Record v0.0.8 publication and stabilize Gatekeeper checks

apps/site/e2e/release.spec.ts

@@ -42,7 +42,7 @@ test('offline, partial and hostile responses keep all verified fallback links us
   for (const candidate of [undefined, { release: { version: '0.0.8' } }, { ...feed(), release: { ...feed().release, downloadUrl: 'https://example.com/untrusted.dmg' }, stats: { stars: '9999', downloads: -1 } }]) {
     response = candidate;
     await page.goto('/');
-    await expectVersion(page, '0.0.7');
+    await expectVersion(page, '0.0.8');
     await expect(page.locator('.community-stats')).toBeHidden();
     await expect(page.getByRole('link', { name: 'iPhone companion TestFlight' })).toHaveAttribute('href', invite);
   }
@@ -158,7 +158,7 @@ test('verified download and TestFlight links work without JavaScript', async ({
   const context = await browser.newContext({ javaScriptEnabled: false });
   const page = await context.newPage();
   await page.goto('http://127.0.0.1:5187');
-  await expectVersion(page, '0.0.7');
+  await expectVersion(page, '0.0.8');
   await expect(page.getByRole('link', { name: 'iPhone companion TestFlight' })).toHaveAttribute('href', invite);
   await context.close();
 });

apps/site/release.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.0.7",
+  "version": "0.0.8",
   "architecture": "Apple silicon",
   "ios": "testflight",
   "testflightUrl": "https://testflight.apple.com/join/Qr14JKCh"

apps/site/test/release.test.mjs

@@ -78,7 +78,7 @@ test('rate limits preserve last good links and counts, and cold failure has no f
   assert.deepEqual(stale.release, good.release); assert.deepEqual(stale.stats, good.stats);
   assert.equal(stale.checkedAt, good.checkedAt); assert.equal(stale.stale, true);
   const cold = await createReleaseFeed({ fetchImpl })();
-  assert.equal(cold.release.version, '0.0.7'); assert.deepEqual(cold.stats, { stars: null, forks: null, downloads: null });
+  assert.equal(cold.release.version, '0.0.8'); assert.deepEqual(cold.stats, { stars: null, forks: null, downloads: null });
   assert.equal(cold.checkedAt, null);
 });
 

docs/reviews/2026-10-06-v0.0.8-release-notes.md

@@ -1,7 +1,5 @@
 # Modex v0.0.8
 
-Release notes prepared for the next standalone macOS release. Publication is pending.
-
 - See each thread's provider, model, current branch and GitHub PR state in the left sidebar.
   Open a PR directly from its draft, open, merged or closed label. Install and sign in to
   the GitHub CLI (`gh auth login`) to read PR metadata; unavailable access is shown explicitly.
@@ -16,5 +14,6 @@ the Companion TestFlight invitation. Enrollment depends on Apple's current avail
 This release targets macOS on Apple Silicon. Mac App Store submission and iPhone delivery
 remain separate tracks. Approval-rule automation remains gated off in production.
 
-Signing, notarization, packaged tests and downloadable-asset checks must pass before these
-notes are published with the DMG, ZIP and SHA256SUMS.txt.
+The macOS app and installer are Developer ID signed, notarized, and stapled. Download the Apple Silicon DMG below, or use the ZIP. SHA256SUMS.txt and verification-v0.0.8.txt document the verified CI artifacts.
+
+[Full changelog](https://github.com/TypeSafeAI/modex/compare/v0.0.7...v0.0.8)

docs/reviews/2026-10-06-v0.0.8-release-review.md

@@ -1,4 +1,4 @@
-# v0.0.8 release preparation
+# v0.0.8 release review
 
 ## Scope and execution ledger
 
@@ -10,7 +10,7 @@
 - Prepare the standalone macOS version bump and release notes, including the workspace,
   empty-screen polish and changes already merged since v0.0.7.
 - Verify build, typecheck, unit tests, source e2e and signed/notarized packaged e2e.
-- Review, commit and prepare a PR after verification. Tagging and publication are pending.
+- Review, land signed commits, run the protected release workflow and verify its downloads.
 
