This packet tracks the unpublished 6.2.0 candidate and the completed 6.1.7 macOS UI and interaction release, and retains historical evidence for the completed 6.1.6, 6.1.5, 6.1.4, 6.1.3, 6.1.2, 6.1.1, and 6.1.0 releases, the quarantined 6.0.0 prerelease, the 6.0.1 stabilization release, and the 6.0.2 desktop recovery hotfix. It separates merged implementation, deterministic conformance, local runtime proof, signed publication, and Homebrew availability.
Veritas Kanban 6.1.7 is the active stable release. Do not use 6.0.0 for installation or upgrade validation.
Documentation freshness: 2026-09-07. Local native and media acceptance passed. Audit fixes are merged; release and distribution acceptance remain separate.
The candidate is prepared from the audit backlog delivered through individually reviewed public pull requests. No 6.2.0 release, installation replacement, or distribution update has occurred. The evidence below records the integrated delivery candidate. All 24 implemented audit fixes and the acceptance follow-ups are merged; #1544 is explicitly dispositioned as not reproducible. Tracker #1545 records the delivery readback.
a2b8fbba0e2851d65611238624d8c9de347a2a27. Whole-app SHA-256: 476a61cbc81f2a78b76657a87ccc98e2be645d2886d78e5df5fe51d7424dedcb. The arm64 package was exercised on macOS 26.6.2 and is unsigned; it has not replaced an installed application.0b5d65754735716edfd8ebe8ecb93633b70bfbc7, whole-app SHA-256 fab61cf2514475b2d872d8f041735ba3fe59bee54d80a6dcb9ccabe27de69fba, captured on macOS 15.7.9. Capture run passed signing, notarization, Gatekeeper, all 144 native cases, all six deliberate faults, the large-board journeys, and the media contract. The exact signed screenshots, GIFs and video were reviewed locally. Release upload and destination readback are still pending at this checkpoint.| Field | Value |
|---|---|
| Release version | 6.1.7 |
| Release tracker | #1389, covering child issues #1378-#1388 |
| Version preparation | PR #1494, merged as 62b95ee9a72ed7ca2010737b1b88f4956a469b50 |
| Signed candidate | Build ed5094c6a5f9dd6958ceb952d8d018a40135bf33, whole-bundle SHA-256 a23df6443940aff4d9b5013b97ab753b986a63f3bb15dc0d3a8c6aaace866f94 |
| Release source | Annotated tag object 9c3bf5b60bdd836e0a248a150892fc59ef5a6703 peels to 6befd39cbc1264b18fa272d25bc64642f2b60383, which contains the exact captured documentation media |
| Version and compatibility | All maintained packages are 6.1.7; REST API remains v1; no database migration; valid 6.1.6 workspaces remain compatible; macOS 13 arm64 minimum |
| Native and media evidence | 144 of 144 required states passed, all six seeded defects were detected, and 14 maintained screenshots and GIFs were captured, hash-verified, visually reviewed, and published from the exact candidate |
| Publication status | Complete: live tag and release body, signed/notarized assets, updater metadata, Homebrew cask, installed-app verification, and owner-directed private advisory disposition all passed |
The signed capture run 33926469724 completed the full packaged macOS matrix in light and dark appearance at the 1700×760 expanded and 1180×760 compact content sizes. It covered every required route, task drawer and expanded mode, Board Chat, Squad Chat, Task Chat, Settings, shared popouts, relaunch behavior, keyboard behavior, reduced motion, and the final HTTP ledger. All six deliberate faults were detected. The only accepted HTTP exceptions were documented optional task-chat 404 responses; no 429 or 5xx response remained.
The same run retained the candidate and the 14 documentation assets. Those
exact files were verified by digest, visually reviewed, and published unchanged
in commit 6befd39cbc1264b18fa272d25bc64642f2b60383. Promotion run
33928175193
then validated and published the live v6.1.7 tag, release body, and signed
artifacts.
| Asset | Size | Published SHA-256 |
|---|---|---|
Veritas-Kanban-6.1.7-mac-arm64.dmg |
280,160,406 bytes | 172531cdad55b6a3683a03da3d0287fd52cebc0ddcc05eb2087dda10f65f2665 |
Veritas-Kanban-6.1.7-mac-arm64.zip |
284,591,165 bytes | ac0b84ced655b02a87b2964f1036916683ba95628ef9acfeace6beac8142ff17 |
Veritas-Kanban-6.1.7-mac-arm64.dmg.blockmap |
289,072 bytes | 4e68a8bf8614d727362fd6095e026ea0f8d9dc3af2c32c4ea8286fb1b876adc0 |
Veritas-Kanban-6.1.7-mac-arm64.zip.blockmap |
297,160 bytes | 7b03f01309de28785ee06099f327c7fb301b6a78683bae2022e4798aefda2bd5 |
latest-mac.yml |
530 bytes | 17f1f5fd19f21f1ae3fd455a052f43db0609aa702fe2abd62aebdd1143b87509 |
Homebrew tap PR #63
merged as e83f9b53d9ede0826683715ee2e04a84b84a3b82 and publishes the
verified ZIP digest above. The registered cask reports 6.1.7 and passed Ruby
syntax, strict online audit, fetch, and livecheck before installation.
After explicit operator approval of macOS’s first-launch confirmation,
/Applications/Veritas Kanban.app reported version 6.1.7, passed deep strict
signature verification, Gatekeeper assessment as a notarized Developer ID
application, and staple validation. Its bundled server owned the port 3001
listener and returned ok: true, service veritas-kanban, and version 6.1.7
from /api/health.
The installed app was exercised at 1180×760 in both themes. Board Chat, Squad Chat, the compact Squad actions popover, sender selection, and composers were contained and readable. Opening either auxiliary rail closed Workbench; opening Workbench collapsed both rails. A non-sent Squad draft survived channel switching and a 1500×900-to-1180×760 resize without being sent. Fullscreen exit and a quit/relaunch at the saved minimum size both restored the compact state with Workbench and both rails closed. No bottom dock, blank canvas, clipped control, or dead chat action remained. The coordinated private advisory was closed without publication at the owner’s direction after the fixed versions were available in every supported distribution channel.
| Field | Value |
|---|---|
| Release version | 6.1.6 |
| Release tracker | #1374 |
| Source release | 655df233d5b0ed0e8ebf1e54076b692c8cae893c, containing focused merged fixes #1367-#1373 and the 6.1.6 release integration |
| Included issues | #1360-#1366: dependencies, app-shell containment, Settings, Command+K, desktop wordmark, consecutive drag, and action/navigation consistency |
| Version and compatibility | All maintained packages are 6.1.6; REST API remains v1; no database migration; valid 6.1.5 workspaces remain compatible; macOS 13 arm64 minimum |
| Local integration evidence | Full workspace integration, browser coverage, public-safe media, unsigned arm64 packaging, compiled app launch, and exact-version readiness passed |
| Publication status | Complete: authoritative full CI, annotated tag, GitHub release, signed/notarized assets, independent launch, Homebrew cask, and installed-app verification |
Focused feature-level verification passed in the implementation pull requests. The release retains zero open Dependabot alerts and both production and complete dependency audits report no known vulnerabilities.
The isolated documentation-media capture produced twelve 1440x1000 or 390x844 PNGs, a 75-frame 1200x833 desktop GIF, a 54-frame 390x844 mobile GIF, and identical 1280x720 H.264 demo-video copies with SHA-256 677c1e90ca8d85807811b2b0e3887bcfb32f82ad65557277670918b67f414818. Visual inspection confirmed the brighter selected state, redesigned Command+K surface, aligned Settings header, and bounded Workbench dock.
The release integration passed both dependency audits, public-doc and security-artifact checks, delivery-cadence and gitleaks checks, lint with 448 warnings under the 458-warning budget, typecheck, all seven workspace builds, and 4,574 unit tests with 24 intentional skips. Browser acceptance passed 46 applicable tests with one explicit media-capture skip after installing the matching Playwright WebKit runtime; the one Chromium test initially limited by the test server’s 60-write default passed after the isolated configuration set the documented RATE_LIMIT_WRITE_MAX override. Desktop coverage passed 72 tests, Electron artifact checks, unsigned DMG and ZIP packaging, and staging-isolation smoke.
