release: ship T4 Code v0.1.14 with automated OMP maintenance

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -10,7 +10,7 @@ body:
     id: version
     attributes:
       label: T4 Code version
-      placeholder: "0.1.13"
+      placeholder: "0.1.14"
     validations:
       required: true
   - type: dropdown

.github/android-release-identity.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "applicationId": "com.lycaonsolutions.t4code",
+  "minSdkVersion": 24,
+  "targetSdkVersion": 36,
+  "signingCertificateSha256": "fa58f53c953a078d8db2b633ee8c226cfd2ad3f7220cd55dd03a2e195a81b0ac",
+  "certificateBaseline": {
+    "tag": "v0.1.13",
+    "asset": "T4-Code-0.1.13-android.apk",
+    "assetSha256": "ce863c0c957ed7992393226d5f9aa7968d8c1bc748245f6e1d10de491247c5ef"
+  }
+}

.github/workflows/release.yml

@@ -237,17 +237,16 @@ jobs:
 
       - name: Inspect signed Android APK
         shell: bash
-        env:
-          VERSION: ${{ needs.verify.outputs.version }}
         run: |
           set -euo pipefail
           apk="apps/mobile/android/app/build/outputs/apk/release/app-release.apk"
-          test -f "$apk"
+          metadata="apps/mobile/android/app/build/outputs/apk/release/output-metadata.json"
           build_tools="${ANDROID_SDK_ROOT:-$ANDROID_HOME}/build-tools/36.0.0"
-          export PATH="$build_tools:$PATH"
-          apksigner verify --verbose "$apk"
-          aapt dump badging "$apk" | grep -F "package: name='com.lycaonsolutions.t4code'"
-          aapt dump badging "$apk" | grep -F "versionName='${VERSION}'"
+          node scripts/inspect-android-release.mjs \
+            --apk "$apk" \
+            --metadata "$metadata" \
+            --aapt "$build_tools/aapt" \
+            --apksigner "$build_tools/apksigner"
 
       - name: Stage Android artifact
         shell: bash

README.md

@@ -4,35 +4,35 @@ T4 Code is a free, open-source (MIT) desktop app for [Oh My Pi](https://github.c
 
 ![T4 Code main window](docs/assets/t4-code-main.png)
 
-[**Download v0.1.13**](https://github.com/LycaonLLC/t4-code/releases/tag/v0.1.13) · [**Docs**](https://t4code.net/docs) · [**Get the source**](#build-from-source)
+[**Download v0.1.14**](https://github.com/LycaonLLC/t4-code/releases/tag/v0.1.14) · [**Docs**](https://t4code.net/docs) · [**Get the source**](#build-from-source)
 
 ## Requirements
 
-T4 Code needs an OMP build with desktop appserver support. For v0.1.13, use the public integration build below.
+T4 Code needs an OMP build with desktop appserver support. For v0.1.14, use the public integration build below.
 
-T4 Code v0.1.13 was verified with OMP 16.5.1 built from [`bed27ae6`](https://github.com/lyc-aon/oh-my-pi/commit/bed27ae6e5658267745e2ec774e011fe7062e2f1), tagged [`t4code-16.5.1-appserver-6`](https://github.com/lyc-aon/oh-my-pi/tree/t4code-16.5.1-appserver-6). That public integration is based on the official upstream [`v16.5.1`](https://github.com/can1357/oh-my-pi/tree/v16.5.1) tag at [`14b5da76`](https://github.com/can1357/oh-my-pi/commit/14b5da76a9aece9a469288718d22c3d624daf033). It carries forward T4's appserver and lifecycle integration, adds bounded prompt-image upload and transcript-image readback, keeps image-bearing managed RPC notifications below their line ceiling, and makes tiny canonical transcript images retrievable by digest. The official upstream v16.5.1 tag has no `appserver` command, so it cannot host T4 Code. The verified runtime is a normal build from the public `lyc-aon/oh-my-pi` source; T4 Code does not depend on private home-directory files, an auth broker, or a custom Codex CLI fork. T4 Code vendors `@oh-my-pi/app-wire` 0.5.5 from integration commit [`6a87fa64`](https://github.com/lyc-aon/oh-my-pi/commit/6a87fa6407ebff20417b4d52885a6bb3091003ea), source tree `a2495fe8781c979184fe7fb9a6d37d8f33bad30f`.
+T4 Code v0.1.14 was verified with OMP 16.5.2 built from [`d7c9ac81`](https://github.com/lyc-aon/oh-my-pi/commit/d7c9ac81a3764085d050d0b7148ac7eee976ddd3), tagged [`t4code-16.5.2-appserver-1`](https://github.com/lyc-aon/oh-my-pi/tree/t4code-16.5.2-appserver-1). That public integration is based on the official upstream [`v16.5.2`](https://github.com/can1357/oh-my-pi/tree/v16.5.2) tag at [`7d02778c`](https://github.com/can1357/oh-my-pi/commit/7d02778c60f4b5db60f84bedbca79d6e64cb91f5). It carries forward T4's appserver, lifecycle, image, and session-control integration and adds an identity-bound `drain-if-idle` operation for safe local upgrades. The official upstream v16.5.2 tag has no `appserver` command, so it cannot host T4 Code. The verified runtime is a normal build from the public `lyc-aon/oh-my-pi` source; T4 Code does not depend on private home-directory files, an auth broker, or a custom Codex CLI fork. T4 Code vendors `@oh-my-pi/app-wire` 0.5.5 from integration commit [`6a87fa64`](https://github.com/lyc-aon/oh-my-pi/commit/6a87fa6407ebff20417b4d52885a6bb3091003ea), source tree `a2495fe8781c979184fe7fb9a6d37d8f33bad30f`.
 
