NeveshtYar v4.9.2 — نوشت‌یار

Canonical NeveshtYar · نوشت‌یار release.

Highlights:

• canonical NeveshtYar product identity
• version 4.9.2
• Chrome 15/15 acceptance PASS
• Firefox 15/15 acceptance PASS
• 193/193 deterministic tests PASS
• Store audit PASS
• Node.js CI updated to 22
• deterministic Chromium, Firefox, and AMO reviewer-source artifacts

Historical Farsi Smart Assistant releases remain immutable provenance records.

Farsi Smart Assistant v4.9.1

Farsi Smart Assistant v4.9.1

Store-safe correction-only hotfix and dual-browser acceptance release.

Highlights

• Removes automatic Wikipedia lookup and Google search-term transmission/interception from the Store-safe runtime.
• Minimizes extension permissions to storage + activeTab with no third-party host permissions.
• Preserves Persian, English, Finglish, spelling, keyboard-layout recovery, Smart Auto, Undo, bilingual UI, site controls, and the approved visual contract.
• Adds conservative physical-keyboard EN→FA recovery for cases such as sghl → سلام while protecting valid English.
• Automated browser acceptance: 15/15 Chrome + 15/15 Firefox PASS.
• Produces deterministic Chromium/Firefox packages and a deterministic Firefox AMO reviewer-source archive.
• Publishes GitHub artifact attestations from the exact tag-triggered Release provenance workflow.

Verified lifecycle

• Remediation PR: #50
• Accepted PR #50 head: 9b9dd1ffdbbf1bac1b706876cdd70058cb53ace2
• PR #50 squash merge: 713f70a6260c82485b66475f3406d6d3e4b5ed5c
• Release-provenance fix PR: #51
• Final GitHub Release commit: 3d33956197e4c6c4d3e6a6891bc6e70e050b9a71
• Final Git tree: 7c9e57c686e64d933b34c86bd002334f5a6867c8
• Annotated tag object: 6f514744a83bd026a2778ef877534e21e83f6d0d
• Tag target: 3d33956197e4c6c4d3e6a6891bc6e70e050b9a71
• PR #50 Security quality gate run 31961017290: PASS
• PR #50 CodeQL run 31961017332: PASS
• Release provenance run 31962331759: PASS
• Independent Cosign v3.0.6 verification of all six published attestation subjects: PASS
• Chrome automated acceptance: 15/15 PASS
• Firefox automated acceptance: 15/15 PASS

Canonical published assets

• Farsi-Smart-Assistant-v4.9.1-chromium.zip
  • SHA256: 45EFB77C9A92A9167F07F7B9F442F55C40B743AA44284418A91D2C7CC9FBA32C
• Farsi-Smart-Assistant-v4.9.1-firefox.zip
  • SHA256: 746B2EC7C116D21171C93C9616DA8AE8F0716A07703FF4A5E082E2FBC174EAB0
• Farsi-Smart-Assistant-v4.9.1-amo-source.zip
  • SHA256: EAD3F2C9E7DE6077D1C892CE243EB1BB7A03701A6E6E4EA55080227746C31E7B
• release-manifest.json
  • SHA256: 6C4DC07D59CBD986704AB0A3622509E75FEB557153FAC73B2933EEDF0E185D28
• SHA256SUMS.txt
  • SHA256: 9EF67414C5B706CCAD8C9E926B29ED6EF4B7EE64889AC54A5CBB7F61CAB43BD0
• source-manifest.json
  • SHA256: F131B2015217A3F6F95794912E7DE3F8FCABD05F224A7C98A2C83B7AAE29B192

Browser Store status

This GitHub Release is the canonical v4.9.1 Store-submission candidate.

Chrome Web Store and Firefox AMO upload, review, signing, approval, and publication are separate lifecycle steps tracked in Issue #24.

Chrome Web Store publication is NOT CLAIMED.

Firefox AMO publication is NOT CLAIMED.

Farsi Smart Assistant v4.9.0

Farsi Smart Assistant v4.9.0

Universal Persian/English/Finglish correction-engine release.

