Reedtrullz · Reedtrullz · Aug 8, 2026 · Aug 8, 2026
@@ -62,5 +62,20 @@
     "manualCompatibility": "pending",
     "manualCompatibilityScope": null
   },
-  "candidate": null
+  "candidate": {
+    "version": "1.4.5",
+    "build": 13,
+    "tag": "v1.4.5",
+    "artifact": "Vifty-v1.4.5.zip",
+    "checksumAsset": "Vifty-v1.4.5.zip.sha256",
+    "artifactSummary": "Vifty-v1.4.5-artifact-summary.json",
+    "releaseChecklist": "Vifty-v1.4.5-release-checklist.md",
+    "sha256": null,
+    "artifactTrust": "pending",
+    "signingTrust": "pending",
+    "tagTrust": "signed-required",
+    "installedReleaseReview": "pending",
+    "manualCompatibility": "pending",
+    "manualCompatibilityScope": null
+  }
 }
@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.4.5] - 2026-08-08
+
+### Fixed
+
+- Accept the macOS 26 `launchctl print-disabled` output format (`label => disabled`) in the helper lifecycle's disable confirmation, so the published-app migration from a v1.3.2 install can complete instead of failing closed at status 76.
+- Harden remaining review findings: require an `.active` journal phase before idempotent re-apply confirmation, bound XPC manual/auto-restore request fields, remove Codex usage from the default custom menu-bar fields, make `capabilities` fail closed when the daemon returns no usable policy, and require full request equality for prepare idempotency.
+
+### Scope
+
+- `v1.4.4` published but cannot migrate a v1.3.2 install on macOS 26 because its bundled lifecycle predates the `=> disabled` confirmation fix; installed release-mode review and manual hardware compatibility remain pending for it and for `v1.4.5`. `v1.4.3` and `v1.4.1` remain retired without publication, and the prepared `v1.4.2` candidate was superseded before publication.
+
 ## [1.4.4] - 2026-08-08
 
 ### Fixed

@@ -17,9 +17,9 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.4.4</string>
+	<string>1.4.5</string>
 	<key>CFBundleVersion</key>
-	<string>12</string>
+	<string>13</string>
 	<key>LSMinimumSystemVersion</key>
 	<string>15.0</string>
 	<key>LSApplicationCategoryType</key>

@@ -28,7 +28,7 @@ The separate supported-hardware review also passed with `manualSmokeTestResult:
 
 Future Developer ID publication uses an explicit solo-maintainer governance boundary rather than pretending an unavailable peer review exists. There is no eligible second human release reviewer today: zero required approvals is not a reviewer pass and must never be recorded as one. As of the 2026-07-18 administrator readback, active GitHub ruleset `18940029` (`Immutable Vifty release tags`) covers `refs/tags/v*`, prevents update and deletion, has a visible empty bypass list, and reports that the current administrator cannot bypass it. The live `release` environment has no required-reviewer rule and administrator bypass is disabled. Its deployment admission is now tag-only: `protected_branches: false`, `custom_branch_policies: true`, no branch policy, and exactly one custom policy (`54991885`) with type `tag` and pattern `v*`. Both the administrator and workflow-public environment checkers passed that exact state. This readback resolves the prior protected-branch-only blocker; every release must still acquire fresh pre-tag governance evidence after exact-main CI rather than treating this point-in-time statement as permanent proof.
 
