From a76cd3d76ca422d042f6c7b15a8845ce730ac154 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Val=20Alexander=20=F0=9F=91=91?= Date: Fri, 30 Oct 2026 04:25:03 -0500 Subject: [PATCH 1/2] Prepare v0.4.1: desktop version and release review v0.4.1 is a patch release of the CF-7 close-out follow-ups (#450). This bumps the desktop version to 0.4.1, adds the release review with the local ad-hoc rehearsal, and marks the candidate in docs/status.md. The Companion stays at 0.4.0 (9). The packaged rehearsal's one failure, an unexplained stray character in a relaunched composer draft, passed ten unchanged repetitions and is recorded, not cleared. Co-Authored-By: Claude Opus 5.5 --- apps/desktop/package.json | 2 +- .../2026-10-30-v0.4.1-release-review.md | 89 +++++++++++++++++++ docs/status.md | 4 +- 3 files changed, 93 insertions(+), 2 deletions(-) create mode 100644 docs/reviews/2026-10-30-v0.4.1-release-review.md diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 631ab479..b7fb3b17 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -1,6 +1,6 @@ { "name": "@modex/desktop", - "version": "0.4.0", + "version": "0.4.1", "description": "Modex desktop — a Codex-App-style GUI: projects, parallel agent threads, worktrees, inline approvals, and a live Changes panel.", "license": "MIT", "private": true, diff --git a/docs/reviews/2026-10-30-v0.4.1-release-review.md b/docs/reviews/2026-10-30-v0.4.1-release-review.md new file mode 100644 index 00000000..7dbc299b --- /dev/null +++ b/docs/reviews/2026-10-30-v0.4.1-release-review.md @@ -0,0 +1,89 @@ +# v0.4.1 release review + +Desktop v0.4.1 is a patch release. It fixes the three observations from the CF-7 close-out's live +runs (#280): + +- a turn's files list no longer looks complete when a shell command may have changed files no CLI + named; +- a thread named after its opening message is cut at a word break with "…", not mid-word. + +Val asked on 2026-10-30 for the CF-7 work to land and the next patch release to ship. The iPhone +Companion stays at 0.4.0 (9); nothing in this release changes it. + +This preparation starts from protected `main` at `9f85d61` (#455), which includes #450 as +`108b814`. It changes only the desktop version and the release records. The tag source is this +PR's squash merge on protected `main`. + +## Scope since v0.4.0 + +| Area | Pull requests | +| --- | --- | +| Commands that may have changed unlisted files are named in the context map, footer, Task view and note; opening-message titles cut at a word break (CF-7 follow-ups) | #450 | +| Local child admission refuses enabled or missing subagent settings. Local coding execution stays unadmitted in production | #448 | +| Tests: native Canvas readiness before Escape (the flake in #443's first queue run), secure answer field focus, local auxiliary dispatch boundaries | #446, #455, #447 | +| Records: v0.4.0 publication and site fallback, CF-7 close-out receipt, CF-4 deferral and full-suite record | #445, #443, #444, #449, #454 | + +Any other pull request that reaches `main` before this one merges is listed in the publication +section with its merge SHA. + +## Candidate behavior and compatibility + +- **Updates.** v0.4.0 reaches v0.4.1 through the background update: a check downloads and verifies + it without a click, and it installs on **Restart to update** or the next time Modex quits. v0.2.0 + and older still need one **Download update** click. Windows and Linux still install by hand. + [Download and restart](../update-recovery.md#download-and-restart). +- **Files touched.** A finished turn that ran a command which may have written files, and is + neither a check nor known to be read-only, now shows that command under the files list. The label + reads "N, maybe more", or "not listed" when no file was named. A turn that only reads, or only + edits through patch tools, looks as before. + [Context map](../task-context.md#context-map). +- **Saved notes.** Notes and task records saved by v0.4.0 reopen unchanged, without the command + list. Nothing is backfilled or inferred. A new save of the same turn writes the list. +- **Thread titles.