Highlights

• Universal arbitration across valid/unchanged, keyboard-layout, Finglish, spelling and normalization hypotheses.
• English spelling suggestions with protected valid-source behavior and up to three visible ranked choices.
• Persian spelling suggestions with up to four visible ranked choices, selected from measured holdout evidence.
• Generalized Finglish correction with flexible multi-character + single-character segmentation and guarded reranking.
• Conservative Smart Auto with exact Undo behavior.
• Persian Unicode normalization and strong valid Persian/English protection.
• Persistent FA/EN UI remains independent from correction-engine language decisions.
• Existing approved toolbar, popup/header and current-site favicon visual contracts remain unchanged.

Verified release gates

Exact tested RC head: bc5c89752672a14d6a2e9641650aacd061f2b6da

Squash merge commit: a074f5178b8b7e015f0fe4c3010818cf86a68107

Exact tested/merge tree: 8e94e0d6bcbbbe8a34d136228e94b380261f6f83

Final fresh 5,000+/10,000 holdout:

• Keyboard Layout FA->EN: 99.92%
• Keyboard Layout EN->FA: 99.32%
• Valid English protection: 100%
• Valid Persian protection: 100%
• Canonical Finglish: 97.88%
• Variant Finglish: 95.04%
• English spelling visible top-3: 98.68%
• Persian spelling visible top-4: 98.24%
• Smart Auto English destructive FP: 0 / 10,000
• Smart Auto Persian destructive FP: 0 / 10,000
• Unicode normalization: 100%
• Adversarial suite: 100%

Security:

• CodeQL run 31935100092: PASS
• Security quality gate run 31935100113: PASS

Founder/manual Chrome:

• exact CI Chromium artifact: PASS
• manual checks: 15/15 PASS
• founder receipt SHA256: 2C58EF3039479B6BB8B4A4576F10D3193C1FB8380E71B3A5BF22D33B1F247D1A

Deterministic release artifacts

• Chromium SHA256: 688D6EB7E442F4C3D6F51B921A4B339CF151B60C13534ED94436A2DB351C251B
• Chromium size: 4267064 bytes
• Firefox SHA256: 62C5AA9F474A332C43F0E917B97023E4844B22821CC1380703CDF9C4252EBA29
• Firefox size: 4267616 bytes
• Local deterministic A/B build: PASS
• Local build vs GitHub CI artifact: byte-identical PASS

This release does not claim correction of every possible misspelling.

Store publication is not claimed by this GitHub Release. Chrome Web Store / Firefox AMO publication remains a separate dashboard-verified lifecycle in Issue #24.

Farsi Smart Assistant v4.8.0

Farsi Smart Assistant v4.8.0

Bilingual FA/EN Product UI release.

Highlights

• Persistent FA/EN UI with Persian RTL default and English LTR mode.
• Shared localization across Popup, Settings, Site Management, dynamic UI strings and inline Correction/Undo.
• Smart Auto and correction decisions remain independent from UI language.
• Official transparent blue Persian ف product mark.
• Locale-aware popup header: blue ف in FA and blue E in EN.
• Clean current-site favicon rendering.
• Final pinned toolbar icons: pure-white ف in FA and standard uppercase white E in EN.

Verified lifecycle

• Exact tested PR head: 6eec044
• Squash merge commit: 9ee85cf
• Exact tested/merge tree: 5376b576d2dda3a790c3fc0ba6cad948f00cc239
• Full product suite: 164/164 PASS.
• Evaluation exact-match rate: 1.
• Evaluation false-positive rate: 0.
• CodeQL: PASS.
• Security quality gate: PASS.
• Founder visual gates: PASS.

Deterministic artifacts

• Chromium SHA-256: 5767B7032D5EEA2780DC9A2540BC547AC1FF4A2AA6537D5701EBB6D9E777ECAB
• Firefox SHA-256: 037E5EA09BE76BE3F4A151E54D5122D83F069A7046F39D11E53D9E8DB86E24FB
• Chromium entries: 56.
• Firefox entries: 56.

Store publication is not claimed by this release. Browser-store submission remains a separate follow-up lifecycle.

Farsi Smart Assistant v4.7.0

Farsi Smart Assistant v4.7.0

Universal Intent Engine release with conservative, local-first Persian/English keyboard-intent correction.

