kaikkone4 · kaikkone4 · Jul 4, 2026 · Jul 3, 2026 · Jul 3, 2026 · Jul 3, 2026
diff --git a/README.md b/README.md
@@ -2,7 +2,7 @@
 
 Vire is a local-only macOS desktop app for project time tracking, AI usage evidence, and billing review. It imports AI traces (pi, Claude Code) from a **local Docker self-hosted Langfuse stack** as the primary AI time/usage/cost evidence source and requires human approval before any billable or profitability total is computed.
 
-Current version: v0.8.0. Includes manual time entries, projects, reports (with Last 7/14/30/90 day quick-range presets), and CSV export; a local Docker Langfuse AI trace importer with configurable range, backfill, and diagnostics; and an AI time-entry suggestion engine that proposes time blocks from imported Langfuse evidence for human review and explicit acceptance — nothing is auto-posted. Accepted suggestions carry AI cost (where available), visible in Reports summary cards and in the CSV export as `cost_total`/`cost_currency` columns. The Suggestions view provides actionable notices for unmapped environments, untimed entries, and a disabled Langfuse source (TASK-034).
+Current version: v0.8.2. Includes manual time entries, projects, reports (with Last 7/14/30/90 day quick-range presets), and CSV export; a local Docker Langfuse AI trace importer with configurable range, backfill, and diagnostics; and an AI time-entry suggestion engine that proposes time blocks from imported Langfuse evidence for human review and explicit acceptance — nothing is auto-posted. Accepted suggestions carry AI cost (where available), visible in Reports summary cards and in the CSV export as `cost_total`/`cost_currency` columns. The Suggestions view provides actionable notices for unmapped environments, untimed entries, and a disabled Langfuse source (TASK-034).
 
 **New in v0.8.0:** an opt-in zero-permission active-app and idle capture loop (default OFF). **Settings →
 Active-window capture** provides the enable toggle, sample-interval/idle/retention controls, a live capture
@@ -69,7 +69,7 @@ The quickest way to run Vire is to install the prebuilt macOS app — no toolcha
 Building from source (below) is the alternative for developers, not the primary install path.
 
 1. Open the [latest release](https://github.com/kaikkone4/vire/releases/latest) and download the
-   DMG asset **`Vire_0.8.1_aarch64.dmg`** (Apple Silicon / `aarch64` only — Intel Macs are not
+   DMG asset **`Vire_0.8.2_aarch64.dmg`** (Apple Silicon / `aarch64` only — Intel Macs are not
    supported by this build).
 2. Double-click the downloaded `.dmg` to mount it, then drag **only `Vire.app`** onto the
    `Applications` shortcut in the DMG window. Drag just the app — do **not** Select-All (⌘A) and
@@ -121,7 +121,7 @@ npm run tauri:build
 | Artifact | Path |
 |---|---|
 | App bundle | `src-tauri/target/release/bundle/macos/Vire.app` |
-| Disk image (where the toolchain supports it) | `src-tauri/target/release/bundle/dmg/Vire_<version>_<arch>.dmg` (e.g. `Vire_0.8.1_aarch64.dmg`) |
+| Disk image (where the toolchain supports it) | `src-tauri/target/release/bundle/dmg/Vire_<version>_<arch>.dmg` (e.g. `Vire_0.8.2_aarch64.dmg`) |
 