The independently downloaded arm64 app reported version 6.1.6 and macOS 13.0 minimum. Its DMG and app passed deep strict signature verification, Gatekeeper acceptance as a notarized Developer ID app, and staple validation. It launched with a disposable profile on isolated ports, completed first-run security setup, served /api/health.version as 6.1.6 from its bundled server, loaded the empty board, and exposed the icon-only desktop header, aligned Settings header, redesigned Command+K surface, bounded Workbench dock, and MIT About panel. The candidate stopped cleanly and its disposable profile was moved to Trash.
| Gate | Verified result |
|---|---|
| Source and CI | Release PR #1375 passed the labeled full matrix and merged as 655df233d5b0ed0e8ebf1e54076b692c8cae893c. CI run 33734916724, Scheduled QA 33734916592, Docker contract 33734916755, desktop artifacts 33734916763, and Security Gates 33734903559 passed. |
| Tag and release | Annotated tag object 044ca19ab5df56df0e28b60d08ab87adbd046830 peels to the exact release merge. The v6.1.6 release is published, and post-publication validation proves its body matches docs/releases/v6.1.6.md. |
| Signed desktop artifacts | Desktop Release run 33735685114 passed. DMG: 280,134,108 bytes, SHA-256 c0ce9f19de967c983bdd94bfe15449c3f1099c524d7aa90cd72be6cda81e747e. ZIP: 284,569,539 bytes, SHA-256 d92a8b7449152434032301d4e9b7602085a73868f964aee54d81960444c7b70a. Both checksum sidecars and updater SHA-512 values match the downloaded assets. |
| Homebrew and installed app | Homebrew issue #60 and PR #61, merged as ed807bc0b7b3849a82131f30d1d45a0bfa402864, publish 6.1.6 with the verified ZIP digest. The registered cask passed strict online audit, fetch, livecheck, dry-run upgrade, and actual 6.1.5 to 6.1.6 upgrade. /Applications/Veritas Kanban.app passes deep strict signature, Gatekeeper notarization, staple, exact-version readiness, and native About-panel verification while retaining the existing user profile. |
| Field | Value |
|---|---|
| Release version | 6.1.5 |
| Release tracker | #1356 |
| Source base | 76ffa4966ffd3b450325b9b72159d640a5bb6ee3, containing the completed backlog, reliability follow-up, and documentation boundary |
| Starting backlog | Issues #1295-#1302 completed; dependency PRs #1303-#1306 superseded by focused PRs #1311-#1313 |
| Release implementation | PR #1357, reviewed head d84d8414697e58c66a54242221e454c8dc4c34be, merged as 4d27bfcff0c881c2205d36654cb6b6f558bb1cba |
| Version and compatibility | All maintained packages are 6.1.5; REST API remains v1; no database migration; valid 6.1.4 workspaces remain compatible; macOS desktop requires macOS 13 Ventura or later |
| Local candidate evidence | Frozen install, all-workspace build, Electron artifact checks, unsigned arm64 packaging, isolated launch, renderer/server readiness, and UI readback |
| Documentation media | Twelve current public-safe PNGs, two GIFs, and the demo video regenerated from an isolated 6.1.5 workspace with pnpm docs:capture-media |
| Publication status | Complete: authoritative full CI, annotated tag, GitHub release, signed desktop assets, updater metadata, independent launch, and Homebrew verification |
The isolated current-main macOS candidate reached the board with /api/health reporting the matching application version. Settings exposed the grouped Core, Collaboration, Automation, Governance, and System navigation with all twenty destinations, and the built renderer contained the progressive task-workspace modes. This confirms the backlog UI is present in the integrated source candidate; it was not present in the earlier 6.1.4 signed application because those pull requests merged after that tag.
The documentation media capture passed in an isolated Playwright profile using only seeded dummy tasks. The maintained set contains twelve PNG screenshots, a 75-frame 1200x833 desktop GIF, a 54-frame 390x844 mobile GIF, and identical 1280x720 H.264 demo-video copies with SHA-256 7200da247183fca4090ba96505665b26387a4db9bc38843928581d34bbbe0f73.
Local feature-level acceptance passed five Chromium task-status and Mantine interaction checks plus six mobile-flow checks across Chromium and WebKit. The canonical sequential workspace unit gate passed, all workspaces built, and the unpacked arm64 Electron bundle reported 6.1.5 in Info.plist. A fresh packaged-app profile completed onboarding, served a ready 6.1.5 health response from the bundled server, loaded the board, and exposed the grouped Settings UI. A second packaged-app readback confirmed the native About panel reports 6.1.5, the stable channel, Apple silicon, the project URL, and MIT License · © 2026 Digital Meld. Each candidate and child server then stopped cleanly.
The release pull request passed all sixteen required checks on reviewed head d84d8414697e58c66a54242221e454c8dc4c34be. CI run 33722804894 passed build, lint/typecheck, workspace units, changed tests, critical-path coverage, security audit, and test-scope selection. Companion runs 33722805011, 33722805015, 33722805084, and 33722804896 passed CodeQL, gitleaks, Playwright, k6, the Docker runtime contract, and unsigned macOS, Linux, and Windows artifacts.
Annotated tag object ac15d17edb36ef1ac01a4a72322bf2ab74444deb peels to exact release merge 4d27bfcff0c881c2205d36654cb6b6f558bb1cba. The v6.1.5 GitHub release was published on 2026-09-03 with a live body matching docs/releases/v6.1.5.md. Desktop Release run 33723400659 completed successfully against that merge and published these maintained macOS assets:
| Asset | Size | SHA-256 |
|---|---|---|
Veritas-Kanban-6.1.5-mac-arm64.dmg |
280,152,680 bytes | a6b637fbfd18a5ed0315a1d8dc8233e36c4de8864948aec5c19d3ee321865b55 |
Veritas-Kanban-6.1.5-mac-arm64.zip |
284,554,805 bytes | 478b15d25473c07e77c4d7f264af51c126203810c58ccdfe43347915623df91a |
Veritas-Kanban-6.1.5-mac-arm64.dmg.blockmap |
290,649 bytes | 752f452eaeb27b4c2bb2985b7b6f44d5d68540413edc1a4ea33ca3dbfe30476b |
Veritas-Kanban-6.1.5-mac-arm64.zip.blockmap |
296,686 bytes | 82baa30685483b609fc9cd298161017c06e0e7bdeb9de0e0076e3465da1177f3 |
Veritas-Kanban-6.1.5-mac-arm64.dmg.sha256 |
101 bytes | 9efcdc2ce7ef779e03df8ccd2a6adb51775e0469bc21306e40de9af013084eef |
Veritas-Kanban-6.1.5-mac-arm64.zip.sha256 |
101 bytes | 18801598dbfc1dfd387de99a75710e067de8111c72cbedfe580f9251e728b3cc |
latest-mac.yml |
530 bytes | 3dd956778011f978923ffc84cd3e5853555945dd7e7c2fc7a60cde114eec4351 |
Independent downloads matched both published checksum sidecars and updater metadata. The DMG and mounted app passed deep strict signature verification, Gatekeeper acceptance as a notarized Developer ID application, and stapling validation for team RLBHD62MPW. The exact mounted app launched with an isolated profile, its bundled server owned the listener and reported health version 6.1.5, and the signed About panel exposed the expected MIT license and release identity before the candidate stopped cleanly.
Homebrew tap PR #57 merged as 71f36238c736df94281ca9f2cfe96f52a6af8671 with version 6.1.5 and the published ZIP checksum. Artifact inspection identified LSMinimumSystemVersion 13.0, and follow-up PR #59 merged as 3d608110f2d57fbaab5f8bf6b15435fa92392bae to align the cask at macOS Ventura. The registered tap then passed Ruby syntax, strict online audit, forced fetch, livecheck, and dry-run installation without replacing the installed application.
| Field | Value |
|---|---|
| Release version | 6.1.4 |
| Release tracker | #1307 |
| Security implementation | PR #1308, merged as 82bab7fb91e97bdbc675d060bcd2c6abdfef3b51 |
| Release implementation | PR #1309, merged as 36b5529050aeb5cabbbefa8ac90e43f5f02e04d5 |
| Version and compatibility | All maintained packages are 6.1.4; REST API remains v1; no database migration; valid 6.1.3 workspaces remain compatible |
| Security disposition | The coordinated fix is included in every supported 6.1.4 distribution surface; advisory disclosure remains owner-controlled |
The full release CI run 33671382853 passed build, lint/typecheck, workspace units, changed tests, critical-path coverage, security audit, CodeQL, gitleaks, Playwright, k6, the Docker runtime contract, and unsigned macOS, Linux, and Windows desktop artifacts. The annotated tag object fed62cfac3386a3d9c59b2a3befa101e3d5cd19a peels to the exact release merge 36b5529050aeb5cabbbefa8ac90e43f5f02e04d5.
The v6.1.4 GitHub release was published on 2026-09-02 with a live body matching docs/releases/v6.1.4.md. Desktop Release run 33672624733 completed successfully and published these maintained macOS assets:
| Asset | Size | SHA-256 |
|---|---|---|
Veritas-Kanban-6.1.4-mac-arm64.dmg |
272,002,960 bytes | 712af00b95d952b6c5b46642cff19b88d134fe7fe520ebe530bd580cb30dd83a |
Veritas-Kanban-6.1.4-mac-arm64.zip |
276,323,390 bytes | 83eb0dd50116058b975f22de2d96a5583a7a3cda6e2be6266e897ca895ff0672 |
Veritas-Kanban-6.1.4-mac-arm64.dmg.blockmap |
282,204 bytes | 5dd2dd49c89d978e22c094bd48b893fbb81b5f0b101b5a854bf86f26b565208f |
Veritas-Kanban-6.1.4-mac-arm64.zip.blockmap |
287,599 bytes | ad92a8b2c39c5dc769f65fff8d9027bf53ff4f785793f5e97e05e84a9f3e54a5 |
latest-mac.yml |
530 bytes | 82665b85024579ef78a130c2ac71c2d82a389b140bf7a843c7fff0707a11cd54 |
Homebrew tap PR #55 merged as 1b01aa1cfd463bb5d5a51e4395c1071c142bbd80. The live cask reports 6.1.4 and pins the published ZIP checksum 83eb0dd50116058b975f22de2d96a5583a7a3cda6e2be6266e897ca895ff0672.
