chore: archive v0.1.7 release task

.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/check.jsonl

@@ -0,0 +1,3 @@
+{"file": ".trellis/spec/frontend/release-pipeline.md", "reason": "Verify the protected release contract is unchanged."}
+{"file": "docs/RELEASE_CHECKLIST.md", "reason": "Verify complete local and public release evidence."}
+{"file": "cutout.agent-capabilities.json", "reason": "Run Agent capability and plugin validation after version changes."}

.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/design.md

@@ -0,0 +1,51 @@
+# Design: Cutout v0.1.7 release and local replacement
+
+## Release Boundary
+
+The source commit owns the version and changelog. CI validates the tag against
+the synchronized source, runs the reusable quality gate, builds four native
+targets, signs updater artifacts, signs/notarizes macOS, verifies intentionally
+unsigned Windows installers, and publishes only after the complete matrix is
+available.
+
+## Version Flow
+
+1. Change the human-authored version sources and README/changelog references.
+2. Run `pnpm plugin:build` to regenerate plugin runtime data and fingerprints.
+3. Validate `0.1.7` locally and commit the reviewed release preparation.
+4. Merge the release PR to `main` after required checks.
+5. Create annotated tag `v0.1.7` on the merge commit and push it once.
+6. Monitor `Build and Release Cutout` until the public Release and complete
+   asset set exist.
+
+## Installation Flow
+
+1. Download `SHA256SUMS` and the Apple Silicon DMG into a fresh temporary
+   directory.
+2. Verify the DMG SHA-256 and notarization ticket before touching the installed
+   app.
+3. Quit any running Cutout process.
+4. Move the old `/Applications/Cutout.app` bundle aside, mount the verified DMG,
+   and copy the new app into `/Applications`.
+5. Verify the installed version, architecture, signature chain, Gatekeeper
+   acceptance, and stapled ticket. Remove the old bundle only after the new
+   installation passes.
+
+## Data Safety And Rollback
+
+- Do not modify `~/Library/Application Support`, IndexedDB, Keychain, project
+  repositories, or `.cutout` data.
+- Keep the old app bundle recoverable until the new bundle passes verification.
+- The old app is only a rollback byte bundle; its ad-hoc signature means it is
+  not trusted release evidence and must not be restored after a successful
+  verified `0.1.7` installation.
+- If installation verification fails, remove the failed new bundle and restore
+  the old signed bundle; do not alter user data.
+
+## Compatibility
+
+- Windows NSIS/MSI installers remain intentionally unsigned with Authenticode;
+  their updater signature and release provenance remain mandatory.
+- No protocol, CLI, MCP, updater-policy, or release-workflow behavior changes in
+  this task. Only synchronized release version surfaces and generated plugin
+  receipts change.

.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/implement.jsonl

@@ -0,0 +1,3 @@
+{"file": ".trellis/spec/frontend/release-pipeline.md", "reason": "Atomic cross-platform release, signing, notarization, updater, and publication contract."}
+{"file": "docs/RELEASE_CHECKLIST.md", "reason": "Version, quality, signing, publication, and installation verification gates."}
+{"file": "cutout.agent-capabilities.json", "reason": "Agent surface version must stay synchronized and validate."}