 | Platform | Arch                  | Package                                  |
 | -------- | --------------------- | ---------------------------------------- |
 | Android  | arm64, armv7, x86_64  | `.apk` (**signed**)                      |
 | Linux    | x86_64                | `.deb`, AppImage                         |
 | macOS    | Apple Silicon (arm64) | `.dmg`, `.zip` (**unsigned, see below**) |
 
-No Windows build and no Intel Mac build in v0.1.13. The iOS TestFlight build is coming soon.
+No Windows build and no Intel Mac build in v0.1.14. The iOS TestFlight build is coming soon.
 
-## What changed in v0.1.13
+## What changed in v0.1.14
 
-- Fresh transcript images now render immediately in T4 without restarting the OMP appserver.
-- Managed RPC notifications omit redundant inline image bytes while the full image remains in OMP's session and model context, preventing image-bearing turns from losing their runtime at the one MiB line ceiling.
-- Tiny canonical transcript images are persisted by content digest, so the same verified read path works across live delivery, reloads, and reconnects.
-- Image prompts, bounded transcript reads, connection recovery, and lifecycle controls from v0.1.12 remain unchanged.
+- The Linux host maintainer can now take a stable OMP update through exact fork synchronization, atomic publication, public verification, and guarded local installation.
+- Local cutovers require an identity-bound `drain-if-idle` receipt from OMP. If any tracked work is active, the update waits.
+- Gateway ingress is the final exposure step. The deployment is accepted only after the new OMP binary, T4 package, web runtime, loopback health, and exact deployment identity pass verification.
+- Android release CI now rejects the wrong application ID, SDK bounds, APK shape, version, or production signing certificate before publication.
 
 ## Install
 
 ### Android
 
 1. On the Android phone, sign in to Tailscale with an account that can reach the T4 Code host.
-2. Download [`T4-Code-0.1.13-android.apk`](https://github.com/LycaonLLC/t4-code/releases/download/v0.1.13/T4-Code-0.1.13-android.apk).
+2. Download [`T4-Code-0.1.14-android.apk`](https://github.com/LycaonLLC/t4-code/releases/download/v0.1.14/T4-Code-0.1.14-android.apk).
 3. If Android asks, allow your browser or file manager to install unknown apps, then install the APK.
 4. Open T4 Code and enter the host's HTTPS Tailscale address, including its port.
 
@@ -41,26 +41,26 @@ The APK does not contain an appserver or expose one to the public internet. It c
 ### Linux (Debian/Ubuntu)
 
 ```sh
-wget https://github.com/LycaonLLC/t4-code/releases/download/v0.1.13/T4-Code-0.1.13-linux-amd64.deb
-sudo apt install ./T4-Code-0.1.13-linux-amd64.deb
+wget https://github.com/LycaonLLC/t4-code/releases/download/v0.1.14/T4-Code-0.1.14-linux-amd64.deb
+sudo apt install ./T4-Code-0.1.14-linux-amd64.deb
 ```
 
 Use `apt install` rather than `dpkg -i` so system dependencies resolve automatically.
 
