LedgerPDF v0.1.2

This alpha release makes iterative agent exports safer and less cluttered.

What changed

binder_export can reuse the same canonical output path when the existing file is byte-for-byte the last export recorded by that binder.
If a person edits or replaces that PDF—or if the path points to an unrelated file or a symlink—the export is refused rather than overwritten.
The engine rechecks the existing file immediately before its atomic replacement, protecting against another process changing it during the export.
There is no overwrite: true escape hatch: the safety decision is enforced from recorded provenance and SHA-256 hashes.

In ordinary use, an agent can now mark, export, revise, and re-export to one stable filename. Human-touched files remain protected.

macOS Apple silicon: the DMG and ZIP are signed with Ledger Labs LLC's Developer ID, notarized by Apple, and stapled.
Windows x64: the installer is currently unsigned, so Windows may show a SmartScreen warning. The exact installer passed clean per-user install, registration, launch, packaged-app, and uninstall checks in CI.
SHA256SUMS contains hashes for all three artifacts.

LedgerPDF is still alpha software. Keep source documents backed up and review exported work before relying on it.

Source commit: ebc5eb8898148b1d55b394f3f65a2cafafbe44a2
Windows release-candidate run: 31581103175
Public CI: macOS, Windows, and CodeQL all passed
macOS: signature, Gatekeeper, notarization/stapling, packaged UI, frozen engine, export, recents, MCP, and renderer-protocol checks passed
Dependency audits: zero npm production vulnerabilities and no known Python vulnerabilities
Secret scan: no leaks found across the public history