[blessdyb]

Summary

Flowlight 0.17.5 consolidates the completed unpublished 0.17.4 work and all remaining approved 0.17.x redesign work into one release:

• unifies Policies and activity while preserving each policy type's authoritative editor and evidence
• consolidates Sources into one Collector–Devices–Coverage document
• adds a complete, deterministic AI-agent inventory with explainable health and policy coverage
• adds durable alert triage states, dispositions, notes, filters, and bounded bulk actions
• moves Developer plugins and provider profiles under Inspect, with strict endpoint and credential validation
• makes the Live chart keyboard- and VoiceOver-inspectable with non-color series identity and executable palette checks
• isolates the one-second live feed from slower application state so retained screens are not rebuilt on every sample
• adds fail-capable performance budgets and release/UI audit evidence
• hardens CI reuse, CodeQL gating, exact-artifact Pages deployment, signed preparation, credential-free publication, and rerun-safe release artifact identity
• resolves code-scanning alert 4 by keeping untrusted pull-request refs out of checkouts

The immutable v0.17.4 tag remains unpublished and untouched. Its completed product work is carried forward here; 0.17.5 is the next public release. Store metadata, upload, build selection, and submission remain deferred to 0.18.0.

Verification

• 1,218 native tests passed with zero failures; focused live-state suite: 7 tests, zero failures
• the live-state regression test was proved fail-capable by deliberately reconnecting child updates to TrafficMonitor.objectWillChange; it failed at 1 parent invalidation versus the required 0, then passed after the regression was removed
• 89 Python classifier/release/palette/artifact/workflow/site tests passed; 62 focused release-evidence and artifact tests also passed independently
• signed Developer ID and unsigned Store products built independently with no first-party Swift warnings
• exact-head signed Developer candidate is 0.17.5 (79); its independently versioned system extension remains 0.16.3 (28); app, helper, and extension are universal, have valid signatures and designated requirements, and their archive/export executables are byte-identical
• exact-head executable SHA-256: app a99ec3c6dd703f42844c9f261a081429f759c04a59c83e4cbd36cf211b21b89f, helper 1849f30b3f53374c4b05dd1865dfac407b7132ed2020b3de5576d1354e896fdd, system extension 87d91e6d35b74ddb4cb8447b7206d1a0138c64b1d008044051f61007b99b14ad
• exact-head unsigned Store graph is 0.17.5 (79) for both app and app extension, universal, and contains no Developer system extension, response-script helper, privileged installer, SystemExtensions linkage, or OSSystemExtension symbols; signed entitlement validation remains an archive/CI responsibility
• local notarization was skipped only because no notarization credentials were available; deterministic notarization success, retry, exhaustion, permanent-failure, submission-failure, cleanup, and concurrency fixtures passed
• exact Developer candidate launched under an isolated home with deterministic demo data; only demo.sqlite* was open
• settled synthetic-traffic CPU fell from approximately 43–54% to 12–18%; the corrected profile contains no AgentDetail.body work, with remaining activity dominated by the intentionally changing macOS status-item label
• Live, AI Agents, Alerts, Inspect, Policies, and Sources passed acceptance at the 1000 × 660 minimum; light, dark, increased-contrast, and reduced-motion paths were checked
• Xcode project drift, working/staged whitespace, declared-shell syntax, workflow YAML, Python compilation, CodeQL gate fixtures, rule-pack policy fixtures, Homebrew updater fixtures, Swift-warning fixtures, and Store negative fixtures passed
• all ten localization catalogs: 1,899/1,899 keys, zero missing/obsolete, valid property lists
• static site regenerated deterministically; 53 pages, zero contract problems
• chart palette passes light/dark contrast, chroma, normal-vision, protan, and deutan checks
• the alternate-base reusable-CI-evidence path is rejected; reusable evidence must belong to exactly one same-repository pull request targeting canonical main at the matching head SHA
• final release review found no verified HIGH/MEDIUM findings at the required confidence threshold

🤖 Generated with Claude Code

[blessdyb]

Independent final release-blocker review completed against the exact committed tree. No verified HIGH or MEDIUM correctness, security, data-loss, product-separation, or release-pipeline blocker survived verification.

Reviewed-Commit: e0b0630

[blessdyb]

Independent final release-blocker review covers the previously reviewed release tree plus the exact one-file compiler-compatibility delta. The delta preserves identity ordering, conditional durable IDs, empty filtering, and first-occurrence deduplication; no verified HIGH or MEDIUM blocker survived. The prospective-merge build, 20 inventory tests, and 7 performance budgets pass locally without first-party Swift warnings.

Reviewed-Commit: 3424711

[blessdyb]

Independent final release-blocker review covers the previously reviewed release tree and the exact dense-graph routing delta. Inclusive segment bounds conservatively prefilter only impossible card intersections before the unchanged exact clipping test; node placement, retries, cancellation, and observer behavior remain equivalent. No verified HIGH or MEDIUM blocker survived. The full 1,218-test native suite, all 162 graph tests, and all 7 performance budgets pass without first-party Swift warnings; the 600-edge fixture improved from about 1.53 seconds to 0.99 seconds locally.

Reviewed-Commit: 2354f8d

[blessdyb]

Superseded by #85 after immutable v0.17.5 correctly failed its pre-signing review-evidence gate. No certificates, signed bytes, artifacts, or release were produced. The tag remains immutable and unpublished; 0.17.6 carries the reviewed product forward with the token-dependent reviewer-association correction.