 ### Linux (AppImage)
 
 ```sh
-wget https://github.com/LycaonLLC/t4-code/releases/download/v0.1.13/T4-Code-0.1.13-linux-x86_64.AppImage
-chmod +x T4-Code-0.1.13-linux-x86_64.AppImage
-./T4-Code-0.1.13-linux-x86_64.AppImage
+wget https://github.com/LycaonLLC/t4-code/releases/download/v0.1.14/T4-Code-0.1.14-linux-x86_64.AppImage
+chmod +x T4-Code-0.1.14-linux-x86_64.AppImage
+./T4-Code-0.1.14-linux-x86_64.AppImage
 ```
 
 ### macOS (Apple Silicon)
 
 > [!WARNING]
-> **The macOS v0.1.13 build is unsigned and unnotarized.** Apple has not signed or notarized it, so Gatekeeper can report a "damaged" app or an unidentified developer. Only continue if you trust the release from this repository. You can always build from source instead.
+> **The macOS v0.1.14 build is unsigned and unnotarized.** Apple has not signed or notarized it, so Gatekeeper can report a "damaged" app or an unidentified developer. Only continue if you trust the release from this repository. You can always build from source instead.
 
-1. Download [`T4-Code-0.1.13-mac-arm64.dmg`](https://github.com/LycaonLLC/t4-code/releases/download/v0.1.13/T4-Code-0.1.13-mac-arm64.dmg) (or [`T4-Code-0.1.13-mac-arm64.zip`](https://github.com/LycaonLLC/t4-code/releases/download/v0.1.13/T4-Code-0.1.13-mac-arm64.zip)).
+1. Download [`T4-Code-0.1.14-mac-arm64.dmg`](https://github.com/LycaonLLC/t4-code/releases/download/v0.1.14/T4-Code-0.1.14-mac-arm64.dmg) (or [`T4-Code-0.1.14-mac-arm64.zip`](https://github.com/LycaonLLC/t4-code/releases/download/v0.1.14/T4-Code-0.1.14-mac-arm64.zip)).
 2. Drag `T4 Code.app` into `/Applications`.
 3. If Gatekeeper blocks the app and you choose to proceed, remove the quarantine attributes from the copied app bundle:
 

SECURITY.md

@@ -26,4 +26,4 @@ We read every report and will reply to tell you what happens next. This is a sma
 
 - T4 Code is a desktop client. The OMP runtime is a separate project; runtime vulnerabilities belong at <https://github.com/can1357/oh-my-pi>.
 - Pairing credentials are encrypted with the OS keychain via Electron `safeStorage`. Reports about credential handling, the pairing flow, or the `t4-code://` deep-link handler are especially welcome.
-- The macOS v0.1.13 build is unsigned and unnotarized; that is a known, disclosed limitation, not a vulnerability report. Removing `com.apple.quarantine` changes Gatekeeper handling but does not sign, notarize, or verify the app.
+- The macOS v0.1.14 build is unsigned and unnotarized; that is a known, disclosed limitation, not a vulnerability report. Removing `com.apple.quarantine` changes Gatekeeper handling but does not sign, notarize, or verify the app.

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4-code/desktop",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "private": true,
   "type": "module",
   "main": "dist-electron/main.cjs",

apps/desktop/src/target-manager.ts

@@ -339,7 +339,7 @@ export class DesktopTargetManager {
       capabilities: requestedCapabilities,
       requestedFeatures: REQUESTED_FEATURES,
       compatibilityRequestedFeatures: COMPATIBILITY_FEATURES,
-      client: { name: "T4 Code", version: "0.1.13", build: "desktop", platform: process.platform },
+      client: { name: "T4 Code", version: "0.1.14", build: "desktop", platform: process.platform },
       reconnect: { attemptCap: 12, baseMs: 250, maxMs: 10_000 },
     };
     const client = createOmpClient(clientOptions);

apps/mobile/capacitor.config.json

@@ -3,7 +3,7 @@
   "appName": "T4 Code",
   "webDir": "dist",
   "loggingBehavior": "debug",
-  "appendUserAgent": " T4CodeMobile/0.1.13",
+  "appendUserAgent": " T4CodeMobile/0.1.14",
   "android": {
     "path": "android",
     "minWebViewVersion": 60,

apps/mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4-code/mobile",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "private": true,
   "type": "module",
   "scripts": {

apps/site/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4-code/site",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "private": true,
   "type": "module",
   "scripts": {