Exact release evidence

• exact Chrome-tested PR head: 63c11cb8b84d315043e21d2573358dcc9586451f
• exact squash merge / annotated-tag target: eacf702bd5f806bd2524425db7bbfc0853cf35ac
• final real Chrome gate: 10/10 PASS
• automated product suite: 149/149 PASS
• Google Persian-context English Auto FP: 0
• physical-keyboard valid-Persian Auto FP: 0.001625
• reverse-layout Auto recall: 0.9099208764
• forward-layout Auto recall: 0.893125
• Finglish exact Auto recall: 0.6734822668
• exact-head CodeQL / Security quality gate: PASS
• exact-tag Release provenance run 31809971192: PASS

Product changes

• dictionary-independent statistical intent engine
• contextual ambiguity resolution
• generalized Finglish and Persian normalization
• conservative Smart Auto
• real Google lang=en field handling from Persian surrounding-text evidence
• stable controlled-input mutation/caret behavior
• visible local Undo / برگردان
• token-local post-Auto bounce protection

Release artifacts

• Chromium SHA-256: 404B104AA71A76641C40903E68E9B3FE70A283D6D125DEFD0E176DAC2BAE8764
• Firefox SHA-256: 827A62ED0BEEE897BF5EBBD7B9AAE15DF73FFD580CA5F5CC3BFC0633F55AB67E
• SHA256SUMS.txt SHA-256: 68CCF16CE44336853E7AC4C1CCAC3119130A485954F9C618D2D840AB2FDE92C9
• release-manifest.json SHA-256: 7A046E8D02B63521F5F2BD415A2ED632F3AE621BDFF3DD2D254C52A4F1CB047B

The Git tag is annotated and points exactly at the merge SHA. GitHub currently reports tag signature verification as verified=False with reason unsigned. Artifact provenance is independently successful.

Chrome Web Store / Firefox AMO publication is not claimed by this release. Store lifecycle remains open in #24.

Dependency Review Resolution 2026

Dependency Review Resolution 2026

Completes the real Code Review feedback loop for Farsi-Smart-Assistant PR #37.

Review lifecycle

• Original blocked head: 3c277e6ac4d97a026f2d83e1304bb2e208e1683e
• Original review: CHANGES_REQUESTED
• Contract-fix PR: #43
• Contract-fix merge SHA: 70e7e62d3aad5db198a615fc897a876f4f890c3b
• Rebased dependency head: 7bec6ebde7aa370e3cc949ac7c3c35890678e992
• Final re-review: APPROVED
• Final review ID: 4935702747
• Dependency PR #37 merge SHA: 8918097736060c5ed3fb7c1ed9b5b9d46bf5146f

Reviewed dependency scope

The rebased Dependabot PR changed exactly two existing uses of actions/upload-artifact:

• .github/workflows/security-quality-gate.yml
• .github/workflows/release-provenance.yml

Both were changed from the reviewed v4 full SHA to:

043fb46d1a93c77aae656e7c1c64a875d1fc6a0a (v7.0.1)

The complete PR check set was green on the exact approved head.

Integrity

• old blocking review preserved;
• old blocking review preserved;
• no direct reviewer commit to the Dependabot branch;
• no unrelated product-code change;
• dependency PR merged only after exact-head approval and green CI.

Evidence

• Issue: #42
• evidence/phase10-1-dependency-review-resolution.md
• Evidence SHA-256: 404C55BA9CCCF6E2A58046144ACD296805EFF2A9C3DB867FDDA081F0209831EF
• Exact final tag: dependency-review-resolution-v2026.08.14

Open Source Community Growth 2026

Open Source Community Growth 2026

Creates a real community and contributor funnel for AmirMotefaker/Farsi-Smart-Assistant.

