Unpin v1.0.2

Unpin v1.0.2

v1.0.2 is a delivery-only release that gives official macOS CLI and desktop
artifacts one stable signing identity. CLI, terminal TUI, MCP, desktop behavior,
and Rust mutation authority are unchanged from v1.0.1.

Highlights

• Apple Silicon and Intel CLI and desktop archives are signed with the stable
  self-signed CodeBurn Update Signing certificate
  (E2AB4267F6B79DF40B8776A2EE9309F64CFD2389).
• The app, bundled bridge, and standalone CLI retain their existing identifiers:
  dev.unpin.workbench, dev.unpin.workbench.bridge, and dev.unpin.cli.
  A move from 1.0.1 or earlier changes the designated requirement once from
  the old ad-hoc signature, so the first 1.0.2 launch can prompt for
  Keychain access again. After that approval, replacements signed by the same
  certificate and identifier keep the same designated requirement, allowing
  Keychain Always Allow grants to survive later updates.
• Release automation reads the password-protected P12 and password from the
  protected GitHub Actions release-signing environment, behind its required
  approval, imports them into an ephemeral runner Keychain, verifies exactly
  the expected identity, and removes the temporary Keychain and P12 after
  packaging.
• Stable signing is mandatory for official macOS artifacts; the workflow fails
  instead of silently falling back to ad-hoc signing.

Artifacts

The release provides three CLI archives and two native desktop archives:

• unpin-v1.0.2-aarch64-apple-darwin.tar.gz
• unpin-v1.0.2-x86_64-apple-darwin.tar.gz
• unpin-v1.0.2-x86_64-unknown-linux-gnu.tar.gz
• unpin-desktop-v1.0.2-aarch64-apple-darwin.tar.gz
• unpin-desktop-v1.0.2-x86_64-apple-darwin.tar.gz

Every archive has a CycloneDX SBOM, GitHub build-provenance and SBOM
attestations, and an entry in SHA256SUMS.

Trust boundary

The stable personal certificate preserves code identity for Keychain access; it
is not an Apple Developer ID certificate and the artifacts are not notarized.
It therefore does not establish Gatekeeper trust. Verify the checksum and GitHub
attestation before using Finder's Control-click Open flow. Do not disable
Gatekeeper or strip quarantine metadata. The release uses timestamp mode none;
this release does not claim that Apple's secure timestamping works for this
personal self-signed certificate. Full instructions are in the desktop
guide, and certificate expiry/rotation is covered in the
release guide.

Verification

This release changes release automation, version metadata, and documentation,
not program logic. Under the maintainer-approved delivery-only artifact
exception, provider-matrix and live-host reruns are replaced by:

• signing helper contract tests and the complete release-tooling test suite;
• shell syntax, Python compilation, workflow lint, locked Cargo metadata, and
  an exact unpin 1.0.2 version smoke;
• protected-branch CI and the exact release commit's Linux release compatibility
  job; and
• post-tag validation of the complete draft asset set, checksums, attestations,
  certificate fingerprints, exact code-signing identifiers, bundled bridge
  handshake, and fresh-download identity before publication.

Publication remains blocked until all replacement evidence passes against the
merged release commit and tag artifacts. The delivery-only exception does not
waive post-tag proof that every macOS artifact has the expected certificate
SHA-1 fingerprint and exact app, bridge, and CLI code-signing identifiers.

Known limitations

• No Developer ID signing, notarization, or automatic updates.
• Desktop support remains macOS-only and architecture-specific.
• Profiles, gateways, sessions, and hooks remain on CLI, TUI, and MCP surfaces.
• crates.io, Homebrew, Linux ARM64, and Windows distribution remain deferred.