diff --git a/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/check.jsonl b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/check.jsonl new file mode 100644 index 0000000..a62a898 --- /dev/null +++ b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/check.jsonl @@ -0,0 +1,3 @@ +{"file": ".trellis/spec/frontend/release-pipeline.md", "reason": "Verify the protected release contract is unchanged."} +{"file": "docs/RELEASE_CHECKLIST.md", "reason": "Verify complete local and public release evidence."} +{"file": "cutout.agent-capabilities.json", "reason": "Run Agent capability and plugin validation after version changes."} diff --git a/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/design.md b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/design.md new file mode 100644 index 0000000..1dcaaa4 --- /dev/null +++ b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/design.md @@ -0,0 +1,51 @@ +# Design: Cutout v0.1.7 release and local replacement + +## Release Boundary + +The source commit owns the version and changelog. CI validates the tag against +the synchronized source, runs the reusable quality gate, builds four native +targets, signs updater artifacts, signs/notarizes macOS, verifies intentionally +unsigned Windows installers, and publishes only after the complete matrix is +available. + +## Version Flow + +1. Change the human-authored version sources and README/changelog references. +2. Run `pnpm plugin:build` to regenerate plugin runtime data and fingerprints. +3. Validate `0.1.7` locally and commit the reviewed release preparation. +4. Merge the release PR to `main` after required checks. +5. Create annotated tag `v0.1.7` on the merge commit and push it once. +6. Monitor `Build and Release Cutout` until the public Release and complete + asset set exist. + +## Installation Flow + +1. Download `SHA256SUMS` and the Apple Silicon DMG into a fresh temporary + directory. +2. Verify the DMG SHA-256 and notarization ticket before touching the installed + app. +3. Quit any running Cutout process. +4. Move the old `/Applications/Cutout.app` bundle aside, mount the verified DMG, + and copy the new app into `/Applications`. +5. Verify the installed version, architecture, signature chain, Gatekeeper + acceptance, and stapled ticket. Remove the old bundle only after the new + installation passes. + +## Data Safety And Rollback + +- Do not modify `~/Library/Application Support`, IndexedDB, Keychain, project + repositories, or `.cutout` data. +- Keep the old app bundle recoverable until the new bundle passes verification. +- The old app is only a rollback byte bundle; its ad-hoc signature means it is + not trusted release evidence and must not be restored after a successful + verified `0.1.7` installation. +- If installation verification fails, remove the failed new bundle and restore + the old signed bundle; do not alter user data. + +## Compatibility + +- Windows NSIS/MSI installers remain intentionally unsigned with Authenticode; + their updater signature and release provenance remain mandatory. +- No protocol, CLI, MCP, updater-policy, or release-workflow behavior changes in + this task. Only synchronized release version surfaces and generated plugin + receipts change. diff --git a/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/implement.jsonl b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/implement.jsonl new file mode 100644 index 0000000..05bd63a --- /dev/null +++ b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/implement.jsonl @@ -0,0 +1,3 @@ +{"file": ".trellis/spec/frontend/release-pipeline.md", "reason": "Atomic cross-platform release, signing, notarization, updater, and publication contract."} +{"file": "docs/RELEASE_CHECKLIST.md", "reason": "Version, quality, signing, publication, and installation verification gates."} +{"file": "cutout.agent-capabilities.json", "reason": "Agent surface version must stay synchronized and validate."