 ### Install and run
 

diff --git a/RELEASE.md b/RELEASE.md
@@ -1,5 +1,42 @@
 # Vire — Release Notes
 
+## v0.8.2 — Publish the TASK-056 Settings UI so an older build detects the update (TASK-057)
+
+**Branch:** `feat/task-057-publish-v082-release`
+**PR:** #44
+
+### What changed
+
+This release makes the **TASK-056 in-app Active-window capture Settings panel discoverable** to anyone running the distributed `0.8.1` build. TASK-056 (PR #43, merge `df79423`) shipped the **Settings → Active-window capture** panel — the enable toggle, sample-interval/idle/retention controls, a live capture status/health readout, and a Captured-vs-Never-captured privacy table with truthful status/privacy copy — but carried **no version bump**, so `main` still read `0.8.1` and the latest Release was still `v0.8.1`. A distributed `0.8.1` build ran "Check for updates" and resolved **UpToDate**, so the new UI was invisible to anyone on the released binary. This release reconciles the version metadata to `0.8.2` and publishes a `v0.8.2` Release for the check to point at.
+
+- **Version metadata reconciled `0.8.1` → `0.8.2`.** `src-tauri/Cargo.toml`, `src-tauri/tauri.conf.json`, and the `vire` package entry in `src-tauri/Cargo.lock` (regenerated by `cargo build`) now all read `0.8.2`, so the Tauri/Cargo metadata and the in-app current-version string (`CARGO_PKG_VERSION`) agree.
+- **Published GitHub Release.** A single **full** (non-draft, non-prerelease) Release tagged `v0.8.2` is published against the merged `main` commit that includes TASK-056 (published by the Release Manager in SW-6, after this change merges), so `/releases/latest` returns `v0.8.2`. Once published, the distributed `0.8.1` build resolves "Check for updates" to **UpdateAvailable (0.8.1 → 0.8.2)** with a real `release_url`; a rebuilt `0.8.2` build resolves to **UpToDate**; "Open GitHub Releases" reaches a real release page.
+
+**No source/schema/CSP/dependency change beyond the version strings.** `src-tauri/src/update_check/` (comparison logic, IPC commands, bounded fail-soft client, scoped opener capability, canonical-owner guards) is untouched. No `tauri-plugin-updater`, no download/install/auto-updater, no signing/notarization, and no schema/migration/IPC-storage/CSP/capture/Langfuse change — the only delta is the three version strings, this changelog entry, and the README version/artifact references.
+
+### DMG asset + unsigned first-launch remedy (Plan B)
+
+The published `v0.8.2` Release attaches the built **`Vire_0.8.2_aarch64.dmg`** (Apple Silicon / `aarch64` only, matching the `v0.8.1` single-arch precedent), built from the merged `main` head that includes TASK-056. The build is **unsigned and unnotarized**: a browser-downloaded copy carries `com.apple.quarantine`, so Apple Silicon Gatekeeper reports **"Vire is damaged and can't be opened"** — a policy verdict, not corruption, and right-click → Open does not clear it. The one-time, per-app remedy is to run, after copying the app to `/Applications`:
+
+```sh
+xattr -dr com.apple.quarantine /Applications/Vire.app
+```
+
+Only run this for a DMG downloaded from the official [Vire releases page](https://github.com/kaikkone4/vire/releases) that you trust. The quarantine attribute is stamped by Gatekeeper **on the user's Mac at download time** — it is not present in the shipped artifact, so nothing in the DMG pre-clears it and no quarantine-bypass is (or can be) embedded in the artifact. The only fix that removes the user step is a valid Apple Developer ID signature plus notarization, tracked as **TASK-028**. This is the same Plan B validated on a physical Mac in TASK-054; the notes never instruct `sudo` or a global Gatekeeper disable.
+
+### Compatibility and rollback
+
+Version-string + docs change only; no runtime, schema, IPC, capability, or dependency delta from v0.8.1. The shipped `.app` behaves identically to the TASK-056 `main` build. Rollback: reinstall the prior `Vire_0.8.1_aarch64.dmg` — no cleanup step, no data migration. Deployment size: **patch**. Rollback: **automated**.
+
+### Verification (Part A)
+
+- `cargo build` succeeds; `Cargo.lock` `vire` = `0.8.2`; the version triple agrees at `0.8.2`.
+- `cargo test update_check` green (comparison logic + canonical-owner guards unchanged).
+- `updateCheckUi.test.mjs` green; `npm run build` and `cargo fmt --all -- --check` clean.
+- `openspec validate task-057-publish-v082-release --strict` passes.
+
+Live release verification (0.8.1 build → **UpdateAvailable**; 0.8.2 build → **UpToDate**; DMG asset present and downloadable; `/releases/latest` = `v0.8.2`) is performed in SW-6 (Part B), after this change merges and the Release is published.
+
 ## v0.8.1 — Make the update-check usable: release URL hotfix + first GitHub Release (TASK-052)
 
