v0.1.0-alpha.3

What changed

• WeChat re-signing now uses a persistent per-machine self-signed identity (WGO WeChat Stable Identity) instead of a bare ad-hoc cdhash. macOS TCC could not retain consent granted to an ad-hoc identity, which caused repeated folder/App Data permission prompts every few minutes; consent granted to the stable identity survives restarts.
• First explicit re-sign creates a dedicated keychain at ~/Library/Keychains/wgo-wechat-identity.keychain-db (mode-0600 password sidecar) and reuses it afterwards.
• sudo is now only needed when the WeChat bundle is not writable (to chown the exact target back to you); signing itself runs unprivileged, and post-sign verification requires the signature to anchor the managed certificate.

Notes

• macOS App Data consent remains a per-process-lifetime prompt: at most one prompt per WeChat launch, unchanged platform behavior.
• A WeChat update restores the official signature; re-run the explicit re-sign step (./启动.command --allow-wechat-resign) after each update.
• Already ad-hoc-signed installs keep working; re-run the re-sign step once to stop repeated prompts.

Verification

• 1106 unittest OK (16 skipped) on the merged tree; CI green (macOS Python 3.10–3.14 regression + Windows x64 import boundary).
• Live macOS check: shared signature predicate accepts the stable-identity bundle and identity setup is idempotent on an existing install.

Full Changelog: v0.1.0-alpha.2...v0.1.0-alpha.3

v0.1.0-alpha.2

修复：稳定 macOS app identity + 短命进程授权闸

本机微信反复弹文件权限的根因：macOS App Data consent 按 process identity 绑定，而公开版入口会让短命 Python 进程反复读取受保护的 WeChat source。

• 普通 启动.command 构建并复用 ad-hoc 签名的本机 alias bundle dist/WeGroupchatObsidian.app，不再回退 python app.py；新装 LaunchAgent 绑定同一 bundle
• 刷新数据源 Finder 入口改为重签精确目标后打开稳定 app，在菜单内刷新 key
• refresh_data_source / 补跑遗漏笔记 等 maintenance CLI 默认 fail-closed，需显式 --allow-transient-wechat-source-read
• 默认 health check 不再 stat 受保护的 WeChat container
• py2app>=0.28.9,<0.30 成为 macOS runtime 依赖；README 双语、share-package guide 与 repo contract 已同步

验证：focused 59 passed；全量 1088 passed / 16 skipped；compileall、全部 launcher bash -n、git diff --check 干净；CI macOS 3.10–3.14 + Windows 3.11 全绿（PR #21）。

附件为 exact-commit source package（commit d394deb705625c9b7b2e3ebc689e77432ea43677），SHA-256: 97255ee14699412f34bdc2eba16f81fd9665f5cdf528a2b759fb6e3df3c27a27。仍是 source-distributed alpha，无签名 installer / .dmg。

v0.1.0-alpha.1

First public alpha prerelease of the source-distributed WGO macOS app.

Highlights:

• exact WeChat 4.1.11 (269136) arm64 target binding across startup, runtime, signature checks, and explicit re-sign orchestration
• HMAC-verified key recovery with immutable scanner build identity and atomic cache publication
• generation-bound source cursors and fail-closed source admission
• canonical event, projection, Daily Digest, catch-up receipt, health, and credential-redaction reliability closure
• package metadata aligned to 0.1.0 alpha 1, with one canonical exact-commit offline guide

Verification:

• local macOS full suite: 1081 passed, 16 skipped
• PR and post-merge GitHub matrix passed on macOS Python 3.10 through 3.14 plus the Windows 3.11 import boundary
• bounded authorized macOS arm64 canary produced exactly one new canonical event and a non-empty regular-file projection, passed SQLite and FTS parity checks, migrated legacy state to generation-bound cursors, and restored the pre-existing LaunchAgent
• the canary was deliberately page-capped and therefore reported partial / resume_required; this is not represented as a full historical EOF drain

Distribution:

• source only; no signed installer, DMG, bundled Python runtime, or sealed application bundle
• attached source package is bound to commit 8f04ee2
• SHA-256: 84356f0f9a7336893a8f0b5f3f53c1ac84fa76f0c909bc7b07812160303ffdcd

Known follow-up scope:

• executable generation-admission recovery
• same-second cross-shard ordering edge cases
• optional resource-backup edges
• full Windows product support
• signed installer and automatic update

Those follow-ups are outside this alpha closure and are not claimed complete.