** Only new threads change. An existing thread keeps its title, and a Retry of a + first turn that carries the old 60-character cut is still renamed once the turn completes. +- **Not changed.** The release workflow, signing scripts, release verifier, native updater verifier + and desktop build hooks are unchanged from v0.4.0, so no rc rehearsal is needed. + +## Local preparation — 2026-10-30 + +This Mac has only an Apple Development identity, and the 1Password CLI is signed out, so +`scripts/release-mac.sh` cannot sign or notarize here. The local rehearsal is the ad-hoc package +(`pnpm --filter @modex/desktop dist`) with the packaged e2e. Its artifacts must not be published. +Developer ID signing, notarization, packaged acceptance, native updater scenarios and native platform +checks run in the protected `Release` workflow. + +Machine: Apple M5 Max, 18 cores, macOS 27.0.1, Node 24.22.0, pnpm 10.34.5. + +| Check | Source | Result | +| --- | --- | --- | +| `pnpm build && pnpm test` | #450 head `2fffd9c` | exit 0. Desktop 2,071 passed, 20 skipped, 0 failed; every other package green | +| `pnpm test:e2e` (development Electron) | #450 head `2fffd9c` | exit 0. Desktop 476 passed, 7 skipped; site 7 passed | +| Ad-hoc package, `pnpm --filter @modex/desktop dist` | `2ccb808`, version 0.4.1 | exit 0. `Modex-0.4.1-arm64.dmg` and `.zip`; bundle version 0.4.1, `Signature=adhoc` | +| Packaged e2e, `MODEX_PACKAGED_APP=… pnpm test:e2e` | `2ccb808` | exit 1. Desktop 475 passed, 7 skipped, **1 failed**; the site stage did not run. Transcript median 243.5 ms against the approved 500 ms | +| The failed case alone, `--repeat-each 10`, same packaged app | `2ccb808` | 10 passed | + +`2ccb808` is this branch before its rebase onto `9f85d61`. The rebase added #447, #448, #454 and +#455 from `main`; their own PR and queue runs cover them, and the protected `Release` workflow runs +the full packaged suite on the exact tag source. + +**The first packaged failure stays on record.** `e2e/attachment-lifecycle.spec.ts:305`, "failed +creation restores files while keeping newer text and other drafts usable", expected the relaunched +composer to read `another draft` and found `yanother draft` at line 362. The extra leading `y` was +never typed by the test, and its source is not explained. The same case passed in the development +Electron run above and in ten unchanged packaged repetitions. This release changes neither the +composer nor drafts, so it is recorded as an unexplained flake, not cleared. The trace and error +context are kept outside the tree under +`~/.claude/task-evidence/release-041-2026-10-30/first-failure/`, with the full logs beside it. + +Packaged selection covers the shared desktop launcher, window lifecycle and Code Review launchers. +Store, standalone desktop-host and fixture launchers keep their development or fixture paths, as +[release-signing.md](../release-signing.md#cutting-a-release) describes. The protected `Release` +workflow runs the full packaged suite again on the Developer ID signed bundle. + +## Release steps still to run + +1. CI and the merge queue for this PR (#450 merged as `108b814`). +2. Signed tag `v0.4.1` at this PR's squash SHA with the approved key + (`SHA256:Apqee2EOZLXmfVUUy/QX1QLBn9g10SuzHbK5ARks19E`). +3. The `Release` workflow behind the `release-signing` reviewer. +4. Independent checks of the downloaded draft assets, then publication. diff --git a/docs/status.md b/docs/status.md index 90c86da0..857d7ee9 100644 --- a/docs/status.md +++ b/docs/status.md @@ -72,7 +72,9 @@ PR #422's CR-6 review found two blockers: unconfirmed child exit was reported as The published application source is `2eda138` (v0.4.0). Later source deliveries belong here; the release inventory and its incomplete acceptance gates are recorded separately below. -- **CF-7 close-out follow-ups (#280, 2026-10-30).** The three observations from the live close-out +- **v0.4.1 candidate (2026-10-30).** A patch release of the follow-ups below. See the + [v0.4.1 review](reviews/2026-10-30-v0.4.1-release-review.md). +- **CF-7 close-out follow-ups (#280, #450, 2026-10-30).