| Field | Value |
|---|---|
| Release version | 6.1.3 |
| Source branch | chore/release-6.1.3-1262 |
| Source baseline | 66fca9ec3dec3cb493ff87f49d7e3624ebf954a7, main after packaged Help menu label PR #1292 |
| Validated candidate | 9828a46b06a510227e62348302d821876a7aaa5f, the frozen release PR #1293 head |
| Included issues | Release tracker #1262, implementation #1245-#1259 and #1261, UI audit tracker #1260, and reliability follow-ups #1264, #1266, #1268, #1281, #1283, #1287, #1289, and #1291 |
| Public implementation | Complete through merged PR #1292. Packaged and browser acceptance passed for #1256-#1260 |
| Security disposition | Pre-release source and hosted-security audit has no unresolved blocker. CodeQL alert #325 was dismissed as a metadata-hash false positive after source review |
| Publication state | Complete. PR #1293 merged as 32ced60ebb1709f4a839dd80cc7bf067be1c5d9a; annotated v6.1.3, the exact live release body, signed/notarized assets, updater metadata, isolated readiness, post-publication validation, and Homebrew PR #53 are verified |
| Phase | Issues | Merged evidence |
|---|---|---|
| Dependency and CI foundation | #1245, #1246, #1261, #1264, #1266, #1268 | #1245, #1246, #1263, #1265, #1267, #1269 |
| Work Products and previews | #1247, #1250, #1254 | #1270, #1278, #1285 |
| File provenance and execution | #1251, #1255 | #1277, #1286 |
| Run Access | #1248, #1252 | #1275, #1279 |
| Recurring automation | #1249, #1253 | #1276, #1280 |
| Apple-design and adaptive UI | #1256-#1260 | #1271-#1274; acceptance passed |
| Admission persistence | #1281, #1283 | #1282, #1284 |
| Provider and storage teardown races | #1287, #1289 | #1288, #1290 |
| Packaged Help menu label | #1291 | #1292 |
The integrated provenance candidate at baa2724afda6f98f8c5ffa43b9300f7a72d69c15 passed the full labeled pull-request matrix before merge. CI run 33312498851 passed build, lint/typecheck, workspace units, changed tests, security audit, and critical-path coverage. Companion runs passed CodeQL and gitleaks, Playwright and k6, the Docker runtime contract, and unsigned macOS, Linux, and Windows artifacts. This integration milestone does not replace the final 6.1.3 release-candidate matrix.
The 2026-08-30 hosted-security readback found zero open Dependabot, secret-scanning, and default-branch CodeQL alerts. CodeQL alert #325 was reviewed against run-event-journal-service.ts: SHA-256 derives a deterministic spill artifact ID from workspace, task, attempt, event kind, and event identity metadata, not a password or API token. The alert was dismissed as a false positive by BradGroux; the dismissal is not a source-code exemption.
The unsigned 6.1.3 macOS arm64 package passed focused native acceptance from an isolated profile. /api/health and both bundle version fields reported 6.1.3. The accessibility tree exposed the expected application, File, Edit, Navigate, Desktop, Window, and Help menus; Minimize, Zoom, Bring All to Front, and Show Setup & Diagnostics executed successfully, and the corrected Help item exposed its literal ampersand. Packaged setup, login, and recovery failures each produced one visible alert related to the affected field, corrected input removed stale invalid state, keyboard submission retained field focus instead of moving to the alert, password-strength guidance stayed descriptive, and the forms remained operable at a 200 percent page scale in light and dark color schemes.
Focused Chromium acceptance used the packaged server and a touch-emulated renderer at 320, 390, and 430 CSS pixels. The Task Detail panel stayed within each viewport with no document-width overflow; secondary comment actions settled at full opacity, exposed target-specific Edit and Delete names, retained their layout slot, revealed on keyboard focus, and activated through Enter. A 25-card board trace found no rendered transition-all element. Default hover produced bounded state-change work with no continuing card animation; the only observed normal-mode infinite animation was an indeterminate loading skeleton. Reduced-motion emulation reported no running animations after the interaction and a settled one-second baseline with zero Layout, Paint, UpdateLayoutTree, CompositeLayers, or Animation events.
The final matrix ran once on frozen release PR head 9828a46b06a510227e62348302d821876a7aaa5f. This publication-evidence update is documentation-only and does not alter the validated runtime.
| Gate | Environment | Candidate result |
|---|---|---|
| Frozen install, package-manager, security-artifact, delivery-cadence, and CI-scope policy | Local Node 26.8.1 and CI Node 22; pnpm 11.1.1 | Pass. Local frozen install, package-manager validation, and 1,914-file security-artifact scan passed; CI run 33314084698 selected the full scope and passed every policy gate |
| Typecheck, lint, warning budget, production/full audit, and gitleaks | Local Node 26.8.1 and CI Node 22 | Pass. Production and full audits found no known vulnerabilities; lint, warning budget, typecheck, security audit, CodeQL, and gitleaks passed. Final hosted readback found zero open Dependabot, secret-scanning, and CodeQL alerts |
| Workspace and orchestration units | CI Node 22 on frozen ci:full head |
Pass with no retries: server 3,492 passed and 5 skipped; web 809 passed; CLI 80 passed; MCP 71 passed and 19 skipped; dual-storage parity 4 passed. Total 4,456 passed and 24 skipped across 430 passing and 2 skipped files |
| Critical-path coverage ratchets | CI Node 22 on frozen candidate | Pass. All seven reviewed boundaries passed their line, branch, function, and statement ratchets in CI run 33314084698 |
| Playwright browser coverage plus k6 | Local focused Chromium plus release PR companion workflows | Pass. Playwright run 33314084715 reported 38/38 passing with zero retries; k6 completed 7/7 checks, 5/5 requests, and one iteration. Focused packaged-renderer acceptance also passed at 320, 390, and 430 pixels |
| Build, Mantine QA, and CLI/MCP smoke | Local clean worktree and CI Node 22 | Pass for the authoritative release boundary: all seven workspaces built, lint/typecheck passed, and the existing implementation milestones retained focused Mantine and CLI/MCP coverage. No unchanged focused gate was rerun after release-only documentation edits |
| Desktop tests, readiness, native acceptance, lifecycle, and unsigned packages | macOS arm64 isolated profile plus CI macOS/Linux/Windows | Pass. Focused menu tests 8/8 and packaged auth, accessibility, menus, compact layout, keyboard, touch, motion, reduced motion, lifecycle, and exact-version readiness passed locally. Desktop run 33314084689 produced all three unsigned platform artifacts |
| Production Docker build, size contract, and runtime smoke | CI amd64 | Pass in run 33314084720. Image size 585,933,892 bytes, below 600,000,000; non-root user, version, mounted paths, SQLite, backup, auth, web assets, health, bcrypt, and clean shutdown passed |
| Release-format and release validators | Version 6.1.3 | Pass. Release format 3/3, source/build-output validation, exact GitHub body/tag validation, and the post-publication validator passed. The superseded pre-label CI run was canceled when ci:full started and is not candidate evidence |
| Field | Value |
|---|---|
| Release version | 6.1.2 |
| Source branch | release/6.1.2-audit |
| Source baseline | 3851fea93ecfe5119e4092739662443d29059ac7, main after release-gate fix PR #1243 |
| Validated candidate | 2a21178df97a00395cfc6c43774a57496a5c1f6a, the frozen release PR head before this evidence-only update |
| Included issues | Audit tracker #1174, closed findings #1162-#1173, and closed CodeQL baseline #1231 |
| Public implementation | #1162-#1173 are closed through merged work. Coordinated remediation and release-gate fixes are merged through #1236, #1239, #1241, and #1243 |
| Security disposition | Remediation is integrated into supported 6.1.2 artifacts. The approved repository security advisory was published after artifact verification |
| Publication state | Complete. Release PR #1237, annotated v6.1.2, the stable GitHub release, signed/notarized assets, updater metadata, post-publication validator, Homebrew cask/install, and advisory disposition are verified |
| Phase | Issue | Merged evidence |
|---|---|---|
| Verification | #1172 deterministic and milestone-scoped test gates | #1175, #1177, #1181, #1228 |
| Verification | #1171 native-loader Vite/Vitest configuration | #1178 |
| Supply chain | #1167 immutable actions | #1179 |
| Security gates | #1168 continuous scanning | #1180 |
| Coverage | #1169 critical-path baselines and ratchets | #1183 |
| Runtime paths | #1162 canonical DATA_DIR behavior |
#1184 |
| Persistence | #1163 storage boundary restoration | #1190-#1220 |
| Provider runtime | #1164 lifecycle and provider decomposition | #1223-#1230 |
| Frontend API | #1165 credential-aware requests | #1218 |
| Dependencies | #1170 unused direct dependencies | #1217 |
| Container | #1166 production runtime and size contract | #1222 |
| Type safety | #1173 lint-debt ratchet | #1221 |
| CodeQL baseline | #1231 initial alert triage, remediation, and disposition | #1232-#1235 |
| Coordinated security | Private release blocker integrated without premature disclosure | #1236 |
| Release validation | Recovery-key alphabet and WebSocket header forwarding | #1238, #1239 |
| Release validation | Same-task lifecycle invocation ordering | #1240, #1241 |
| Release validation | Sanitized URI prefix validation | #1242, #1243 |
The initial CodeQL baseline contained 195 open alerts. All were reviewed: 67
were closed through source remediation and 128 received specific,
evidence-backed dispositions. The post-merge default-branch Security Gates run
32700390853
completed successfully at 1cdcd6ec60e3f48b6017146b2583fa82f7061c68
with zero open alerts.
The 2026-08-24 pre-release and post-publication GitHub security readbacks confirm Dependabot security updates, secret scanning, and push protection are enabled, and open Dependabot, secret-scanning, and default-branch CodeQL alert counts are all zero. Every external workflow action reference is pinned to a full commit SHA. The final readback was taken after the exact-main Security Gates run passed.
Final-milestone preflight on 2026-08-24 found local Node 26.7.0, pnpm 11.1.1,
Git 2.55.0, and an available Docker 29.2.1 server. The Node 22 floor remains
the ci:full runner gate; no separate local Node 22 installation is present.