 **Branch:** `feat/task-052-publish-v081-release`

diff --git a/openspec/changes/task-057-publish-v082-release/RELEASE.md b/openspec/changes/task-057-publish-v082-release/RELEASE.md
@@ -0,0 +1,168 @@
+# Release — TASK-057 · Vire v0.8.2 (Part A)
+
+**Gate:** SW-6 Release · **Tier:** L2 · **Date:** 2026-07-03
+**Branch / PR:** `feat/task-057-publish-v082-release` · PR #44 (base `main`)
+**Commit:** `aa4ec09` (merge base `origin/main` = `df79423`, the TASK-056 merge)
+**Tag:** `task-057/v0.8.2` (signed, SSH format)
+
+---
+
+## Summary
+
+Metadata-only patch: version strings reconciled `0.8.1 → 0.8.2` across `src-tauri/Cargo.toml`,
+`src-tauri/tauri.conf.json`, and `src-tauri/Cargo.lock` (`vire` package entry only — zero dep
+drift). `RELEASE.md` (repo root) prepended with a `## v0.8.2` entry; `README.md` version header
+and DMG-filename examples updated. No source, schema, CSP, IPC, dependency, or capability change.
+Publishes the version bump the TASK-056 Settings UI needed so an already-distributed `0.8.1`
+build's "Check for updates" resolves to **UpdateAvailable** instead of **UpToDate**, once the
+Release itself is published in Part B.
+
+**Part A** (this PR): land `0.8.2` metadata + docs on `main`.
+**Part B** (SW-6, post-merge): build `Vire_0.8.2_aarch64.dmg`, publish full non-draft/non-prerelease
+GitHub Release `v0.8.2` on merged `main`, live-smoke the update check. Not performed in this gate —
+explicitly out of scope per task instruction.
+
+---
+
+## Gate results
+
+| Gate | Verdict | Evidence |
+|------|---------|----------|
+| SW-3 QA | **PASS** | `qa.md` — change scope 1:1 with `proposal.md`/`tasks.md`; `cargo test update_check` 11/11, `updateCheckUi.test.mjs` 12/12, `cargo fmt` clean, `npm run build` clean, `openspec validate --strict` passes |
+| SW-4 Code Review | **PASS** | `review.md` — version triple consistent at `0.8.2`; `Cargo.lock` numstat `1 1`; no blocking issues, no suggestions |
+| SW-5 Security | **PASS** | `sec.md` — gitleaks 0 leaks; semgrep 0 ERROR; Trivy 0/0; OSV advisories all pre-existing byte-identical to base, zero dep drift introduced |
+| Documentation | **PASS (complete)** | `docs.md` — README/RELEASE independently re-verified: version, TASK-056 inclusion, update-check wording, manual-install (no auto-updater claim), Plan B xattr remedy + trust caveat + TASK-028 pointer all accurate; no doc edits required |
+
+---
+
+## Declaration 1 — Deployment size: **PATCH**
+
+Semantic version change: `0.8.1 → 0.8.2` — no breaking change, no new user-facing feature in this
+Part A diff itself (the underlying TASK-056 Settings UI was already merged to `main` at `df79423`
+without a version bump). The only code delta here is three version-string lines, one `RELEASE.md`
+changelog entry, and two `README.md` doc edits. This corrects a metadata inconsistency (the
+TASK-056 UI shipped on `main` but `main` still reported `0.8.1`, so a distributed `0.8.1` build's
+update check resolved `UpToDate` and the new UI was undiscoverable) and prepares the version for
+the Part B Release publish. Patch-tier by SemVer, consistent with the TASK-052/v0.8.1 precedent.
+
+---
+
+## Declaration 2 — Rollback strategy: **automated**
+
+Single-surface rollback for this Part A change: `git revert <merged-sha>` on `main`, reviewed and
+merged as a normal PR. The diff is fully deterministic (three version-string lines + one changelog
+block + two doc lines) — no data migration, no schema/IPC/capability change to reconcile, no
+credential or Keychain state to restore. Verify: `src-tauri/Cargo.toml`/`tauri.conf.json` read
+`0.8.1` again and `cargo test update_check` still passes (comparison logic itself is untouched by
+either the forward change or the revert).
+
+For an end user who already installed the `v0.8.2` DMG (Part B), rollback is simpler still:
+reinstall the prior `Vire_0.8.1_aarch64.dmg` — no cleanup step, no data migration, matching the
+root `RELEASE.md` v0.8.2 entry's declared end-user rollback.
+
+**L2 note:** rollback path validated by inspection only (deterministic single-file-class diff);
+no staging rebuild was performed this gate since Part A ships no runtime behavior change to
+regress — the identical `update_check` test suite (11/11) passes both before and after the
+version-string diff.
+
+---
+
+## Declaration 3 — Component compatibility matrix
+
+No dependency, toolchain, or platform-minimum change from the `0.8.1` baseline (`task-052`). This
+change is version-string + docs only.