** The three observations from the live close-out runs are fixed. A turn's files list now names any command that may have changed files no CLI reported, such as a shell redirect or `perl -pi`, and says "maybe more" or "not listed" instead of looking complete. It never guesses the file. A thread named after its opening message is cut at a From cd56f5554217d1a94d684bc122d45483202f0c57 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Val=20Alexander=20=F0=9F=91=91?= Date: Fri, 30 Oct 2026 21:14:06 -0500 Subject: [PATCH 2/2] Record verified v0.4.1 signed rehearsal and preserved failures --- .../2026-10-30-v0.4.1-release-review.md | 93 +++++++++---------- docs/status.md | 3 +- 2 files changed, 44 insertions(+), 52 deletions(-) diff --git a/docs/reviews/2026-10-30-v0.4.1-release-review.md b/docs/reviews/2026-10-30-v0.4.1-release-review.md index 7dbc299b..bf9a480e 100644 --- a/docs/reviews/2026-10-30-v0.4.1-release-review.md +++ b/docs/reviews/2026-10-30-v0.4.1-release-review.md @@ -1,58 +1,40 @@ # v0.4.1 release review -Desktop v0.4.1 is a patch release. It fixes the three observations from the CF-7 close-out's live -runs (#280): +Desktop v0.4.1 is a patch release. It addresses observations from the CF-7 close-out's live runs (#280): -- a turn's files list no longer looks complete when a shell command may have changed files no CLI - named; +- a turn's files list no longer looks complete when a shell command may have changed files no CLI named; - a thread named after its opening message is cut at a word break with "…", not mid-word. -Val asked on 2026-10-30 for the CF-7 work to land and the next patch release to ship. The iPhone -Companion stays at 0.4.0 (9); nothing in this release changes it. +Val asked on 2026-10-30 for the CF-7 work to land and the next patch release to ship. The iPhone Companion stays at 0.4.0 (9); nothing in this release changes it. -This preparation starts from protected `main` at `9f85d61` (#455), which includes #450 as -`108b814`. It changes only the desktop version and the release records. The tag source is this -PR's squash merge on protected `main`. +The current validation combines protected `main` at `f51ef7e8caa17e79c9029be0d696f5bb40b3dcf2` with #452 head `a76cd3d76ca422d042f6c7b15a8845ce730ac154`. The signed validation commit is `04a5f7d78f9de348b5f9e894697b363cf340ddfa`, tree `bacef42528019ba9179117ab34861b7293dbea30`. The final release tag must still name the protected squash merge, which does not yet exist. ## Scope since v0.4.0 | Area | Pull requests | | --- | --- | | Commands that may have changed unlisted files are named in the context map, footer, Task view and note; opening-message titles cut at a word break (CF-7 follow-ups) | #450 | +| Failed possible-writer commands retain uncertainty; denied commands remain excluded | #453 | +| CI: qualified Ubuntu 24.04 KWallet baseline, desktop runner memory diagnostics; worktree stacked-merge proof | #456, #458, #457 | | Local child admission refuses enabled or missing subagent settings. Local coding execution stays unadmitted in production | #448 | | Tests: native Canvas readiness before Escape (the flake in #443's first queue run), secure answer field focus, local auxiliary dispatch boundaries | #446, #455, #447 | | Records: v0.4.0 publication and site fallback, CF-7 close-out receipt, CF-4 deferral and full-suite record | #445, #443, #444, #449, #454 | -Any other pull request that reaches `main` before this one merges is listed in the publication -section with its merge SHA. +Any other pull request that reaches `main` before this one merges is listed in the publication section with its merge SHA. ## Candidate behavior and compatibility -- **Updates.** v0.4.0 reaches v0.4.1 through the background update: a check downloads and verifies - it without a click, and it installs on **Restart to update** or the next time Modex quits. v0.2.0 - and older still need one **Download update** click. Windows and Linux still install by hand. - [Download and restart](../update-recovery.md#download-and-restart). -- **Files touched.