Release Simulator Broker 0.1.0-alpha.6

[VladimirBrejcha]

What changed

Prepares 0.1.0-alpha.6 from the combined green RR-24 and RR-25 main tree. It updates only current release/install surfaces, adds concise release notes, and pins the Formula and Cask to the exact retained CLI and signed/notarized app bytes. Historical Alpha references remain unchanged.

How you verified

• Final spec-only profile and public front-door tests: 51/51
• Full validation: broker core 294/294, client 258/258, harness adoption 24/24, macOS app 172/172, public surface 262 files
• Clean install and portable package smokes passed correlated app launch, snapshot decode, and refresh evidence
• CLI raw USTAR, npm package, and app ZIP structure/metadata checks passed
• Formula and Cask pins match the frozen CLI and app ZIP SHA-256 values
• Developer ID signature, hardened runtime, secure timestamp, notarization Accepted, staple, Gatekeeper, and universal arm64+x86_64 checks passed
• Current source and extracted release payload scans found no supported credential, private-key, or rooted machine-home leak
• Harness closeout passed with a clean worktree and structured commit
• I did not commit private paths, credentials, generated Xcode projects, local broker state, or task-session artifacts

Notes

The tag and four public assets will be published only after exact-head Connector review, supported MacBook Autopilot, hosted CI, merge, and post-merge CI. The retained operator bytes remain the Homebrew source of truth if the tag workflow rebuild differs.

This project is Alpha, macOS-only, and needs Xcode to talk to iOS Simulators. See CONTRIBUTING.md.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T08:15:10.355544Z	a5ee32d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[fiveonecode-autopilot]

Autopilot needs your choice — AD-20260901-001

Review finding (External review):
The active PR changes a guarded verifier or bootstrap implementation file.
Autopilot will not run HEAD verifier code or HEAD bootstrap until this exact implementation identity is authorized.
Keep-blocked does not run old product source; it refuses HEAD verifier/bootstrap and does not push.

Concrete operator choices:

• Authorize this contract change: accept HEAD implementation, then Autopilot may run HEAD verifier and HEAD bootstrap.
• Keep blocked until HEAD reverts: leave the PR blocked; Autopilot must not push, must not run HEAD bootstrap, and must not run HEAD verifier.

Implementation identity (paths and blob SHAs):
package-lock.json@afcdec3f64734374e0ee4a791998a3075c5f89c1..5c0cc15e2ad970d9f94d284c3bb488182b2dc991;package.json@8725fd461303fe77816b2741c476371d3afa8955..dbed95931438fec6e6c6928518812db59449c514

Guarded hits:

• package-lock.json (base blob afcdec3f64734374e0ee4a791998a3075c5f89c1, head blob 5c0cc15e2ad970d9f94d284c3bb488182b2dc991)
• package.json (base blob 8725fd461303fe77816b2741c476371d3afa8955, head blob dbed95931438fec6e6c6928518812db59449c514)
  Release Simulator Broker 0.1.0-alpha.6 #44

Autopilot's assessment:
The active PR changes a guarded verifier or bootstrap implementation file.
Autopilot will not run HEAD verifier code or HEAD bootstrap until this exact implementation identity is authorized.
Keep-blocked does not run old product source; it refuses HEAD verifier/bootstrap and does not push.

Concrete operator choices:

• Authorize this contract change: accept HEAD implementation, then Autopilot may run HEAD verifier and HEAD bootstrap.
• Keep blocked until HEAD reverts: leave the PR blocked; Autopilot must not push, must not run HEAD bootstrap, and must not run HEAD verifier.

Implementation identity (paths and blob SHAs):
package-lock.json@afcdec3f64734374e0ee4a791998a3075c5f89c1..5c0cc15e2ad970d9f94d284c3bb488182b2dc991;package.json@8725fd461303fe77816b2741c476371d3afa8955..dbed95931438fec6e6c6928518812db59449c514

Guarded hits:

• package-lock.json (base blob afcdec3f64734374e0ee4a791998a3075c5f89c1, head blob 5c0cc15e2ad970d9f94d284c3bb488182b2dc991)
• package.json (base blob 8725fd461303fe77816b2741c476371d3afa8955, head blob dbed95931438fec6e6c6928518812db59449c514)

Autopilot recommends:
Authorize this verifier implementation change — Autopilot will accept this exact HEAD verifier/bootstrap implementation identity, then may run HEAD verifier and HEAD bootstrap.

Choose what Autopilot should do next:

1. authorize-contract-change — Autopilot will accept this exact HEAD verifier/bootstrap implementation identity, then may run HEAD verifier and HEAD bootstrap.
2. keep-blocked-until-head-reverts — Autopilot will leave the PR blocked until HEAD reverts the guarded implementation. It will not push, will not run HEAD bootstrap, and will not run HEAD verifier.

Reply with exactly one:
Autopilot decision AD-20260901-001: choose authorize-contract-change
Autopilot decision AD-20260901-001: choose keep-blocked-until-head-reverts

Local artifact: job 20260901-161437-c19ed7da-a2ca-4340-9101-0d1450fe26a5/report.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a5ee32d282

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[VladimirBrejcha]

Autopilot decision AD-20260901-001: choose authorize-contract-change

[fiveonecode-autopilot]

Reviewed top-level PR feedback and left the current code unchanged.

These items were posted as PR review bodies or conversation comments rather than unresolved review threads, so this acknowledgement is recorded on the PR timeline.

• Source: Release Simulator Broker 0.1.0-alpha.6 #44 (comment)
  This is the generated Codex review activity summary, not an independent review finding or requested code change. No action is needed for this item.
• Source: Release Simulator Broker 0.1.0-alpha.6 #44 (review)
  The review body contains no standalone actionable feedback beyond the separate review thread, which is classified separately. No action is needed for the parent review body itself.