The required macOS signing secret names and the complete App Store Connect
notarization secret-name set are configured, without reading their values. The
validation host had no existing Veritas Kanban app or cask before publication.
The live Homebrew install therefore replaced no active application or user data.
The final matrix ran once on the fully integrated candidate. The checked-in evidence update is documentation-only and does not alter the validated runtime.
| Gate | Environment | Candidate result |
|---|---|---|
| Frozen install, package-manager, security-artifact, delivery-cadence, and CI-scope policy | Local Node 26.7.0 and CI Node 22; pnpm 11.1.1 | Pass. Frozen install completed; package-manager, 1,864-file security-artifact, 18/18 delivery-cadence, and 18/18 CI-scope gates passed |
| Typecheck, lint, 458-warning budget, lint report, production/full audit, and gitleaks | Local Node 26.7.0 and CI Node 22 | Pass. Typecheck and lint completed with zero errors and the exact 458-warning budget; production and full audits found no known vulnerabilities; gitleaks passed |
| Workspace and orchestration units | Local clean worktree and CI run 32732019845 | Pass. Local workspace packages reported 4,289 passed and 24 skipped, plus 3/3 root orchestration tests. CI independently reported server 3,376 passed/5 skipped, web 780 passed, CLI 62 passed, MCP 71 passed/19 skipped, and dual-storage parity 4/4 |
| Critical-path coverage ratchets | CI Node 22 on frozen candidate | Pass. All seven boundaries passed: server dispatch 65.2% lines, auth 59.05%, storage 50.45%, web 55.25%, CLI 52.07%, MCP 52.39%, and desktop 66.24%; coverage artifact SHA-256 395ae4aef57b8dcb24eabe2ad2ac628f8bbe51564195b7525e5c2be57613a096 |
| Playwright Chromium and WebKit | Scheduled QA run 32732019821 | Pass. 37/37 cases passed in 3.6 minutes with zero retries; k6 completed 7/7 checks, 5 requests, zero request failures, and one uninterrupted smoke iteration |
| Build, Mantine QA, CLI/MCP smoke | Local clean worktree and CI Node 22 | Pass. Build and Mantine QA passed; initial JS/CSS were 242.3/53.7 KiB gzip. CLI/MCP compatibility had zero failures or warnings; two live read/write checks were explicitly skipped because the isolated profile had no VK_API_KEY |
| Desktop tests, build, readiness, native lifecycle, and unsigned package | macOS arm64 isolated profile and artifact run 32732019898 | Pass. Desktop 67/67, Electron artifacts 4/4, readiness 7/7, package smoke, visible setup/readiness, single-instance, close/reopen, and clean quit all passed. Mounted DMG and ZIP report 6.1.2 arm64. DMG: 265,821,857 bytes, SHA-256 562aa08c1d93653227aa0deee7cc0020f42bfe4ead9e404005fbe67a87822d7a; ZIP: 270,676,980 bytes, SHA-256 e1dc99f95e1c3396cda78c5e38582cdc7554baf2757aa57cfee411ba6a94de60. CI macOS/Linux/Windows unsigned artifacts all passed |
| Production Docker build, image-size contract, and runtime smoke | amd64 Docker contract run 32732019831 | Pass. Image size 571,628,184 bytes, below 600,000,000; non-root user, version, mounted paths, SQLite, backup, auth, static web, health, bcrypt, and clean shutdown passed |
| Release-format and release validators | Version 6.1.2 | Pass with one classified host limitation. Canonical release format passed 3/3 and every source/build-output check passed. Post-publication GitHub, tag, and body validation passed. The local Docker-enabled wrapper reached image assembly before Docker Desktop returned an overlayfs containerd metadata I/O error on a full host filesystem; the clean CI Docker build and complete runtime contract passed on the same frozen source |
| Field | Value |
|---|---|
| Release version | 6.1.1 |
| Source branch | fix/release-6-1-1-1156 |
| Source baseline | main after the audited task-drawer fix, dependency rollup, and Chalk 6 disposition (#1154, #1155, #1149) |
| Included issues | #1153 and release tracker #1156 |
| Pull-request audit | #1154 accepted and merged with browser proof; #1155 accepted with refreshed security floors; #1149 accepted after Node.js and test review; #1150 closed as unnecessary because pnpm/action-setup@v6 already resolves to 6.0.9; #1148 rejected because its engine floor and 65 failing tests violate the release contract |
| Publication state | Complete. PR #1157 merged as 2cfb89396da7e115571f3c1449449ef60bde53d7; annotated v6.1.1, the live GitHub release body, signed/notarized assets, installed-app verification, and Homebrew PR #49 are verified. |
| Gate | Candidate result |
|---|---|
| Task Detail and mobile browser regressions | Chromium verifies the Mantine tabs root is a flex column, the overlay has real overflow, and wheel input increases the scroll position. Chromium and WebKit verify nested task-card controls do not activate the card and status movement completes through the visible save lifecycle |
| Workflow storage readiness | The release-PR workspace job exposed an ENOENT startup race between asynchronous workflow-directory creation and the first write. File-backed workflow operations now await the shared readiness promise; the complete optimistic-concurrency route test passes in ten consecutive isolated runs. |
| Dependency security | pnpm audit --prod and full pnpm audit report no known vulnerabilities after stale override floors were refreshed |
| Dependency PR CI | Build, lint/typecheck, security audit, affected-workspace tests, and unsigned macOS, Linux, and Windows packaging passed on #1155 |
| Consolidated candidate | Frozen install, production and full audits, package-manager policy, release formatting, lint and 592-warning budget, typecheck, build, 3,771 workspace tests, 37 Playwright cases across Chromium and WebKit, Mantine QA, CLI/MCP smoke, 50 Buzz compatibility tests, 67 desktop tests, seven readiness tests, unsigned macOS packaging, packaged-app smoke, and the 6.1.1 release validator pass. The local Docker build variant was unavailable because the Docker daemon was not running. Independent review is owner-directed and is not part of the active release SOP. |
| Field | Value |
|---|---|
| Release version | 6.1.0 |
| Source branch | release/v6.1.0 |
| Source baseline | 0a19b9050da8915042860f55ef9ca009d164e816, the release integration of main after #1142 cleared the milestone blockers |
| Included issues | #855, #864, #865, #866, #867, #868, #871, #872, #873, #876, and #879 |
| Source verification | Focused verification passed per merged roadmap slice. PR #1142 completed append-only admission writes, restored the complete filesystem test-double surface, and mapped the exact knowledge-collection permission prefix. The consolidated candidate then passed pnpm test:unit across every workspace; server reported 3,234 passing and 5 skipped tests, web reported 469 passing tests, and desktop reported 67 passing tests. |
| Publication state | Complete. PR #1137 merged as e5aba49e61fca35c14616574a22174c0f848812f; annotated v6.1.0, signed/notarized assets, post-publication validation, isolated installed-app readiness, and Homebrew PR #46 are verified. |
| Issue | Outcome |
|---|---|
| #855 | Run-scoped egress gateway and enforceable network policy |
| #864 | Durable admission, aggregate budgets, fairness, cancellation, and circuit breaking |
| #865 | Durable goal supervision across turns, restarts, and continuations |
| #866 | Reviewed, attributable memory extraction and consolidation |
| #867 | Source-grounded workspace knowledge collections |
| #868 | Knowledge integrity linting, material-claim lifecycle, scheduling, semantic candidates, and health |
| #871 | Run-scoped background-command and monitor supervision |
| #872 | Preview-first turn-boundary checkpoints and attributable rewind |
| #873 | Stalled and repetitive run detection with bounded recovery |
| #876 | Governed artifact spill for oversized run output |
| #879 | Agent-dependency load shedding integrated with circuit breakers |
| Field | Value |
|---|---|
| Release version | 6.0.2 |
| Release tracker | #1010 |
| Source branch | release/v6.0.2-1010 |
| Source baseline | 2f18229ff24153ef33b5a21de21f0befb94d8a08, the merged #1005 main commit with green CI and cross-platform unsigned desktop artifacts |
| Included issues | #1000, #1004, #1005, and #1010 |
| Source verification | Focused tests and rendered smoke per fix; reviewed full workspace evidence on the exact #1005 merge ancestry; one milestone release validation gate |
| Signed runtime gate | Exact 6.0.2 equality across bundle, health, updater, native About, copied support text, and desktop bridge; Right/Bottom Chat recovery at the minimum supported window; bounded task; clean quit |
| Distribution gate | Annotated tag, reviewed full-width GitHub release body, signed/notarized DMG and ZIP, updater metadata, independent digests, GitHub release validation, and verified Homebrew cask |
| Issue | Pull request | Outcome |
|---|---|---|
| #1000 | #1003 | Deterministic documentation, focused, and full CI test scope |