} diff --git a/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/implement.md b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/implement.md new file mode 100644 index 0000000..b0dec9b --- /dev/null +++ b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/implement.md @@ -0,0 +1,63 @@ +# Implementation plan + +1. Verify `github/main`, the `v0.1.6` public release, the local installed app, + protected release environment configuration, and the absence of `v0.1.7`. +2. Bump `0.1.6` to `0.1.7` in synchronized source manifests, README links/plugin + examples, and add the `0.1.7` changelog entry for the preparation projection + fix. +3. Regenerate Codex plugin runtime outputs and review generated diffs. +4. Run release-version, focused release, full frontend, Rust, Agent, plugin, + bundle, local macOS release, and diff validation gates. +5. Commit release preparation, archive the task, push `release/v0.1.7`, open a + PR, monitor CI/CodeQL, and merge to `main`. +6. Tag the reviewed merge commit as `v0.1.7`, push the tag, and monitor the + protected release workflow through public publication. +7. Verify the complete release asset inventory and updater metadata. +8. Download and verify the arm64 DMG, quit Cutout, replace the `0.1.6` app with + `0.1.7`, then verify version, architecture, signature, Gatekeeper, and + notarization ticket. + +## Validation commands + +- `node scripts/validate-release-version.mjs --expected 0.1.7` +- `node scripts/validate-release-authority.mjs` +- `pnpm agent:validate` +- `node scripts/validate-product-skills.mjs` +- `pnpm plugin:validate` +- `pnpm lint` +- `pnpm exec tsc -b --pretty false` +- focused release and plugin Vitest suites +- `pnpm test` +- `pnpm build` +- `pnpm bundle:gate` +- release-critical Playwright tests +- `cargo fmt --check --manifest-path src-tauri/Cargo.toml` +- `cargo check --locked --manifest-path src-tauri/Cargo.toml` +- `cargo test --locked --manifest-path src-tauri/Cargo.toml` +- `scripts/release-macos.sh --local` +- `git diff --check` + +## Risk And Rollback Points + +- Never tag a branch commit that is not the reviewed `main` merge commit. +- Never install from a workflow artifact or draft release; use the final public + DMG and published checksums. +- Validate the new DMG before moving the old app and retain the old bundle until + the installed replacement passes every macOS verification command. +- Do not delete or migrate local user data. + +## Completion evidence + +- Release preparation commit: `13d4eda18f3131d783e88408e8ec0684ec8889f7` +- Reviewed PR: `https://github.com/Nebutra/cutout/pull/32` +- Main merge and tag target: `be0f152d5145dc94b05fb2b8765f1366793163de` +- Release workflow: `https://github.com/Nebutra/cutout/actions/runs/30073760589` +- Public release: `https://github.com/Nebutra/cutout/releases/tag/v0.1.7` +- Apple Silicon DMG SHA-256: + `2be7c20799504a282ce53b3d2bfa49e6db536a4aa55cac8cbcd6c2e15c82b91c` +- Installed bundle: `/Applications/Cutout.app`, version/build `0.1.7`, ARM64, + Developer ID team `2L5YC85FQ7`, Gatekeeper accepted, notarization ticket + valid. +- Previous ad-hoc `0.1.6` bundle moved to + `/Users/tseka_luk/.Trash/Cutout.app.v0.1.6-backup` after the verified + replacement succeeded. diff --git a/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/prd.md b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/prd.md new file mode 100644 index 0000000..78d1b46 --- /dev/null +++ b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/prd.md @@ -0,0 +1,62 @@ +# Release and install Cutout v0.1.7 + +## Goal + +Publish the merged preparation-projection fix as Cutout `0.1.7`, remove the +installed `0.1.6` macOS application, and install the signed/notarized Apple +Silicon `0.1.7` build locally. + +## Background + +- `/Applications/Cutout.app` is `0.1.6` ARM64, but inspection shows an ad-hoc + signature, Gatekeeper rejection, and no stapled notarization ticket. It must + not be treated as release verification evidence. +- The latest public GitHub Release is `v0.1.6`. +- The duplicate preparation projection fix is merged to `github/main` at merge + commit `9bc348f`, after the `v0.1.6` tag. +- The protected `release` environment contains the required Apple and Tauri + updater credentials. Windows installers remain intentionally published + without Authenticode under the reviewed release contract. + +## Requirements + +- Bump all synchronized product, Tauri, Agent capability, Codex plugin, runtime, + README, and changelog version surfaces from `0.1.6` to `0.1.7`. +- Regenerate the bundled Codex plugin rather than manually editing generated + runtime fingerprints. +- Preserve the atomic four-platform workflow, signing, notarization, updater + signature, checksum, provenance, and publication gates. +- Publish immutable tag and GitHub Release `v0.1.7` from reviewed `main`. +- Download the published Apple Silicon DMG, verify it against `SHA256SUMS`, and + validate the DMG notarization ticket before replacing the local app. +- Quit Cutout, move the installed `0.1.6` bundle aside, install `0.1.7` into + `/Applications`, and verify version, architecture, Developer ID signature, + Gatekeeper, and stapled notarization evidence. +- Preserve all user