[blessdyb]

Summary

Flowlight 0.17.9 is the corrected public patch for the consolidated 0.17.x redesign. It carries the reviewed 0.17.8 product tree forward and fixes the final release-evidence inconsistency exposed by immutable v0.17.8 preparation run 42059608988:

• app, DMG, and PKG signing, notarization, stapling, Gatekeeper, and final signed-product verification all passed
• clean five-file staging and manifest creation were reached
• manifest verification then rejected the authenticated review receipt because GitHub reported the trusted reviewer's private organization membership differently to different viewers
• no attestation, retained artifact, publication handoff, or public release occurred
• v0.17.8 remains immutable and unpublished

The configured trusted-reviewer login allowlist remains the authorization boundary. Both evidence validators now consistently accept the complete documented GitHub author_association enum as audit metadata while rejecting whitespace, unknown, and non-string values; the exact GitHub login, PR, SHA marker, numeric comment ID, bound URL, workflow provenance, and required checks remain fail-closed. The app and Store products advance to 0.17.9 build 83. The independently versioned Developer system extension remains 0.16.3 build 28. Store metadata, upload, build selection, screenshots, and submission remain deferred to 0.18.0.

Verification

• fail-capable proof: the new exact fixture rejected CONTRIBUTOR under the old artifact validator, reproducing the immutable run failure; it passes only after aligning the validator with the trusted-login authorization boundary
• 93 Python classifier/release/palette/artifact/workflow/site tests passed
• 11 release-artifact fixtures passed, including every documented GitHub association value, cross-validator enum equality, and controlled rejection of missing, whitespace, unknown, numeric, array, or object association metadata, directories, symlinks, extras, malformed archives, and substituted bytes
• authenticated GitHub schema introspection returned exactly COLLABORATOR, CONTRIBUTOR, FIRST_TIMER, FIRST_TIME_CONTRIBUTOR, MANNEQUIN, MEMBER, NONE, and OWNER
• 17 release-evidence tests and 15 release-workflow contract tests passed
• notarization fixtures passed immediate success, recovery, capped eight-attempt exhaustion, permanent-error fail-fast, one submission only, cleanup, and concurrent isolation
• Xcode project drift and all 53 generated site pages passed
• complete native suite passed 1,218 tests with zero failures and no first-party Swift warnings
• the exact Developer product is 0.17.9 (83), with the independently versioned 0.16.3 (28) system extension; app, extension, and response-script helper are universal and satisfy strict signature validation
• fresh Developer executable SHA-256 values are 837df4dc5ec3578c635f4efca13706018e40f0ef447ba21f502d5cc30f37d6b4, 1b2f3ab41873f8820c341546453a1eb4242e4bf30455454a24a422ef228d2971, and f7e3ee781b60dd9131502f88347c45142d013767c3dc10dfadef791f4784dbd1
• the exact Store graph is app and app extension 0.17.9 (83), universal, structurally and entitlement-valid, and contains no Developer system extension, response-script helper, privileged installer, SystemExtensions framework linkage, or OSSystemExtension symbol
• fresh Store executable SHA-256 values are 70ed03e35c05e670998a396644e263d82109ea2a5aff2b4da283645be80d6468 and 76fe8fef1038a19eca63e3926b3fe03148d81bd63c0175adde6c9d5a832effe8
• real-machine acceptance passed for Live and AI Agents at 1000 × 660 using only isolated synthetic demo.sqlite; each exact candidate PID was path-verified and stopped after visual inspection
• the actual GitHub review receipt passes both evidence validators; exact-head CI run 42065207768 passed every required lane and exact-head CodeQL run 42065207585 passed Swift, Python, Actions, and aggregate gates with zero results in all three analyses
• exact branch head: c02b6b9311339febefe7a9ec2acd306f610a8a14
• exact tree: edddfb0c10c9e0924ee792c88f80e4003bb43a6c
• patch SHA-256 relative to canonical main: 8d322d18cd7643a7a4a0b3528710566d48fc0112caa669f958104e6f62674c0f

🤖 Generated with Claude Code

[blessdyb]

Independent exact-head review complete. No concrete correctness or security blocker found. The configured reviewer login allowlist remains the authorization boundary; the retained receipt still requires non-empty association metadata, exact SHA/PR/comment URL binding, and exact required-check workflow provenance. CONTRIBUTOR acceptance plus malformed metadata and provenance rejection are covered by the release-artifact fixtures.

Reviewed-Commit: 7d5001d

[blessdyb]

Independent review of the association-hardening delta is complete with no blocker. Both validators use the complete current GitHub enum (COLLABORATOR, CONTRIBUTOR, FIRST_TIMER, FIRST_TIME_CONTRIBUTOR, MANNEQUIN, MEMBER, NONE, OWNER), reject whitespace/unknown/missing/non-string values, and are locked together by a cross-validator contract test. Exact SHA, PR, comment URL, trusted workflow provenance, and required-check bindings remain fail-closed.

Reviewed-Commit: d3b0c6c

[blessdyb]

Final independent exact-head review complete with no blocker. Both validators require a string before GitHub enum membership, so array/object values short-circuit into controlled fail-closed rejection rather than raw TypeError. Collector fixtures verify no receipt is emitted; artifact fixtures verify ReleaseArtifactError; numeric, whitespace, unknown, and missing values remain rejected.

Reviewed-Commit: c02b6b9