** A finished turn that ran a command which may have written files, and is - neither a check nor known to be read-only, now shows that command under the files list. The label - reads "N, maybe more", or "not listed" when no file was named. A turn that only reads, or only - edits through patch tools, looks as before. - [Context map](../task-context.md#context-map). -- **Saved notes.** Notes and task records saved by v0.4.0 reopen unchanged, without the command - list. Nothing is backfilled or inferred. A new save of the same turn writes the list. -- **Thread titles.** Only new threads change. An existing thread keeps its title, and a Retry of a - first turn that carries the old 60-character cut is still renamed once the turn completes. -- **Not changed.** The release workflow, signing scripts, release verifier, native updater verifier - and desktop build hooks are unchanged from v0.4.0, so no rc rehearsal is needed. +- **Updates.** v0.4.0 reaches v0.4.1 through the background update: a check downloads and verifies it without a click, and it installs on **Restart to update** or the next time Modex quits. v0.2.0 and older still need one **Download update** click. Windows and Linux still install by hand. [Download and restart](../update-recovery.md#download-and-restart). +- **Files touched.** A finished turn that ran a command which may have written files, and is neither a check nor known to be read-only, now shows that command under the files list. The label reads "N, maybe more", or "not listed" when no file was named. A turn that only reads, or only edits through patch tools, looks as before. [Context map](../task-context.md#context-map). +- **Saved notes.** Notes and task records saved by v0.4.0 reopen unchanged, without the command list. Nothing is backfilled or inferred. A new save of the same turn writes the list. +- **Thread titles.** Only new threads change. An existing thread keeps its title, and a Retry of a first turn that carries the old 60-character cut is still renamed once the turn completes. +- **Signed rehearsal.** `v0.4.1-rc.1` runs the existing protected Release workflow on the combined validation source to investigate packaged acceptance with a consistent Developer ID signature. Its draft must never be published. ## Local preparation — 2026-10-30 -This Mac has only an Apple Development identity, and the 1Password CLI is signed out, so -`scripts/release-mac.sh` cannot sign or notarize here. The local rehearsal is the ad-hoc package -(`pnpm --filter @modex/desktop dist`) with the packaged e2e. Its artifacts must not be published. -Developer ID signing, notarization, packaged acceptance, native updater scenarios and native platform -checks run in the protected `Release` workflow. +This Mac has only an Apple Development identity, and the 1Password CLI is signed out, so `scripts/release-mac.sh` cannot sign or notarize here. The local rehearsal is the ad-hoc package (`pnpm --filter @modex/desktop dist`) with the packaged e2e. Its artifacts must not be published. Developer ID signing, notarization, packaged acceptance, native updater scenarios and native platform checks run in the protected `Release` workflow. -Machine: Apple M5 Max, 18 cores, macOS 27.0.1, Node 24.22.0, pnpm 10.34.5. +Historical preparation machine: Apple M5 Max, 18 cores, macOS 27.0.1, Node 24.22.0, pnpm 10.34.5. | Check | Source | Result | | --- | --- | --- | @@ -62,28 +44,39 @@ Machine: Apple M5 Max, 18 cores, macOS 27.0.1, Node 24.22.0, pnpm 10.34.5. | Packaged e2e, `MODEX_PACKAGED_APP=… pnpm test:e2e` | `2ccb808` | exit 1. Desktop 475 passed, 7 skipped, **1 failed**; the site stage did not run. Transcript median 243.5 ms against the approved 500 ms | | The failed case alone, `--repeat-each 10`, same packaged app | `2ccb808` | 10 passed | -`2ccb808` is this branch before its rebase onto `9f85d61`. The rebase added #447, #448, #454 and -#455 from `main`; their own PR and queue runs cover them, and the protected `Release` workflow runs -the full packaged suite on the exact tag source. +`2ccb808` is the historical #452 preparation before its rebase onto `9f85d61`. The rebase added #447, #448, #454 and #455 from `main`; their own PR and queue runs cover them, and the protected `Release` workflow runs the full packaged suite on the exact tag source. -**The first packaged failure stays on record.