Skip to content

PUBLICATION_READINESS.md

Latest commit

 

History

History
225 lines (182 loc) · 14.3 KB

PUBLICATION_READINESS.md

File metadata and controls

225 lines (182 loc) · 14.3 KB
Raw

Publication readiness

Audit date: 2026-07-27

Candidate branch: release/final-feature-candidate

Audited candidate commit: 19892e7c02e092af4205a3166bdbf70b00140106

Runtime measurement commit: 727060fb03ad76d752d413db41bfa5d5132e3dc8

This report separates source publication from official binary distribution. It does not grant legal approval, select a license, change repository visibility, or authorize release assets.

Executive status

Distribution step Status Reason
Keep developing and testing privately ready Source, CI, measurements, physical validation, and packaging evidence are present
Make the source repository public blocked on owner decisions A license is missing; commit-email and historical release-asset exposure require explicit acceptance or cleanup
Publish unsigned source-build instructions blocked on the same source-publication decisions The instructions are accurate, but public redistribution terms are undefined without a license
Publish official app binaries not ready Developer ID signing, notarization, stapling, clean-machine tests, and final public assets remain incomplete

Audit scope

The audit covered:

  • the current tracked tree and ignored/generated-file boundaries
  • all reachable local and remote branches and tags after git fetch --all --prune --tags
  • filenames and unique blobs reachable from every Git ref
  • commit authors, committers, and email metadata
  • secret, credential, certificate, personal-path, email, phone, config, build-cache, log, crash, and large-blob patterns
  • Swift package dependencies, framework imports, scripts, and generated app icon source
  • PR #40 plus all listed open, closed, and merged pull requests
  • repository description, topics, visibility, branch protection, rulesets, and community files
  • GitHub Actions workflow permissions, all 53 listed run logs, and all 12 retained validation-artifact ZIPs
  • tags, published releases, checksums, and extracted v0.2.0/v0.3.0 assets

gitleaks and trufflehog were not installed, so this audit used Git object and content scans plus GitHub/API inspection. Pattern scans reduce risk but cannot prove that no unknown secret format exists. Enable GitHub secret scanning and push protection before public visibility where the account plan supports them.

Findings

Current tree

  • No API key, access token, password, private key, certificate, provisioning profile, Apple credential, .env file, personal home path, phone number, personal address, user config, tracked build cache, tracked .DS_Store, log, crash dump, or release binary was found in the current tracked tree.
  • .build/, dist/, DerivedData/, .swiftpm/, and .DS_Store are ignored. Local copies exist in the checkout but are not tracked.
  • The only absolute home paths in tracked source are synthetic /Users/test/... lifecycle-test fixtures.
  • No runtime networking, telemetry, updater, login-item, or launch-agent API was identified. Documentation references those terms only to state their absence.

Full Git history

Finding Severity Evidence Required action
No credential or private-key pattern found none observed Every reachable unique blob was scanned for common token, key, certificate, Apple credential, personal-path, email, and phone patterns Enable platform secret scanning as an additional gate; no credential revocation is indicated by this audit
Historical personal config filename low privacy/presentation Blob aa5cde3c83a6b72429073463d059cb291848fe99 appeared as config/denis-config.json; added by 52816c7 and removed by ffb3d01 Contents are ordinary mouse settings with no credential or identity value. History rewriting is unnecessary for security, but the owner must accept the personal filename becoming public or clean history deliberately before visibility changes
Commit author email owner privacy decision Reachable commits expose kulmand@post.bgu.ac.il in author/committer metadata Accept public disclosure or rewrite authors with git filter-repo before publication. Changing only future Git config will not alter existing commits

No credential requires revocation based on the material inspected. Do not rewrite history automatically: rewriting would replace commit SHAs referenced by the performance reports, tags, PRs, and release evidence.