+
+### Runtime and toolchain
+
+| Component | Min version | Tested on | Notes |
+|-----------|-------------|-----------|-------|
+| Vire | 0.8.2 | 0.8.2 | this release |
+| macOS | 10.13 (High Sierra) | — (Part B live smoke pending, physical-Mac step) | Tauri 2.x platform minimum; macOS-only binary |
+| Rust toolchain | 1.56 (edition 2021) | per CI/session toolchain | edition 2021 minimum, unchanged |
+| Cargo | ≥1.56 | matches Rust toolchain | unchanged |
+
+### Tauri framework (Cargo) — unchanged, zero lockfile diff beyond `vire` self-version
+
+| Crate | Spec version | Resolved version | Notes |
+|-------|-------------|-----------------|-------|
+| `tauri` | `2.2` | `2.11.2` | no feature flags |
+| `tauri-build` | `2.0` | resolved in lock | build-only |
+
+### Frontend / tooling — unchanged
+
+| Package | Spec version | Notes |
+|---------|-------------|-------|
+| `@tauri-apps/api` | `^2.2.0` | Tauri JS bridge |
+| `@tauri-apps/plugin-dialog` | `^2.2.0` | dialog plugin |
+| `@tauri-apps/cli` | `^2.2.0` | dev CLI, build-time only |
+| TypeScript | `^5.7.2` | strict mode |
+| Vite | `^6.4.3` | bundler |
+| tsx | `^4.22.0` | test runner |
+
+### Upstream/downstream services
+
+| Service | Version / endpoint | Notes |
+|---------|--------------------|-------|
+| GitHub Releases API | `/repos/kaikkone4/vire/releases/latest` | polled by in-app update-check; published in Part B |
+| GitHub Releases UI | `github.com/kaikkone4/vire/releases` | "Open GitHub Releases" target; no version lock |
+
+**Carry-forward advisories (pre-existing baseline, not introduced by this change, byte-identical
+to base `df79423`):** `quick-xml 0.39.4` (RUSTSEC-2026-0194/0195, 7.5 HIGH each — reachable only via
+`plist`/Tauri's own build-time config parsing, no attacker-controlled input); `quinn-proto 0.11.14`
+(RUSTSEC-2026-0185, 7.5 HIGH — non-enabled `reqwest` QUIC feature, not compiled/linked on macOS
+target); `glib 0.18.5` (RUSTSEC-2024-0429, 6.9, below the ≥7 line) plus the Linux GTK3 cluster — not
+compiled on this macOS-only app. Governed by the `task-047` dependency-hygiene lineage, independent
+of this release gate.
+
+---
+
+## Part B — Post-merge instruction (SW-6 handoff)
+
+**Precondition:** PR #44 merged to `main`; confirm with:
+
+```bash
+git fetch origin
+git show origin/main:src-tauri/Cargo.toml | grep '^version'  # must read 0.8.2
+```
+
+**Steps:**
+1. Build `Vire_0.8.2_aarch64.dmg` from the merged `main` head (`npm run tauri:build`).
+2. `gh release create v0.8.2 --repo kaikkone4/vire --target <merged-sha> --title "Vire v0.8.2" --notes-file <notes>` — **no** `--draft`, **no** `--prerelease`. Attach the DMG asset.
+3. Backfill DMG name/size/sha256 into the root `RELEASE.md` v0.8.2 entry (v0.8.1 precedent).
+4. Live-smoke: `0.8.1` build → **UpdateAvailable**; rebuilt `0.8.2` build → **UpToDate**; DMG asset downloadable; `/releases/latest` returns `v0.8.2`.
+
+---
+
+## Changed paths (this gate)
+
+```
+openspec/changes/task-057-publish-v082-release/RELEASE.md   (new, this gate)
+openspec/changes/task-057-publish-v082-release/qa.md        (SW-3 gate artifact, committed this gate)
+openspec/changes/task-057-publish-v082-release/review.md    (SW-4 gate artifact, committed this gate)
+openspec/changes/task-057-publish-v082-release/sec.md       (SW-5 gate artifact, committed this gate)
+openspec/changes/task-057-publish-v082-release/docs.md      (Documentation gate artifact, committed this gate)
+openspec/changes/task-057-publish-v082-release/handoff.md   (updated, this gate)
+```
+
+Full PR #44 diff vs `main` (product surface, unchanged from prior gates):
+`README.md`, `RELEASE.md`, `src-tauri/Cargo.lock`, `src-tauri/Cargo.toml`, `src-tauri/tauri.conf.json`,
+plus the `task-057-publish-v082-release` change directory.
+
+---
+
+## Gate checklist
+
+- [x] SW-3 QA PASS
+- [x] SW-4 Code Review PASS
+- [x] SW-5 Security PASS
+- [x] Documentation gate PASS
+- [x] RELEASE.md written with all three required declarations
+- [x] Tag `task-057/v0.8.2` — signed (SSH format), created this gate
+- [x] PR #44 promoted from draft to ready-for-review (this gate)
+
+## Non-blocking follow-ups
+
+1. Part B: build DMG, publish full `v0.8.2` GitHub Release, live-smoke update check, backfill
+   asset name/size/sha256 into root `RELEASE.md` — after Janne merges PR #44.
+2. `quick-xml`/`quinn-proto`/`glib` pre-existing advisories — continue in the dependency-hygiene
+   lane (`task-047` lineage), independent of this release gate.