BetterPullReview 0.3.4

Download and install

System	Download
macOS 14.4+ · Apple Silicon and Intel	Download DMG
Windows · x64	Download MSI
Ubuntu 26.04 · x64	Download DEB

The selected test environments are Windows 11 and Ubuntu 26.04 under WSL2/WSLg.
Other Windows and Linux environments may work but are untested; the packages
do not reject them. Full agent integrations and local automation are included.
On Ubuntu, download
and verify the matching .deb.asc signature before installing.

Changes since 0.3.3

Home searches direct review requests and checks reviewer membership in batches
of ten, reducing repeated discovery reads. Diagnostics record candidate counts,
reuse, rejections, recovery and partial results.
Agent setup supports a saved Claude process wrapper without requiring normal
Claude sign-in. Wrapper availability does not claim that company SSO or VPN
access was verified. Setup failures expose their details and workspace logs.
Agent setup retains wrapper settings and supports reset/recheck correctly.
The diagnostics export option now says “Include verbose logs from the last
3 minutes”.
Product processes use the pinned mimalloc allocator on macOS, Windows and
Ubuntu. Native runtime, package and corresponding-source inventories include
the selected allocator. This does not claim the existing memory budgets are
fixed or that every workload uses less memory.

Verification and distribution

Each platform supplies checksums, SPDX and a separate exact-version
corresponding-source archive. Binary and source access are public through the
same release channel at no additional charge. Corporate/offline redistribution
must include the exact source asset. Source, digests and tags are retained
immutably and indefinitely until all applicable obligations have ended.

macOS uses Developer ID signing and notarization. Windows uses a per-user MSI;
the runtime ZIP is an inventory archive. Ubuntu 26.04 uses a signed DEB and a
per-user archive requiring system dependencies; WSL2 production does not qualify
ordinary-user installation, authentication, vault and removal by itself.
Its private ICU 73.2 libraries retain pinned source and
recipient rebuild instructions.

Linux signature verification

The Ubuntu artifacts have detached OpenPGP signatures. Save the complete public
key block below as bpr-release-signing.asc. Its SHA-256 is
c271732f02b5f3c709ad1a61d7f7816200e96226c490fd77d88f6583437f9798.
The approved full fingerprint is
ED85BAA84A3B6D83FCD5B1F107CEC96F2688E4A8.

Check the saved key's digest and fingerprint before importing it:

sha256sum bpr-release-signing.asc
gpg --show-keys --with-fingerprint bpr-release-signing.asc
gpg --import bpr-release-signing.asc

For each of the six signed Ubuntu products—the DEB, user archive, SPDX,
corresponding-source ZIP, checksum file and provenance—download its matching
.asc signature and run gpg --verify ARTIFACT.asc ARTIFACT, replacing both
names with that exact file. The .release.json manifest is verification
metadata and has no detached signature of its own.
Require a good signature from the full fingerprint above before installation
or use. A detached DEB signature is verified separately; dpkg does not enforce
it. This public key and fingerprint are supplied through the same public
release channel as the signed artifacts.

Known limitations

RFC-BPR-0038 remains open. Clean-account installation, authentication and
platform vaults, native Intel and full ordinary-user Windows 11/Ubuntu WSLg courses,
accessibility, upgrade/removal, resident-material crash privacy, external
hardening and complete vulnerability/fuzz coverage remain incomplete.
Profile purge excludes shared updater/registry state and is not uninstall.

The earlier Ubuntu RSS-growth failure is retained in BPR-1653. The owner
approved a 240 MiB process RSS-growth criterion alongside the independent
216 MiB live-heap limit, and the card's complete current-source course passed.
The v0.3.1 exception is not extended. This release's exact native resource,
artifact and security results require their own qualification.
Historical findings and dispositions retain only their original scope.

Installed source-offer clarification: a sentence describing private repository access remains from earlier releases. This release supplies binaries and their exact corresponding-source assets publicly through the same channel at no additional charge. The exact source URLs and digests, redistribution duties, original-channel fallback and indefinite immutable retention remain in force.

The GHES repair is based on the supplied anonymized failure: requested-reviewer
loading returned HTTP 200 and then a response-limit failure. It does not claim
the private server's exact byte, structural or record guard was identified.
No further diagnostic handoff is a prerequisite for this release; deterministic
provider regressions and the selected native release gates supply its validation.

Qualification scope for 0.3.4

The owner requested publication for macOS universal, Windows x64 and Ubuntu
26.04 x64, explicitly skipping native Intel Mac qualification. The universal
package still contains both architectures. The owner also authorized carrying
the v0.3.3 timeout, memory-budget and configured-skip waivers forward if the
same failures recur; any such results remain failed or skipped evidence.
Fresh results and exact artifact verification are recorded separately.

Recorded qualification scope

Debug performance timings are permanently nongating by the owner's standing
policy. Dedicated Debug performance courses may be omitted; observed timing
failures and configured skips remain recorded rather than relabeled as passes.
Ubuntu's Debug selection omits eight named performance courses while retaining
its separate functional controls. Release timing criteria are unchanged.

Windows Debug retains the known workbench/PR Find timeouts and an Insights
fixture assumption about the number of real slow UI turns. The threaded-reply
functional course passed for both GitHub.com and GHES with a larger bounded
Debug watchdog; its original short-deadline failure is retained. macOS retains
its observed Debug benchmark timing failures and the configured cache-byte skip.
Native Intel Mac qualification was explicitly omitted; the universal package
contains both architectures.

Three stale optional-CLI/package harness expectations were corrected: the
shared instruction packages retain their MIT licenses, and the handoff course
checks the four preparation hooks plus the inactive feedback hook. Their owning
checks pass on the final source. These changes affect licensing/test material,
not application code; retained native suites keep their original source and
configuration identities, with a recorded final-source input bridge.

Raw vulnerability reports and incomplete mapping/fuzz coverage remain explicit.
The existing Qt upstream-issue policy retains its stated scope and end condition;
no bundled library is claimed fixed by a caller-absence disposition. The newly
selected allocator's complete advisory mapping and fuzz coverage are not
established by a scanner returning no match. Signatures, notarization,
corresponding source/SPDX binding and native trust verification are separate from
these Debug timing and coverage limitations.

The final unfiltered vulnerability scans retain 21 macOS findings, 19 Windows
findings and 21 Ubuntu findings. Their exact row sets and affected dependency
metadata match the prior release. Current native import and source observations
support only the existing narrow factual dispositions and their original expiry
or recheck conditions; the raw scans remain failed. This supplies no broader
security, legal, native installation or complete vulnerability-coverage claim.

Navigation Menu

Repository navigation

BetterPullReview v0.3.4

Choose a tag to compare

Sorry, something went wrong.