.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/implement.md

@@ -0,0 +1,63 @@
+# Implementation plan
+
+1. Verify `github/main`, the `v0.1.6` public release, the local installed app,
+   protected release environment configuration, and the absence of `v0.1.7`.
+2. Bump `0.1.6` to `0.1.7` in synchronized source manifests, README links/plugin
+   examples, and add the `0.1.7` changelog entry for the preparation projection
+   fix.
+3. Regenerate Codex plugin runtime outputs and review generated diffs.
+4. Run release-version, focused release, full frontend, Rust, Agent, plugin,
+   bundle, local macOS release, and diff validation gates.
+5. Commit release preparation, archive the task, push `release/v0.1.7`, open a
+   PR, monitor CI/CodeQL, and merge to `main`.
+6. Tag the reviewed merge commit as `v0.1.7`, push the tag, and monitor the
+   protected release workflow through public publication.
+7. Verify the complete release asset inventory and updater metadata.
+8. Download and verify the arm64 DMG, quit Cutout, replace the `0.1.6` app with
+   `0.1.7`, then verify version, architecture, signature, Gatekeeper, and
+   notarization ticket.
+
+## Validation commands
+
+- `node scripts/validate-release-version.mjs --expected 0.1.7`
+- `node scripts/validate-release-authority.mjs`
+- `pnpm agent:validate`
+- `node scripts/validate-product-skills.mjs`
+- `pnpm plugin:validate`
+- `pnpm lint`
+- `pnpm exec tsc -b --pretty false`
+- focused release and plugin Vitest suites
+- `pnpm test`
+- `pnpm build`
+- `pnpm bundle:gate`
+- release-critical Playwright tests
+- `cargo fmt --check --manifest-path src-tauri/Cargo.toml`
+- `cargo check --locked --manifest-path src-tauri/Cargo.toml`
+- `cargo test --locked --manifest-path src-tauri/Cargo.toml`
+- `scripts/release-macos.sh --local`
+- `git diff --check`
+
+## Risk And Rollback Points
+
+- Never tag a branch commit that is not the reviewed `main` merge commit.
+- Never install from a workflow artifact or draft release; use the final public
+  DMG and published checksums.
+- Validate the new DMG before moving the old app and retain the old bundle until
+  the installed replacement passes every macOS verification command.
+- Do not delete or migrate local user data.
+
+## Completion evidence
+
+- Release preparation commit: `13d4eda18f3131d783e88408e8ec0684ec8889f7`
+- Reviewed PR: `https://github.com/Nebutra/cutout/pull/32`
+- Main merge and tag target: `be0f152d5145dc94b05fb2b8765f1366793163de`
+- Release workflow: `https://github.com/Nebutra/cutout/actions/runs/30073760589`
+- Public release: `https://github.com/Nebutra/cutout/releases/tag/v0.1.7`
+- Apple Silicon DMG SHA-256:
+  `2be7c20799504a282ce53b3d2bfa49e6db536a4aa55cac8cbcd6c2e15c82b91c`
+- Installed bundle: `/Applications/Cutout.app`, version/build `0.1.7`, ARM64,
+  Developer ID team `2L5YC85FQ7`, Gatekeeper accepted, notarization ticket
+  valid.
+- Previous ad-hoc `0.1.6` bundle moved to
+  `/Users/tseka_luk/.Trash/Cutout.app.v0.1.6-backup` after the verified
+  replacement succeeded.

.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/prd.md

@@ -0,0 +1,62 @@
+# Release and install Cutout v0.1.7
+
+## Goal
+
+Publish the merged preparation-projection fix as Cutout `0.1.7`, remove the
+installed `0.1.6` macOS application, and install the signed/notarized Apple
+Silicon `0.1.7` build locally.
+
+## Background
+
+- `/Applications/Cutout.app` is `0.1.6` ARM64, but inspection shows an ad-hoc
+  signature, Gatekeeper rejection, and no stapled notarization ticket. It must
+  not be treated as release verification evidence.
+- The latest public GitHub Release is `v0.1.6`.
+- The duplicate preparation projection fix is merged to `github/main` at merge
+  commit `9bc348f`, after the `v0.1.6` tag.
+- The protected `release` environment contains the required Apple and Tauri
+  updater credentials. Windows installers remain intentionally published
+  without Authenticode under the reviewed release contract.
+
+## Requirements
+
+- Bump all synchronized product, Tauri, Agent capability, Codex plugin, runtime,
+  README, and changelog version surfaces from `0.1.6` to `0.1.7`.
+- Regenerate the bundled Codex plugin rather than manually editing generated
+  runtime fingerprints.
+- Preserve the atomic four-platform workflow, signing, notarization, updater
+  signature, checksum, provenance, and publication gates.
+- Publish immutable tag and GitHub Release `v0.1.7` from reviewed `main`.
+- Download the published Apple Silicon DMG, verify it against `SHA256SUMS`, and
+  validate the DMG notarization ticket before replacing the local app.
+- Quit Cutout, move the installed `0.1.6` bundle aside, install `0.1.7` into
+  `/Applications`, and verify version, architecture, Developer ID signature,
+  Gatekeeper, and stapled notarization evidence.
+- Preserve all user projects, `.cutout` repositories, IndexedDB/application
+  support data, settings, and credentials; only the application bundle changes.
+
+## Acceptance Criteria
+
+- [x] Source version validation passes for `0.1.7` across all required files.
+- [x] Focused release tests, full tests, lint, TypeScript, production build,
+      Rust checks/tests, Agent validation, and release-local gates pass.
+- [x] Release PR merges with required CI and CodeQL checks green.
+- [x] Tag `v0.1.7` points to the reviewed merge commit on `main`.
+- [x] The protected release workflow publishes all required macOS, Windows,
+      Linux, updater, checksum, SBOM, provenance, and metadata assets.
+- [x] `/Applications/Cutout.app` reports version/build `0.1.7` and passes
+      Developer ID `codesign`, `spctl`, and `stapler validate` checks.
+- [x] The previous `0.1.6` application bundle is no longer installed after the
+      verified replacement succeeds.
+
+## Out Of Scope
+
+- Changing release signing policy or weakening any required gate.
+- Migrating or deleting local application data.
+- Adding product behavior beyond the already merged preparation-projection fix.
+
+## Notes
+
+- Keep `prd.md` focused on requirements, constraints, and acceptance criteria.
+- Lightweight tasks can remain PRD-only.
+- For complex tasks, add `design.md` for technical design and `implement.md` for execution planning before `task.py start`.

