diff --git a/.github/release-manifest.json b/.github/release-manifest.json index 28a48f2..228c727 100644 --- a/.github/release-manifest.json +++ b/.github/release-manifest.json @@ -62,5 +62,20 @@ "manualCompatibility": "pending", "manualCompatibilityScope": null }, - "candidate": null + "candidate": { + "version": "1.4.5", + "build": 13, + "tag": "v1.4.5", + "artifact": "Vifty-v1.4.5.zip", + "checksumAsset": "Vifty-v1.4.5.zip.sha256", + "artifactSummary": "Vifty-v1.4.5-artifact-summary.json", + "releaseChecklist": "Vifty-v1.4.5-release-checklist.md", + "sha256": null, + "artifactTrust": "pending", + "signingTrust": "pending", + "tagTrust": "signed-required", + "installedReleaseReview": "pending", + "manualCompatibility": "pending", + "manualCompatibilityScope": null + } } diff --git a/CHANGELOG.md b/CHANGELOG.md index b5dad32..9865ec9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [1.4.5] - 2026-08-08 + +### Fixed + +- Accept the macOS 26 `launchctl print-disabled` output format (`label => disabled`) in the helper lifecycle's disable confirmation, so the published-app migration from a v1.3.2 install can complete instead of failing closed at status 76. +- Harden remaining review findings: require an `.active` journal phase before idempotent re-apply confirmation, bound XPC manual/auto-restore request fields, remove Codex usage from the default custom menu-bar fields, make `capabilities` fail closed when the daemon returns no usable policy, and require full request equality for prepare idempotency. + +### Scope + +- `v1.4.4` published but cannot migrate a v1.3.2 install on macOS 26 because its bundled lifecycle predates the `=> disabled` confirmation fix; installed release-mode review and manual hardware compatibility remain pending for it and for `v1.4.5`. `v1.4.3` and `v1.4.1` remain retired without publication, and the prepared `v1.4.2` candidate was superseded before publication. + ## [1.4.4] - 2026-08-08 ### Fixed diff --git a/Resources/Info.plist b/Resources/Info.plist index 72a1054..6a54600 100644 --- a/Resources/Info.plist +++ b/Resources/Info.plist @@ -17,9 +17,9 @@ CFBundlePackageType APPL CFBundleShortVersionString - 1.4.4 + 1.4.5 CFBundleVersion - 12 + 13 LSMinimumSystemVersion 15.0 LSApplicationCategoryType diff --git a/docs/release-status.md b/docs/release-status.md index 712d148..3ccff8c 100644 --- a/docs/release-status.md +++ b/docs/release-status.md @@ -28,7 +28,7 @@ The separate supported-hardware review also passed with `manualSmokeTestResult: Future Developer ID publication uses an explicit solo-maintainer governance boundary rather than pretending an unavailable peer review exists. There is no eligible second human release reviewer today: zero required approvals is not a reviewer pass and must never be recorded as one. As of the 2026-07-18 administrator readback, active GitHub ruleset `18940029` (`Immutable Vifty release tags`) covers `refs/tags/v*`, prevents update and deletion, has a visible empty bypass list, and reports that the current administrator cannot bypass it. The live `release` environment has no required-reviewer rule and administrator bypass is disabled. Its deployment admission is now tag-only: `protected_branches: false`, `custom_branch_policies: true`, no branch policy, and exactly one custom policy (`54991885`) with type `tag` and pattern `v*`. Both the administrator and workflow-public environment checkers passed that exact state. This readback resolves the prior protected-branch-only blocker; every release must still acquire fresh pre-tag governance evidence after exact-main CI rather than treating this point-in-time statement as permanent proof. -Protected `main` requires a pull request with zero approvals and no bypass actors, strict Actions-owned `SwiftPM checks` for administrators, conversation resolution, and forbids force pushes and deletion. The existing six release secret names remain deliberately repository-scoped for this solo-maintainer workflow; the environment contains no same-name copies, and the checked-in workflow contract restricts every secret reference to the protected `sign-notarize` job after its non-secret checks. Only after release prep merge and successful push CI on that exact `main` SHA may `scripts/create-signed-release-tag.sh` run. The creator requires both the signer allowlist and `.github/release-gh-toolchain.json` to be byte-identical to the exact first parent, runs the exact committed manifest-history and workflow-contract gates, copies and verifies the pinned Darwin arm64 `gh` bytes before token access, rechecks exact-main CI, invokes the exact committed `scripts/check-release-governance.sh`, proves tag absence and the privileged facts, embeds those exact live `administrator-pretag` bytes plus the verifier/policy hashes in the signed annotated tag, and repeats the full live readback before reporting success. Despite its retained filename, `scripts/push-and-dispatch-signed-release-tag.sh` does not dispatch: it revalidates those facts, creates only the exact absent annotated tag with a compare-and-swap push, reads it back, and observes the `Release ` run that GitHub automatically creates for that tag push. It requires exactly one `push`-event run at attempt 1 and verifies its actor ID/login, repository, workflow path/ID, tag, commit, URL, and creation time. Immediately before the push boundary it creates a checkout-independent retired-tag marker and private receipt under `~/Library/Application Support/Vifty/ReleaseTransactions/Reedtrullz-Vifty//`. Those files are inspection evidence only and never retry authorization. A failure conclusively before both marker creation and remote mutation may be retried with fresh gates and proven exact-ref absence; once the marker exists or the tag may exist, a second helper invocation, manual dispatch, workflow rerun, or deleting/moving/reusing that tag is forbidden. Inspect the original marker, receipt, immutable tag, first-attempt run, and release state while the outcome is inconclusive; cut a new patch version only after the original transaction is conclusively shown not to have published. The workflow validates the embedded evidence with the committed `scripts/validate-release-governance-evidence.rb`, carries a current-fresh admission record in a complete inventoried candidate handoff, requires the signed ruleset ID to match the narrower public ruleset readback, and rechecks the same public revision and its own no-bypass state before and after promotion. The manifest candidate remains `null` until a separate release-prep pull request passes exact-main CI; no release is authorized by candidate metadata alone. +Protected `main` requires a pull request with zero approvals and no bypass actors, strict Actions-owned `SwiftPM checks` for administrators, conversation resolution, and forbids force pushes and deletion. The existing six release secret names remain deliberately repository-scoped for this solo-maintainer workflow; the environment contains no same-name copies, and the checked-in workflow contract restricts every secret reference to the protected `sign-notarize` job after its non-secret checks. Only after release prep merge and successful push CI on that exact `main` SHA may `scripts/create-signed-release-tag.sh` run. The creator requires both the signer allowlist and `.github/release-gh-toolchain.json` to be byte-identical to the exact first parent, runs the exact committed manifest-history and workflow-contract gates, copies and verifies the pinned Darwin arm64 `gh` bytes before token access, rechecks exact-main CI, invokes the exact committed `scripts/check-release-governance.sh`, proves tag absence and the privileged facts, embeds those exact live `administrator-pretag` bytes plus the verifier/policy hashes in the signed annotated tag, and repeats the full live readback before reporting success. Despite its retained filename, `scripts/push-and-dispatch-signed-release-tag.sh` does not dispatch: it revalidates those facts, creates only the exact absent annotated tag with a compare-and-swap push, reads it back, and observes the `Release ` run that GitHub automatically creates for that tag push. It requires exactly one `push`-event run at attempt 1 and verifies its actor ID/login, repository, workflow path/ID, tag, commit, URL, and creation time. Immediately before the push boundary it creates a checkout-independent retired-tag marker and private receipt under `~/Library/Application Support/Vifty/ReleaseTransactions/Reedtrullz-Vifty//`. Those files are inspection evidence only and never retry authorization. A failure conclusively before both marker creation and remote mutation may be retried with fresh gates and proven exact-ref absence; once the marker exists or the tag may exist, a second helper invocation, manual dispatch, workflow rerun, or deleting/moving/reusing that tag is forbidden. Inspect the original marker, receipt, immutable tag, first-attempt run, and release state while the outcome is inconclusive; cut a new patch version only after the original transaction is conclusively shown not to have published. The workflow validates the embedded evidence with the committed `scripts/validate-release-governance-evidence.rb`, carries a current-fresh admission record in a complete inventoried candidate handoff, requires the signed ruleset ID to match the narrower public ruleset readback, and rechecks the same public revision and its own no-bypass state before and after promotion. The manifest candidate records `v1.4.5` build `13` as pending until exact-main CI and signed-tag publication; no release is authorized by candidate metadata alone. The prior `v1.4.0` candidate is retired without publication. Its one-shot transaction created immutable annotated tag object `08259da0ad43b720938246848a5dae3bfc2221e0` at commit `8b39f8701ec3ea3d3e946de335f7cf95ee0b1908` and observed automatic first-attempt push run `29658220561`. That run passed its `Validate candidate version and signed tag` step and the complete unsigned build/inventory job, but the protected signing job failed during `Verify release environment protection` because the checker was invoked outside the nested trusted Git worktree. It exited before the required-secret check, Developer ID certificate import, signing, notarization, verified-asset upload, or publication; the publish job was skipped, and no draft, prerelease, or published `v1.4.0` GitHub Release exists. Do not rerun that workflow or delete, move, or reuse the tag. Recovery advances to `v1.4.1` build `9`; candidate metadata alone does not authorize a release. @@ -48,7 +48,7 @@ Update status: the exact public `v1.3.2` binary has no update checker and cannot Public release facts: - The public `Vifty-v1.4.4.zip` and checked-in cask both resolve to SHA-256 `d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f`. -- Release metadata in `Resources/Info.plist` and `Casks/vifty.rb` is aligned at `1.4.4` build `12` with SHA-256 `d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f`; installed release-mode and hardware compatibility evidence remain pending. +- Release candidate metadata in `Resources/Info.plist` is staged at `1.4.5` build `13`, while `Casks/vifty.rb` remains pinned to published `1.4.4` with SHA-256 `d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f`; candidate signing, installation, and hardware evidence remain pending. - Source CI run `29284751837` passed on release commit `6a771c2ea10386bf7a0a8369a759930f01d56062`, and Release run `29285576026` passed all signing, notarization, pre-publication verification, checklist, and publication steps. - The GitHub Release publishes `Vifty-v1.3.2.zip`, `Vifty-v1.3.2.zip.sha256`, `Vifty-v1.3.2-artifact-summary.json`, and `Vifty-v1.3.2-release-checklist.md`. - The published workflow summary and an independent downloaded-artifact verification both passed with TeamID `X88J3853S2`, no signature skips, and no notarization skips.