Skip to content

Flowlight 0.17.7 — resilient notarization handoff - #86

Closed
blessdyb wants to merge 8 commits into
mainfrom
release/0.17.7
Closed

blessdyb wants to merge 8 commits into
mainfrom
release/0.17.7

Conversation

@blessdyb

@blessdyb blessdyb commented Nov 5, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Flowlight 0.17.7 is the corrected public patch for the consolidated 0.17.x redesign. It carries the reviewed 0.17.6 product tree forward unchanged and hardens the one release step that failed after the immutable v0.17.6 tag:

  • signing and the Developer app archive succeeded
  • Apple accepted and stapled the app notarization
  • Apple accepted the DMG notarization
  • Apple’s CloudKit ticket-delivery endpoint then returned NSURLErrorDomain Code=-1005 on all four DMG staple attempts
  • no final product verification, manifest, attestation, retained artifact, publication handoff, or public release occurred
  • v0.17.6 remains immutable and unpublished

The known -1005 path still retries only the idempotent staple operation and never resubmits notarization. Its bounded backoff now allows eight attempts over 2, 4, 8, 16, 32, 60, 60 seconds, long enough to outlast a transient multi-minute ticket-delivery outage while continuing to fail immediately for every other stapler error.

The app and Store products advance to 0.17.7 build 81. The independently versioned Developer system extension remains 0.16.3 build 28. Store metadata, upload, build selection, screenshots, and submission remain deferred to 0.18.0.

Verification

  • 90 Python classifier/release/palette/artifact/workflow/site tests passed
  • 17 focused release-evidence tests passed
  • notarization fixtures pass immediate success, recovery, capped eight-attempt exhaustion, permanent-error fail-fast, non--1005 URL failure, one submission only, failed-app cleanup, and isolated concurrent uploads
  • the retry check is fail-capable: deliberately restoring the old four-attempt policy makes the strengthened fixture fail, and restoring eight attempts makes it pass
  • Xcode project drift and all 53 generated site pages pass
  • the exact signed Developer product is 0.17.7 (81), with the independently versioned 0.16.3 (28) system extension; the app, extension, and response-script helper are universal, satisfy their designated requirements, and are byte-identical between archive and export
  • fresh Developer executable SHA-256 values are 8c9830068fd0f107cef721945cd2c4c70c796b4c966db748495d946ff6590ee7, 1c91b7957554dcd83fa2489ce511e97c9129043ce562b62d367330e5a93b503e, and 4075814e0622905fd35742cf19f0ccc89ad4de46be8a6ccff80a7c35413a4513
  • the exact unsigned Store graph is app and app extension 0.17.7 (81), universal, and contains no Developer system extension, response-script helper, privileged installer, SystemExtensions framework linkage, or OSSystemExtension symbol; executable SHA-256 values are 008bf25ca5942d8a0270eab7cd2aed4ca4025178ec4555958a69a5abecf93a34 and 31a605386210646c112a111abd9066ed48ab1a5114d4c5bec86628abbc422498
  • real-machine acceptance passed for Live, AI Agents, and Connections at 1000 × 660 using only synthetic demo.sqlite; each exact candidate PID was path-verified and stopped after capture
  • exact-head CI passed 1,218 tests with zero failures on both supported Xcode lanes, signed Store entitlement validation, prospective merge compatibility, project drift, site, and authenticated review gates
  • exact-head Swift, Python, and Actions CodeQL passed with zero findings, including no recurrence of code-scanning alert 4 in PR analysis
  • exact branch head: 9f4c9dc5a9456696502bae13fc0de138d4c9778d
  • exact tree: 29431e41550257fd4c7ec7bc1a2730a73c22e2c4
  • patch SHA-256 relative to canonical main: 07dc4160f54e433951586c9616e125915672c8190b787543fff71cfa73862a27

🤖 Generated with Claude Code

blessdyb and others added 8 commits November 4, 2026 22:18
Unify policy inventory and activity, reshape Sources into one operational page, fix History hover dismissal, and harden exact-byte release preparation with authenticated review provenance.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Keep trusted reviewer configuration and exact review markers out of release-check diagnostics while preserving actionable fixed-category errors.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Consolidate the completed unpublished 0.17.4 work and all remaining approved 0.17.x redesign scope into one public release. Add explainable agent inventory, durable alert triage, Inspect-owned provider profiles, accessible Live inspection, measured performance gates, and hardened CI, Pages, CodeQL, and signed-release provenance.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Consolidate the remaining 0.17.x product redesign into the AI-agent inventory, unified policy activity, durable alert triage, responsive native layouts, and runtime-effective provider profiles. Keep merged agent identities consistent across reporting and enforcement, preserve truthful inspection-effect provenance, and make migrations interruption-safe.

Harden CI reuse, CodeQL gating, exact-artifact Pages deployment, signed preparation, and credential-free publication. Add fail-capable migration, policy, plugin transport, activity, accessibility, performance, and product-separation coverage.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Preserve identity ordering while replacing chained array concatenation with explicit append operations so the prospective-merge build compiles within the CI Swift frontend type-check budget.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Preserve exact segment clipping while rejecting impossible card intersections by inclusive segment bounds, and reuse placement collision state instead of rebuilding it for every node. Keep the 600-edge layout inside its fail-capable CI budget.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Carry the consolidated 0.17.x product forward after the immutable 0.17.5 tag exposed viewer-dependent GitHub reviewer association metadata. Trust the configured reviewer allowlist while preserving exact comment, pull request, commit, workflow, and check provenance, then bump and regenerate the corrected release metadata.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Carry the consolidated product tree forward as 0.17.7/81 after immutable v0.17.6 failed during Apple CloudKit DMG ticket delivery, and extend the idempotent stapling retry with a capped bounded backoff.

Co-Authored-By: Claude Code <noreply@anthropic.com>
@blessdyb

blessdyb commented Nov 5, 2026

Copy link
Copy Markdown
Contributor Author

Reviewed-Commit: 9f4c9dc

@blessdyb

blessdyb commented Nov 5, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #87 after immutable v0.17.7 completed signing, notarization, stapling, Gatekeeper, and signed-product verification but failed before attestation or retention because build-only archive/export directories were mixed into strict bundle verification. v0.17.7 remains unpublished and untouched.

@blessdyb blessdyb closed this Nov 5, 2026

This branch had an error being deployed

1 failed deployment
release — 9f4c9dc5 Deployed Nov 5, 2026 by blessdyb via Prepare signed release #220
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant