [current] Waiting for the Draft PR's macOS CI to provide the full
+  SwiftPM/XCTest and packaged-DMG evidence unavailable on this machine.
+- [pending] A real newer public Release does not exist yet, so clicking the
+  menu through a production download/open flow remains a post-release smoke
+  test; automated tests never launch an installer. Keep this PR scoped to the
+  macOS guided handoff and do not fold #276 or #237 into it.
+
 ## Client release v1.5.12 (2026-08-08)
 
 - [scope] Reviewed and merged 10 pending community/self PRs that had accumulated