| #1004 | #1008 | Bounded right/bottom Chat dock with complete visible recovery paths |
| #1005 | #1009 | Authoritative native version/build/channel/OS/architecture record and offline copy action |
| #1010 | #1011 | Version, documentation, full-width release body, signed publication, downloaded-app verification, and Homebrew gate |
| Field | Value |
|---|---|
| Release version | 6.0.1 |
| Stabilization tracker | #924 |
| Source branch | release/v6.0.1 |
| Superseded publication | v6.0.0, retained as a quarantined prerelease |
| Stabilization issues | #935, #936, #937, #938, #939, #941, #943, #944, #945, and #986 |
| Source verification | Focused tests plus changed-file CI per issue; one full workspace suite is reserved for the release PR |
| Signed runtime gate | Exact 6.0.1 equality across bundle, health, updater, and desktop bridge metadata; Chat recovery; bounded task; clean quit |
| Distribution gate | Signed/notarized DMG and ZIP, updater metadata, independent checksums, GitHub release validation, and verified Homebrew cask |
| Issue | Pull request | Outcome |
|---|---|---|
| #935 | #992 | Task drawers and shared overlays remain usable at compact heights |
| #936 | #989 | Workflow actions normalize omitted collections and surface recoverable failures |
| #937 | #993 | Navigation and nested overlays preserve the actual route origin and scroll state |
| #938 | #995 | Scoring profile content has intentional nested scroll ownership |
| #939 | #991 | Archive cards and layout remain reachable at compact sizes |
| #941 | #996 | Template editing is a complete visible authoring flow |
| #943 | #990 | New scoring profiles open as visible validated drafts |
| #944 | #994 | Operations Digest reconciles current state, windowed events, exclusions, and source evidence |
| #945 | #988 | Chat has visible, keyboard, browser-history, persisted-state, compact-window, and native-menu recovery paths |
| #986 | #997 | Desktop setup is version-neutral and the bridge consumes Electron’s application version |
| Field | Value |
|---|---|
| Release version | 6.0.0 |
| Release tracker | Veritas Kanban 6.0.0 harness parity and Buzz integration |
| Buzz epic | First-class Buzz integration |
| Harness epic | Equal-footing agent harness support |
| Implementation baseline | 398fe7f67e94c3d6cabee0702b2331d9c873fd0f |
| Release branch | release/v6.0.0 |
| Release PR | #985 |
| Release merge | 1bd43f9279f5ab736bff03378d5d85243e16813e |
| Tag and GitHub release | v6.0.0 |
| Desktop Release workflow | Run 30109135335 |
| Homebrew PR | #37, merged as 7d77106e7c526a0975c49b9b11e0c9526921ead0 |
| Evidence host | macOS 26.5.2 arm64; Node 26.5.0; pnpm 11.1.1; Git 2.55.0 |
| Issue | Pull request | Outcome |
|---|---|---|
| First-class harness support profile | #925 | One support tier and fail-closed onboarding contract |
| Immutable run launch manifest | #926 | Attempt-bound compiled launch evidence |
| Provider-owned task transports | #928 | Immutable task request rendered per adapter |
| Idempotent completion results | #930 | One authoritative provider-neutral terminal result |
| Credential registry and leases | #933 | Value-free definitions and exact run/action leases |
| Transactional worktrees | #934 | Remote-safe allocation, ownership, recovery, and cleanup |
| Issue | Pull request | Outcome |
|---|---|---|
| Causal run-event journal | #949, #950 | Replayable redacted events and CI repair |
| Interactive approval broker | #953 | Exact-action durable approvals |
| Durable run supervisor | #954 | Restart ownership, recovery, and terminal reconciliation |
| Conversation lifecycle | #958 | Capability-gated resume, follow-up, fork, steer, and close |
| Run-scoped tool control plane | #959 | Versioned discovery/catalog and governed invocation |
| Generic ACP stdio provider | #961 | Provider-neutral ACP v1 client adapter |
| ACP server view | #967 | vk acp serve and status over Veritas-owned sessions |
| Launch credential classification | #963 | Boot, brokered, and high-risk passthrough evidence |
| Credential boundary catalog | #971 | Exact value-free broker boundary |
| Mediated lease consumption | #972 | One-shot downstream MCP credential resolution |
| System-owned provider bridge | #973 | Narrow veritas-run injection or fail-closed block |
| Runtime hook bus | #977 | Bounded in-process pre/post runtime hooks |
| Harness conformance suites | #975 | Seeded deterministic repeated evaluation |
| Issue | Pull request | Outcome |
|---|---|---|
| Grok Build ACP profile | #966 | Exact v0.2.111 restrictive ACP profile |
| Codex app-server v2 | #952 | Pinned JSON-RPC v2 lifecycle adapter |
| Claude Code stream adapter | #951 | Bare-mode supervised stream-json execution |
| GitHub Copilot CLI ACP profile | #965 | Public-preview exact v1.0.74 restrictive profile |
| Buzz compatibility diagnostics | #946 | Reference-only relay/identity evidence |
| Buzz Squad Chat adapter | #947 | Signed bidirectional roots/replies and replay |
| Buzz Agent ACP profile | #964 | Exact Buzz v0.4.24 generic ACP profile |
| Buzz run-scoped MCP | #974 | System-owned veritas-run bridge for Buzz |
| Buzz persona/team import | #948 | Signed preview-first one-way import |
| Buzz workflow triggers | #978 | Allowlisted root-message triggers with replay protection |
| Buzz compatibility gate | #979 | Composed 50-test credential-free gate |
| Cross-harness matrix | #976 | One matrix for API, doctor, Settings, telemetry, and dispatch |
| Issue | Pull request | Outcome |
|---|---|---|
| Lazy run-supervisor storage binding | #982 | Packaged SQLite startup initializes storage before lookup |
| Reject desktop updater downgrade metadata | #984 | v6 refuses published v5 metadata after stable channel selection |
| Issue | Pull request | Outcome |
|---|---|---|
| Tier changed-file and full CI | #957 | Focused pull-request gates with explicit full-workspace lanes |
| Bounded desktop upgrade readiness | #929 | Version-matched installed-app startup and diagnostic readiness |
| Harness | Version/build | Deterministic posture | Credential-gated posture |
|---|---|---|---|
| Buzz Agent | v0.4.24 / 710ed9...; buzz-agent 0.1.0 |
Pass: 7 files, 50 tests | Binary unavailable; no live claim |
| Grok Build | v0.2.111 / 94172f2aa4e5 |
Pass in workspace gate | Installed 0.2.22 is stale and unauthenticated |
| Codex app-server | 0.145.0 / 25af12... |
Pass in workspace gate | Pass: exact authenticated 0.145.0, 1 smoke test |
| Codex SDK | 0.144.3 | Pass in workspace gate | Deterministic evidence only |
| Claude Code | 2.1.218 | Pass in workspace gate | Binary unavailable; no live claim |
| GitHub Copilot CLI | 1.0.74 / 2b809c... tag commit |
Pass in workspace gate | Exact binary installed; authentication unavailable |
| Hermes | v2026.7.7.2 | Pass in workspace gate | Binary unavailable; retained non-Certified tier |
| OpenClaw | v2026.6.11 | Pass in workspace gate | Installed 2026.6.1 is stale; no live gateway claim |
No row may be changed to a live passing claim without exact command/runtime evidence. A skipped credential gate remains skipped, not passed.
The packaged 6.0.0 candidate returned the configured-profile rows below through
the redacted harness-compatibility-matrix/v1 status path from the copied
v5.2.5 profile. The OpenClaw row applies the same normalized tier contract at
the host executable boundary because that copied profile had no OpenClaw entry.
Deterministic fixture results do not replace these live tiers.
| Profile | Observed tier | Certification | Evidence date | Runtime evidence |
|---|---|---|---|---|
| OpenAI Codex CLI | Configured | Not current | 2026-07-24 | codex-cli 0.145.0; executable and authentication detected |
| OpenAI Codex SDK | Detected | Not current | 2026-07-24 | codex-cli 0.145.0; disabled profile |
| OpenAI Codex app-server | Detected | Not current | 2026-07-24 | codex-cli 0.145.0; disabled profile |
| GitHub Copilot CLI | Detected | Not current | 2026-07-24 | GitHub Copilot CLI 1.0.74; disabled profile; auth not inferred |
| Grok Build | Detected | Not current | 2026-07-24 | 0.2.22 build 967574cb117; disabled and older than reviewed 0.2.111 |
| Claude Code | Degraded | Not current | 2026-07-24 | Executable not installed |
| Buzz Agent | Degraded | Not current | 2026-07-24 | Executable not installed |
| Hermes | Degraded | Not current | 2026-07-24 | Executable not installed |
| OpenClaw | Detected | Not current | 2026-07-24 | 2026.6.1 executable found; no enabled profile or live gateway claim |
No profile reported Certified because persisted certification evidence was not current in this isolated profile. OpenClaw is Detected at the host boundary because the executable exists while no profile is enabled; its stale 2026.6.1 build is not a live gateway claim. The exact authenticated app-server smoke remains separate command evidence, not a support-tier mutation.