 ## Progress
 
@@ -21,8 +21,11 @@
 - [x] Source verification and independent review.
 - [x] Signed/notarized candidate and packaged verification.
 - [x] Prepared PR content with exact candidate evidence.
+- [x] Landed signed preparation/recovery commits and the corrected signed tag.
+- [x] Protected release workflow and independent downloaded-artifact verification.
+- [x] Published v0.0.8 and verified its unauthenticated public DMG download.
 
-The GitHub release remains v0.0.7. Store submission and iPhone delivery are separate tracks.
+v0.0.8 is published. Store submission and iPhone delivery remain separate tracks.
 
 ## Review findings and regressions
 
@@ -73,7 +76,7 @@ The complete packaged run passed **114 desktop + 7 website e2e tests**, includin
 sidebar themes, keyboard PR links, branch refresh, long-title/status layout, the Store
 browser boundary and the tabbed workspace. Archived DMG/ZIP checksums match the verifier.
 
-## Remaining release steps
+## Release workflow recovery
 
 PR #126 merged as signed commit `db264a3`, with the same tree as tested head `3999191`.
 All four macOS/iPhone checks passed on that head. The initial signed tag `f5cf661` pointed
@@ -84,13 +87,56 @@ draft release or artifacts were uploaded.
 The release job built only core and standalone desktop, leaving the Store source client
 absent. Removing that client's generated output locally reproduced the timeout at its
 Electron launch. The corrected job builds the client and initializes development Electron
-before running the unchanged packaged suite. After verification and landing, reissue the
-unpublished signed tag on the corrected merge and rerun the protected release workflow.
+before running the unchanged packaged suite. Recovery PR #127 merged as signed commit
+`3dc6b84`; the unpublished tag was reissued as signed object `2d55c3f` at that commit.
+The original tag object and failed-run evidence are archived locally.
 
-Download and independently verify the successful draft's assets before publishing; local
-candidate hashes must not be substituted for the eventual CI artifact hashes.
+The successful draft's downloads were independently verified before publication; the
+published CI hashes below are distinct from the local rehearsal hashes above.
 
 The recovery passed workspace build, typecheck, all 310 unit/bridge tests, all three
 focused Store cases and the full **114 desktop + 7 website packaged e2e tests** against
 the signed local candidate. Independent review found no required changes. Application
 source and the test suite are unchanged; only release prerequisites and this ledger changed.
+
+## Published release and downloaded verification
+
+- PR #126 merged at `db264a3` after all four hosted checks passed on `3999191`.
+- Recovery PR #127 merged at `3dc6b84` after both required macOS runs passed. Both iPhone
+  runs also finished successfully; the last completed after the merge.
+- Corrected signed tag: `2d55c3f067eb241dacb83030787a6ef9737aefb3`, pointing to
+  `3dc6b84183bb7e3b87eabac9ba7640c6ea327e93`.
+- The corrected workflow's first attempt hit `tee: stdout: Broken pipe` after Gatekeeper
+  accepted the app. `grep -q` closed its input before the trailing output arrived, and
+  `pipefail` treated that as failure. Attempt 2 on the unchanged signed tag passed every
+  gate. This publication follow-up changes both app/DMG checks to drain the full output;
+  accepted, missing-marker and rejected-with-marker probes confirm acceptance still
+  requires both a notarized marker and a successful Gatekeeper exit.
+- Protected [Release run 37436514563](https://github.com/TypeSafeAI/modex/actions/runs/37436514563)
+  passed signing, notarization, stapling and all **114 desktop + 7 website packaged e2e tests**.
+- Downloaded draft DMG/ZIP checksums match the workflow's `SHA256SUMS.txt` and GitHub asset
+  digests. The unmodified repository verifier passed strict signatures, pinned Developer ID
+  certificate `EE732DF3F48D7535561AF54D3FFFC4B44DAF3E7F`, team `9LR8Z8UQ9X`, hardened
+  runtime, library validation, same-team native code, Gatekeeper, app/DMG/ZIP tickets,
+  container integrity, official icon, version 0.0.8 and arm64 architecture.
+- The mounted DMG and extracted ZIP match across all 311 app files/symlinks.
+- [v0.0.8](https://github.com/TypeSafeAI/modex/releases/tag/v0.0.8) was published at
+  `2026-10-06T09:09:32Z` as the latest stable release. Its unauthenticated public DMG
+  download matches the verified CI checksum. The release includes
+  [the verification log](https://github.com/TypeSafeAI/modex/releases/download/v0.0.8/verification-v0.0.8.txt).
+
+Published CI artifacts:
+
+```text
+633da7fbf449f486d012a22278334dd47f30ffad8bc75b012d92cb70e54fb943  Modex-0.0.8-arm64.dmg
+c0a984f2a607fe75b2abc56e0aed64223e6ab37a6b688b0f2a9919237b159233  Modex-0.0.8-arm64.zip
+```
+
+## Publication follow-up verification
+
+The website feed returned fresh v0.0.8 metadata after publication. Its static/offline
+fallback now advances to that verified release, including the no-JavaScript links.
+The follow-up passed workspace build, typecheck, all **310 unit/bridge tests** and
+**114 desktop + 7 website source e2e tests**. The corrected verifier also passed on the
+signed local candidate; its hashes remained unchanged. Independent review found no
+required changes in the ledger, fallback update or Gatekeeper pipeline fix.