.trellis/tasks/archive/2026-07/07-24-release-install-v0-1-7/task.json

@@ -0,0 +1,26 @@
+{
+  "id": "release-install-v0-1-7",
+  "name": "release-install-v0-1-7",
+  "title": "Release and install Cutout v0.1.7",
+  "description": "Publish the merged preparation-projection fix as v0.1.7, replace the local v0.1.6 app, and verify the signed/notarized installation.",
+  "status": "completed",
+  "dev_type": null,
+  "scope": null,
+  "package": null,
+  "priority": "P1",
+  "creator": "tseka",
+  "assignee": "tseka",
+  "createdAt": "2026-07-24",
+  "completedAt": "2026-07-24",
+  "branch": null,
+  "base_branch": "release/v0.1.7",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": null,
+  "relatedFiles": [],
+  "notes": "",
+  "meta": {}
+}

.trellis/workspace/tseka/index.md

@@ -8,7 +8,7 @@
 
 <!-- @@@auto:current-status -->
 - **Active File**: `journal-1.md`
-- **Total Sessions**: 27
+- **Total Sessions**: 28
 - **Last Active**: 2026-07-24
 <!-- @@@/auto:current-status -->
 
@@ -19,7 +19,7 @@
 <!-- @@@auto:active-documents -->
 | File | Lines | Status |
 |------|-------|--------|
-| `journal-1.md` | ~922 | Active |
+| `journal-1.md` | ~955 | Active |
 <!-- @@@/auto:active-documents -->
 
 ---
@@ -29,6 +29,7 @@
 <!-- @@@auto:session-history -->
 | # | Date | Title | Commits | Branch |
 |---|------|-------|---------|--------|
+| 28 | 2026-07-24 | Release and install Cutout v0.1.7 | `13d4eda` | `chore/archive-release-install-v0-1-7` |
 | 27 | 2026-07-24 | Fix duplicate preparation projection | `2f84034` | `fix/preparing-run-duplicate-projection` |
 | 26 | 2026-07-23 | Release and install Cutout v0.1.6 | `ca28859b8a9a25e73fa9fb7c3cc703b4489f2091` | `chore/archive-release-install-v0-1-6` |
 | 25 | 2026-07-23 | Fix regenerate activity bubble duplication | `bd185d0` | `fix/regenerate-bubble-duplication` |

.trellis/workspace/tseka/journal-1.md

@@ -920,3 +920,36 @@ Kept durable preparation events in the full audit projection while rendering pur
 ### Next Steps
 
 - None - task complete
+
+
+## Session 28: Release and install Cutout v0.1.7
+
+**Date**: 2026-07-24
+**Task**: Release and install Cutout v0.1.7
+**Branch**: `chore/archive-release-install-v0-1-7`
+
+### Summary
+
+Published the single-active-surface preparation fix as the atomic four-platform v0.1.7 release, verified checksums and notarization, replaced the local ad-hoc v0.1.6 bundle with the public Developer ID signed/notarized ARM64 build, and moved the old bundle to Trash.
+
+### Main Changes
+
+- Detailed change bullets were not supplied; see the summary above.
+
+### Git Commits
+
+| Hash | Message |
+|------|---------|
+| `13d4eda` | (see git log) |
+
+### Testing
+
+- Validation was not recorded for this session.
+
+### Status
+
+[OK] **Completed**
+
+### Next Steps
+
+- None - task complete