Results are filled from the clean release candidate. Counts and elapsed time are recorded when the tool reports them.
| Gate | Environment | Result | Evidence or limitation |
|---|---|---|---|
| Toolchain versions | macOS 26.5.2 arm64 | Pass | Node 26.5.0; pnpm 11.1.1; Git 2.55.0 |
pnpm install --frozen-lockfile |
clean release worktree | Pass | 1,116 packages in 4.8 s; lockfile pinned to pnpm 11.1.1 |
pnpm check:pnpm-settings |
clean release worktree | Pass | Package manager and instruction versions agree |
pnpm audit --prod --audit-level=high |
production dependencies | Pass | 0 high/critical; 1 low and 1 moderate retained |
pnpm lint and pnpm lint:budget |
all tracked source/docs | Pass | 0 errors; 595 warnings within the 600-warning budget |
pnpm qa:mantine |
built web bundle | Pass | Initial JS 238.9 KiB gzip; CSS 51.4 KiB gzip |
pnpm typecheck |
all workspaces | Pass | 11.97 s |
pnpm build |
all workspaces | Pass | 16.53 s |
pnpm test:unit |
sequential workspaces | Pass | 3,217 passed, 4 skipped; 329 files; 48.74 s |
pnpm test:e2e |
Playwright matrix | Pass | 36/36; Chromium, mobile Chromium, mobile WebKit; 79.76 s |
pnpm smoke:cli-mcp |
release output | Limited | Static versions/builds pass; live read/write skipped without test key |
pnpm test:buzz:compatibility |
credential-free fixtures | Pass | 7 files, 50/50 tests; 4.30 s Vitest |
| Provider/lifecycle/approval/MCP/credential suites | credential-free fixtures | Pass | Focused release integration set: 4 files, 83/83 tests, 2.76 s |
pnpm desktop:test |
macOS arm64 | Pass | 14 files, 61 tests, 344 ms |
pnpm desktop:build |
macOS arm64 | Pass | 1.20 s; Electron artifact check 4/4 |
pnpm desktop:check:electron-artifacts |
fresh desktop output | Pass | Main and preload artifacts accepted |
pnpm desktop:smoke:mac:local |
isolated unsigned package | Pass | 25.28 s |
pnpm desktop:package:mac:unsigned |
macOS arm64 | Pass | Final post-blocker DMG/ZIP package in 57.49 s |
| v5.2.5 populated-profile upgrade | isolated copy | Pass | Matching counts, integrity, owner summary, profile; registry absence preserved |
| v5.2.5 registry compatibility | exact-format deterministic test | Pass | 1/1; identity, provider, capabilities, metadata, status, and session preserved |
| File-backed migration and restore | isolated deterministic fixture | Pass | 7/7; tasks, config, workflows, chat, telemetry, backup, and restore |
| In-app Browser runtime | isolated server/web | Pass | First run, login, provider/Buzz settings, themes, palette/focus; 0 console errors |
| Local browser automation | Playwright matrix | Pass | 36-route/interaction E2E matrix |
| Native desktop runtime | isolated profile | Pass | One instance, window, health, menus, reopen, update, clean quit |
pnpm validate:release -- --version 6.0.0 |
clean release worktree | Pass | 0.60 s |
pnpm validate:release -- --version 6.0.0 --docker-build |
production target | Pass | 116.39 s; veritas-kanban:validate-6.0.0 |
| Focused standards review | diff from 398fe7f6... |
Pass | GPT-5.6 standards axis; no remaining findings; cross-model review waived |
| Focused spec/security claim review | release tracker and goal prompt | Pass | GPT-5.6 spec axis; findings corrected; secret/security scan passed |
On 2026-07-24 the maintainer directed a sustainable verification cadence: focused behavior tests for issue pull requests, changed-file CI per pull request, and one complete workspace suite at the final release gate. Applying that direction, the in-app Browser pass covered rendered and interactive behavior that benefits from manual inspection: first run, login, provider and Buzz Settings, degraded states, dark/light themes, command-palette focus, labels, and console health. Stateful task launch, causal events, approvals, cancellation, Buzz replay, MCP, worktrees, telemetry, completion, compact layout, and recoverable errors remained in the passing deterministic and E2E automation instead of being duplicated manually in the in-app Browser.
This is an explicit release-evidence split, not a claim that those scripted flows were manually clicked in the in-app Browser.
Completed isolated drill:
codex-v525-smoke profile;PRAGMA quick_check=ok before and after;The signed profile contained no agent registry, so the native drill proves that absence remains absence while the exact-format automated fixture covers a populated v5 registry. The signed fixture’s two task rows were deliberately minimal direct-SQL migration records, so the onboarding count is authoritative evidence; their incomplete legacy JSON is not claimed as a rendered task-card test.
No private data, credential value, raw provider conversation, or unrestricted runtime profile is retained in this packet.
Source publication, signed-macOS verification, updater validation, isolated signed-app readiness, and Homebrew distribution are complete.
| Publication item | Result |
|---|---|
| Release PR and merge | #1293; frozen full-matrix head 9828a46b06a510227e62348302d821876a7aaa5f; verified squash merge 32ced60ebb1709f4a839dd80cc7bf067be1c5d9a |
Annotated v6.1.3 tag object and peeled commit |
0d457e772678a8ef3add72aca89492798a69396e; 32ced60ebb1709f4a839dd80cc7bf067be1c5d9a |
| GitHub release URL and body | Veritas Kanban 6.1.3; stable release published 2026-08-30; API and rendered-page readback passed and the live body exactly matches docs/releases/v6.1.3.md |
| Final release workflows | CI 33314084698, Security Gates 33314074882, QA 33314084715, Docker 33314084720, and Desktop Artifacts 33314084689 passed on the frozen release head |
| Desktop Release workflow | Run 33314404490; exact release merge SHA; signed and notarized macOS job passed in 10m19s |
| Signed/notarized DMG | Veritas-Kanban-6.1.3-mac-arm64.dmg; 271,976,580 bytes; SHA-256/GitHub digest and sidecar value bba2c99e0367dab1a355f14d5f05bb78c8bc16ff96ad2032c0c9e27d83cdd836; DMG staple validated |
| Signed/notarized ZIP | Veritas-Kanban-6.1.3-mac-arm64.zip; 276,291,723 bytes; SHA-256/GitHub digest and sidecar value 0bdf96451415a027106398c93de9d1ffbfc44d35164205d3219fdbe284a939b3; extracted bundle reports 6.1.3 |
| DMG/ZIP blockmaps and SHA-256 sidecars | Blockmap digests 7088998394bf4caeeb0ac432b9a8f307bca095134a692042d264adc56634f345 and 0adac8ecfafc3849e1571dc8b28b4c6369beea9b43757673f3074e654c076232; sidecar-file digests 5f1dc812daa0f915f5b857627e1b87c78fca52faa34248a4ed87d25ba5f70220 and 0deccedfb6b2cab409ce2accaf214713f1a299a64044b80d3b70d914f0212b45 |
latest-mac.yml |
Version 6.1.3; 530 bytes; SHA-256 a73b7804b013a4f8455c17d90a2585a94705a7747c19eb6d2e1f310e906a5d53; ZIP and DMG names, sizes, and SHA-512 values match the public assets |
| Signed-app isolated launch | Deep strict signature validation, hardened runtime, Team ID RLBHD62MPW, Gatekeeper Notarized Developer ID acceptance, and app/DMG staple validation passed. A disposable user-data root launched the downloaded ZIP app on isolated ports 33130/33131; /api/health reported 6.1.3, the packaged child owned the listener, and the complete task-owned process tree stopped. The existing Homebrew-installed 6.1.2 app and its data were not replaced or opened |
| Release validator | Post-publication pnpm validate:release -- --version 6.1.3 --github --repo BradGroux/veritas-kanban passes and proves the live release and body match the annotated tag and canonical checked-in file |
| Homebrew cask | Issue #52; PR #53; reviewed head 5457be058a8a8b61d76235ec83c2ade31e24966d; verified merge c62c600cfa1130ddbae1fe991b5ba4cf943bc007; registered bradgroux/tap/veritas-kanban resolves 6.1.3 with the public ZIP checksum and passes Ruby syntax, cask style, strict online audit, fetch, and livecheck without replacing the installed 6.1.2 app |
| Final hosted state | Open pull requests: 0. Open release-scoped issues: only tracker #1262 pending this evidence merge. Open Dependabot, secret-scanning, and CodeQL alerts: 0. Every GitHub mutation read back as BradGroux with no GitHub App attribution |
Source publication, signed-macOS verification, full-width release-note validation, isolated installed-app readiness, Homebrew distribution, and the approved advisory disposition are complete.
| Publication item | Result |
|---|---|
| Release PR and merge | #1237; frozen full-matrix head 2a21178df97a00395cfc6c43774a57496a5c1f6a; final evidence-only head ec1d3a7e106e2dd2753d41b5e351cdf665e2cd7c; verified squash merge dfae7911cc282e32262a006e2171ce5fe4865714 |
Annotated v6.1.2 tag object and peeled commit |
819aad9ae8eae3f2f40593d4567647963f7bfbc3; dfae7911cc282e32262a006e2171ce5fe4865714 |
| GitHub release URL and body | Veritas Kanban 6.1.2; stable release published 2026-08-24; the live body exactly matches docs/releases/v6.1.2.md |
| Exact-main CI and security | CI run 32734012479 and Security Gates run 32734012461 passed on the exact release merge; CodeQL, Dependabot, secret scanning, push protection, gitleaks, and immutable-action gates have no unresolved release blockers |
| Desktop Release workflow | Run 32734749604; exact release merge SHA; signed and notarized macOS job passed in 11m1s |
| Signed/notarized DMG | Veritas-Kanban-6.1.2-mac-arm64.dmg; 267,430,041 bytes; SHA-256/GitHub digest and published sidecar value 1b2a75c241642a8af14e48827dfc48c5e7846f2709af2359dc1ae34ba2588baa; Apple notarization accepted, stapling validated, and Gatekeeper accepted Notarized Developer ID RLBHD62MPW |
| Signed/notarized ZIP | Veritas-Kanban-6.1.2-mac-arm64.zip; 271,666,610 bytes; SHA-256/GitHub digest and published sidecar value 81ea146d20d2ab279331e73c01bc3c4eafdda8a4082be3607e9ca535a7d2be85; the independently downloaded Homebrew cache matched this digest and contained bundle version 6.1.2 |
| DMG/ZIP blockmaps and SHA-256 sidecars | Blockmap digests 9c99a416dbc518306456bf7025cbe478ea1242a40eb8acf349eb3dc67946ee97 and 77e55eb209f04b10bc1d38e2600032a1b2e808b4eeb11389d9e02819d306c935; sidecar-file digests 30a6aa1831ed8f8f9c93c0e7e705c5f5e18805d092033732352f4513b6077c5a and 9608ca6f5b365d9f74d0e6f9b3f71164dee4212af136b8cc8adf5650908b9790 |
latest-mac.yml |
Version 6.1.2; 530 bytes; SHA-256 591073ea888481ffdf1b0d2dc1d026b751422d44954ff2084bf7f8e64151992b; ZIP and DMG names, sizes, and SHA-512 values match the published assets |
| Installed signed-app isolated launch | Homebrew installed 6.1.2 without replacing an existing app or cask. CFBundleShortVersionString and CFBundleVersion report 6.1.2; deep strict code-signature validation, hardened runtime, Gatekeeper acceptance, and stapling validation pass. A disposable user-data root launched the installed app on isolated port 3101; exact-version readiness passed in 209ms and proved the packaged app owned the listener. /api/health reported 6.1.2, first-run onboarding showed all local readiness checks healthy, native menus rendered, and the task-owned process tree and listener stopped without touching the separate development build |
| Release validator | Post-publication pnpm validate:release -- --version 6.1.2 --github --repo BradGroux/veritas-kanban passes and proves the live release and body match the annotated tag and canonical checked-in file |
| Homebrew cask | Issue #50; PR #51; reviewed head a3269d43eb657c0480e549e4d1fc15bc21baddea; verified merge 2b29b79a26b269ed832f38b7173c7459c3db508d; registered bradgroux/tap/veritas-kanban resolves 6.1.2 with the published ZIP checksum and passes Ruby syntax, cask style, strict online audit, dry-run install, livecheck, actual installation, signature/stapling/Gatekeeper verification, and exact-version packaged readiness |
| Advisory disposition | Owner approved publication after supported artifacts were available. The repository security advisory was published 2026-08-24 with the affected range and >= 6.1.2 patched version verified |
| Classified host limitation | The first local Docker wrapper and first Homebrew audit encountered the validation host’s exhausted filesystem. No gate was weakened: clean CI proved the Docker contract, owner-approved removal of 1.67 GB of regenerable release output restored capacity, and the same live Homebrew audit/install then passed. No source, evidence, active development build, or user workspace was removed |
Source publication, signed-macOS verification, full-width release-note validation, isolated installed-app readiness, and Homebrew distribution are complete.
