Repository navigation
Code Flow Studio 0.4.2
Code Flow Studio 0.4.2 — accepted release
By Jason Stys. Built from immutable source.
The exact-source main validation, full-main CodeQL and three-platform SDK/compiled
native checks passed. The fresh release build then passed
all three compiled native journeys and the corrected final draft-verification job.
The owner downloaded all six actual payloads and all six sidecars, compared their
SHA-256 values with GitHub's asset digests, and verified source/worker provenance
inside all three portable archives. The downloaded Windows portable application
and the application extracted from the actual NSIS installer each passed the real
account/editor/source-inspection/privacy/lock journey, including HTTP drain,
workspace sealing and disappearance of the owned backend processes.
This tests the installer payload, not Windows installer registration, upgrade,
uninstall or clean-machine lifecycle. Existing user installations were not replaced.
Builds are unsigned; normal OS protections remain applicable. Critical local work
can outlive the five-second HTTP drain budget. Execution still requires a working
local Docker engine and an explicitly built matching 0.4.2 restricted worker;
there is no host-execution fallback. Docker was left unchanged on the owner's PC.
The previously published 0.4.0 assets and the unpublished 0.4.1 candidate remain
unchanged. No asset, tag or prior release was overwritten or retargeted.
Source release notes
These notes record the source-stage plan; the accepted checks above describe
the completed publication review.
By Jason Stys. This is a fresh delivery candidate, not a claim that downloads have
been published. The 0.4.1 draft and all its existing assets are preserved. Published
0.4.0 releases/tags/assets remain unchanged.
All 0.4.1 native platform builds passed actual compiled application acceptance.
Its final verification job could not read the prepared draft with a read-only
contents credential. GitHub exposes draft metadata to push-capable credentials.
Only that main-only manual job now has contents: write, with unchanged read-only
actions/security scopes. Its command still performs metadata reads only and keeps
the release a draft; there is no automatic publication or asset overwrite.
The policy validator now requires the exact final-job permission set. Real
workflow mutation regressions reject insufficient draft visibility and expanded
unrelated scopes; the actual final-verifier test still permits reads only.
Current exact-main successful validation/native/CodeQL checks, positive processed
rule counts, zero open main alerts, prepared numeric-ID/source binding, serial
uploads, compiled acceptance, checksums and draft preservation remain mandatory.
See the observed CI fault and evidence.
Application algorithms, account/vault/consent schemas and UI workflows retain the
accepted safe-shutdown and bounded worker-report implementation. Product/runtime/
UI/npm/Python/installer and worker metadata are coherently 0.4.2. Compiler jobs
require the matching reviewed worker: docker build -t code-flow-worker:0.4.2 runner.
This version change neither repairs Docker nor executes target programs on the host.
No account-data migration is added.
Fresh exact-source hosted gates, three-OS native acceptance and independent
downloaded Windows installer acceptance must pass before owner publication.
Packages remain unsigned; OS security protections and the trusted local-service/
device boundary still apply. Existing Word/Excel editions retain their explicit
7d historical runtime baseline; they are not relabeled as current release proof.