Dependencies and assets

  • Package.swift declares no external Swift package dependency.
  • Runtime imports are Apple system frameworks such as Foundation, CoreGraphics, IOKit, AppKit, SwiftUI, Combine, Dispatch, and Darwin.
  • No vendored third-party source, third-party image, acknowledgement requirement, or copied license header was identified.
  • The app icon is generated by scripts/generate-app-icon.swift; the README PNG is generated from that same repository source.
  • Repository inspection cannot prove authorship. The owner should confirm that the icon design and all submitted source are theirs to license.

Existing releases and Actions artifacts

Item Result Publication impact
v0.2.0 source ZIP Checksum passed; contains config/denis-config.json; no secret or personal path was found Old personal filename becomes visible when the repository is public
v0.3.0 source ZIP Checksum passed; contains config/denis-config.json; no secret or personal path was found Predates the neutral defaults and final candidate
v0.3.0 app ZIP Ad-hoc signed, thin arm64, no Team ID, and contains the old default-config.json resource Must not be presented as an official signed or current multi-architecture binary
Final-candidate Actions artifacts Separate arm64 and x86_64 validation ZIPs; checksums passed; neutral defaults.json; no sensitive path found Suitable as CI validation evidence only; default signing is ad hoc
Actions logs All 53 listed run logs were scanned; no owner home path, commit email, Apple credential replacement, private-key marker, or common token marker was found Recheck after future runs and after visibility changes
Retained Actions artifacts All 12 retained validation ZIPs were downloaded and scanned; no sensitive entry or content match was found Validation-only archives remain ad-hoc signed

Before public visibility, the owner must decide whether to retain, remove, or clearly archive the v0.2.0/v0.3.0 assets. A new official release must be built from the final source state and must not reuse the old app ZIP.

Ready

  • Final candidate source is integrated without the rejected CGEvent-delta change.
  • CI passed generated-default, unit-test, release-build, linkage, source-archive, app-resource, arm64 archive, and x86_64 archive checks.
  • The release helper is 433,528 bytes with a 212,992-byte __TEXT segment.
  • One controlled 150.086-second idle run recorded zero CPU-time and wakeup growth, two stable threads, flat RSS and physical footprint, zero sockets, and zero normal-mode log files.
  • One MX Master 3S on macOS 26.5.1 passed the maintainer-run gesture, button, scrolling, trackpad, reconnect, power-cycle, sleep/wake, and lifecycle matrix.
  • Current source and app archive scripts exclude user config, tests, performance probes, build caches, Git metadata, and personal paths.
  • Separate Apple Silicon and Intel validation packages build successfully.
  • README, technical guide, architecture report, performance evidence, and public release procedure are present.

Must complete before public visibility

  1. Select a license and exact copyright-holder name. This is the hard legal blocker. Do not call the project open source until the license is committed.
  2. Decide whether the existing commit email may be public. If not, perform a planned history rewrite before visibility changes and update every SHA-based report, tag, PR reference, and release reference afterward.
  3. Decide how to handle the historical personal config filename and existing v0.2.0/v0.3.0 assets. No secret was found, but they are old and not the final public distribution state.
  4. Review repository presentation. The description is suitable and topics currently include macos, swift, logitech, mx-master, mouse, and accessibility. Consider adding native-app and performance, and set a custom social preview.
  5. Protect main. No branch protection or ruleset is configured. Require the Test workflow and block force pushes/deletion before accepting public changes.
  6. Enable security controls. Dependabot alerts, secret scanning, and code scanning are currently disabled. Actions have read-only default token permissions, which is good, but all third-party actions are allowed and SHA pinning is not required.
  7. Review public collaboration surfaces. CONTRIBUTING.md, SECURITY.md, issue templates, a pull request template, changelog, and code of conduct are absent. Add the files that match the intended contribution model.
  8. Review every public issue, PR, Actions log, artifact, tag, and release. Closed discussions and old artifacts become visible with the repository.
  9. Verify while signed out. After visibility changes, verify README links, badges, source access, release links, and issue/report links in a private browser window.