| Publication item | Result |
|---|---|
| Release PR and merge | #1157; reviewed head 5813d0d3d5285558582cb76c97e7d824b5ad9425; verified squash merge 2cfb89396da7e115571f3c1449449ef60bde53d7 |
Annotated v6.1.1 tag object and peeled commit |
c18955bbd7cc582f7ccd41a958ec1f53b6907cc2; 2cfb89396da7e115571f3c1449449ef60bde53d7 |
| GitHub release URL and body | https://github.com/BradGroux/veritas-kanban/releases/tag/v6.1.1; stable release published 2026-08-22; the live body exactly matches docs/releases/v6.1.1.md and is the latest non-prerelease |
| Release CI and unsigned packaging | CI run 32608829719 passed build, security audit, lint/typecheck, scope selection, 3,771 workspace tests, and the changed-test gate; artifact run 32608829776 passed macOS, Linux, and Windows unsigned packaging on the reviewed head |
| Desktop Release workflow URL and duration | Run 32609140955; exact release merge SHA; signed and notarized job passed in 11m37s |
| Signed/notarized DMG | Veritas-Kanban-6.1.1-mac-arm64.dmg; 268,632,259 bytes; SHA-256 and published sidecar value 7fa44f4129be751757a7e049cd3681266cab3215402cd2e2a5d8b0acf38c6c11; independent download, signature, Gatekeeper, and stapling validation pass |
| Signed/notarized ZIP | Veritas-Kanban-6.1.1-mac-arm64.zip; 272,805,716 bytes; SHA-256 and published sidecar value cd9c1cc68d474d3dbea8b6aae90380f5188f041009c229756371eeba7eecd9b0; Homebrew strict online audit independently downloaded and accepted the asset |
| DMG/ZIP blockmaps and SHA-256 sidecars | Blockmap digests fe15ce89df44e720e3b1c9381b035d80a079042697a592c12b2be9cad96a949e and a5b9b910d458ab430daee0ae61ad962948c115bd69436fdbc4e56af861db38b8; sidecar-file digests 7f29b0095ff92529b0c9fdcffac539fe4ae20adff772011f4ed14ca735a641c6 and fd0cbb9aa58315f4143c1b4daf9aad158c150283086660a6be93829e42b9ccce |
latest-mac.yml |
Version 6.1.1; 530 bytes; SHA-256 df7b4f16c3f6c21720f7446af531967854bc3901749f09aaa87e5d1d06b1eb11; ZIP and DMG names, sizes, and SHA-512 values match the published assets |
| Installed signed-app isolated launch | Homebrew upgraded the installed cask from 6.1.0 to 6.1.1. CFBundleShortVersionString reports 6.1.1; deep strict code-signature validation, Gatekeeper acceptance from notarized Developer ID RLBHD62MPW, and stapling validation pass. A disposable profile and workspace launched the packaged app on isolated port 3101; exact-version readiness passed in 4.289s and proved the packaged app owned the listener. /api/health reported 6.1.1, the process stopped cleanly, both disposable user-data directories moved to Trash, and the existing workspace was not opened. |
| Release validator | Post-publication pnpm validate:release -- --version 6.1.1 --skip-build-output --github --repo BradGroux/veritas-kanban passes and proves the live release and body match the annotated tag and canonical checked-in file |
| Homebrew cask | Issue #48; PR #49; reviewed head 4956cd0c7245ad28571f0860ce1f0d63159e4ff5; verified merge 033983c2d76eccb6ef348e529a42f53d328ef335; registered bradgroux/tap/veritas-kanban resolves 6.1.1 with the published ZIP checksum and passes Ruby syntax, cask style, strict online audit, dry-run install, livecheck, installed-cask upgrade, and exact-version packaged readiness |
Source publication, signed-macOS verification, full-width release-note validation, isolated installed-app readiness, and Homebrew distribution are complete.
| Publication item | Result |
|---|---|
| Release PR and merge | #1137; reviewed head ec9d7b6e86bcb5566cf04419db8817fa836508ae; squash merge e5aba49e61fca35c14616574a22174c0f848812f |
Annotated v6.1.0 tag object and peeled commit |
415a88e50e96a5c1ca02034e7e2392c08482d6e0; e5aba49e61fca35c14616574a22174c0f848812f |
| GitHub release URL and body | https://github.com/BradGroux/veritas-kanban/releases/tag/v6.1.0; stable release published 2026-07-26; the post-publication release validator proves the live body exactly matches docs/releases/v6.1.0.md, which passes the checked-in full-width format gate |
| Release CI and unsigned packaging | CI run 30199975494 passed security audit, lint, typecheck, build, and changed tests; artifact run 30199975488 passed macOS, Linux, and Windows preview packaging |
| Desktop Release workflow URL and duration | Run 30200162940; exact release merge SHA; signed and notarized job passed in 10m55s |
| Signed/notarized DMG | Veritas-Kanban-6.1.0-mac-arm64.dmg; 277,393,979 bytes; SHA-256/GitHub digest b7f3fb09a4b35c34bf015b3fa4f878bf6c91b126d2f5c5bad70e602839b9d599; release workflow signature, Gatekeeper, and stapling validation passed |
| Signed/notarized ZIP | Veritas-Kanban-6.1.0-mac-arm64.zip; 281,520,166 bytes; SHA-256/GitHub digest and published sidecar 6ca5f99394fb551b6b5fb60006ffaa8e5a793808be1382d49c4b3a3209e98701; Homebrew strict online audit independently downloaded and accepted the asset |
| DMG/ZIP blockmaps and SHA-256 sidecars | Blockmap digests 29582df6dbdc121cbbfab4255c7ccaf5c258100456be7230b971d65a27a8eaf9 and f9834743c9523f334c6d7113af00402f16c18c08a5f35345313ad0f644ecb886; sidecar digests 33b2eb510b4eaa6b51082aa9dc0090b4e5e578316d51b98dcf5305016d63577e and bdf782510a2aebb35b22d29875d92bcaf0c75415164c0644f01d43a58914e301 |
latest-mac.yml |
Version 6.1.0; 530 bytes; SHA-256 b51be7cb54b37dc7cf49e045c276d7d09a4563e9462583a3eaec72d972c88c6d |
| Installed signed-app isolated launch | Homebrew upgraded the installed cask from 6.0.2 to 6.1.0. CFBundleShortVersionString reports 6.1.0; deep strict code-signature validation, Gatekeeper acceptance from notarized Developer ID RLBHD62MPW, and stapling validation pass. A disposable profile and workspace launched the packaged app on isolated port 3101; exact-version readiness passed in 6.294s and proved the packaged app owned the listener. The process stopped cleanly, the disposable user-data directory moved to Trash, and the existing workspace was not opened. |
| Compatibility smoke | CLI/MCP version and build-output smoke passed with zero failures and two expected live read/write skips because no VK_API_KEY was supplied; Buzz deterministic compatibility passed 7 files and 50 tests |
| Release validator | Post-publication pnpm validate:release -- --version 6.1.0 --skip-build-output --github --repo BradGroux/veritas-kanban passes and proves the published release body equals the canonical checked-in file |
| Homebrew cask | Issue #45; PR #46; reviewed head 222c5a8; merge 4179cce931e7a7e6401a0e3fcd5097bcc23ff830; registered bradgroux/tap/veritas-kanban resolves 6.1.0 with the published ZIP checksum and passes Ruby syntax, style, strict online audit, dry-run install, livecheck, installed-cask upgrade, and exact-version verification |
Source publication, independent signed-macOS verification, release-note format validation, and Homebrew distribution are complete.