apps/site/src/release.ts

@@ -5,16 +5,16 @@ export const SITE_URL = "https://t4code.net";
 export const DOCS_URL = `${SITE_URL}/docs`;
 export const REPO_URL = "https://github.com/LycaonLLC/t4-code";
 export const OMP_URL = "https://github.com/can1357/oh-my-pi";
-export const OMP_RUNTIME_VERSION = "16.5.1";
-export const OMP_RUNTIME_COMMIT = "bed27ae6e5658267745e2ec774e011fe7062e2f1";
-export const OMP_RUNTIME_TAG = "t4code-16.5.1-appserver-6";
+export const OMP_RUNTIME_VERSION = "16.5.2";
+export const OMP_RUNTIME_COMMIT = "d7c9ac81a3764085d050d0b7148ac7eee976ddd3";
+export const OMP_RUNTIME_TAG = "t4code-16.5.2-appserver-1";
 export const OMP_RUNTIME_URL = `https://github.com/lyc-aon/oh-my-pi/tree/${OMP_RUNTIME_TAG}`;
-export const OMP_UPSTREAM_TAG = "v16.5.1";
-export const OMP_UPSTREAM_COMMIT = "14b5da76a9aece9a469288718d22c3d624daf033";
+export const OMP_UPSTREAM_TAG = "v16.5.2";
+export const OMP_UPSTREAM_COMMIT = "7d02778c60f4b5db60f84bedbca79d6e64cb91f5";
 export const OMP_UPSTREAM_URL = `${OMP_URL}/tree/${OMP_UPSTREAM_TAG}`;
 export const APP_WIRE_VERSION = "0.5.5";
-export const RELEASE_TAG = "v0.1.13";
-export const RELEASE_VERSION = "0.1.13";
+export const RELEASE_TAG = "v0.1.14";
+export const RELEASE_VERSION = "0.1.14";
 export const RELEASES_URL = `${REPO_URL}/releases/tag/${RELEASE_TAG}`;
 
 export type Platform = "android" | "linux" | "mac";
@@ -48,11 +48,11 @@ function asset(
 }
 
 export const RELEASE_ASSETS: readonly ReleaseAsset[] = [
-  asset("android", "apk", "universal", "T4-Code-0.1.13-android.apk", "Android APK"),
-  asset("linux", "deb", "x86_64", "T4-Code-0.1.13-linux-amd64.deb", "Linux .deb"),
-  asset("linux", "appimage", "x86_64", "T4-Code-0.1.13-linux-x86_64.AppImage", "Linux AppImage"),
-  asset("mac", "dmg", "arm64", "T4-Code-0.1.13-mac-arm64.dmg", "macOS .dmg"),
-  asset("mac", "zip", "arm64", "T4-Code-0.1.13-mac-arm64.zip", "macOS .zip"),
+  asset("android", "apk", "universal", "T4-Code-0.1.14-android.apk", "Android APK"),
+  asset("linux", "deb", "x86_64", "T4-Code-0.1.14-linux-amd64.deb", "Linux .deb"),
+  asset("linux", "appimage", "x86_64", "T4-Code-0.1.14-linux-x86_64.AppImage", "Linux AppImage"),
+  asset("mac", "dmg", "arm64", "T4-Code-0.1.14-mac-arm64.dmg", "macOS .dmg"),
+  asset("mac", "zip", "arm64", "T4-Code-0.1.14-mac-arm64.zip", "macOS .zip"),
 ];
 
 export function assetsFor(platform: Platform): readonly ReleaseAsset[] {

apps/site/test/release.test.ts

@@ -1,4 +1,4 @@
-// Release contract guard: exact v0.1.13 asset names and URLs, and the
+// Release contract guard: exact v0.1.14 asset names and URLs, and the
 // platform-detection rule the hero download button relies on.
 import { describe, expect, it } from "vite-plus/test";
 import {
@@ -19,13 +19,13 @@ import {
 } from "../src/release.ts";
 
 describe("release assets", () => {
-  it("carries the five contracted v0.1.13 filenames", () => {
+  it("carries the five contracted v0.1.14 filenames", () => {
     expect(RELEASE_ASSETS.map((a) => a.filename)).toEqual([
-      "T4-Code-0.1.13-android.apk",
-      "T4-Code-0.1.13-linux-amd64.deb",
-      "T4-Code-0.1.13-linux-x86_64.AppImage",
-      "T4-Code-0.1.13-mac-arm64.dmg",
-      "T4-Code-0.1.13-mac-arm64.zip",
+      "T4-Code-0.1.14-android.apk",
+      "T4-Code-0.1.14-linux-amd64.deb",
+      "T4-Code-0.1.14-linux-x86_64.AppImage",
+      "T4-Code-0.1.14-mac-arm64.dmg",
+      "T4-Code-0.1.14-mac-arm64.zip",
     ]);
   });
 
