Vifty 1.4.5

Vifty 1.4.5 Release Checklist

This checklist is prepended to the GitHub Release notes and uploaded as a release asset. It distinguishes the checks completed by the release workflow from the follow-up checks that must happen after publication.

Verified By The Release Workflow

• Release tag v1.4.5 matched the non-null manifest candidate and Resources/Info.plist; its signature passed git verify-tag.
• CFBundleVersion matched the manifest candidate build and was greater than the published build.
• Candidate bundle metadata matched the manifest while Homebrew remained on the exact published manifest version/SHA; artifact names, helper cleanup, TeamID wiring, notarization gates, verifier checks, and publication assets passed.
• Signed administrator-pretag evidence verified all six repository-scoped Developer ID/notarization secret names and no same-name release-environment shadows.
• Swift tests passed on the release runner.
• The release app was assembled ad-hoc with the manifest-authorized VIFTY_XPC_ALLOWED_TEAM_ID, then the hash-inventoried candidate was re-signed with the configured Developer ID identity in the protected job.
• Bundle plist files, signing TeamID, viftyctl signing identifier, and bundled LaunchDaemon TeamID allowlist were verified.
• Apple notarization completed, the ticket was stapled, stapling was validated, and Gatekeeper assessment passed.
• Vifty-v1.4.5.zip and Vifty-v1.4.5.zip.sha256 were generated.
• scripts/verify-release-artifact.sh passed before publication and wrote Vifty-v1.4.5-artifact-summary.json.

Required Post-Publication Follow-Up

• After the exact public artifact/checksum pass, append the prior publishedRelease unchanged to manifest historicalReleases, promote the candidate into publishedRelease with exact source/workflow facts, and clear candidate.
• Atomically advance Casks/vifty.rb to the promoted manifest version and authorized Vifty-v1.4.5.zip.sha256 using scripts/update-cask-checksum.sh --version 1.4.5, then refresh generated release-fact blocks.
• Run scripts/verify-release-artifact.sh --team-id "$APPLE_TEAM_ID" against the public cask artifact after the checksum update.
• Collect a release-mode evidence bundle with scripts/collect-validation-evidence.sh --release-summary ./Vifty-v1.4.5-artifact-summary.json --release-checklist ./Vifty-v1.4.5-release-checklist.md.
• Review that bundle with make validation-evidence-review VALIDATION_EVIDENCE_BUNDLE=<evidence-dir> VALIDATION_EVIDENCE_REVIEW_MODE=release VALIDATION_EVIDENCE_REVIEW_SUMMARY=<evidence-dir>/review-result.json.
• Update docs/release-status.md after the signed artifact, checksum, verifier summary, and cask SHA are aligned.
• Keep compatibility claims gated on reviewed hardware reports with manualSmokeTestResult: "passed-auto-restored".

Until the post-publication checks pass, do not describe the Homebrew path as a fully trusted public binary install.

What's Changed

• Promote v1.4.4 to published release with cask handoff by @Reedtrullz in #33
• Fix public-archive installer under the hostile C-locale environment by @Reedtrullz in #34
• Accept launchctl print-disabled '=> disabled' format in helper lifecycle by @Reedtrullz in #36
• Preserve unreadable preferences and emit explicit nulls in status JSON by @Reedtrullz in #37
• Fail closed when capabilities policy is unusable and require full idempotency equality by @Reedtrullz in #39
• Prepare v1.4.5 release by @Reedtrullz in #40

Full Changelog: v1.4.4...v1.4.5