Skip to content

NeonDiff v1.0.3

Choose a tag to compare

View all tags
@100yenadmin 100yenadmin released this 09 Jul 22:41
v1.0.3
5411365
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.0.3

  • Release type: stable Mac startup-stability patch
  • Release source SHA: to be stamped by refs/tags/v1.0.3
  • Previous stable release: v1.0.2
  • Tracking issues / source PR: #484, #503, #505, #506
  • Package artifact: neondiff@1.0.3 after publish
  • Rollback baseline: v1.0.2

Purpose

Publish the Keychain startup-stability fix without changing NeonDiff's public
1.0 launch boundary. The native Mac app remains the advanced product surface;
the local HTML dashboard remains a browser preview and setup surface rather than
an embedded replacement for the native UI.

Included Changes

  • Stop desktop model initialization from decrypting stored GitHub login or
    expiration values.
  • Use metadata-only Keychain presence queries with
    kSecUseAuthenticationUISkip, including legacy ACL-protected items, without
    constructing a LocalAuthentication context during startup.
  • Preserve interactive Keychain reads for explicit user actions and source
    compatibility for existing secret-store conformers.
  • Share the detached dashboard argument contract with the displayed command so
    both paths explicitly use --operator false.
  • Pin the Swift PR and unsigned desktop-release workflows to macOS 15, compile
    the broad and Keychain check targets there, and keep Security-linked helper
    execution in the local visible-smoke lane.
  • Preserve the advanced native SwiftUI onboarding/provider experience; no
    WebView or embedded-browser takeover is included.

Required Gates

  • Focused validation:
    • NODE_OPTIONS=--experimental-sqlite npx vitest run tests/desktop-keychain-startup.test.ts tests/desktop-release-pipeline.test.ts tests/swift-ci-velocity.test.ts tests/public-release-readiness.test.ts tests/release-status.test.ts tests/checkout-issuance-smoke.test.ts --pool=forks --maxWorkers=1
    • swift run --package-path apps/neondiff-desktop NeonDiffDesktopKeychainChecks
    • swift run --package-path apps/neondiff-desktop NeonDiffDesktopCoreSmoke
    • npm run build
    • node scripts/check-public-claims.mjs
    • node scripts/check-secret-scan.mjs
    • git diff --check
  • macOS 15 release workflow proof:
  • License API proof:
    • docs/evidence/v1.0.3-license-api-healthz.json
    • docs/evidence/v1.0.3-license-checkout-issuance-unauthenticated.json
    • docs/evidence/v1.0.3-license-checkout-issuance-authenticated.json
  • Desktop startup proof:
    • docs/evidence/v1.0.3-desktop-startup-smoke.json
  • Release-status public manifest gate:
    • npx tsx src/cli.ts release-status --expected-head "$(git rev-parse HEAD)" --public-release-manifest docs/public-release-manifest.json --expected-public-version v1.0.3
  • npm publication governance:
    • the tag must be annotated and reachable from protected main
    • the declared pre-metadata candidate must be an ancestor of the tag
    • a stable package is rejected from a prerelease-marked GitHub Release
    • manual retries must resolve the matching existing non-prerelease GitHub Release
    • new packages publish under a quarantine dist-tag; registry integrity, shasum, and gitHead must match the reviewed tag and dry-run pack before promotion to latest

Before publication, release_candidate and source_checkout describe the
candidate honestly. The manifest gate validates release metadata and proofs; it
does not claim npm or GitHub publication. After the public registry, GitHub
Release, and installed-package smoke pass, a separate post-release state stamp
updates main to published without moving refs/tags/v1.0.3.

Caveats

  • This release does not ship signed/notarized desktop artifacts, Sparkle
    appcast, or auto-update proof. Those remain tracked by #116 and #449.
  • The macOS 15 hosted workflow proves compilation, bundle shape, and unsigned
    artifact packaging. Visible startup behavior is proven only for the named
    local unsigned bundle.
  • This release does not claim browser/native dashboard parity, full native
    desktop maturity, customer-ready installation, or calibrated review accuracy.

Rollback

Published npm versions and release tags are immutable provenance. Rollback does
not delete or rewrite v1.0.3, and it never resets a maintainer's main
checkout. Instead:

  1. Move the public install channel back to the verified 1.0.2 package.
  2. Reinstall 1.0.2 on affected daemon/dashboard hosts.
  3. Restart each host's configured daemon and dashboard process using its own
    launchd label and config path.
  4. Mark the GitHub v1.0.3 release as not latest and add an incident note that
    points users to v1.0.2.
npm dist-tag add neondiff@1.0.2 latest
npm install -g neondiff@1.0.2
gh release edit v1.0.3 \
  --repo electricsheephq/evaos-code-review-bot-neondiff \
  --latest=false

The host-specific restart is intentionally not hard-coded here: operators must
use the launchd label and configuration selected during that installation, for
example neondiff daemon start --launchd-label <label> --dry-run false --confirm true after
the package downgrade. Browser dashboard sessions are restarted from the newly
installed neondiff@1.0.2 binary.

The manifest's rollback fields remain source-checkout revert references to
satisfy the canonical governance gate. They may be used only in an isolated
recovery checkout, never against protected main; the npm/install commands
above are the public operator rollback.

Assets 2
Loading