@@ -37,8 +37,8 @@ describe("release assets", () => {
 
   it("targets the public LycaonLLC repo", () => {
     expect(REPO_URL).toBe("https://github.com/LycaonLLC/t4-code");
-    expect(RELEASE_TAG).toBe("v0.1.13");
-    expect(RELEASE_VERSION).toBe("0.1.13");
+    expect(RELEASE_TAG).toBe("v0.1.14");
+    expect(RELEASE_VERSION).toBe("0.1.14");
   });
 
   it("splits assets by platform with correct architectures", () => {
@@ -59,14 +59,14 @@ describe("release assets", () => {
 
 describe("OMP integration contract", () => {
   it("pins the verified runtime tag, commit, and app-wire package", () => {
-    expect(OMP_RUNTIME_TAG).toBe("t4code-16.5.1-appserver-6");
-    expect(OMP_RUNTIME_COMMIT).toBe("bed27ae6e5658267745e2ec774e011fe7062e2f1");
+    expect(OMP_RUNTIME_TAG).toBe("t4code-16.5.2-appserver-1");
+    expect(OMP_RUNTIME_COMMIT).toBe("d7c9ac81a3764085d050d0b7148ac7eee976ddd3");
     expect(OMP_RUNTIME_URL).toBe(
-      "https://github.com/lyc-aon/oh-my-pi/tree/t4code-16.5.1-appserver-6",
+      "https://github.com/lyc-aon/oh-my-pi/tree/t4code-16.5.2-appserver-1",
     );
-    expect(OMP_UPSTREAM_TAG).toBe("v16.5.1");
-    expect(OMP_UPSTREAM_COMMIT).toBe("14b5da76a9aece9a469288718d22c3d624daf033");
-    expect(OMP_UPSTREAM_URL).toBe("https://github.com/can1357/oh-my-pi/tree/v16.5.1");
+    expect(OMP_UPSTREAM_TAG).toBe("v16.5.2");
+    expect(OMP_UPSTREAM_COMMIT).toBe("7d02778c60f4b5db60f84bedbca79d6e64cb91f5");
+    expect(OMP_UPSTREAM_URL).toBe("https://github.com/can1357/oh-my-pi/tree/v16.5.2");
     expect(APP_WIRE_VERSION).toBe("0.5.5");
   });
 });

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4-code/web",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "private": true,
   "type": "module",
   "scripts": {

apps/web/src/platform/browser-shell-port.ts

@@ -279,7 +279,7 @@ export function createBrowserShellPort(
       },
       client: {
         name: "T4 Code",
-        version: "0.1.13",
+        version: "0.1.14",
         build: mobilePlatform ?? "browser",
         platform: mobilePlatform ?? (platform === "darwin" ? "darwin" : "linux"),
       },

compat/omp-app-matrix.json

@@ -12,14 +12,14 @@
   },
   "verifiedRuntime": {
     "package": "omp",
-    "version": "16.5.1",
+    "version": "16.5.2",
     "sourceRepository": "https://github.com/lyc-aon/oh-my-pi",
-    "sourceCommit": "bed27ae6e5658267745e2ec774e011fe7062e2f1",
-    "sourceUrl": "https://github.com/lyc-aon/oh-my-pi/commit/bed27ae6e5658267745e2ec774e011fe7062e2f1",
-    "sourceTag": "t4code-16.5.1-appserver-6",
+    "sourceCommit": "d7c9ac81a3764085d050d0b7148ac7eee976ddd3",
+    "sourceUrl": "https://github.com/lyc-aon/oh-my-pi/commit/d7c9ac81a3764085d050d0b7148ac7eee976ddd3",
+    "sourceTag": "t4code-16.5.2-appserver-1",
     "upstreamRepository": "https://github.com/can1357/oh-my-pi",
-    "upstreamTag": "v16.5.1",
-    "upstreamCommit": "14b5da76a9aece9a469288718d22c3d624daf033",
+    "upstreamTag": "v16.5.2",
+    "upstreamCommit": "7d02778c60f4b5db60f84bedbca79d6e64cb91f5",
     "integrationPatches": [
       "bounded-growing-session-replay",
       "complete-session-event-projection",
@@ -47,12 +47,13 @@
       "typed-command-result-validation",
       "canonical-response-boundaries",
       "managed-rpc-session-entry-projection",
-      "tiny-transcript-image-externalization"
+      "tiny-transcript-image-externalization",
+      "atomic-maintenance-drain"
     ],
     "upstreamTagContainsIntegrationPatches": false
   },
   "desktop": {
     "package": "@t4-code/protocol",
-    "version": "0.1.13"
+    "version": "0.1.14"
   }
 }