projects, `.cutout` repositories, IndexedDB/application + support data, settings, and credentials; only the application bundle changes. + +## Acceptance Criteria + +- [x] Source version validation passes for `0.1.7` across all required files. +- [x] Focused release tests, full tests, lint, TypeScript, production build, + Rust checks/tests, Agent validation, and release-local gates pass. +- [x] Release PR merges with required CI and CodeQL checks green. +- [x] Tag `v0.1.7` points to the reviewed merge commit on `main`. +- [x] The protected release workflow publishes all required macOS, Windows, + Linux, updater, checksum, SBOM, provenance, and metadata assets. +- [x] `/Applications/Cutout.app` reports version/build `0.1.7` and passes + Developer ID `codesign`, `spctl`, and `stapler validate` checks. +- [x] The previous `0.1.6` application bundle is no longer installed after the + verified replacement succeeds. + +## Out Of Scope + +- Changing release signing policy or weakening any required gate. +- Migrating or deleting local application data. +- Adding product behavior beyond the already merged preparation-projection fix. + +## Notes + +- Keep `prd.md` focused on requirements, constraints, and acceptance criteria. +- Lightweight tasks can remain PRD-only. +- For complex tasks, add `design.md` for technical design and `implement.md` for execution planning before `task.py start`. diff --git a/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/task.json b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/task.json new file mode 100644 index 0000000..78b444e --- /dev/null +++ b/.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/task.json @@ -0,0 +1,26 @@ +{ + "id": "release-install-v0-1-7", + "name": "release-install-v0-1-7", + "title": "Release and install Cutout v0.1.7", + "description": "Publish the merged preparation-projection fix as v0.1.7, replace the local v0.1.6 app, and verify the signed/notarized installation.", + "status": "completed", + "dev_type": null, + "scope": null, + "package": null, + "priority": "P1", + "creator": "tseka", + "assignee": "tseka", + "createdAt": "2026-07-24", + "completedAt": "2026-07-24", + "branch": null, + "base_branch": "release/v0.1.7", + "worktree_path": null, + "commit": null, + "pr_url": null, + "subtasks": [], + "children": [], + "parent": null, + "relatedFiles": [], + "notes": "", + "meta": {} +} \ No newline at end of file diff --git a/.trellis/workspace/tseka/index.md b/.trellis/workspace/tseka/index.md index aafef6c..1eefaf0 100644 --- a/.trellis/workspace/tseka/index.md +++ b/.trellis/workspace/tseka/index.md @@ -8,7 +8,7 @@ - **Active File**: `journal-1.md` -- **Total Sessions**: 27 +- **Total Sessions**: 28 - **Last Active**: 2026-07-24 @@ -19,7 +19,7 @@ | File | Lines | Status | |------|-------|--------| -| `journal-1.md` | ~922 | Active | +| `journal-1.md` | ~955 | Active | --- @@ -29,6 +29,7 @@ | # | Date | Title | Commits | Branch | |---|------|-------|---------|--------| +| 28 | 2026-07-24 | Release and install Cutout v0.1.7 | `13d4eda` | `chore/archive-release-install-v0-1-7` | | 27 | 2026-07-24 | Fix duplicate preparation projection | `2f84034` | `fix/preparing-run-duplicate-projection` | | 26 | 2026-07-23 | Release and install Cutout v0.1.6 | `ca28859b8a9a25e73fa9fb7c3cc703b4489f2091` | `chore/archive-release-install-v0-1-6` | | 25 | 2026-07-23 | Fix regenerate activity bubble duplication | `bd185d0` | `fix/regenerate-bubble-duplication` | diff --git a/.trellis/workspace/tseka/journal-1.md b/.trellis/workspace/tseka/journal-1.md index 5e733e0..eed6436 100644 --- a/.trellis/workspace/tseka/journal-1.md +++ b/.trellis/workspace/tseka/journal-1.md @@ -920,3 +920,36 @@ Kept durable preparation events in the full audit projection while rendering pur ### Next Steps - None - task complete + + +## Session 28: Release and install Cutout v0.1.7 + +**Date**: 2026-07-24 +**Task**: Release and install Cutout v0.1.7 +**Branch**: `chore/archive-release-install-v0-1-7` + +### Summary + +Published the single-active-surface preparation fix as the atomic four-platform v0.1.7 release, verified checksums and notarization, replaced the local ad-hoc v0.1.6 bundle with the public Developer ID signed/notarized ARM64 build, and moved the old bundle to Trash. + +### Main Changes + +- Detailed change bullets were not supplied; see the summary above. + +### Git Commits + +| Hash | Message | +|------|---------| +| `13d4eda` | (see git log) | + +### Testing + +- Validation was not recorded for this session. + +### Status + +[OK] **Completed** + +### Next Steps + +- None - task complete