[raiseCatError]

Summary

Adds an independent, fail-closed recovery workflow .github/workflows/recover-mac-release.yml, recovery script scripts/release/recover-mac-release.sh, state reconciler scripts/release/reconcile-mac-release.sh, and comprehensive test suite scripts/release/test/recover_mac_release_test.rb to safely verify and recover the MeowDisplay Mac 2.1.0 release without modifying the immutable candidate commit 94c796fc34fd699776764d67d2f26013909a308e on release/2.1.0.

Recovery Mechanism Details

Preflight and Gate Checks

1. Pinned strictly to exact version (2.1.0), candidate SHA (94c796fc34fd699776764d67d2f26013909a308e), draft release ID (442117184), and repository (raiseCatError/meowdisplay). Overrides are rejected.
2. Confirms live draft release points to the approved candidate commit and is still a draft.
3. Confirms iOS 2.1.0 build 2 is already published on the App Store (READY_FOR_DISTRIBUTION) on origin/release-state (fetch failure is fail-closed; no stale local state).
4. Checks that the draft contains exactly the five expected assets using deterministic ASCII collation (LC_ALL=C sort).
5. Downloads the draft assets and verifies the four Mac platform SHA-256 hashes against approved records on origin/release-state.
6. Verifies SHA256SUMS.txt digest independently against pinned digest 279e22555e9a84a4fc59bd7d529f4efca6ccf2a8c986ac9fc939d627368bc1b7.
7. Checks internal checksum validation (shasum -a 256 -c SHA256SUMS.txt).
8. Repeats full binary and Sparkle feed checks: Developer ID signature (team CZ8BW9J896), Gatekeeper notarization, stapled tickets, version and build (2.1.0), and Ed25519 feed signatures against published baseline key M9Je3RXE9GYGv7ZvVmJj2xK2FrpSR/rQvbuZFfYORcU=.

Protected Deployment Entrypoint & Human Approval Gate

• Publication cannot be executed locally (--publish is refused locally; local execution is strictly verification-only --verify).
• Enforces external T7 scratch storage (/Volumes/T7Tmp/ai-dev) for local runs; never falls back to internal /tmp.
• GitHub Actions workflow .github/workflows/recover-mac-release.yml provides the explicit recovery entrypoint with pinned inputs.
• Publication job is bound to environment: release-publish, guarded by required human reviewers via check-environment.sh release-publish --require-reviewers and verified live via gh api repos/$REPO/actions/runs/$GITHUB_RUN_ID/approvals.
• Deployment branch policy on release-publish requires running from a branch matching release/*. Repository admin can create a temporary branch (e.g. release/2.1.0-recovery) pointing to this commit to satisfy the policy without touching the frozen release/2.1.0 candidate branch.

Verified Rollback Behavior

• Correctly uses tag-based editing (gh release edit v2.1.0) while verifying numeric draft ID 442117184 via API.
• If live feeds fail to verify after publication (over 10 attempts / 5 minutes) or any error occurs:
  1. Restores previous Latest tag (v2.0.0) via gh release edit v2.0.0 --latest and verifies the API returns v2.0.0.
  2. Returns release v2.1.0 back to draft via gh release edit v2.1.0 --draft=true and verifies the API confirms draft: true.
  3. Reports partial rollback failures explicitly if either action fails.

Release-State Reconciliation

• reconcile-mac-release.sh --manifest-only is genuinely read-only (zero state mutations).
• reconcile-mac-release.sh --execute requires the minted release App token (RELEASE_STATE_TOKEN, App ID 5582030):
  1. Transitions publication stage from failed to in-progress (publish start).
  2. Advances Mac platform to published (publish mac-published).
  3. Confirms store states (publish stores --stores live).
  4. Generates website release.json manifest.
  5. Verifies updated release-state on remote.

Test Coverage

scripts/release/test/recover_mac_release_test.rb contains 19 focused unit and end-to-end tests (124 assertions, 0 failures):

• Parameter validation failure before network calls.
• Local execution refusal of --publish.
• Unapproved GitHub Actions run refusal of publication.
• Stale origin/release-state fetch failure fail-closed behavior.
• Scratch volume enforcement.
• Candidate SHA, non-draft status, asset count, and tampered SHA256SUMS.txt rejections.
• Feed verification failure before publication.
• End-to-end mocked publication with exact arguments.
• Rollback execution on live feed failure.
• Partial rollback failure detection.
• Reconcile script modes, argument validation, read-only manifest generation, and end-to-end reconciliation.