Prepare and verify the first Windows/Linux release candidate #119

Classification: first-release blocker. Target is the first mature public release; completion depends on evidence, not a fixed publication date.

The repository is public and MIT-licensed, but there are no published releases as of this audit. desktop-preview.yml builds Windows Server 2022 and Ubuntu 22.04 preview artifacts, retained for seven days; it does not publish a release. Package hashes, pinned Node hashes and source-commit metadata already exist.

Acceptance:

• Freeze one RC source commit/version and record successful full CI plus both native package acceptance jobs against that exact candidate.
• Prepare a complete version-pinned asset set: Windows install.cmd/install.ps1/zip, Linux installer/tar.gz, matching checksums and source/build identity. Keep final publication separately approved.
• Test the actual downloadable asset arrangement, including installer bootstrap, matching archive retrieval, corrupt/mismatched download rejection and offline archive installation.
• Run clean consumer-machine checks as a standard user without development tools: actual browser launch and shortcut, sample completion/resume, repeat authoring, relaunch/crash recovery and upgrade/restore. Existing automated acceptance substitutes browser opening and skips shortcut creation, so it is not the whole manual check.
• State tested minimum OS/distribution/browser requirements. Validate consumer Windows and the claimed Linux baseline; do not infer support from CI runner names.
• Verify bundled dependency/native-library license notices are retained, alongside Examify and Node licenses; inspect the final archive for secrets/private study data.
• Decide and document the bootstrap trust/signing policy. Checksums detect changed bytes but do not establish publisher identity independently of the downloaded installer. Record real Windows download/reputation-warning behavior; do not require disabling system security.
• Record the current dependency/security check outcome and triage failures. The failed Dependabot update run is not by itself proof of a shipped vulnerability.
• Close only with artifact hashes, OS/browser test notes and CI links.

Sources: packaging workflow, package builder, packaged acceptance.

No macOS/ARM support or enterprise release infrastructure is required for this issue.

Verified progress (2026-10-03)

#123 merged as a882e591b774b0402819d9ff7598f84f121097bd. Final PR head 2545f1b10e8c06eb4b991d4b8fe2238bcb43f06d passed full CI and native Windows/Linux acceptance.

• Implemented version-pinned installers/archives, checksum and source/lockfile identity, matching candidate assembly, independent archive inspection and retained dependency/native-license evidence.
• Automated real-download tests cover a local mirror, mismatch/corruption rejection and offline archives. Native Windows acceptance runs as a standard user without host Node/Git/pnpm on installer PATH.
• PR evidence records a zero-vulnerability production dependency audit at that point. This does not replace a current audit of the eventual RC or native/embedded dependency triage.
• #124 merged first-run/help improvements and #125 merged guarded author question preview. Main is therefore newer than the Prepare verified portable release assets without unused native image optimization #123 package candidate.

Verified progress (2026-10-05)

#132 merged as af684f112a8784534a40d35ec84d94db23af0991, simplifying the README and seven-stage setup while retaining explicit approved Apply and improving session revocation/browser-startup reliability. Exact head c58c85bf829debf5bb9ea89ecf3194239c374d4a passed full CI with 1,560 unit tests and 32 Chromium E2E cases, plus both Windows/Linux native acceptance jobs.

Accessibility #126 merged as f6f482e64e4adbf9852e5a16a960a81e584a5a18. Final head 6f9ba7bf5cd49042b5bed544a91cd1ba879271cb passed full CI with 1,569 unit tests and 32 Chromium E2E cases, plus Windows/Linux native acceptance and both CodeQL analyses. These are current implementation checks; the final RC, artifact sign-off and consumer-machine criteria below still need their own evidence.

Remaining before closure

No single final RC version/source commit has been frozen or a stable candidate set assembled and preserved for sign-off. The nine acceptance items remain open because they refer to that final candidate and include manual/public-download evidence.

Still required: exact RC CI and native jobs; final artifact hashes/identity and retained notices/private-data inspection; current security triage; actual download/HTTPS/CDN and offline route verification; ordinary-user consumer Windows/Linux browser/shortcut, sample/resume, repeated authoring, restart/crash and upgrade/full-folder restore checks; tested minimum OS/browser claims; explicit unsigned-distribution/signing decision and real Windows download/Mark-of-the-Web/SmartScreen behavior.

CI runner names are not a consumer support baseline. No completed consumer-machine verification is established by the implementation work above. Publication remains separately approved. Procedure: version-pinned release checklist.