** `e2e/attachment-lifecycle.spec.ts:305`, "failed -creation restores files while keeping newer text and other drafts usable", expected the relaunched -composer to read `another draft` and found `yanother draft` at line 362. The extra leading `y` was -never typed by the test, and its source is not explained. The same case passed in the development -Electron run above and in ten unchanged packaged repetitions. This release changes neither the -composer nor drafts, so it is recorded as an unexplained flake, not cleared. The trace and error -context are kept outside the tree under -`~/.claude/task-evidence/release-041-2026-10-30/first-failure/`, with the full logs beside it. +**The first packaged failure stays on record.** `e2e/attachment-lifecycle.spec.ts:305`, "failed creation restores files while keeping newer text and other drafts usable", expected the relaunched composer to read `another draft` and found `yanother draft` at line 362. The extra leading `y` was never typed by the test, and its source is not explained. The same case passed in the development Electron run above and in ten unchanged packaged repetitions. This release changes neither the composer nor drafts, so it is recorded as an unexplained flake, not cleared. The trace and error context are kept outside the tree under `~/.claude/task-evidence/release-041-2026-10-30/first-failure/`, with the full logs beside it. -Packaged selection covers the shared desktop launcher, window lifecycle and Code Review launchers. -Store, standalone desktop-host and fixture launchers keep their development or fixture paths, as -[release-signing.md](../release-signing.md#cutting-a-release) describes. The protected `Release` -workflow runs the full packaged suite again on the Developer ID signed bundle. +Packaged selection covers the shared desktop launcher, window lifecycle and Code Review launchers. Store, standalone desktop-host and fixture launchers keep their development or fixture paths, as [release-signing.md](../release-signing.md#cutting-a-release) describes. The protected `Release` workflow runs the full packaged suite again on the Developer ID signed bundle. + +## Combined candidate validation + +This section records the combined candidate rehearsal. The final publication source must still be the protected merge, and final-tag artifacts require their own verification. + +| Check | Exact source | Result | +| --- | --- | --- | +| Build and unit checks | `04a5f7d` | Exit 0; 2,272 passed, 26 skipped, 0 failed | +| Ad-hoc package | `04a5f7d` | Version 0.4.1; ASAR SHA-256 `422d1056366c508413de4aa6143549312483451580f6bf6a4820b0ee309e8089` | +| Full packaged desktop E2E | `04a5f7d` | Exit 1; 474 passed, 7 skipped, 2 failed, plus 2 worker-teardown errors, in 25.4 minutes. Jev and OpenCoven Settings-click/teardown timeouts preserved | +| Website E2E, run separately | `04a5f7d` | 7 passed in 9.4 seconds | +| Signed CI rehearsal | `04a5f7d` | [Run 41102241411](https://github.com/TypeSafeAI/modex/actions/runs/41102241411): all seven jobs passed, including signed macOS packaged E2E (479 passed, 4 skipped; site 7 passed), three native updater scenarios, Windows and Linux checks, and artifact attachment | + +A native sample during the OpenCoven failure showed the main thread waiting in `SecItemCopyMatching` and `SecurityServer::ClientSession::decrypt`. The failure occurred before contrast measurements. Settings invokes routing status, which synchronously checks encryption availability; that is a plausible call path, not a captured JavaScript stack. Whether a permission dialog was visible remains unconfirmed. The source and first failure remain unchanged; subsequent cases progressed in a replacement worker. Neither a later passing case nor the signed rehearsal erases these failures. + +Windows