[blessdyb]

Summary

Flowlight 0.17.8 is the corrected public patch for the consolidated 0.17.x redesign. It carries the reviewed 0.17.7 product tree forward unchanged and repairs the release-bundle boundary exposed by the immutable v0.17.7 preparation:

• the app and installer built and signed successfully
• Apple accepted notarization and stapling for the app, DMG, and PKG
• Gatekeeper and final signed-product verification passed
• manifest verification then correctly rejected Flowlight.xcarchive, a build-only directory that had been left beside the release files
• no manifest, attestation, retained artifact, publication handoff, or public release occurred
• v0.17.7 remains immutable and unpublished

The preparation workflow now creates a new empty runner-temp bundle and copies only the exact DMG, versioned PKG, and checksum file into it. Release notes and the manifest are created in that bundle, strict verification still rejects every directory, symlink, or extra file, and only those five verified files are attested and retained. Build archives and exported app directories never enter the prepared artifact.

The app and Store products advance to 0.17.8 build 82. The independently versioned Developer system extension remains 0.16.3 build 28. Store metadata, upload, build selection, screenshots, and submission remain deferred to 0.18.0.

Verification

• 91 Python classifier/release/palette/artifact/workflow/site tests passed
• 15 release-workflow contract tests passed
• nine release-artifact fixtures passed, including strict rejection of directories, symlinks, extras, malformed archives, and substituted bytes
• notarization fixtures still pass immediate success, recovery, capped eight-attempt exhaustion, permanent-error fail-fast, one submission only, cleanup, and concurrent isolation
• the clean-staging contract is fail-capable: it fails against the old --bundle build workflow and passes only after the exact five-file runner-temp boundary is present
• Xcode project drift and all 53 generated site pages pass
• the exact signed Developer product is 0.17.8 (82), with the independently versioned 0.16.3 (28) system extension; the app, extension, and response-script helper are universal, satisfy their designated requirements, and are byte-identical between archive and export
• fresh Developer executable SHA-256 values are b9fcd19b0188a43e748ad98a4bc4a287152ef0af0961aa86d41bba76849e9324, 5c631eb168d87dde0b98b5687101f5aac95d549fa3a347030d9117b4cc2bd4b0, and 35cfdc51fa9db016974f29c06587263f4d6744b499ba8e99443e71012ae0941f
• the exact unsigned Store graph is app and app extension 0.17.8 (82), universal, and contains no Developer system extension, response-script helper, privileged installer, SystemExtensions framework linkage, or OSSystemExtension symbol; executable SHA-256 values are 47ca4185f4b950ff676101698d327a10e9acb49aff34d9d0f29808f3971c0b6f and 831936100a901b7bd082cb1ba7df45252aa0fbc4c7fe2b0a2316bc0f85bc19df
• real-machine acceptance passed for Live, AI Agents, and Connections at 1000 × 660 using only synthetic demo.sqlite; each exact candidate PID was path-verified and stopped after capture
• exact-head CI passed 1,218 tests with zero failures on both supported Xcode lanes, signed Store entitlement validation, prospective merge compatibility, project drift, site, and authenticated review gates
• exact-head CodeQL run 42054284812 passed Swift, Python, Actions, and aggregate gates; each exact-head analysis reports zero results
• exact branch head: d13c209fddc44868a36980ce13b509316c30ed80
• exact tree: 54385b0965251842559294f97189325fcdf68d65
• patch SHA-256 relative to canonical main: 1fad6b4f3eefa897e41a1677f155b4b3e2adc402ccd5e9e9f70f8d6413741117

🤖 Generated with Claude Code

[blessdyb]

Reviewed-Commit: d13c209

[blessdyb]

Superseded by #88 after immutable v0.17.8 preparation run 42059608988 completed signing, notarization, stapling, Gatekeeper, and signed-product verification but failed manifest verification on viewer-dependent review association metadata. No attestation, retained artifact, publication handoff, or public release occurred. v0.17.8 remains immutable and unpublished.