-Protected `main` requires a pull request with zero approvals and no bypass actors, strict Actions-owned `SwiftPM checks` for administrators, conversation resolution, and forbids force pushes and deletion. The existing six release secret names remain deliberately repository-scoped for this solo-maintainer workflow; the environment contains no same-name copies, and the checked-in workflow contract restricts every secret reference to the protected `sign-notarize` job after its non-secret checks. Only after release prep merge and successful push CI on that exact `main` SHA may `scripts/create-signed-release-tag.sh` run. The creator requires both the signer allowlist and `.github/release-gh-toolchain.json` to be byte-identical to the exact first parent, runs the exact committed manifest-history and workflow-contract gates, copies and verifies the pinned Darwin arm64 `gh` bytes before token access, rechecks exact-main CI, invokes the exact committed `scripts/check-release-governance.sh`, proves tag absence and the privileged facts, embeds those exact live `administrator-pretag` bytes plus the verifier/policy hashes in the signed annotated tag, and repeats the full live readback before reporting success. Despite its retained filename, `scripts/push-and-dispatch-signed-release-tag.sh` does not dispatch: it revalidates those facts, creates only the exact absent annotated tag with a compare-and-swap push, reads it back, and observes the `Release <tag>` run that GitHub automatically creates for that tag push. It requires exactly one `push`-event run at attempt 1 and verifies its actor ID/login, repository, workflow path/ID, tag, commit, URL, and creation time. Immediately before the push boundary it creates a checkout-independent retired-tag marker and private receipt under `~/Library/Application Support/Vifty/ReleaseTransactions/Reedtrullz-Vifty/<tag>/`. Those files are inspection evidence only and never retry authorization. A failure conclusively before both marker creation and remote mutation may be retried with fresh gates and proven exact-ref absence; once the marker exists or the tag may exist, a second helper invocation, manual dispatch, workflow rerun, or deleting/moving/reusing that tag is forbidden. Inspect the original marker, receipt, immutable tag, first-attempt run, and release state while the outcome is inconclusive; cut a new patch version only after the original transaction is conclusively shown not to have published. The workflow validates the embedded evidence with the committed `scripts/validate-release-governance-evidence.rb`, carries a current-fresh admission record in a complete inventoried candidate handoff, requires the signed ruleset ID to match the narrower public ruleset readback, and rechecks the same public revision and its own no-bypass state before and after promotion. The manifest candidate remains `null` until a separate release-prep pull request passes exact-main CI; no release is authorized by candidate metadata alone.
+Protected `main` requires a pull request with zero approvals and no bypass actors, strict Actions-owned `SwiftPM checks` for administrators, conversation resolution, and forbids force pushes and deletion. The existing six release secret names remain deliberately repository-scoped for this solo-maintainer workflow; the environment contains no same-name copies, and the checked-in workflow contract restricts every secret reference to the protected `sign-notarize` job after its non-secret checks. Only after release prep merge and successful push CI on that exact `main` SHA may `scripts/create-signed-release-tag.sh` run. The creator requires both the signer allowlist and `.github/release-gh-toolchain.json` to be byte-identical to the exact first parent, runs the exact committed manifest-history and workflow-contract gates, copies and verifies the pinned Darwin arm64 `gh` bytes before token access, rechecks exact-main CI, invokes the exact committed `scripts/check-release-governance.sh`, proves tag absence and the privileged facts, embeds those exact live `administrator-pretag` bytes plus the verifier/policy hashes in the signed annotated tag, and repeats the full live readback before reporting success. Despite its retained filename, `scripts/push-and-dispatch-signed-release-tag.sh` does not dispatch: it revalidates those facts, creates only the exact absent annotated tag with a compare-and-swap push, reads it back, and observes the `Release <tag>` run that GitHub automatically creates for that tag push. It requires exactly one `push`-event run at attempt 1 and verifies its actor ID/login, repository, workflow path/ID, tag, commit, URL, and creation time. Immediately before the push boundary it creates a checkout-independent retired-tag marker and private receipt under `~/Library/Application Support/Vifty/ReleaseTransactions/Reedtrullz-Vifty/<tag>/`. Those files are inspection evidence only and never retry authorization. A failure conclusively before both marker creation and remote mutation may be retried with fresh gates and proven exact-ref absence; once the marker exists or the tag may exist, a second helper invocation, manual dispatch, workflow rerun, or deleting/moving/reusing that tag is forbidden. Inspect the original marker, receipt, immutable tag, first-attempt run, and release state while the outcome is inconclusive; cut a new patch version only after the original transaction is conclusively shown not to have published. The workflow validates the embedded evidence with the committed `scripts/validate-release-governance-evidence.rb`, carries a current-fresh admission record in a complete inventoried candidate handoff, requires the signed ruleset ID to match the narrower public ruleset readback, and rechecks the same public revision and its own no-bypass state before and after promotion. The manifest candidate records `v1.4.5` build `13` as pending until exact-main CI and signed-tag publication; no release is authorized by candidate metadata alone.
 
 The prior `v1.4.0` candidate is retired without publication. Its one-shot transaction created immutable annotated tag object `08259da0ad43b720938246848a5dae3bfc2221e0` at commit `8b39f8701ec3ea3d3e946de335f7cf95ee0b1908` and observed automatic first-attempt push run `29658220561`. That run passed its `Validate candidate version and signed tag` step and the complete unsigned build/inventory job, but the protected signing job failed during `Verify release environment protection` because the checker was invoked outside the nested trusted Git worktree. It exited before the required-secret check, Developer ID certificate import, signing, notarization, verified-asset upload, or publication; the publish job was skipped, and no draft, prerelease, or published `v1.4.0` GitHub Release exists. Do not rerun that workflow or delete, move, or reuse the tag. Recovery advances to `v1.4.1` build `9`; candidate metadata alone does not authorize a release.
 
@@ -48,7 +48,7 @@ Update status: the exact public `v1.3.2` binary has no update checker and cannot
 Public release facts:
 
 - The public `Vifty-v1.4.4.zip` and checked-in cask both resolve to SHA-256 `d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f`.
-- Release metadata in `Resources/Info.plist` and `Casks/vifty.rb` is aligned at `1.4.4` build `12` with SHA-256 `d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f`; installed release-mode and hardware compatibility evidence remain pending.
+- Release candidate metadata in `Resources/Info.plist` is staged at `1.4.5` build `13`, while `Casks/vifty.rb` remains pinned to published `1.4.4` with SHA-256 `d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f`; candidate signing, installation, and hardware evidence remain pending.
 - Source CI run `29284751837` passed on release commit `6a771c2ea10386bf7a0a8369a759930f01d56062`, and Release run `29285576026` passed all signing, notarization, pre-publication verification, checklist, and publication steps.
 - The GitHub Release publishes `Vifty-v1.3.2.zip`, `Vifty-v1.3.2.zip.sha256`, `Vifty-v1.3.2-artifact-summary.json`, and `Vifty-v1.3.2-release-checklist.md`.
 - The published workflow summary and an independent downloaded-artifact verification both passed with TeamID `X88J3853S2`, no signature skips, and no notarization skips.