and Linux installed-candidate receipts both bind source `04a5f7d78f9de348b5f9e894697b363cf340ddfa`, run `41102241411`, and version `0.4.1`, and report `nativeChecksPassed: true`. Windows verifies NSIS replacement/restart and DPAPI persistence. Linux verifies Debian/AppImage paths, libsecret persistence and basic-text refusal; a separate KWallet5 receipt verifies write, app restart and automatic daemon restart. Both retain `installerAcceptance: pending`: complete CLI/account acceptance remains, and Linux also retains KWallet6 and full graphical login-session acceptance. The private same-source `0.0.0` baseline does not prove historical migration. + +The five downloaded RC installers match both `SHA256SUMS.txt` and the manifest. The manifest binds version `0.4.1`, source `04a5f7d78f9de348b5f9e894697b363cf340ddfa` and run `41102241411`. The extracted macOS app passes deep strict signature verification; the app and DMG are accepted by Gatekeeper as Notarized Developer ID and pass stapler validation. The signing team is Soul Protocol LLC (`9LR8Z8UQ9X`). The signed hosted transcript median is 450.5 ms against the 500 ms limit. RC draft `429478340` must never be published. + +The exact downloaded signed RC also passes all five local Code Review accessibility cases in 24.3 seconds, including the two themes that stalled with the ad-hoc bundle. This supports a signing-related Keychain explanation but does not establish a definitive root cause; both original traces remain preserved. + +The historical attachment-draft failure above remains unexplained. Its case passed in the current full run; this does not establish a root cause or clear the historical failure. ## Release steps still to run -1. CI and the merge queue for this PR (#450 merged as `108b814`). -2. Signed tag `v0.4.1` at this PR's squash SHA with the approved key - (`SHA256:Apqee2EOZLXmfVUUy/QX1QLBn9g10SuzHbK5ARks19E`). +1. Current-head CI and the protected merge queue for the release preparation. This preparation carries #452 plus the combined-source evidence; close #452 as superseded only after the replacement lands. +2. Signed tag `v0.4.1` at this PR's squash SHA with the approved key (`SHA256:Apqee2EOZLXmfVUUy/QX1QLBn9g10SuzHbK5ARks19E`). 3. The `Release` workflow behind the `release-signing` reviewer. 4. Independent checks of the downloaded draft assets, then publication. + +The combined rehearsal evidence is archived outside the repository at `/Users/buns/Documents/Codex/artifacts/modex-land-and-prune/`: `release041-combined-packaged-final.json`, `release041-combined-packaged-results.tar.gz`, `release041-rc1-native-receipts-verified.json`, and `release041-rc1-independent-verification.json`. The original failure traces and log hashes remain in that archive. diff --git a/docs/status.md b/docs/status.md index 16352c0a..61fe87b8 100644 --- a/docs/status.md +++ b/docs/status.md @@ -72,8 +72,7 @@ PR #422's CR-6 review found two blockers: unconfirmed child exit was reported as The published application source is `2eda138` (v0.4.0). Later source deliveries belong here; the release inventory and its incomplete acceptance gates are recorded separately below. -- **v0.4.1 candidate (2026-10-30).** A patch release of the follow-ups below. See the - [v0.4.1 review](reviews/2026-10-30-v0.4.1-release-review.md). +- **v0.4.1 candidate (2026-10-30).** The combined candidate passed the signed RC workflow (packaged desktop 479 passed, 4 skipped; website 7 passed; native updater, Windows and Linux jobs passed) and independent downloaded-asset verification. The local ad-hoc failures remain recorded. Protected release-preparation merge, the final signed tag workflow and final artifact verification/publication remain pending. See the [v0.4.1 review](reviews/2026-10-30-v0.4.1-release-review.md). - **CF-7 close-out follow-ups (#280, #450, 2026-10-30).** The three observations from the live close-out runs are fixed. A turn's files list now names any command that may have changed files no CLI reported, such as a shell redirect or `perl -pi`, and says "maybe more" or "not listed" instead of