Community

• GitHub Discussions: enabled
• Q&A available through GitHub's default Discussions categories
• Issues remain the path for reproducible bugs and scoped work
• COMMUNITY.md published
• CONTRIBUTING.md expanded
• README community route published

Baseline

• Stars at Phase 9 audit: 19
• Forks at Phase 9 audit: 3
• Public-only merged PR count after this repository merge: 111

Integrity

• No fake Q&A
• No fabricated coauthors
• No no-op pull requests
• No synthetic reactions
• No artificial star networks
• License state preserved
• Product behavior unchanged

Lifecycle

• Issue: #40
• Pull Request: #41
• Exact merged SHA: f302d0e698417fe92d99c20818d954571f007f25
• Evidence SHA-256: 54DA2E289BC3872CCB8B3C20B70EA230A56C84256D93CB849C8DDCE7046D4709

Farsi Smart Assistant v4.6.0

Farsi Smart Assistant v4.6.0

Bidirectional keyboard-layout intent correction with real-browser editable hookup and controlled-input application fixes.

Exact merge/tag/release SHA: 47aecf9

Product behavior

• sghl -> سلام
• هقشد -> iran
• ضعثقغ -> query
• سلام هقشد -> سلام iran
• pre-focused and dynamically encountered editables are tracked
• live Google controlled-input application manually verified
• valid Persian false-positive protection retained
• Store publication remains paused

Quality gates

• 94/94 automated tests PASS before manual gate
• evaluation corpus 0.4.0 PASS, false-positive rate 0
• exact candidate CI PASS
• real Chrome manual gate PASS
• exact evidence-head CI PASS
• exact-merge tests/eval/build/verify/audit PASS

Canonical SHA256

• Chromium: 358a4bc00abc0a0d37138f40fc5b27950d9d47718694c664877560f76a4e0a44
• Firefox: 417f32a6c13f0dcb566aba1d1e8ef0bf2eb4f7e506b64e6451d52ff6b831001f

Lifecycle

• Issue #27
• PR #28
• tested candidate SHA: 466ae08
• manual evidence SHA: 401b0fc
• exact merge/tag/release SHA: 47aecf9
• Store Issue #24 remains PAUSED

Farsi Smart Assistant v4.5.1

Farsi Smart Assistant v4.5.1

Store Compatibility Hotfix built from exact merge SHA:

939c84c06b6478daba90b843a9a1a4f788246b7f

Changes

• icon16.png = 16x16
• icon32.png = 32x32
• icon48.png = 48x48
• icon128.png = 128x128 with Store-safe transparent padding
• no correction-engine behavior change
• no permission expansion
• Store audit now verifies real icon dimensions
• Chrome Web Store / Firefox AMO submission documentation included

Quality gates

• 78/78 automated tests PASS
• evaluation PASS
• exact-merge release build PASS
• release artifact verification PASS
• Store audit PASS
• GitHub Actions exact-head PASS

Canonical SHA256

e243210825d23bc6e8c83bcd6ece8bed710ef28c3c7b3885c5c6668a80112ebc  Farsi-Smart-Assistant-v4.5.1-chromium.zip
d30950d03f653d96fa12fe43f7314ce63b2403a843af71c10fbb624ef890dbcd  Farsi-Smart-Assistant-v4.5.1-firefox.zip

Lifecycle

• Parent Store Publication Issue: #24
• Hotfix Issue: #25
• PR: #26
• Candidate SHA: 6940eca
• Exact merge/tag/release SHA: 939c84c

GitHub Trust & Security Hardening 2026

GitHub Trust & Security Hardening 2026

Hardens repository community health, vulnerability reporting, GitHub Actions supply-chain controls, and dependency security without changing product behavior.

Delivered

• SECURITY.md
• CONTRIBUTING.md
• Code of Conduct
• Issue forms and PR template
• CODEOWNERS
• Dependabot version-update configuration
• vulnerability alerts
• Dependabot security updates
• private vulnerability reporting
• read-only default GITHUB_TOKEN
• GitHub Actions cannot approve PRs
• full-SHA repository Actions policy
• immutable action pins
• CodeQL for JavaScript/TypeScript
• store-readiness test aligned with the immutable upload-artifact SHA
• sanitized public evidence

Integrity

• Existing MIT license state was preserved exactly.
• Product/runtime behavior was not changed by the CI compatibility recovery.
• Community health: 42% -> 100%
• Issue: #33
• Pull Request: #34
• Exact merged SHA: 519f5dcb59b1d24d571980a7565452df3a8d42dc
• Evidence SHA-256: 697F079C7FD941B066D033127D9321C3C494959BA52947225AFE1F3B43BA135E