docs/status.md

@@ -17,6 +17,7 @@ _Last updated 2026-10-06._
 | v0.0.5 | 2026-10-03 | #69 | First Developer ID signed and notarized build, from the protected `Release` workflow; the Modex app icon; Jev settings and routing limits (#51); terminals no longer leak a PTY each. [Review](reviews/2026-10-03-v0.0.5-release-review.md). |
 | v0.0.6 | 2026-10-05 | #106, #110 | Jev-inspired near-black blue/pink workspace, Claude/ChatGPT sign-in, Retry, Streamer Mode and the paired iPhone service. [Release](https://github.com/TypeSafeAI/modex/releases/tag/v0.0.6). |
 | v0.0.7 | 2026-10-05 | #117 | Official pink identity, persistent Companion pairing, update banner, OpenCoven theme, verified CLI discovery, polished connections and full-width website walkthrough. [Release](https://github.com/TypeSafeAI/modex/releases/tag/v0.0.7). |
+| v0.0.8 | 2026-10-06 | #126, #127 | Per-thread provider/model, live branch and PR state; tabbed workspace, empty-screen polish and failure recovery. [Release](https://github.com/TypeSafeAI/modex/releases/tag/v0.0.8). |
 
 Every release so far is macOS Apple Silicon. v0.0.1–v0.0.4 were ad-hoc signed; from v0.0.5
 releases are Developer ID signed (Soul Protocol LLC), notarized and stapled. The release
@@ -61,7 +62,7 @@ The download site lives in `apps/site`, deployed to Vercel project `modex` for
 `modex.build`. It uses the Jev near-black blue/pink palette and a three-stage CSS 3D
 carousel with real demo captures. Mac links point to the published signed/notarized
 latest stable Apple Silicon release automatically through a cached public GitHub feed,
-with independently verified v0.0.7 links as the static fallback. The page shows GitHub
+with independently verified v0.0.8 links as the static fallback. The page shows GitHub
 stars, forks and total stable Mac installer downloads; missing counts remain hidden and
 cached counts are labeled after a failed refresh. The iPhone buttons now use Val's
 [public TestFlight invitation](https://testflight.apple.com/join/Qr14JKCh).
@@ -133,25 +134,32 @@ and exposes GitHub in the main navigation on desktop and mobile.
   receipts merged after v0.0.6. Both desktop and iPhone jobs passed on both final CI runs.
   The production gate remains off; human acceptance before enabling it is tracked below.
 