| Publication item | Result |
|---|---|
| Release PR and merge | #1011; reviewed head 88fb70c23cf10ac58b6444b9fd08af4077956bb6; squash merge 3a73662b9c3431115f77401e3620a6839f95b61d; the two commits have identical Git trees |
Annotated v6.0.2 tag object and peeled commit |
a56785e0f9052572982332bb974dbab871c0c971; 3a73662b9c3431115f77401e3620a6839f95b61d |
| GitHub release URL and body | https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.2; stable release published 2026-07-24; live body exactly matches docs/releases/v6.0.2.md; no carriage returns, hard-wrapped prose, trailing-space breaks, literal escaped newlines, or HTML <br> |
| Desktop Release workflow URL and duration | https://github.com/BradGroux/veritas-kanban/actions/runs/30132949865; exact release merge SHA; signed and notarized job passed in 11m52s |
| Signed/notarized DMG | Veritas-Kanban-6.0.2-mac-arm64.dmg; 276,146,896 bytes; SHA-256/GitHub digest 2cf7deb9c600036468db12436988b1c23b679130f088a46a5a910366119ea52b; Developer ID RLBHD62MPW, hardened runtime, Gatekeeper, and stapling pass; the mounted app independently passes the same signature, Gatekeeper, and stapling checks |
| Signed/notarized ZIP | Veritas-Kanban-6.0.2-mac-arm64.zip; 279,993,375 bytes; SHA-256/GitHub digest b6f389c67f3a99086210df104c8cdec4976b9bb56a7cea5b32e611fbc41c21cd; extracted app Developer ID RLBHD62MPW, hardened runtime, Gatekeeper, and stapling pass |
| DMG/ZIP blockmaps and SHA-256 sidecars | Blockmap digests 02c7fe30788c92b5ec06459a157b5c4096a645c398fdda867090e5ba707e4f9e and 08ac8ed54189981039368074c0fd085348d4cd080c9cb63ae2924dcb67776398; sidecar digests 40e95f25cf9a2297db872d3fed33ac198bd5f40901df189069a6a5e08795266f and d32a9e1184ce1d8ebaa611c3c4a4fbebcc885072920963b470d37e226ffaf632; both sidecars verify |
latest-mac.yml |
Version 6.0.2; 530 bytes; SHA-256 04797813b0aae9643295329a7ee93aa75f18746a1f4a47992cfb1432813139b3; DMG/ZIP names, byte sizes, and independently computed SHA-512 values match |
| Downloaded signed-app isolated launch | Pass at 1180x760; fresh disposable profile; ready local-production server; bundle, /api/health, updater, native About, copied support information, and desktop bridge report 6.0.2 with build 3a73662b9c3431115f77401e3620a6839f95b61d; Right and Bottom docks remain contained and preserve the active conversation; close, Escape, Back, obsolete-state recovery, and Reset Layout restore the board and focus; bounded task creation passes; latest-version update check passes; native Quit removes app and bundled-server listeners; disposable profiles moved to Trash |
| Release validator | Pre-publication pnpm validate:release -- --version 6.0.2 and --docker-build pass; post-publication pnpm validate:release -- --version 6.0.2 --skip-build-output --github passes and proves the live body equals the canonical file |
| Homebrew cask | Issue #43; PR #44; reviewed head 3bb23d5c7e7f8593ed8c4b7a294e59e4e6aa754b; merge 03878fbbf886d24fd543422c484397747e55c80c; registered bradgroux/tap/veritas-kanban resolves 6.0.2 with the published ZIP checksum and passes syntax, style, strict online audit, dry-run install, and livecheck |
| Verification-efficiency follow-up | Issue #1012 and PR #1013 stop cosmetic label events from executing or canceling CI and reuse reviewed full-suite evidence only for exact-tree squash merges; two live cosmetic-label runs skipped every job while the authoritative run completed, and the post-merge workspace suite reused the exact reviewed tree |
Source publication, the independent signed-macOS gate, and Homebrew restoration are complete.
| Publication item | Result |
|---|---|
| Release PR and merge | #998; reviewed head 1c86d90386ce9ed05639c7118ab355385b88fb37; merge faeec2752a79ca42adef982ad169f21fd55b0711 |
Annotated v6.0.1 tag object and peeled commit |
a2388528ecd80e4b4ecc5ce6e8922dcb05f23c95; faeec2752a79ca42adef982ad169f21fd55b0711 |
| GitHub release URL | https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.1; stable release published 2026-07-24 |
| Desktop Release workflow URL and duration | https://github.com/BradGroux/veritas-kanban/actions/runs/30118916300; exact merge SHA; signed and notarized job passed in 11m6s |
| Signed/notarized DMG | Veritas-Kanban-6.0.1-mac-arm64.dmg; 276,120,202 bytes; SHA-256/GitHub digest f6b811f46c92532feceb18302a7edd46ecac33580fdd3bf417bb3afd3952c22c; Developer ID RLBHD62MPW, hardened runtime, Gatekeeper, and stapling pass |
| Signed/notarized ZIP | Veritas-Kanban-6.0.1-mac-arm64.zip; 279,986,716 bytes; SHA-256/GitHub digest f0f03e0210141b789daed09de34171c07260eaad2cf5f5c1d1f74fbd5296a4de; extracted app Developer ID RLBHD62MPW, hardened runtime, Gatekeeper, and stapling pass |
| DMG/ZIP blockmaps and SHA-256 sidecars | Blockmap digests 4cc52ca62e0cd3fb44bbe230d44811e8da87d06cef52cb45ba456e4d8e69d593 and 369b0891d9d7ae0a3641ba5cc8d6dfa0a207dfd4fd8ee6b09a46f0353b4fb3db; sidecar digests eb2e223c0a0220e748f7b21b9c15c8c09dfc3718e9894ddfb1330ae6d702fac1 and 32ff009d56f6d18b27608ac616dc7c7a01914b5e4382ce22070b7d0bb965b6f6; both sidecars verify |
latest-mac.yml |
Version 6.0.1; 530 bytes; SHA-256 47e6b3a2b24696873699ee11cc15de2d8b7dd580c2302ee698ae4c49ab5abbdc; DMG/ZIP names, byte sizes, and independently computed SHA-512 values match |
| Downloaded signed-app isolated launch | Pass; fresh disposable profile; ready local-production server; bundle, health, updater, and desktop bridge report 6.0.1; onboarding/login and bounded task creation pass; Board Chat preserves the shell; close, Escape, Back, obsolete-state recovery, and native layout reset pass; stable updater reports latest; native Quit removes both app and bundled-server listeners |
| Release validator | pnpm validate:release -- --version 6.0.1 --github --repo BradGroux/veritas-kanban --docker-build passes, including a clean production image build |
| Homebrew cask | Issue #40; PR #42; reviewed head 0a785cc1956070a8bc05533b194108010997bedb; merge c23cc7e1b6d1b1d05f5117b5fdfea67806d42f48; normal registered tap resolves 6.0.1 with the published ZIP checksum and passes syntax, style, strict online audit, dry-run install, and livecheck; verification #41 records the exact command evidence |
Source publication completed from reviewed release PR #985. The tag-triggered workflow, independent artifact verification, signed-app runtime check, and Homebrew publication are also complete.
| Publication item | Result |
|---|---|
| Release merge SHA | 1bd43f9279f5ab736bff03378d5d85243e16813e |
Annotated v6.0.0 tag object and peeled commit |
85d0328a23b54bd7e7d578b5725d50cd2e0084f3; 1bd43f9279f5ab736bff03378d5d85243e16813e |
| GitHub release URL | https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.0 |
| Desktop Release workflow URL and duration | https://github.com/BradGroux/veritas-kanban/actions/runs/30109135335; pass in 12m7s |
| Signed/notarized DMG | Veritas-Kanban-6.0.0-mac-arm64.dmg; 276,118,002 bytes; SHA-256/GitHub digest 0a2a51cb279d42089770932f760bb77abedf9db767c151cc0071d1ee3e1bfa55; Developer ID, Gatekeeper, and stapling pass |
| Signed/notarized ZIP | Veritas-Kanban-6.0.0-mac-arm64.zip; 279,976,801 bytes; SHA-256/GitHub digest 7a5947bb6abd440c4d69da36def9f891e154139547f741d2f44c4733c6719cb8; extracted app Developer ID, hardened runtime, Gatekeeper, and stapling pass |
| DMG/ZIP blockmaps and SHA-256 sidecars | Present; blockmap digests b31e50258dd3744a0daeef45a1f7ae375f538b24e6c68243f13c0963661b95b5 and af99a35b1e6380a8b9888658054690846c84b325067f7108299a4eedb6993255; both sidecars verify |
latest-mac.yml |
Version 6.0.0; 530 bytes; SHA-256 ac2e5ee7f25d235d607409a62a047359145f80dbaf9f1f5333131dc20700df72; DMG/ZIP names, sizes, and SHA-512 values match independent downloads |
| Downloaded signed-app isolated launch | Pass; fresh disposable profile, ready SQLite, health/update version 6.0.0, latest-version update check, task creation, and clean quit |
| Homebrew tap issue/PR/merge | Issue #36; PR #37; merge 7d77106e7c526a0975c49b9b11e0c9526921ead0 |
| Homebrew style/audit/dry-run/livecheck | Pass against registered bradgroux/tap/veritas-kanban at 6.0.0 with the published ZIP checksum |
Source CI, tag creation, asset upload, signing, notarization, downloaded runtime, and Homebrew availability are independent gates.