From 0f551ec3a71f922bdcf2f1c558f5bfabe00c8e91 Mon Sep 17 00:00:00 2001
From: krishagel <530001+krishagel@users.noreply.github.com>
Date: Fri, 31 Jul 2026 01:02:35 +0000
Subject: [PATCH] docs: update OpenWiki

---
 openwiki/.last-update.json           | 4 ++--
 openwiki/operations/release-gates.md | 6 ++++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/openwiki/.last-update.json b/openwiki/.last-update.json
index 83e5f52..dc4ca9d 100644
--- a/openwiki/.last-update.json
+++ b/openwiki/.last-update.json
@@ -1,6 +1,6 @@
 {
-  "updatedAt": "2026-07-30T18:43:03.490Z",
+  "updatedAt": "2026-07-31T01:02:08.631Z",
   "command": "update",
-  "gitHead": "d4aeddcf536044803adebee76372d98634dd2c65",
+  "gitHead": "ef81c827916ad88685588de0b35190e30cae0917",
   "model": "zai.glm-5"
 }
diff --git a/openwiki/operations/release-gates.md b/openwiki/operations/release-gates.md
index 5f125ec..d44f3c4 100644
--- a/openwiki/operations/release-gates.md
+++ b/openwiki/operations/release-gates.md
@@ -29,8 +29,10 @@ Apple Development-signed and installed with a stable identity.
 
 The macOS release workflow automates notarized installer builds when triggered by a
 version tag or manual dispatch. It requires Developer ID Application and Installer
-credentials in the CI environment and publishes a GitHub release only after successful
-notarization and Gatekeeper acceptance.
+credentials in the CI environment, notarizes and staples the app bundle before
+packaging, and publishes a GitHub release only after successful installer notarization
+and Gatekeeper acceptance. The build enforces the expected PSD signing team via
+ATRIUM_CAPTURE_EXPECTED_TEAM_ID to prevent misissued certificates.
 
 Both public OAuth clients, idempotent authored-asset publication, and
 authenticated synthetic production-Atrium acceptance are live verified.