-## On `main`, not yet released
+## v0.0.8 release
+
+Published on 2026-10-06 from signed tag `2d55c3f` at verified merge commit `3dc6b84`
+(#126, release setup recovery #127). Protected Release run `37436514563` passed signing,
+notarization, stapling and **114 desktop + 7 website packaged e2e tests**. Downloaded
+artifacts passed independent checksum, certificate, strict signature, native code,
+Gatekeeper, ticket, icon, version and container checks. All 311 files/symlinks in
+the DMG and ZIP app payloads match; the unauthenticated public DMG matches the verified
+CI artifact. [Verification log](https://github.com/TypeSafeAI/modex/releases/download/v0.0.8/verification-v0.0.8.txt).
+[Release ledger](reviews/2026-10-06-v0.0.8-release-review.md).
 
+- **Thread details in the left sidebar.** Each thread shows its provider/model, current
+  checkout branch and linked draft/open/merged/closed GitHub PR state. Missing GitHub CLI
+  access and absent PRs remain explicit. Metadata requests are bounded and cached.
 - **Right workspace replacement.** The right workspace replaces the stacked Changes
   panel with the reference tab strip, new-tab launcher, full view, and a side-by-side review
   with numbered diffs and a filterable file tree. Files previews, the existing per-thread
   terminal, and isolated browser pages run inside tabs. [Design and verification](reviews/2026-10-05-right-workspace.md).
+- **Workspace polish and failure recovery.** A clearer empty workspace makes new projects
+  and chats easier to start; coding CLI failures expose Retry and connection controls.
 
-## In flight
+## On `main`, not yet released
+
+No standalone desktop changes pending release.
 
-- **v0.0.8 standalone macOS release.** The release branch starts from current `main` and
-  adds provider/model, live branch and GitHub PR state to every visible thread in the left
-  sidebar. It includes the merged tabbed workspace, empty-screen polish and failure recovery.
-  Source verification, signed/notarized candidate verification and release notes are tracked
-  in [the release ledger](reviews/2026-10-06-v0.0.8-release-review.md). v0.0.7 remains the
-  published release until the protected release workflow and downloaded-artifact checks pass.
-  PR #126 is merged; the first release run passed signing and all 111 standalone desktop
-  tests, but three Store integration tests timed out because the release job had not built
-  their source client. The release job now prepares that client and development Electron
-  before the packaged suite. Publication remains gated on a successful corrected run.
+## In flight
 
 - **Mac App Store edition.** Val selected investigation of a sandboxed Store front end
   with a separately installed signed host to retain full desktop functionality. Apple's

scripts/release-mac.sh

@@ -93,8 +93,9 @@ verify() {
   fi
   if [ "$notarized" = true ]; then
     say "Gatekeeper: assessment on the notarized app and DMG"
-    spctl -a -vv -t exec "$app" 2>&1 | tee /dev/stderr | grep -q 'source=Notarized Developer ID' || die "Gatekeeper does not see a notarized Developer ID app"
-    spctl -a -vv -t open --context context:primary-signature "$dmg" 2>&1 | tee /dev/stderr | grep -q 'source=Notarized Developer ID' || die "Gatekeeper does not see a notarized Developer ID DMG"
+    # Drain all output so grep cannot close tee's pipe early under pipefail.
+    spctl -a -vv -t exec "$app" 2>&1 | tee /dev/stderr | grep -F 'source=Notarized Developer ID' >/dev/null || die "Gatekeeper does not see a notarized Developer ID app"
+    spctl -a -vv -t open --context context:primary-signature "$dmg" 2>&1 | tee /dev/stderr | grep -F 'source=Notarized Developer ID' >/dev/null || die "Gatekeeper does not see a notarized Developer ID DMG"
     say "stapler: ticket attached to the app and the DMG"
     xcrun stapler validate "$app"
     xcrun stapler validate "$dmg"