WVST v0.1.0-alpha.3

[0.1.0-alpha.3] - 2026-09-07

Added

• macOS release signing with Developer ID, hardened runtime, Apple notarization,
  stapled DMG tickets, Gatekeeper assessment and mounted-content verification.
• Worker-only third-party library entitlement; Bridge keeps library validation.
• Required Apple signing/notarization credentials are checked before release
  builds. The published alpha.2 archives remain unsigned and unchanged.

Downloads and verification

Choose the archive matching your CPU and OS, verify SHA256SUMS, then extract
the entire directory and follow its README. For macOS, open the Developer ID
signed and notarized DMG and copy its entire WVST folder to a local directory.
DMGs carry stapled Apple tickets and pass Gatekeeper; only the host worker
permits third-party plugin libraries. Windows/Linux archives are unsigned
and experimental. No service is installed and no third-party plugin
certification is claimed.

The SDK tarball can be installed from a local file with npm; no npm registry
publication occurs. release-manifest.json records hashes and the exact
source commit. Keep Bridge and host worker from the same archive when updating.

中文发布与升级指南：https://wvst-docs.pages.dev/docs/zh/releases
English release guide: https://wvst-docs.pages.dev/docs/releases