Must complete before official binary distribution

  1. Enroll in the Apple Developer Program.
  2. Obtain a Developer ID Application certificate.
  3. Build both architecture-specific apps from the final release commit.
  4. Sign the helper, settings executable, and app with hardened runtime.
  5. Submit both app archives for Apple notarization.
  6. Staple and validate the notarization ticket.
  7. Run Gatekeeper verification on fresh extractions.
  8. Test first launch, permissions, Start/Stop, gestures, scrolling, and uninstall on a clean Apple Silicon Mac.
  9. Repeat the clean-machine test on an Intel Mac.
  10. Generate and verify final SHA-256 checksums.
  11. Publish only the final signed assets and verify downloads while signed out.

The repository's existing app release is not a substitute for these steps.

License decision note

MIT

  • Short, familiar, and permissive.
  • A practical fit for a small native utility and broad community reuse.
  • Requires preservation of the copyright and license notice.
  • Does not include the explicit patent grant language found in Apache-2.0.

Apache-2.0

  • Permissive and business-friendly.
  • Includes an explicit contributor patent grant and patent-termination terms.
  • Longer and more formal, with NOTICE-related considerations when applicable.

Recommendation: MIT is the simpler default for this small, dependency-free utility unless the owner specifically wants Apache-2.0's explicit patent terms. The final choice and exact copyright-holder name remain owner decisions.

Community and repository recommendations

Item Current state Recommendation
Description Present and accurate Keep
Topics Six relevant topics Add native-app and performance if desired
Social preview Not independently verified Add a clean repository-owned image
Contributing guide Missing Add after contribution and license terms are decided
Security policy Missing Add a private vulnerability-reporting route before public launch
Issue/PR templates Missing Add concise bug, hardware-compatibility, and PR checklists
Code of conduct Missing Add only if community participation is actively invited
Changelog Missing Add before the next public release
Main protection Missing Require CI and block force pushes/deletion
Dependabot / secret / code scanning Disabled Enable the controls supported by the account plan
Actions permissions Read-only token default; all actions allowed Keep read-only token; consider restricting allowed actions and pinning action SHAs

Branch audit before merge

This table records the live branches before PR #40 is merged. Cleanup is allowed only after main contains the final candidate.

Branch PR PR status Unique work Decision after merge Reason
main - active default branch keep Required
release/final-feature-candidate #40 open draft complete candidate and publication documentation delete after merge Safe only after the normal merge commit and CI pass
fix/reset-interrupted-gesture #30 closed accepted implementation; report imported delete Candidate preserves implementation and evidence
fix/use-cgevent-movement-deltas #31 closed rejected rejected experiment; report imported delete Rejection is preserved in the report and closed PR
fix/abort-stale-gesture-holds #32 closed accepted implementation; report imported delete Candidate preserves implementation and evidence
perf/gesture-recovery-integration #33 closed pairwise evidence; report imported delete Candidate preserves accepted behavior and report
perf/reset-scroll-smoothing-state #34 closed accepted implementation; report imported delete Candidate preserves implementation and evidence
fix/preserve-scroll-delta-fields #35 closed accepted implementation; report imported delete Candidate preserves implementation and evidence
refactor/standardize-config-defaults #36 closed accepted implementation; report imported delete Candidate preserves implementation and evidence
release/public-distribution-readiness #37 closed accepted release tooling; report imported delete Candidate preserves implementation and evidence
perf/scroll-processing-integration #38 closed pairwise evidence; report imported delete Candidate preserves accepted behavior and report
perf/all-runtime-integration #39 closed cumulative runtime evidence; report imported delete Candidate preserves optimized runtime and report

Preserve performance-baseline-v1 and release tags v0.1.0, v0.2.0, and v0.3.0. Closed PR discussion remains available after branch deletion.

Final owner checkpoint

The current source tree is technically suitable for a public repository. The repository as a whole is not yet cleared for public visibility because the license, commit-email disclosure, and handling of older release assets require owner decisions. Official binaries are not ready to publish.