Skip to content

Release Simulator Broker 0.1.0-alpha.7 - #49

Merged
VladimirBrejcha merged 1 commit into
mainfrom
codex/alpha7-release
Sep 1, 2026
Merged

Release Simulator Broker 0.1.0-alpha.7#49
VladimirBrejcha merged 1 commit into
mainfrom
codex/alpha7-release

Conversation

@VladimirBrejcha

@VladimirBrejcha VladimirBrejcha commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What changed

Prepares 0.1.0-alpha.7 from exact RR-28 main. It updates only the established current release/install surfaces, documents that forgetting an inactive project no longer recreates it in the app Projects list, and pins the Formula and Cask to the exact retained CLI and signed/notarized app bytes. Alpha 6 history remains unchanged.

How you verified

  • Final spec-only profile and public front-door tests: 51/51
  • Full validation: broker core 294/294, client 258/258, harness adoption 24/24, macOS app 172/172, public surface 262 files
  • Clean install smoke and two retained portable-package smokes passed correlated app launch, snapshot decode, and refresh evidence
  • CLI raw USTAR, npm package, and app ZIP structure/metadata checks passed on the frozen bytes
  • Formula and Cask pins match the retained CLI and app ZIP SHA-256 values
  • Developer ID signature, hardened runtime, secure timestamp, Accepted zero-issue notarization, staple, Gatekeeper, system distribution policy, and universal arm64+x86_64 checks passed
  • Current-source and extracted-package scans found no supported credential, private-key, or rooted machine-home leak
  • Harness closeout passed with a clean worktree and structured commit
  • I did not commit private paths, credentials, generated Xcode projects, local broker state, or task-session artifacts

Notes

One initial portable package smoke exited with code 4 and emitted no diagnostic before its temporary evidence was cleaned. Two immediate exact reruns passed without a source or candidate-byte change. This is retained as a host/test near miss rather than hidden; no new release mechanism was added for a one-off condition.

The tag and four public assets will be published only after exact-head Connector review, supported MacBook Autopilot, hosted CI, merge, and post-merge CI. The retained operator bytes remain the Homebrew source of truth if the tag workflow rebuild differs.

This project is Alpha, macOS-only, and needs Xcode to talk to iOS Simulators. See CONTRIBUTING.md.

@VladimirBrejcha
release: prepare 0.1.0-alpha.7
0a60b7a 
Why:
RR-28 keeps forgotten inactive projects out of the app read model while preserving their event history, so the next immutable Alpha must contain that fix.

Changed:
- Bump the current CLI, npm, app, security, and install surfaces to 0.1.0-alpha.7.
- Document the read-model fix without changing the already-correct broker contract.
- Pin Formula and Cask to the exact retained Alpha 7 CLI and notarized app bytes.

Verification:
- npm run agent:verify -- --profile spec-only
- npm run test:docs
- ./scripts/validate.sh
- npm run test:install-smoke
- npm run test:package-smoke (two retained-evidence passes after one diagnostic-free host near miss)
- npm run verify:public-surface
- current-source, raw archive, isolated install, signature, notarization, staple, Gatekeeper, and universal binary audits

Affected:
Release metadata, newcomer install guidance, package versions, Formula/Cask pins, and the Alpha changelog.

Refs:
#47
91e42e5

Session:
task-sessions/alpha7-release-20260901
@VladimirBrejcha VladimirBrejcha added the autopilot:on Enable Autopilot processing for this PR label Sep 1, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-01T13:48:29.804372Z 0a60b7a PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@fiveonecode-autopilot

fiveonecode-autopilot Bot commented Sep 1, 2026

Copy link
Copy Markdown

Autopilot needs your choice — AD-20260901-001

Review finding (External review):
The active PR changes a guarded verifier or bootstrap implementation file.
Autopilot will not run HEAD verifier code or HEAD bootstrap until this exact implementation identity is authorized.
Keep-blocked does not run old product source; it refuses HEAD verifier/bootstrap and does not push.

Concrete operator choices:

  • Authorize this contract change: accept HEAD implementation, then Autopilot may run HEAD verifier and HEAD bootstrap.
  • Keep blocked until HEAD reverts: leave the PR blocked; Autopilot must not push, must not run HEAD bootstrap, and must not run HEAD verifier.

Implementation identity (paths and blob SHAs):
package-lock.json@5c0cc15e2ad970d9f94d284c3bb488182b2dc991..26a7f5904ee19e4fa8e9b74ad1be86ec4e345222;package.json@dbed95931438fec6e6c6928518812db59449c514..32f2ddcebcc2349c10a7dfc73173ad4dad21175e

Guarded hits:

  • package-lock.json (base blob 5c0cc15e2ad970d9f94d284c3bb488182b2dc991, head blob 26a7f5904ee19e4fa8e9b74ad1be86ec4e345222)
  • package.json (base blob dbed95931438fec6e6c6928518812db59449c514, head blob 32f2ddcebcc2349c10a7dfc73173ad4dad21175e)
    Release Simulator Broker 0.1.0-alpha.7 #49

Autopilot's assessment:
The active PR changes a guarded verifier or bootstrap implementation file.
Autopilot will not run HEAD verifier code or HEAD bootstrap until this exact implementation identity is authorized.
Keep-blocked does not run old product source; it refuses HEAD verifier/bootstrap and does not push.

Concrete operator choices:

  • Authorize this contract change: accept HEAD implementation, then Autopilot may run HEAD verifier and HEAD bootstrap.
  • Keep blocked until HEAD reverts: leave the PR blocked; Autopilot must not push, must not run HEAD bootstrap, and must not run HEAD verifier.

Implementation identity (paths and blob SHAs):
package-lock.json@5c0cc15e2ad970d9f94d284c3bb488182b2dc991..26a7f5904ee19e4fa8e9b74ad1be86ec4e345222;package.json@dbed95931438fec6e6c6928518812db59449c514..32f2ddcebcc2349c10a7dfc73173ad4dad21175e

Guarded hits:

  • package-lock.json (base blob 5c0cc15e2ad970d9f94d284c3bb488182b2dc991, head blob 26a7f5904ee19e4fa8e9b74ad1be86ec4e345222)
  • package.json (base blob dbed95931438fec6e6c6928518812db59449c514, head blob 32f2ddcebcc2349c10a7dfc73173ad4dad21175e)

Autopilot recommends:
Authorize this verifier implementation change — Autopilot will accept this exact HEAD verifier/bootstrap implementation identity, then may run HEAD verifier and HEAD bootstrap.

Choose what Autopilot should do next:

  1. authorize-contract-change — Autopilot will accept this exact HEAD verifier/bootstrap implementation identity, then may run HEAD verifier and HEAD bootstrap.
  2. keep-blocked-until-head-reverts — Autopilot will leave the PR blocked until HEAD reverts the guarded implementation. It will not push, will not run HEAD bootstrap, and will not run HEAD verifier.

Reply with exactly one:
Autopilot decision AD-20260901-001: choose authorize-contract-change
Autopilot decision AD-20260901-001: choose keep-blocked-until-head-reverts

Local artifact: job 20260901-214754-72b61361-74fb-45a0-b7c4-f4fb6b25eef5/report.md

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Sep 1, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a60b7a6c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread CHANGELOG.md
@fiveonecode-autopilot

fiveonecode-autopilot Bot commented Sep 1, 2026

Copy link
Copy Markdown

Autopilot recorded decision AD-20260901-001: selected authorize-contract-change.

Operator: @VladimirBrejcha

@fiveonecode-autopilot

fiveonecode-autopilot Bot commented Sep 1, 2026

Copy link
Copy Markdown

Reviewed top-level PR feedback and left the current code unchanged.

These items were posted as PR review bodies or conversation comments rather than unresolved review threads, so this acknowledgement is recorded on the PR timeline.

@VladimirBrejcha
VladimirBrejcha merged commit c373a48 into main Sep 1, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

autopilot:on Enable Autopilot processing for this PR

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@VladimirBrejcha